chore(deps): bump posthog-js from 1.391.6 to 1.396.2 in /dashboard

[dependabot]

Bumps posthog-js from 1.391.6 to 1.396.2.

Release notes

Sourced from posthog-js's releases.

posthog-js@1.396.2

1.396.2

Patch Changes

• #4003 b6261e7 Thanks @​marandaneto! - Include a Promise polyfill in the IE11 bundle and avoid Promise-dependent async compression paths when Promise support is unavailable. (2026-06-29)

posthog-js@1.396.1

1.396.1

Patch Changes

• #3999 cdeae17 Thanks @​marandaneto! - Fall back to uncompressed browser requests when gzip encoding fails. (2026-06-29)

posthog-js@1.396.0

1.396.0

Minor Changes

• #3987 74cc6bb Thanks @​TueHaulund! - Add a get_current_url config option that overrides the URL used for client-side URL targeting — session replay URL triggers, the session replay URL blocklist, survey URL display conditions, product tour URL conditions, web experiment URL conditions, and autocapture URL allow/ignore lists. These match against window.location.href directly, which does not reflect a $current_url rewritten in before_send. Apps where the browser URL is not meaningful for targeting (e.g. Electron/desktop builds served from a generated host) can now return the logical URL to match against. Defaults to window.location.href when not set. (2026-06-29)

Patch Changes

• Updated dependencies [74cc6bb]:
  • @​posthog/types@​1.392.0

posthog-js@1.395.0

1.395.0

Minor Changes

• #3977 6200888 Thanks @​turnipdabeets! - Add getAllFeatureFlags(), which returns all currently loaded feature flags as structured FeatureFlagResults (key, enabled, variant, payload). It is a synchronous read of the cached flags and does not send a $feature_flag_called event. (2026-06-26)

Patch Changes

• Updated dependencies [6200888]:
  • @​posthog/core@​1.38.0

posthog-js@1.394.0

1.394.0

Minor Changes

• #3986 919abca Thanks @​ioannisj! - Capture the $device_model super-property on Android Chromium via navigator.userAgentData.getHighEntropyValues(['model']). Resolved once during init and sent on subsequent events; opt out with disableDeviceModel: true. (2026-06-26)

... (truncated)

Commits

• 7dfc3af chore: update versions and lockfile [version bump]
• 710a6e7 ci: Reuse existing PostHog upgrade PR (#4008)
• 77c22d5 chore: use pnpm setup runtime action (#3964)
• b6261e7 fix(browser): avoid Promise-dependent IE startup failures (#4003)
• 479d5ea chore: update versions and lockfile [version bump]
• 08b404b fix(node): apply in/not_in operator on flag-level cohort conditions in local ...
• cdeae17 fix(browser): fall back when payload compression fails (#3999)
• 272c193 chore: update versions and lockfile [version bump]
• 619a25c fix(flags): retry flag requests on transient network errors (#3961)
• 1ba8ce8 chore: update versions and lockfile [version bump]
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
leadgen-platform	Ready	Preview, Comment	Jul 27, 2026 4:39am
leadgenengineplatform-api	Ready	Preview, Comment	Jul 27, 2026 4:39am
sonar	Ready	Preview, Comment	Jul 27, 2026 4:39am

[gitguardian]

⚠️ GitGuardian has uncovered 2 secrets following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secrets in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
35200354	Triggered	Google OAuth2 Keys	72ed13d	dashboard/.playwright-mcp/page-2026-06-22T09-42-07-314Z.yml	View secret
35200356	Triggered	Generic Password	e503d73	admin-panel/src/App.jsx	View secret

🛠 Guidelines to remediate hardcoded secrets

1. Understand the implications of revoking this secret by investigating where it is used in your code.
2. Replace and store your secrets safely. Learn here the best practices.
3. Revoke and rotate these secrets.
4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

• following these best practices for managing and storing secrets including API keys and other credentials
• install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

---

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

[sxrxvxnn]

@dependabot rebase

[dependabot]

Oh no! Something went wrong on our end. Please try again later.

If the problem persists, please contact GitHub support for assistance 🙇