[dependabot]

Bumps posthog-js from 1.435.9 to 1.438.15.

Release notes

Sourced from posthog-js's releases.

posthog-js@1.438.15

1.438.15

Patch Changes

• #5273 d9148bb Thanks @​posthog! - Warn in debug mode when reloadFeatureFlags() runs inside an onFeatureFlags callback, because cross-tab flag changes can turn it into a request loop (2026-10-22)
• Updated dependencies [d9148bb]:
  • @​posthog/browser-common@​0.9.7

posthog-js@1.438.14

1.438.14

Patch Changes

• #4992 3b7ffc6 Thanks @​dustinbyrne! - Share surveys across browser SDKs; calls to getSurveys before survey setup now invoke the callback immediately with an unavailable error. Notify all survey subscribers when survey loading fails. (2026-10-22)
• Updated dependencies [3b7ffc6]:
  • @​posthog/browser-common@​0.9.6

posthog-js@1.438.13

1.438.13

Patch Changes

• #5322 5beb414 Thanks @​AyobamiH! - Flush buffered web vitals immediately using a beacon when the page is hidden or unloaded. (2026-10-20)

posthog-js@1.438.12

1.438.12

Patch Changes

• #5298 e940c92 Thanks @​github-actions! - Prevent backward device clock changes from subtracting client rate-limit tokens. (2026-10-15)

posthog-js@1.438.11

1.438.11

Patch Changes

• #5260 845bf99 Thanks @​gesh! - Capture WebMCP failures in Error Tracking when exception autocapture is enabled. With posthog-js/slim, add ErrorTrackingExtensions next to WebMCPExtensions to get these events. (2026-10-15)

posthog-js@1.438.10

1.438.10

Patch Changes

• #5300 09d4ba2 Thanks @​rafaeelaudibert! - Capture the Freebuff click identifier (bfcid) as a campaign parameter, so it is set on events and as $initial_bfcid like every other ad click ID.

... (truncated)

Commits

• 0570bca chore: update versions and lockfile [version bump]
• d9148bb fix(flags): warn when onFeatureFlags callbacks reload flags (#5273)
• 0fd3214 chore: update versions and lockfile [version bump]
• 2b5a9cc feat(browser-next): integrate dynamically loaded surveys (#4993)
• 3b7ffc6 refactor(browser-common): extract surveys extension (#4992)
• b5e99d1 fix(ai): capture Gemini thought parts as reasoning instead of answer text (#5...
• b2cd418 fix(react-native): keep native session on one client when several exist (#5347)
• cf0a67a chore(llma): bump @​modelcontextprotocol/sdk from 1.30.0 to 1.32.0 (#5342)
• c103b00 test(browser): validate replay network capture in deployment goldens (#5337)
• 6f2570a test(browser): expand deployment compatibility scenarios (#5323)
• Additional commits viewable in compare view

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 74ab0f9e-1f16-48b8-8491-fced6c7167a6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/posthog-js	^1.438.15	Unknown	Unknown
npm/@posthog/browser-common	0.9.7	🟢 7.8	Details Check Score Reason Code-Review 🟢 5 Found 16/27 approved changesets -- score normalized to 5 Maintained 🟢 10 30 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Binary-Artifacts 🟢 7 binaries present in source code License 🟢 9 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 4 branch protection is not maximal on development and all release branches Security-Policy 🟢 10 security policy file detected Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 Fuzzing 🟢 10 project is fuzzed SAST 🟢 7 SAST tool detected but not run on all commits
npm/@posthog/core	1.59.3	🟢 7.8	Details Check Score Reason Code-Review 🟢 5 Found 16/27 approved changesets -- score normalized to 5 Maintained 🟢 10 30 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Binary-Artifacts 🟢 7 binaries present in source code License 🟢 9 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 4 branch protection is not maximal on development and all release branches Security-Policy 🟢 10 security policy file detected Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 Fuzzing 🟢 10 project is fuzzed SAST 🟢 7 SAST tool detected but not run on all commits
npm/@posthog/types	1.416.0	🟢 7.8	Details Check Score Reason Code-Review 🟢 5 Found 16/27 approved changesets -- score normalized to 5 Maintained 🟢 10 30 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Binary-Artifacts 🟢 7 binaries present in source code License 🟢 9 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 4 branch protection is not maximal on development and all release branches Security-Policy 🟢 10 security policy file detected Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 Fuzzing 🟢 10 project is fuzzed SAST 🟢 7 SAST tool detected but not run on all commits
npm/core-js	3.51.0	🟢 5.3	Details Check Score Reason Code-Review 🟢 3 Found 8/22 approved changesets -- score normalized to 3 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10 Security-Policy 🟢 10 security policy file detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo License 🟢 10 license file detected Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/posthog-js	1.438.15	🟢 7.8	Details Check Score Reason Code-Review 🟢 5 Found 16/27 approved changesets -- score normalized to 5 Maintained 🟢 10 30 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Binary-Artifacts 🟢 7 binaries present in source code License 🟢 9 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 4 branch protection is not maximal on development and all release branches Security-Policy 🟢 10 security policy file detected Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 Fuzzing 🟢 10 project is fuzzed SAST 🟢 7 SAST tool detected but not run on all commits
npm/web-vitals	6.2.3	🟢 5.4	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 3 Found 11/30 approved changesets -- score normalized to 3 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Packaging ⚠️ -1 packaging workflow not detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Security-Policy ⚠️ 0 security policy file not detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST 🟢 4 SAST tool is not run on all commits -- score normalized to 4

Scanned Files

• apps/web/package.json
• pnpm-lock.yaml

[dependabot]

Looks like posthog-js is up-to-date now, so this is no longer needed.