[dependabot]

Bumps posthog-js from 1.399.2 to 1.434.12.

Release notes

Sourced from posthog-js's releases.

posthog-js@1.434.12

1.434.12

Patch Changes

• #5073 60bd968 Thanks @​ksvat! - The replayer no longer freezes the tab on a mutation that adds tens of thousands of nodes at once. It now applies a batch of 1,000 or more adds against a detached subtree, so the document updates style and layout once instead of per insert. A recorded batch of 25,746 style elements went from 92 seconds of blocked main thread to 1.5 seconds. (2026-09-23)

posthog-js@1.434.11

1.434.11

Patch Changes

• #5051 1549919 Thanks @​DeepanshuPal! - Avoid cross-domain cookie probes when cross-subdomain cookies are disabled. (2026-09-23)

posthog-js@1.434.10

1.434.10

Patch Changes

• #5060 a9c40ec Thanks @​marandaneto! - Fix SDK initialization when a script loader pre-creates window.posthog as a placeholder object. (2026-09-23)

posthog-js@1.434.9

1.434.9

Patch Changes

• #4970 708a5f7 Thanks @​Christian2702! - Session replay no longer defers its input setter hooks on zone.js's patched setTimeout. In Angular apps each of those timers ended a zone task and triggered another change detection, so any component writing an input property on every cycle drove the tab into an endless loop at 100% CPU. (2026-09-22)

posthog-js@1.434.8

1.434.8

Patch Changes

• #5054 36f356d Thanks @​posthog! - fix(dead-clicks): survive a denied property access in Firefox

  Firefox denies property access on a DOM node from another origin or from a realm that was torn down. The detector reads isConnected and nodeType on mutation records and on composed paths, and reads getRootNode on selection endpoints, so the denial escaped the MutationObserver callback and stopped the rest of the batch from refreshing the liveness timestamp. A node that cannot be read is now treated as a node that cannot be inspected. (2026-09-22)

posthog-js@1.434.7

1.434.7

Patch Changes

• #5001 c551218 Thanks @​posthog! - Session replay network capture no longer fails to start in frames without PerformanceObserver or its supportedEntryTypes; those frames record without live network timing. (2026-09-22)

posthog-js@1.434.6

... (truncated)

Commits

• 338d82d chore: update versions and lockfile [version bump]
• 60bd968 fix(replay): apply huge add mutations against a detached subtree (#5073)
• f8eaea2 docs: check org membership for public API exemption, point agents to sdk-spec...
• 4d64b8f ci(node): run v2 harness alongside legacy compliance (#5052)
• 2eaba2b feat(node): add v2 compliance binding and source-built package validation (#5...
• 7b3121f chore: update versions and lockfile [version bump]
• 31dd1ad feat(node): expose a flag's evaluation runtime through the SDK (#5050)
• 0c5557a chore: update versions and lockfile [version bump]
• f4704ac fix: honor filters.holdout in local flag evaluation (#5078)
• 2d5fe45 chore: update versions and lockfile [version bump]
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)