chore(deps): update npm packages - #464
Merged
Merged
Conversation
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
renovate
Bot
force-pushed
the
renovate/npm-packages
branch
from
August 30, 2026 22:58
38779d0 to
a15de4a
Compare
Brooooooklyn
approved these changes
Aug 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
22.1.3→22.1.422.1.5→22.1.622.1.3→22.1.422.1.3→22.1.422.1.3→22.1.422.1.3→22.1.422.1.3→22.1.422.1.3→22.1.422.1.3→22.1.422.1.3→22.1.422.1.3→22.1.422.1.3→22.1.46.10.1→6.11.01.418.6→1.422.11.103.0→1.103.1Release Notes
angular/angular (@angular/animations)
v22.1.4Compare Source
common
compiler
compiler-cli
core
forms
language-service
migrations
platform-server
angular/angular-cli (@angular/build)
v22.1.6Compare Source
@angular/build
@angular/ssr
angular/components (@angular/cdk)
v22.1.4Compare Source
cdk
material
sanity-io/sanity (@sanity/types)
v6.11.0Compare Source
Bug Fixes
PostHog/posthog-js (posthog-js)
v1.422.1Compare Source
v1.422.0Compare Source
1.422.0
Minor Changes
db8687cThanks @posthog! - Report$sdk_debug_replay_throttled_mutations_droppedon captured events, counting the attribute changes the session recorder discarded during that session. The recorder throttles elements that change hundreds of times a second, and a discardedclassorstylechange never reaches the player — so a recording can keep showing an element the live page had already hidden. Query this property to see whether your app is affected.(2026-08-27)
v1.421.2Compare Source
1.421.2
Patch Changes
#4653
712223aThanks @posthog! - Fix request timeouts never firing on pages where a browser extension makesError.prototype.namenon-writable(2026-08-27)
#4036
718beeeThanks @emmayusufu! - Fixlogs.captureConsoleLogsset ininit()not enabling console autocapture, captureconsolecalls made before the logs script loads, and drop captured console records when the user opts out(2026-08-27)
#4036
718beeeThanks @emmayusufu! - Fix session replay and posthog-js leaving each other'sconsolewrapper in the call path when either one stops(2026-08-27)
Updated dependencies [
718beee,712223a]:v1.421.1Compare Source
1.421.1
Patch Changes
#4657
9c09bd4Thanks @marandaneto! - Use the best available compression for browser feature flag requests, preferring gzip when supported.(2026-08-27)
#4520
362d081Thanks @veksa! - DropsourcesContentfrom the source maps published to npm. The maps themselves still ship, so downstream source-map chaining and the//# sourceMappingURLreferences are unaffected — only the copy of our TypeScript sources embedded in each map is gone, taking the package from 40.8 MB to 17.4 MB unpacked. CDN artifacts are built separately and keep their inlined sources.(2026-08-27)
Updated dependencies [
7902e44,e899b1c]:v1.421.0Compare Source
1.421.0
Minor Changes
4f80973Thanks @robbie-c! - Add the2026-08-30config defaults. These defaults enable sanitized JSON-LD replay events.(2026-08-26)
Patch Changes
4f80973]:v1.420.0Compare Source
1.420.0
Minor Changes
0d2cf49Thanks @robbie-c! - Add opt-in Schema.org JSON-LD capture to session replay throughsession_recording.captureJsonLd. When enabled, the recorder emits sanitized JSON-LD as custom replay events and excludes all script elements from replay snapshots.(2026-08-26)
Patch Changes
#4635
ab1383aThanks @robbie-c! - Capture paste interactions with clipboard autocapture without collecting pasted text.(2026-08-26)
#4594
1d88b4eThanks @posthog! - Fix session replay playback ending when a recording contains a shadow host the browser refuses. The player now skips that one subtree instead of aborting the rebuild.(2026-08-26)
Updated dependencies [
ab1383a,0d2cf49]:v1.419.4Compare Source
1.419.4
Patch Changes
#4592
ca540f9Thanks @dustinbyrne! - Add typed stable-name lookup for installed browser extensions and use it when independently loaded survey code resolves feature flags.(2026-08-25)
#4533
53fcb2dThanks @dustinbyrne! - Fix console log autocapture silently failing when an olderposthog-jscore loads a newer logs bundle.(2026-08-25)
#4476
ed4dd97Thanks @posthog! - fix(browser): refresh configured feature flags when a hidden tab becomes visibleFeature flags now own their automatic refresh timer and visibility listener.
Hidden tabs reload due flags when they become visible. The existing five-minute
default and
remote_config_refresh_interval_msbehavior remain unchanged. (2026-08-25)Updated dependencies [
53fcb2d,ca540f9,ed4dd97]:v1.419.3Compare Source
v1.419.2Compare Source
1.419.2
Patch Changes
#4645
cb7cc12Thanks @turnipdabeets! - Type declarations no longer import theJSXnamespace fromreact, so they typecheck against@types/reactback to the declared 16.8.0 floor. Component return types are now spelledReactElement<any, any>, which is the definition ofJSX.Element— the same type, so consuming code is unaffected.JSXonly became an exported member of thereacttypes module in@types/react@18.2.6, so projects on older React types previously sawTS2305: Module '"react"' has no exported member 'JSX'when checking these declarations withskipLibCheck: false. (2026-08-25)v1.419.1Compare Source
1.419.1
Patch Changes
#4638
d166e54Thanks @github-actions! - Declarereactand@types/reactas optional peer dependencies so theposthog-js/reactentry point can resolve React on strictnode_moduleslayouts — pnpm and bun isolated linkers backed by a global store, where the package is installed outside the project tree and Node's directory walk never reaches the app's React.Projects that do not import
posthog-js/reactare unaffected: the peers are optional, so npm, pnpm, yarn, and bun install them only when React is already present and emit no unmet-peer warnings. (2026-08-25)v1.419.0Compare Source
1.419.0
Minor Changes
334159bThanks @posthog! - Web vitals now capture attribution by default for INP and LCP, so a slow interaction or paint arrives with the target element and phase breakdown that make it diagnosable. CLS stays without attribution by default, because its attribution holds detached DOM nodes and can leak memory in single-page apps. Setcapture_performance.web_vitals_attributiontofalseto opt out,truefor every metric, or an array to name the metrics. The captured metric also drops the emptyentriesarray and bounds attribution to a small set of useful fields, and the attributed INP observer no longer collects theprocessedEventEntrieswe never read.(2026-08-25)
Patch Changes
334159b]:v1.418.17Compare Source
1.418.17
Patch Changes
#4612
e8a2c2aThanks @marandaneto! - Prevent session recordings from emitting failed CSSOM changes and fix shadow DOM, cross-origin iframe, blocked and unsupported canvas, and deep DOM serialization edge cases.(2026-08-25)
#4611
d4eee8fThanks @marandaneto! - Share survey property matching between the browser and React Native SDKs while preserving their existing missing-value behavior.(2026-08-25)
Updated dependencies [
930de19,d4eee8f]:v1.418.16Compare Source
1.418.16
Patch Changes
7ec4f0dThanks @posthog! - Drop exceptions thrown by user scripts the browser injects into every page (Firefox for iOS, Chrome for iOS) instead of reporting them as the page's own errors. Seterror_tracking.captureExtensionExceptions: trueto keep capturing them.(2026-08-24)
7ec4f0d]:v1.418.15Compare Source
1.418.15
Patch Changes
60ee0acThanks @dustinbyrne! - Migrate surveys to the shared browser extension lifecycle.(2026-08-24)
60ee0ac]:v1.418.14Compare Source
1.418.14
Patch Changes
#4513
cb7e4a6Thanks @dustinbyrne! - Migrate browser autocapture to the shared extension lifecycle.(2026-08-24)
#4623
be299dfThanks @turnipdabeets! - Fix logs and metrics batches being dropped instead of retried after HTTP 408(2026-08-24)
Updated dependencies [
be299df]:v1.418.13Compare Source
1.418.13
Patch Changes
#4418
be2161dThanks @posthog! - feat: add granular automatic pageview options for SPA navigationcapture_pageviewnow accepts an object withpath,search, andhashoptions. Each selected URL component triggers a$pageviewwhen it changes, including direct hash changes used by hash-based routers. The existing'history_change'option continues to capture pathname changes. (2026-08-24)Updated dependencies [
be2161d]:v1.418.12Compare Source
1.418.12
Patch Changes
9e853c1Thanks @posthog! - Session replay: fixed a stale element left rendered in the player when a mutation re-added a node id with changed attributes. Affects bothuseVirtualDommodes.(2026-08-24)
v1.418.11Compare Source
1.418.11
Patch Changes
#4603
ca030a6Thanks @martinfrancois! - Stop adding PostHog's optional feature scripts, such as the session replay recorder and exception autocapture, to the page more than once. Sites that proxy PostHog through their own domain, by settingapi_hostto a path like/ingestrather than a full URL, ended up with the same<script>tag three or four times: the check meant to spot the duplicate compared the browser's resolved absolute URL against the relative one, so it never matched. The network tab showed a single request either way, because the browser served the repeats from its cache, which is why this was easy to miss. Nothing measurable got slower as a result, so this is a correctness fix rather than a speed one.(2026-08-24)
#4453
325870aThanks @posthog! - When session replay is waiting on a trigger, debug mode now names the conditions that haven't matched yet (for examplebuffering: URL condition not matched, or the named trigger group whose condition is pending) instead of only reportingbuffering. Enable it withposthog.debug(). Logged once per change, not once per flush.(2026-08-24)
v1.418.10Compare Source
1.418.10
Patch Changes
#4451
e1d993cThanks @posthog! - Guard the replayer's hover handling against non-element and detached hover targets, which previously threw an unhandledTypeError(querySelectorAllon a node without that method) and stopped session recording playback mid-stream.(2026-08-21)
#4557
4451274Thanks @posthog! - Keep replay playback running when a recording adopts constructed stylesheets across a document swap. A constructed stylesheet can only be adopted by the document that created it, so a sheet held over a swap is rejected and the error previously stopped the player. Adoption now falls back to whatever is already applied.(2026-08-21)
v1.418.9Compare Source
1.418.9
Patch Changes
c8df61cThanks @clr182! - fix(replay): attribute the backdated sessionIdle marker to the session that went idle, so a rotation-born session's recording no longer starts hours before its first snapshot(2026-08-21)
v1.418.8Compare Source
1.418.8
Patch Changes
6322f09Thanks @turnipdabeets! - Fix logs and metrics being silently dropped when an attribute holds a very large integer, a function, a symbol, a sparse array, or a truncated emoji.Cap log and metric attributes at 20 levels of nesting, 1,000 entries per object and 10,000 values in total, marking anything beyond as
[Truncated].Type
OtlpAnyValue.intValueasstring | number— code reading that field must handle both. (2026-08-21)6322f09]:v1.418.7Compare Source
sass/dart-sass (sass)
v1.103.1Compare Source
Configuration
📅 Schedule: (in timezone Asia/Shanghai)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.