chore(deps): update npm packages - #472
Merged
Merged
Conversation
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
renovate
Bot
force-pushed
the
renovate/npm-packages
branch
from
September 6, 2026 21:08
a2ba1b1 to
f45abb2
Compare
Brooooooklyn
approved these changes
Sep 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
22.1.4→22.1.522.1.6→22.1.722.1.4→22.1.522.1.4→22.1.522.1.4→22.1.522.1.4→22.1.522.1.4→22.1.522.1.4→22.1.522.1.4→22.1.522.1.4→22.1.522.1.4→22.1.522.1.4→22.1.56.11.0→6.12.07.3.1→7.3.28.5.26→8.5.281.422.1→1.426.14.23.12→4.23.130.16.2→0.16.3Release Notes
angular/angular (@angular/animations)
v22.1.5Compare Source
compiler-cli
core
forms
nameinput on ControlValueAccessormigrations
platform-server
router
angular/angular-cli (@angular/build)
v22.1.7Compare Source
angular/components (@angular/cdk)
v22.1.5Compare Source
aria
multiple
sanity-io/sanity (@sanity/types)
v6.12.0Compare Source
Features
sindresorhus/p-limit (p-limit)
v7.3.2Compare Source
limitFunctionqueue clearing (#109)f3e7f9bpostcss/postcss (postcss)
v8.5.28Compare Source
v8.5.27Compare Source
/*#(by @dylanpulver).*hack before a comment in Custom Properties (by @Jaybhade).list.comma()(by @MahinAnowar).list.space()(by @MahinAnowar).PostHog/posthog-js (posthog-js)
v1.426.1Compare Source
1.426.1
Patch Changes
d8508b6Thanks @marandaneto! - Initialize the Segment enrichment integration when Segment is configured throughset_config, so Segment events include PostHog properties such as active feature flags.(2026-09-03)
v1.426.0Compare Source
1.426.0
Minor Changes
6325953Thanks @mayteio! - Capture Meta's$fbcperson property when a newfbclidis observed.(2026-09-03)
Patch Changes
#4760
41ed3afThanks @marandaneto! - Require a distinct ID when callingidentifyand correct its API documentation to match the existing runtime validation.(2026-09-03)
#4713
7a027adThanks @posthog! - Gate$groupidentifyon person processing. Underidentified_only, agroup()call promotes the user to identified so the event is kept instead of dropped. Undernever, the local group association is retained for subsequent events and feature flags, but$groupidentifyis not sent because the server always drops it.(2026-09-03)
Updated dependencies [
41ed3af,dbbb58e]:v1.425.1Compare Source
1.425.1
Patch Changes
#4731
9b4008aThanks @fasyy612! - fix(replay): re-adopt constructed stylesheets when a shadow host is removed and re-added mid-replay. An SPA navigation can detach and reattach the same web component element; the browser keeps its shadow root and adopted sheets, so the recorder (which already tracks that shadow root) emits no new AdoptedStyleSheet event. The replayer rebuilds the element with a fresh shadow root and previously dropped the adopted styles for the rest of playback, rendering the component unstyled. The replayer now remembers the last adopted styleIds per host and re-adopts them when the shadow root is rebuilt, in both live playback and fast-forward. Fixes playback of existing recordings.(2026-09-02)
#4744
77797c9Thanks @fasyy612! - fix(replay): keep recording through a session-id rotation when the persisted remote config is past its TTL. A rotation restart transits through stop() before start(), which made the config TTL check treat it as a cold boot: the stale config was discarded, start() bailed silently, and the recorder died with session attribution stuck on the old session id. The rotated session then shipped events with no initial full snapshot, producing recordings whose prefix cannot be played until something else restarted recording. Affects any rotation on a session older than one hour, most visibly posthog.reset() on logout. Cold-boot TTL behavior is unchanged.(2026-09-02)
v1.425.0Compare Source
1.425.0
Minor Changes
61a26e5Thanks @veryayskiy! - Forward generic server-signed identity claims with conversations widget requests.(2026-09-02)
Patch Changes
61a26e5]:v1.424.1Compare Source
1.424.1
Patch Changes
d90b3c5Thanks @posthog! - Prevent failed replay network body reads from escaping into the host page's ownfetch()call(2026-09-01)
v1.424.0Compare Source
1.424.0
Minor Changes
e87820aThanks @turnipdabeets! - Addos.nameandos.versionresource attributes to logs from the browser SDK, overridable vialogs.resourceAttributes(2026-09-01)
Patch Changes
e87820a]:v1.423.2Compare Source
v1.423.1Compare Source
1.423.1
Patch Changes
5931638Thanks @skvark! - Prevent stale session recorders from initializing after consent or session teardown, and dispose of recorders when switching to cookieless mode.(2026-09-01)
v1.423.0Compare Source
1.423.0
Minor Changes
#4663
6ae173fThanks @pauldambra! - Detect the Claude, Codex, and ChatGPT apps from their user agent markers:$browsernow reports the app name instead ofChrome.ChatGPT versions its apps differently per platform, so its
$browser_versionis not comparable across platforms. (2026-09-01)#4659
1406e04Thanks @marandaneto! - Synchronize feature flag and early access enrollment persistence across browser tabs. Keep successful partial evaluations authoritative for payload updates and removals, including falsy payload values, while retaining cached state for failed evaluations.(2026-09-01)
Patch Changes
#4696
aa72a36Thanks @github-actions! - Preferdata-ph-capture-attribute-*values from the closest element when the same property is defined on multiple ancestors.(2026-09-01)
#4683
6309cb2Thanks @posthog! - Harden the directly importablegetElementsChainStringutility against runtime JavaScript callers that pass a non-array value. It now returns an empty string instead of calling.mapon malformed input.(2026-09-01)
#4708
6723395Thanks @turnipdabeets! - Changebigintattributes on logs, metrics and spans to send as an int64 rather than as a string.(2026-09-01)
#4692
ec550b8Thanks @mhornbacher! - Respectnavigator.globalPrivacyControlwhenrespect_dntis enabled(2026-09-01)
#4697
6d6091eThanks @yfwmaniish! - Fix a memory leak in Session Replay recording:MutationBufferskipped its own cleanup whenever a mutation batch normalized to an empty payload (e.g. a node added and removed within the same task), leaving the buffer holding strong references to DOM nodes indefinitely.(2026-09-01)
#4672
0cddefeThanks @posthog! - Error tracking now drops a known uBlock Origin Lite exception thrown by its Safari extension. Safari masks extension content-script URLs aswebkit-masked-url://hidden/, but also uses that URL for application code, so the filter requires the extension's error signature before dropping an all-masked stack. A remaining unmaskedin_appframe still preserves the exception as first-party.(2026-09-01)
#4704
cee2280Thanks @veryayskiy! - back off support widget polling to stop starving sends(2026-09-01)
#4684
5874d1cThanks @yfwmaniish! - Fall back to in-memory storage when neither web storage nor cookies are available, instead of selecting a backend that cannot store anything. In contexts like adata:URL — a Figma plugin, for example — Chrome disables localStorage and cookies alike, and both the persistence and consent paths previously committed to an unusable store, logging a SecurityError on every capture.cookieStore._is_supported()now round-trips a probe cookie rather than only checking thatdocumentexists, andmemoryStoreno longer reports a stored falsy value (such as the0consent writes for "opted out") as absent.(2026-09-01)
#4662
e7f5733Thanks @posthog! - Warn at init whenpersistenceis'memory'or'sessionStorage'and nobootstrap.distinctIDis set. In this setup the SDK mints a fresh distinct ID on every page load, so eachidentify()call merges another ID onto the same person. A person can then pass the distinct-ID limit, after which person pages and the session tab load only a truncated slice and the rest of the events look missing even though ingestion is fine. The warning points at the two fixes: switch tolocalStorage+cookie, or keep this persistence and pass a stable ID throughbootstrap.distinctID.(2026-09-01)
#4682
5c6ab6fThanks @posthog! - Fix an uncaughtTypeErrorin the web vitals attribution bundle. The attributed INP observer readstartTimefrom the first entry without a guard, so a report with no entries (for example after a bfcache restore or soft navigation) threw and stopped the metric capture. Bumpweb-vitalsto 6.2.1, which guards the empty-entry case: instead of throwing, it reports the metric with fallback attribution that carries no interaction details (zeroed input and processing delays).(2026-09-01)
Updated dependencies [
444bf35,6ae173f,6309cb2,6723395]:v1.422.5Compare Source
1.422.5
Patch Changes
a895e7e]:v1.422.4Compare Source
1.422.4
Patch Changes
3c650a1Thanks @nandinitiw! - Re-translate popover surveys when the display language changes while the survey is on screen, either from a browserlanguagechangeevent or fromidentify()updating thelanguageperson property. In-progress answers are preserved.$survey_questions[].questionand$survey_languageonsurvey sent/survey dismissednow report the text and language the user saw when they answered, not the language active when the event fired. Feedback-button (widget) surveys are unchanged.(2026-08-28)
3c650a1]:v1.422.3Compare Source
1.422.3
Patch Changes
d0279e5Thanks @posthog! - Autocapture no longer throws aRangeErrorinto the host page when it sorts element attributes. It now sorts attribute keys with a plain lexical comparator instead oflocaleCompare, which can throw on browsers with faulty ICU data.(2026-08-28)
d0279e5]:v1.422.2Compare Source
1.422.2
Patch Changes
d5ef459Thanks @fasyy612! - Session replay can now bound DOM mutation bytes with an opt-in budget. Set__mutationBytesBucketSize(e.g. 1MB) to enable: mutations beyond the sustained budget (__mutationBytesRefillRate, default 25KB/s) are dropped and the recording resyncs with a full snapshot, keeping recordings from apps with very high DOM churn playable. Off by default.(2026-08-28)
d5ef459]:privatenumber/tsx (tsx)
v4.23.13Compare Source
angular/angular (zone.js)
v0.16.3Compare Source
Configuration
📅 Schedule: (in timezone Asia/Shanghai)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.