Update dependency posthog-js to v1.438.7

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
posthog-js (source)	1.435.8 → 1.438.7

---

Release Notes

PostHog/posthog-js (posthog-js)

v1.438.7

Compare Source

1.438.7

Patch Changes

• #​4990 a66cada Thanks @​dustinbyrne! - Share browser logging across SDKs with consistent initialization and cleanup; captureLog and logger calls before logging setup are now dropped instead of buffered.
  (2026-10-09)
• Updated dependencies [a66cada]:
  • @​posthog/browser-common@0.9.4

v1.438.6

Compare Source

1.438.6

Patch Changes

• #​5218 8bc2df6 Thanks @​lucasheriques! - Skip WebMCP intent and model injection for schemas with constraints that the extra fields could break.
  (2026-10-09)

• #​5217 6af3aa8 Thanks @​lucasheriques! - Export WebMCPExtensions from the slim extension-bundles entry point.
  (2026-10-09)

v1.438.5

Compare Source

1.438.5

Patch Changes

• #​5258 429b5b2 Thanks @​hpouillot! - Recognize native bundler debug IDs and build-time error tracking release IDs.
  (2026-10-09)
• Updated dependencies [429b5b2]:
  • @​posthog/core@1.57.4

v1.438.4

Compare Source

1.438.4

Patch Changes

• #​5245 76b4402 Thanks @​abrahamguo! - Fix type checking in posthog-js 1.438.2 by publishing the feature flag types it imports from @​posthog/browser-common.
  (2026-10-09)
• Updated dependencies [76b4402]:
  • @​posthog/browser-common@0.9.3

v1.438.3

Compare Source

1.438.3

Patch Changes

• #​5200 34cdfa6 Thanks @​hpouillot! - fix(replay): add a private opt-in to preserve application stacks for failed fetch requests
  (2026-10-08)
• Updated dependencies [34cdfa6]:
  • @​posthog/types@1.415.2

v1.438.2

Compare Source

1.438.2

Patch Changes

• #​4988 22dfa4a Thanks @​dustinbyrne! - Share feature flag functionality across browser SDKs while preserving existing behavior.
  (2026-10-07)
• Updated dependencies [ff7582a]:
  • @​posthog/core@1.57.1

v1.438.1

Compare Source

1.438.1

Patch Changes

• #​5004 730d92b Thanks @​posthog! - Stop carousel and pager arrow controls from capturing false $rageclick events. The rageclick content ignorelist, active from the 2025-11-30 config defaults, now also covers arrow glyphs (→, ←, ›, ‹, », «, ▶, ◀, ❯, ❮). The built-in word keywords match whole words wherever they appear, including inside a list you pass yourself, so "Preview" keeps capturing; other word keywords you add still match as substrings. Keywords now match against the clicked control (the nearest button, link, ARIA control or cursor: pointer wrapper), reading its label from the control's whole subtree instead of every ancestor up to the body, so a region labelled "Featured carousel" no longer suppresses the buttons inside it. A control's own text or aria-label wins over an icon's aria-label inside it, so clicking the icon and clicking the text agree. Set rageclick: { content_ignorelist: false } to keep capturing these events.
  (2026-10-06)
• Updated dependencies [730d92b]:
  • @​posthog/browser-common@0.9.2
  • @​posthog/types@1.415.1

v1.438.0

Compare Source

1.438.0

Minor Changes

• #​5191 6cd5496 Thanks @​gesh! - Capture WebMCP tool intent and model metadata by default.
  (2026-10-06)

Patch Changes

• Updated dependencies [6cd5496]:
  • @​posthog/types@1.415.0
  • @​posthog/core@1.57.0

v1.437.0

Compare Source

1.437.0

Minor Changes

• #​5190 6af4c59 Thanks @​gesh! - Add opt-in WebMCP tool call capture for MCP Analytics.
  (2026-10-06)

Patch Changes

• Updated dependencies [6af4c59]:
  • @​posthog/types@1.414.0

v1.436.1

Compare Source

1.436.1

Patch Changes

• #​5203 633f5b2 Thanks @​marandaneto! - Restore batching for events carrying pending Meta $fbc or $fbp identifiers to reduce races with preceding identify() calls.
  (2026-10-05)

v1.436.0

Compare Source

1.436.0

Minor Changes

• #​5083 d576bec Thanks @​61465! - Opt-in WebView bot heuristic for #​2921.
  • posthog-js/customizations exports a new isLikelyWebViewBot(ua) helper that flags the UA pattern described in #​2921 (a Chrome/... token without the usual AppleWebKit/* + Safari/* co-markers that real Chrome always sends). Wire it into before_send to tag or drop the matching events — see isLikelyWebViewBot JSDoc for a usage example. Default SDK behaviour is unchanged; the helper is tree-shaken out unless you import it.
  • @posthog/core keeps isBlockedUA and DEFAULT_BLOCKED_UA_STRS byte-for-byte compatible, and gains session-level memoisation of isBlockedUA results keyed on (ua, customBlockedUserAgents), so repeat calls within the same session are O(1). (2026-10-05)

Patch Changes

• Updated dependencies [d576bec]:
  • @​posthog/core@1.56.0

v1.435.9

Compare Source

1.435.9

Patch Changes

• #​5150 abe2924 Thanks @​DeepanshuPal! - Stop a SecurityError escaping the recorder when an iframe becomes cross-origin while shadow DOM observation starts.
  (2026-10-05)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

3 Skipped Deployments

Project	Deployment	Actions	Updated
captainofbass	Skipped		Oct 13, 2026 1:30am UTC
mikeallisonjs	Skipped		Oct 13, 2026 1:30am UTC
sltdnb	Skipped		Oct 13, 2026 1:30am UTC

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 7bf61e25-be50-48c8-af1c-65c2341b5bff

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}