Update dependency posthog-js to v1.396.3

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
posthog-js (source)	1.392.0 → 1.396.3

---

Release Notes

PostHog/posthog-js (posthog-js)

v1.396.3

Compare Source

v1.396.2

Compare Source

1.396.2

Patch Changes

• #​4003 b6261e7 Thanks @​marandaneto! - Include a Promise polyfill in the IE11 bundle and avoid Promise-dependent async compression paths when Promise support is unavailable.
  (2026-06-29)

v1.396.1

Compare Source

1.396.1

Patch Changes

• #​3999 cdeae17 Thanks @​marandaneto! - Fall back to uncompressed browser requests when gzip encoding fails.
  (2026-06-29)

v1.396.0

Compare Source

1.396.0

Minor Changes

• #​3987 74cc6bb Thanks @​TueHaulund! - Add a get_current_url config option that overrides the URL used for client-side URL targeting — session replay URL triggers, the session replay URL blocklist, survey URL display conditions, product tour URL conditions, web experiment URL conditions, and autocapture URL allow/ignore lists. These match against window.location.href directly, which does not reflect a $current_url rewritten in before_send. Apps where the browser URL is not meaningful for targeting (e.g. Electron/desktop builds served from a generated host) can now return the logical URL to match against. Defaults to window.location.href when not set.
  (2026-06-29)

Patch Changes

• Updated dependencies [74cc6bb]:
  • @​posthog/types@​1.392.0

v1.395.0

Compare Source

1.395.0

Minor Changes

• #​3977 6200888 Thanks @​turnipdabeets! - Add getAllFeatureFlags(), which returns all currently loaded feature flags as structured FeatureFlagResults (key, enabled, variant, payload). It is a synchronous read of the cached flags and does not send a $feature_flag_called event.
  (2026-06-26)

Patch Changes

• Updated dependencies [6200888]:
  • @​posthog/core@​1.38.0

v1.394.0

Compare Source

1.394.0

Minor Changes

• #​3986 919abca Thanks @​ioannisj! - Capture the $device_model super-property on Android Chromium via navigator.userAgentData.getHighEntropyValues(['model']). Resolved once during init and sent on subsequent events; opt out with disableDeviceModel: true.
  (2026-06-26)

v1.393.6

Compare Source

1.393.6

Patch Changes

• #​3965 6ef9179 Thanks @​marandaneto! - Handle request serialization errors without throwing or blocking queued requests.
  (2026-06-26)

v1.393.5

Compare Source

1.393.5

Patch Changes

• #​3960 619d318 Thanks @​marandaneto! - Improve console log capture performance for truncated large objects.
  (2026-06-25)

v1.393.4

Compare Source

1.393.4

Patch Changes

• #​3942 c9c8925 Thanks @​hpouillot! - Fix browser console log capture when session activity timestamps are missing and refresh session attributes for each log.
  (2026-06-24)
• Updated dependencies [c9c8925]:
  • @​posthog/core@​1.37.2

v1.393.3

Compare Source

1.393.3

Patch Changes

• #​3945 f94deaf Thanks @​ioannisj! - fix(surveys): guard handlePageUnload against version-skewed surveys instance missing the method
  (2026-06-24)

v1.393.2

Compare Source

1.393.2

Patch Changes

• #​3944 1c9a811 Thanks @​ioannisj! - Stop logging a misleading "upgrade your PostHog server" warning for valid v2 flags responses that have no flags.
  (2026-06-24)

v1.393.1

Compare Source

1.393.1

Patch Changes

• #​3919 99bad9c Thanks @​pauldambra! - Session replay network capture: add an opt-in streaming reader for request/response bodies that stops at the payload size limit instead of buffering the whole body and then discarding it — bounding memory and pre-request latency when a body is very large. It reads only a clone of the body, so it never consumes the stream the page itself reads, and always resolves (never rejects) into the page's fetch. Off by default; enabled for defaults: '2026-06-25' and settable directly via session_recording.streamNetworkBody.
  (2026-06-24)
• Updated dependencies [99bad9c]:
  • @​posthog/types@​1.391.1

v1.393.0

Compare Source

1.393.0

Minor Changes

• #​3921 c28b161 Thanks @​marandaneto! - Add disable_capture_url_hashes to strip URL fragments from automatically captured URLs. It is disabled by default for backwards compatibility, and enabled automatically when config.defaults is '2026-06-25' or later. Enabling it (either explicitly or via the '2026-06-25' defaults) is a breaking behavior change for SPAs that rely on URL hashes for routing or analytics, because hash-based routes will be collapsed to the same URL without the fragment in fields such as $current_url, $initial_current_url, $session_entry_url, autocapture $elements[*].attr__href, $external_click_url, replay href URLs, heatmaps, web vitals $current_url, logs url.full, conversations current_url/request_url, or Next.js Pages Router $pageview $current_url.

  If you only want to capture some hashes, leave hash capture enabled and use before_send to remove or redact sensitive hash values before events are sent. (2026-06-23)

Patch Changes

• Updated dependencies [c28b161]:
  • @​posthog/core@​1.36.0
  • @​posthog/types@​1.391.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	posthog-js@​1.392.0 ⏵ 1.396.3	-17		+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Telemetry collection: npm posthog-js Note: The file package/dist/module.full.js contains a browser telemetry/session-replay SDK that instruments DOM/events, intercepts fetch/XHR, and uploads data to remote endpoints. It supports a dynamic external script loader controlled by remote configuration, creating privacy, data-exfiltration, and supply-chain/external-code execution risk exposure. It should be treated as a sensitive third-party dependency requiring strict governance, CSP/allow-listing, careful configuration review, and verification of remote-config/external asset integrity to prevent misconfigurations or upstream compromise. From: package.json → npm/posthog-js@1.396.3 ℹ Read more on: This package | This alert | What is telemetry? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Most telemetry comes with settings to disable it. Consider disabling telemetry if you do not want to be tracked. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/posthog-js@1.396.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Telemetry collection: npm posthog-js Note: The file package/dist/module.no-external.js represents a client-side analytics/telemetry SDK that loads external scripts at runtime and transmits telemetry to remote endpoints. It can modify the DOM and assign server-provided HTML via innerHTML (and CSS via style) without apparent sanitization, creating a credible XSS risk if experiment data is untrusted. The runtime loader and external dependencies also expand supply-chain attack surface. From: package.json → npm/posthog-js@1.396.3 ℹ Read more on: This package | This alert | What is telemetry? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Most telemetry comes with settings to disable it. Consider disabling telemetry if you do not want to be tracked. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/posthog-js@1.396.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Telemetry collection: npm posthog-js Note: The PostHog JavaScript SDK loads remote configurations and conditionally injects external scripts via dynamically created script tags, enabling extensions and server-driven experiments. This creates a supply-chain/execution risk and potential data-collection/privacy concerns through telemetry, identifier persistence in cookies/localStorage, and possible DOM modifications. Mitigations include strict CSP/SRI, asset allowlisting, restricted external dependencies, and server-side sanitization for any HTML/CSS transforms. From: package.json → npm/posthog-js@1.396.3 ℹ Read more on: This package | This alert | What is telemetry? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Most telemetry comes with settings to disable it. Consider disabling telemetry if you do not want to be tracked. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/posthog-js@1.396.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Telemetry collection: npm posthog-js Note: The package/dist/lazy-recorder.js module implements a rrweb-style session recorder that captures DOM mutations and user interactions, applies masking/sampling, buffers events, and uploads recordings to a backend API endpoint. The primary risk is privacy and data-handling security, contingent on masking guarantees, endpoint integrity, secure routing, and proper consent/authorization; there are no evident signs of malware, but misconfiguration can lead to leakage of sensitive content. From: package.json → npm/posthog-js@1.396.3 ℹ Read more on: This package | This alert | What is telemetry? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Most telemetry comes with settings to disable it. Consider disabling telemetry if you do not want to be tracked. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/posthog-js@1.396.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report