chore(deps): update dependency posthog-js to v1.429.5

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
posthog-js (source)	1.425.1 → 1.429.5

---

Release Notes

PostHog/posthog-js (posthog-js)

v1.429.5

Compare Source

1.429.5

Patch Changes

• #​4579 19e78cc Thanks @​turnipdabeets! - Cap the retry delay for log exports at 30 seconds, the ceiling the logs contract states. It previously doubled to 64 times the flush interval — 192s on web, 640s on React Native — so a log export now resumes within 30 seconds of a failing endpoint recovering, at the cost of more retry requests while that endpoint is down.
  (2026-09-10)

• #​4579 19e78cc Thanks @​turnipdabeets! - Keep backing off a failing log flush while new records arrive, instead of the next record resetting the retry to the flush interval.
  (2026-09-10)

• #​4579 19e78cc Thanks @​turnipdabeets! - Logs and metrics now always send service.name and telemetry.sdk.*, even when a resourceAttributes value is too large to encode in full. Previously that value could crowd them out, and the records reached PostHog with no service attribution.
  (2026-09-10)

• Updated dependencies [19e78cc, 19e78cc, 19e78cc, 19e78cc, 19e78cc, 19e78cc, 19e78cc]:

  • @​posthog/core@1.53.0
  • @​posthog/types@1.411.0

v1.429.4

Compare Source

1.429.4

Patch Changes

• #​4862 3278cd0 Thanks @​pauldambra! - Call the original console method with the console as its receiver when recording console logs. The wrapper passed undefined instead, and passed no receiver at all when reporting its own failures, which a console implementation is free to reject.
  (2026-09-10)

• #​4887 0da006c Thanks @​posthog! - Error tracking no longer counts an injected script as your own code. A stack frame is in_app only when its filename names a script your app was served — http(s), file, blob, app, capacitor, ionic, a bundler scheme, or a bare path. A frame served over any other scheme, such as an in-app browser bridge on iabjs:// or an extension content script on chrome-extension://, is kept for context but no longer groups the issue under your code.
  (2026-09-10)

• #​4837 99b4fc7 Thanks @​pauldambra! - Stop recording autoplay attribute mutations on <video> and <audio> during session replay. The check compared a lowercase tag name against Element.tagName, which is uppercase for HTML elements, so a looping background video emitted a mutation for every autoplay toggle.
  (2026-09-10)

• Updated dependencies [0da006c]:

  • @​posthog/core@1.52.2

v1.429.3

Compare Source

1.429.3

Patch Changes

• #​4878 14ba783 Thanks @​dustinbyrne! - Allow null bootstrap values and treat null or empty distinct IDs as missing.
  (2026-09-10)

• #​4831 9498567 Thanks @​posthog! - Log a console message when advanced_disable_feature_flags stops surveys from displaying
  (2026-09-10)

• Updated dependencies [14ba783, 9498567]:

  • @​posthog/types@1.410.1

v1.429.2

Compare Source

1.429.2

Patch Changes

• #​4880 412c97c Thanks @​marandaneto! - Fix recording package exports, native ESM loading, and strict TypeScript 4.7 consumer compatibility.
  (2026-09-10)
• Updated dependencies [412c97c]:
  • @​posthog/core@1.52.1

v1.429.1

Compare Source

1.429.1

Patch Changes

• #​4861 61b92f9 Thanks @​pauldambra! - Disable browser autofill on input and textarea fields during session replay.
  (2026-09-09)

v1.429.0

Compare Source

1.429.0

Minor Changes

• #​4707 b441eb2 Thanks @​posthog! - Segment integration: allow segment to accept an integration config with filterProperties, so customers can filter PostHog-generated enrichment properties before Segment sends an event to its destinations. Returning null or throwing leaves the original Segment event unenriched.
  (2026-09-09)

Patch Changes

• #​4876 0c2a15f Thanks @​dustinbyrne! - Fix dead-click detection for text selection and editable caret gestures when mouse release is delayed, while continuing to report inert text clicks.
  (2026-09-09)

• #​4733 24fa541 Thanks @​dustinbyrne! - fix(web): avoid reporting clicks that select or unselect text as dead clicks
  (2026-09-09)

• #​4882 4bd37b7 Thanks @​lucasheriques! - Fix TypeScript compatibility between public replay events and the replay player.
  (2026-09-09)

• #​4833 f1395b6 Thanks @​posthog! - Keep surveys hidden while capture is disabled and preserve answers if capture stops before submission.
  (2026-09-09)

• Updated dependencies [0c2a15f, 24fa541, b441eb2]:

  • @​posthog/types@1.410.0

v1.428.11

Compare Source

1.428.11

Patch Changes

• #​4725 d5abece Thanks @​bs1180! - fix(surveys): don't show the default "Start typing..." placeholder when the survey's placeholder text is empty
  (2026-09-09)

v1.428.10

Compare Source

1.428.10

Patch Changes

• #​4869 891eefa Thanks @​robbie-c! - Apply replay URL privacy settings to URL values in captured JSON-LD payloads.
  (2026-09-09)
• Updated dependencies [891eefa, 891eefa]:
  • @​posthog/types@1.409.4
  • @​posthog/core@1.52.0

v1.428.9

Compare Source

1.428.9

Patch Changes

• #​4864 e8b2be1 Thanks @​robbie-c! - Include the masked page URL with JSON-LD replay events.
  (2026-09-09)
• Updated dependencies [e8b2be1]:
  • @​posthog/types@1.409.3

v1.428.8

Compare Source

v1.428.7

Compare Source

1.428.7

Patch Changes

• #​4842 f93160d Thanks @​marandaneto! - Restore retry queue connectivity tracking when a page returns from the back-forward cache, without reactivating it after an explicit shutdown().
  (2026-09-08)

v1.428.6

Compare Source

1.428.6

Patch Changes

• #​4791 b2affdc Thanks @​posthog! - Prefer sendBeacon for unbatched events, such as { send_instantly: true } captures, once PostHog's own pagehide handler (or unload fallback) marks the page as unloading. Captures from beforeunload or earlier pagehide listeners retain their normal transport. Preserve response-capable transports on active pages so failed requests can be retried, including when fetch is unavailable.
  (2026-09-08)
• Updated dependencies [b2affdc]:
  • @​posthog/types@1.409.2

v1.428.5

Compare Source

v1.428.4

Compare Source

1.428.4

Patch Changes

• #​4828 4ae6405 Thanks @​marandaneto! - Prevent waking an idle tab from extending the previous session recording across the entire idle gap.
  (2026-09-08)

v1.428.3

Compare Source

1.428.3

Patch Changes

• #​4805 4cd5717 Thanks @​marandaneto! - Wait for the initial remote config outcome before using cached autocapture enablement, so a newly disabled project does not capture events while its settings load. Disabled remote requests retain local startup behavior, and failed or incomplete responses retain the cached fallback.
  (2026-09-07)

v1.428.2

Compare Source

1.428.2

Patch Changes

• #​4803 87b34af Thanks @​marandaneto! - Preserve Error details, causes, aggregate errors, and custom enumerable properties in event properties, including cross-realm Errors. Apply string truncation to ordinary capture properties and retain custom toJSON serialization for exception additional properties.
  (2026-09-07)
• Updated dependencies [87b34af]:
  • @​posthog/browser-common@0.8.2

v1.428.1

Compare Source

1.428.1

Patch Changes

• #​4804 988f03a Thanks @​marandaneto! - Recover autocapture targets for dropdown clicks retargeted to the page root, and attribute nested SVG icon clicks to their enclosing button or link while preserving privacy checks.
  (2026-09-07)
• Updated dependencies [988f03a]:
  • @​posthog/browser-common@0.8.1

v1.428.0

Compare Source

1.428.0

Minor Changes

• #​4809 3a5b322 Thanks @​marandaneto! - Add best-effort in-app browser attribution using $webview_app and $webview_app_version, without changing existing $browser or $browser_version values. Detect explicit user-agent markers for Facebook, Facebook Lite, Messenger, Instagram, Threads, LinkedIn, Twitter, TikTok, WhatsApp, Snapchat, WeChat, LINE, Google, Bing, Pinterest, Naver, and KakaoTalk. Unknown apps and versions are omitted; missing markers do not imply a standalone browser.
  (2026-09-07)

Patch Changes

• Updated dependencies [3a5b322]:
  • @​posthog/core@1.51.0
  • @​posthog/browser-common@0.8.0

v1.427.3

Compare Source

1.427.3

Patch Changes

• #​4815 c207020 Thanks @​marandaneto! - Prevent queued session recording mutations from capturing content beneath DOM or shadow ancestors that have become blocked.
  (2026-09-07)

• #​4785 74ca945 Thanks @​marandaneto! - Clarify feature flag return-value terminology across SDK APIs. A false value is a conclusive off evaluation, while undefined means no evaluation is available. Remote evaluation omits globally inactive flags, whereas backend local evaluation can resolve cached inactive definitions to false.
  (2026-09-07)

• #​4797 fd4ece8 Thanks @​posthog! - Prevent exception autocapture from throwing when the handler it wraps belongs to another compartment or a destroyed document.
  (2026-09-07)

• #​4754 d73455e Thanks @​posthog! - Session replay now reports why a recording holds its buffer. An epoch that starts without user interaction keeps its snapshots and uploads nothing, while $recording_status still reads active. Captured events now carry $sdk_debug_replay_flush_hold_reason (no_interaction_since_recording_started or no_interaction_since_session_rotated), and the SDK logs the reason once per held epoch in debug mode. Discarding a recording (for example when the server turns replay off) also no longer uploads the stylesheet mutations the recorder emits as it stops.
  (2026-09-07)

• #​4788 95b159a Thanks @​fasyy612! - fix(replay): reset the idle clock on a session-id rotation so the new session's first snapshot is not dropped as idle and its recording does not start hours early
  (2026-09-07)

• #​4770 24f1937 Thanks @​fasyy612! - fix(replay): drain the compression queue synchronously on a session-id rotation so the old session's unflushed tail ships under the old session id instead of being discarded
  (2026-09-07)

• #​4666 5e74132 Thanks @​robbie-c! - Preserve universally safe JSON-LD properties and allowlisted tree structure when replay redacts other fields. Keep only DOM-backed ID fragments. Keep only @type values shaped like a Schema.org term, and limit types and payloads. Publish a reusable sanitization contract fixture.
  (2026-09-07)

• #​4814 21dcebd Thanks @​posthog! - Prevent invalid clock values from breaking UUID generation and continue capturing replay chunks after a chunk fails.
  (2026-09-07)

• Updated dependencies [74ca945, 5e74132, 21dcebd]:

  • @​posthog/core@1.50.6
  • @​posthog/types@1.409.1
  • @​posthog/browser-common@0.7.3

v1.427.2

Compare Source

1.427.2

Patch Changes

• #​4787 fd87caf Thanks @​marandaneto! - Prevent failures in automatic and manual exception processing from escaping into customer code.
  (2026-09-04)

v1.427.1

Compare Source

1.427.1

Patch Changes

• #​4786 a04c333 Thanks @​marandaneto! - Prevent automatic and manual exception capture from recursively recapturing stack overflows raised while sending an exception.
  (2026-09-04)

v1.427.0

Compare Source

1.427.0

Minor Changes

• #​4774 426e1fd Thanks @​Fhatu12! - Add reuseAnonymousId support to browser identify calls.
  (2026-09-04)

Patch Changes

• #​4782 b64b113 Thanks @​posthog! - Stop counting stack frames that have no filename (in-app browser bridge scripts and other code the runtime reports without a script URL) as in-app code.
  (2026-09-04)

• #​4758 dd74222 Thanks @​marandaneto! - Keep relaying session recording events when a cross-origin iframe redirects through the parent page's origin.
  (2026-09-04)

• Updated dependencies [b64b113, 426e1fd]:

  • @​posthog/core@1.50.5
  • @​posthog/types@1.409.0

v1.426.4

Compare Source

1.426.4

Patch Changes

• #​4764 fa2924d Thanks @​marandaneto! - Preserve previously persisted feature flags as an offline fallback when bootstrap flags are provided.
  (2026-09-04)

v1.426.3

Compare Source

1.426.3

Patch Changes

• #​4761 ebf7318 Thanks @​marandaneto! - Prevent session replay network capture from replacing a downstream fetch wrapper's response with an instrumentation error when the response has no headers.
  (2026-09-04)

v1.426.2

Compare Source

1.426.2

Patch Changes

• #​4763 7b30da7 Thanks @​marandaneto! - Ship the package ESM entrypoint with an .mjs extension so Node recognizes its module format, while retaining the existing .js bundle for backwards compatibility.
  (2026-09-03)

• #​4759 c475070 Thanks @​marandaneto! - Preserve explicitly false feature flag values supplied through bootstrap configuration.
  (2026-09-03)

• #​4767 9d683ca Thanks @​marandaneto! - Preserve the anonymous distinct ID used for feature flag persistence when identify() queues a reload behind an in-flight flags request.
  (2026-09-03)

• #​4766 ed4ba23 Thanks @​marandaneto! - Limit persisted initial URLs by their encoded cookie size to prevent long URLs and referrers from exceeding browser cookie limits.
  (2026-09-03)

• #​4762 fbf10d4 Thanks @​marandaneto! - Merge event-specific $groups with groups registered on the browser client.
  (2026-09-03)

• #​4732 f00e24d Thanks @​posthog! - Polyfill Array.prototype.findLast in the web vitals attribution bundles so they keep capturing on browsers older than Chrome 97 and Safari 15.4
  (2026-09-03)

• Updated dependencies [c475070, f00e24d]:

  • @​posthog/core@1.50.4
  • @​posthog/browser-common@0.7.2

v1.426.1

Compare Source

1.426.1

Patch Changes

• #​4765 d8508b6 Thanks @​marandaneto! - Initialize the Segment enrichment integration when Segment is configured through set_config, so Segment events include PostHog properties such as active feature flags.
  (2026-09-03)

v1.426.0

Compare Source

1.426.0

Minor Changes

• #​4740 6325953 Thanks @​mayteio! - Capture Meta's $fbc person property when a new fbclid is observed.
  (2026-09-03)

Patch Changes

• #​4760 41ed3af Thanks @​marandaneto! - Require a distinct ID when calling identify and correct its API documentation to match the existing runtime validation.
  (2026-09-03)

• #​4713 7a027ad Thanks @​posthog! - Gate $groupidentify on person processing. Under identified_only, a group() call promotes the user to identified so the event is kept instead of dropped. Under never, the local group association is retained for subsequent events and feature flags, but $groupidentify is not sent because the server always drops it.
  (2026-09-03)

• Updated dependencies [41ed3af, dbbb58e]:

  • @​posthog/types@1.408.1
  • @​posthog/core@1.50.3

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • Between 08:00 AM and 05:59 PM, Monday through Friday (* 8-17 * * 1-5)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	launchpad	08157ed	Commit Preview URL Branch Preview URL	Sep 13 2026, 08:54 PM