You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
#4224ba7042b Thanks @turnipdabeets! - Fix session replay recordings being unplayable after the session rotated in a tab with no user interaction. When a session expired and rotated (for example in a long-lived background tab), a recorder that had not yet seen user interaction kept attributing snapshots — including full snapshots — to the previous session, so the new session never received a playable full snapshot. The recorder now restarts on rotation in this state, re-syncs its session id from the session manager if they ever diverge, and flushes its buffer on the normal cadence before the first user interaction instead of holding data until the next rotation or page unload.
(2026-07-23)
#421833f0bd7 Thanks @marandaneto! - Send ISO feature flag timestamps in request bodies, use numeric sent_at query timestamps for capture POSTs, and preserve _ cache busting for dynamic GET requests.
(2026-07-23)
isFeatureEnabled(key, { defaultValue: false }) now returns the given default when the flag has no value — flags not loaded yet, or no flag with that key — and the return type narrows to boolean. The option name is the same in posthog-js, posthog-js-lite, and posthog-react-native. Without defaultValue, behavior is unchanged: boolean | undefined. (2026-07-22)
Patch Changes
#420390e7483 Thanks @posthog! - fix(conversations): let users start a new conversation while a ticket is still open
The support widget now surfaces the ticket list navigation (and its "New conversation"
button) whenever the user has any ticket, instead of only when they have multiple tickets
or a single resolved one. Previously a user sitting on one open, unresolved ticket was
locked into that conversation with no way to raise a second issue. (2026-07-22)
#4221da6e082 Thanks @posthog! - fix(exception-autocapture): don't throw when the page's onerror handler is non-callable
The wrapped window.onerror, window.onunhandledrejection, and console.error handlers
chained to the page's original handler using optional chaining, which only guards against null/undefined. When a page had one of these set to a truthy non-callable value (e.g.
via Object.defineProperty, or clobbered by another script/extension), our wrapper threw a TypeError from inside its own handler. We now check the original handler is actually
callable before invoking it and fall back to false otherwise. (2026-07-22)
#4209569fc62 Thanks @posthog! - Session recording no longer emits an uncaught TypeError: Illegal invocation from the input observer's synchronous native-setter call. The previous fix only guarded the deferred hooked setter; the synchronous original.set.call(this, value) still ran with a non-native this (a proxy, custom element, or cross-realm object) and threw inside the host page's own assignment. The recorder now probes the native getter — which fails the same internal-slot brand check as the setter — before forwarding: a non-native this is skipped, so the recorder no longer re-throws from its own frame, while genuine elements (including file inputs that legitimately throw on a programmatic value) keep their native behavior. The input event handler and getInputType are similarly guarded against reading native accessors on a non-native this.
(2026-07-22)
#4068d5e1188 Thanks @posthog! - Fix event-triggered surveys re-displaying in a fresh session without their trigger firing. A non-repeatable event/action-triggered survey that was shown but never dismissed or answered had its activation persisted indefinitely, so it kept being treated as "triggered" on later page loads. The persisted activation is now scoped to the triggering session: it still survives a reload within that session, but a brand-new session drops it until the trigger fires again. Repeatable surveys are unaffected.
(2026-07-22)
#4205de3ad61 Thanks @posthog! - Warn when session recording masking options in posthog.init shadow the project-level "Privacy and masking" setting. Client-side masking still intentionally takes precedence, but previously the override was silent — a developer could set masking in the dashboard and see it quietly ignored because their SDK config diverged. The recorder now logs a console warning (in debug mode) naming the diverging fields so the precedence is self-explaining.
(2026-07-22)
#4206a3112d9 Thanks @posthog! - fix(surveys): stop recurring surveys re-showing off a stale internal targeting flag
Recurring surveys could re-display and record a duplicate response when the eligibility
check ran against a cached internal targeting flag before fresh flags had loaded. The
display loop now waits for feature flags to actually load before trusting the internal
targeting flag, and forces a flag reload after a survey is completed so the flag recomputes
promptly. (2026-07-21)
#4127220fa2c Thanks @sarmah-rup! - Don't let save_referrer overwrite a $referrer / $referring_domain that was explicitly set via posthog.register(), so registered attribution values survive pageviews in SPA and iframe contexts
(2026-07-21)
#4194d39b903 Thanks @dustinbyrne! - Move shared browser utility implementations into @posthog/browser-common and consume them directly from posthog-js.
(2026-07-21)
Patch Changes
#4204ba977d0 Thanks @turnipdabeets! - Keep autocapture off when a remote config response omits autocapture_opt_out. The SDK now retains the last known server value for the missing-field case, the same as when the config fetch fails, instead of enabling autocapture. Values persisted by earlier SDK versions are still trusted; a browser holding a stale value corrects itself on the first config response that includes the field.
(2026-07-21)
#41729621830 Thanks @haacked! - send minimal $feature_flag_called events when the server enables it
When the v2 /flags response carries minimalFlagCalledEvents: true (or, for posthog-node local evaluation, the flag-definitions payload carries minimal_flag_called_events: true) and the evaluated flag is not linked to an experiment ($feature_flag_has_experiment === false), $feature_flag_called events are rebuilt from a strict allowlist of flag-evaluation, processing-control, and SDK-identity properties. Super properties, $set/$set_once, the $feature/<key> enumeration, $active_feature_flags, and the context envelope are stripped. Any missing signal (no gate on the response, bootstrapped or locally injected flags, has_experiment unknown) falls back to the full event, and experiment-linked flags always send the full envelope. The gate is stored alongside the cached flags (posthog-js persistence, posthog-node poller state) and is server-controlled, with no SDK-side configuration. before_send runs after the filter and may re-add stripped properties. (2026-07-20)
#419166c1666 Thanks @turnipdabeets! - Honour the project-level autocapture opt-out when the remote config request fails. Previously a failed config fetch (network error, timeout, blocked request) enabled autocapture on opted-out projects and persisted that state for later page loads. Autocapture now keeps the last successfully received server value, and stays off until the first successful config response.
(2026-07-17)
#4149607bf54 Thanks @pauldambra! - Add dead swipe detection to dead clicks autocapture. When dead clicks autocapture is enabled, touch swipe gestures that produce no observable screen change (no scroll, mutation, selection or visibility change) are now captured as $dead_swipe events, surfacing failed navigations on touch devices. Configurable via capture_dead_swipes (default true) and swipe_threshold_px (default 30) on the capture_dead_clicks config. Swipes over surfaces whose response cannot be observed (canvas, video and other media elements under the finger) are skipped, and captures are limited per page load via max_dead_swipes_per_page_load (default 10).
(2026-07-16)
Patch Changes
#4171df17ddc Thanks @posthog! - Catch synchronous throws from a monkey-patched window.fetch so they no longer escape as unhandled exceptions. A synchronous throw is now routed through the same handling as an async rejection, so the request queue retries instead of the error leaking into error tracking.
(2026-07-16)
Avoid emitting rgb() or rgba() functions with non-percent decimal
channels. Older browsers only support integer values or (potentially decimal)
percentages for these functions, so in order to preserve
backwards-compatibility while retaining full precision for modern browsers,
legacy colors that contain at least one non-integer channel will now use
percentages for their channels (for example, rgb(0%, 100%, 50%) rather than rgb(0, 255, 127.5)).
Fix a bug where the values of plain-CSS if() expressions were emitted using
their meta.inspect() format rather than their CSS serialization format.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@angular/build@22.0.8. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
22.0.7→22.0.822.0.7→22.0.822.0.5→22.0.622.0.7→22.0.822.0.7→22.0.822.0.7→22.0.822.0.7→22.0.822.0.7→22.0.822.0.5→22.0.622.0.7→22.0.822.0.7→22.0.822.0.7→22.0.86.5.0→6.6.07.3.0→7.3.10.0.78→0.0.798.5.19→8.5.221.403.0→1.407.21.101.0→1.101.7Release Notes
angular/angular (@angular/animations)
v22.0.8Compare Source
common
core
forms
pendingstatus propagates to the root form in signal formshttp
migrations
angular/angular-cli (@angular/build)
v22.0.8Compare Source
@angular/cli
@angular/build
angular/components (@angular/cdk)
v22.0.6Compare Source
cdk
material
material-luxon-adapter
sanity-io/sanity (@sanity/types)
v6.6.0Compare Source
Features
sindresorhus/p-limit (p-limit)
v7.3.1Compare Source
ef37eb2stackblitz-labs/pkg.pr.new (pkg-pr-new)
v0.0.79Compare Source
postcss/postcss (postcss)
v8.5.22Compare Source
v8.5.21Compare Source
v8.5.20Compare Source
AtRule#paramsis set after (by @sarathfrancis90).PostHog/posthog-js (posthog-js)
v1.407.2Compare Source
1.407.2
Patch Changes
ba7042bThanks @turnipdabeets! - Fix session replay recordings being unplayable after the session rotated in a tab with no user interaction. When a session expired and rotated (for example in a long-lived background tab), a recorder that had not yet seen user interaction kept attributing snapshots — including full snapshots — to the previous session, so the new session never received a playable full snapshot. The recorder now restarts on rotation in this state, re-syncs its session id from the session manager if they ever diverge, and flushes its buffer on the normal cadence before the first user interaction instead of holding data until the next rotation or page unload.(2026-07-23)
v1.407.1Compare Source
1.407.1
Patch Changes
33f0bd7Thanks @marandaneto! - Send ISO feature flag timestamps in request bodies, use numericsent_atquery timestamps for capture POSTs, and preserve_cache busting for dynamic GET requests.(2026-07-23)
v1.407.0Compare Source
1.407.0
Minor Changes
#4222
0f2407bThanks @turnipdabeets! - feat: add a default-value option toisFeatureEnabledisFeatureEnabled(key, { defaultValue: false })now returns the given default when the flag has no value — flags not loaded yet, or no flag with that key — and the return type narrows toboolean. The option name is the same in posthog-js, posthog-js-lite, and posthog-react-native. WithoutdefaultValue, behavior is unchanged:boolean | undefined. (2026-07-22)Patch Changes
#4203
90e7483Thanks @posthog! - fix(conversations): let users start a new conversation while a ticket is still openThe support widget now surfaces the ticket list navigation (and its "New conversation"
button) whenever the user has any ticket, instead of only when they have multiple tickets
or a single resolved one. Previously a user sitting on one open, unresolved ticket was
locked into that conversation with no way to raise a second issue. (2026-07-22)
#4221
da6e082Thanks @posthog! - fix(exception-autocapture): don't throw when the page's onerror handler is non-callableThe wrapped
window.onerror,window.onunhandledrejection, andconsole.errorhandlerschained to the page's original handler using optional chaining, which only guards against
null/undefined. When a page had one of these set to a truthy non-callable value (e.g.via
Object.defineProperty, or clobbered by another script/extension), our wrapper threw aTypeErrorfrom inside its own handler. We now check the original handler is actuallycallable before invoking it and fall back to
falseotherwise. (2026-07-22)#4209
569fc62Thanks @posthog! - Session recording no longer emits an uncaughtTypeError: Illegal invocationfrom the input observer's synchronous native-setter call. The previous fix only guarded the deferred hooked setter; the synchronousoriginal.set.call(this, value)still ran with a non-nativethis(a proxy, custom element, or cross-realm object) and threw inside the host page's own assignment. The recorder now probes the native getter — which fails the same internal-slot brand check as the setter — before forwarding: a non-nativethisis skipped, so the recorder no longer re-throws from its own frame, while genuine elements (including file inputs that legitimately throw on a programmatic value) keep their native behavior. The input event handler andgetInputTypeare similarly guarded against reading native accessors on a non-nativethis.(2026-07-22)
#4068
d5e1188Thanks @posthog! - Fix event-triggered surveys re-displaying in a fresh session without their trigger firing. A non-repeatable event/action-triggered survey that was shown but never dismissed or answered had its activation persisted indefinitely, so it kept being treated as "triggered" on later page loads. The persisted activation is now scoped to the triggering session: it still survives a reload within that session, but a brand-new session drops it until the trigger fires again. Repeatable surveys are unaffected.(2026-07-22)
#4205
de3ad61Thanks @posthog! - Warn when session recording masking options inposthog.initshadow the project-level "Privacy and masking" setting. Client-side masking still intentionally takes precedence, but previously the override was silent — a developer could set masking in the dashboard and see it quietly ignored because their SDK config diverged. The recorder now logs a console warning (in debug mode) naming the diverging fields so the precedence is self-explaining.(2026-07-22)
Updated dependencies [
0f2407b]:v1.406.2Compare Source
1.406.2
Patch Changes
#4206
a3112d9Thanks @posthog! - fix(surveys): stop recurring surveys re-showing off a stale internal targeting flagRecurring surveys could re-display and record a duplicate response when the eligibility
check ran against a cached internal targeting flag before fresh flags had loaded. The
display loop now waits for feature flags to actually load before trusting the internal
targeting flag, and forces a flag reload after a survey is completed so the flag recomputes
promptly. (2026-07-21)
v1.406.1Compare Source
1.406.1
Patch Changes
220fa2cThanks @sarmah-rup! - Don't let save_referrer overwrite a $referrer / $referring_domain that was explicitly set via posthog.register(), so registered attribution values survive pageviews in SPA and iframe contexts(2026-07-21)
v1.406.0Compare Source
1.406.0
Minor Changes
d39b903Thanks @dustinbyrne! - Move shared browser utility implementations into@posthog/browser-commonand consume them directly fromposthog-js.(2026-07-21)
Patch Changes
ba977d0Thanks @turnipdabeets! - Keep autocapture off when a remote config response omitsautocapture_opt_out. The SDK now retains the last known server value for the missing-field case, the same as when the config fetch fails, instead of enabling autocapture. Values persisted by earlier SDK versions are still trusted; a browser holding a stale value corrects itself on the first config response that includes the field.(2026-07-21)
d39b903]:v1.405.3Compare Source
1.405.3
Patch Changes
91505baThanks @pauldambra! - fix: apply the active full snapshot interval as soon as a recording trigger matches(2026-07-21)
v1.405.2Compare Source
1.405.2
Patch Changes
fbfc84fThanks @pauldambra! - feat: make the pending session recording trigger buffer interval configurable(2026-07-20)
fbfc84f]:v1.405.1Compare Source
1.405.1
Patch Changes
dec8fe7Thanks @turnipdabeets! - Internal restructuring of remote config failure handling across SDK extensions; no behavior change.(2026-07-20)
v1.405.0Compare Source
1.405.0
Minor Changes
#4172
9621830Thanks @haacked! - send minimal$feature_flag_calledevents when the server enables itWhen the v2
/flagsresponse carriesminimalFlagCalledEvents: true(or, for posthog-node local evaluation, the flag-definitions payload carriesminimal_flag_called_events: true) and the evaluated flag is not linked to an experiment ($feature_flag_has_experiment === false),$feature_flag_calledevents are rebuilt from a strict allowlist of flag-evaluation, processing-control, and SDK-identity properties. Super properties,$set/$set_once, the$feature/<key>enumeration,$active_feature_flags, and the context envelope are stripped. Any missing signal (no gate on the response, bootstrapped or locally injected flags,has_experimentunknown) falls back to the full event, and experiment-linked flags always send the full envelope. The gate is stored alongside the cached flags (posthog-js persistence, posthog-node poller state) and is server-controlled, with no SDK-side configuration.before_sendruns after the filter and may re-add stripped properties. (2026-07-20)Patch Changes
9621830]:v1.404.1Compare Source
1.404.1
Patch Changes
66c1666Thanks @turnipdabeets! - Honour the project-level autocapture opt-out when the remote config request fails. Previously a failed config fetch (network error, timeout, blocked request) enabled autocapture on opted-out projects and persisted that state for later page loads. Autocapture now keeps the last successfully received server value, and stays off until the first successful config response.(2026-07-17)
v1.404.0Compare Source
1.404.0
Minor Changes
607bf54Thanks @pauldambra! - Add dead swipe detection to dead clicks autocapture. When dead clicks autocapture is enabled, touch swipe gestures that produce no observable screen change (no scroll, mutation, selection or visibility change) are now captured as$dead_swipeevents, surfacing failed navigations on touch devices. Configurable viacapture_dead_swipes(defaulttrue) andswipe_threshold_px(default30) on thecapture_dead_clicksconfig. Swipes over surfaces whose response cannot be observed (canvas, video and other media elements under the finger) are skipped, and captures are limited per page load viamax_dead_swipes_per_page_load(default10).(2026-07-16)
Patch Changes
df17ddcThanks @posthog! - Catch synchronous throws from a monkey-patchedwindow.fetchso they no longer escape as unhandled exceptions. A synchronous throw is now routed through the same handling as an async rejection, so the request queue retries instead of the error leaking into error tracking.(2026-07-16)
607bf54]:sass/dart-sass (sass)
v1.101.7Compare Source
v1.101.6Compare Source
v1.101.5Compare Source
v1.101.4Compare Source
Avoid emitting
rgb()orrgba()functions with non-percent decimalchannels. Older browsers only support integer values or (potentially decimal)
percentages for these functions, so in order to preserve
backwards-compatibility while retaining full precision for modern browsers,
legacy colors that contain at least one non-integer channel will now use
percentages for their channels (for example,
rgb(0%, 100%, 50%)rather thanrgb(0, 255, 127.5)).Fix a bug where the values of plain-CSS
if()expressions were emitted usingtheir
meta.inspect()format rather than their CSS serialization format.v1.101.3Compare Source
Configuration
📅 Schedule: (in timezone Asia/Shanghai)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.