Update dependency posthog-js to v1.434.0

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
posthog-js (source)	1.392.0 → 1.434.0

---

Release Notes

PostHog/posthog-js (posthog-js)

v1.434.0

Compare Source

1.434.0

Minor Changes

• #​5014 5e86154 Thanks @​pauldambra! - Rename the metrics.network default attributes to the OTel HTTP client semantic conventions: http.request.method, server.address, server.port, url.scheme, url.template, http.response.status_code and error.type replace method, host, path and status_class.
  (2026-09-17)

Patch Changes

• Updated dependencies [5e86154]:
  • @​posthog/types@1.412.2

v1.433.10

Compare Source

1.433.10

Patch Changes

• #​4960 c8e53fa Thanks @​posthog! - Log a console warning when session replay stops capturing canvas frames (browser without OffscreenCanvas, a CSP that blocks blob: workers, or a failing canvasCapture.maskRegionsFn), and stop changing WebGL and WebGPU canvas settings when canvas capture fails to start
  (2026-09-17)

• #​4977 0257a29 Thanks @​lucasheriques! - Share survey choice and question shuffling between web and React Native through surveys core. Use Fisher-Yates for web questions, preserve Other-last choice ordering, and avoid mutating configured choices.
  (2026-09-17)

• Updated dependencies [0257a29]:

  • @​posthog/core@1.54.4

v1.433.9

Compare Source

1.433.9

Patch Changes

• #​5007 c3043f4 Thanks @​marandaneto! - Add a session diagnostic when stale replay configuration cannot be refreshed, without changing recording behavior.
  (2026-09-17)

v1.433.8

Compare Source

1.433.8

Patch Changes

• #​4709 c1d1faf Thanks @​posthog! - Prefer synchronous compression for events captured with send_instantly, including the initial $pageview, to avoid delaying request dispatch on asynchronous compression.
  (2026-09-17)

v1.433.7

Compare Source

1.433.7

Patch Changes

• #​4979 c767b98 Thanks @​darkopia! - fix(surveys): keep URL prefill working when localStorage is unavailable, such as on a page with an opaque origin or in private browsing
  (2026-09-16)
• Updated dependencies [2828b6b]:
  • @​posthog/browser-common@0.9.0

v1.433.6

Compare Source

1.433.6

Patch Changes

• #​4926 ec4062b Thanks @​posthog! - Stop treating a <link rel=preload as=style> resource hint as a stylesheet when recording. Because it carries the URL of the sheet it preloads, the recorder matched it to the loaded stylesheet and inlined the whole sheet onto it, putting the CSS in every full snapshot twice and reporting a failed stylesheet deferral on every snapshot.
  (2026-09-16)

v1.433.5

Compare Source

1.433.5

Patch Changes

• #​4962 85b775a Thanks @​posthog! - Docstrings for identity_hash and setIdentity() now say the hash is signed with the Secret API key from Support settings, not a project secret API key or a personal API key.
  (2026-09-15)
• Updated dependencies [85b775a]:
  • @​posthog/types@1.412.1

v1.433.4

Compare Source

1.433.4

Patch Changes

• #​4941 07c1045 Thanks @​marandaneto! - Capture causes and AggregateError members with relationship metadata and individual stacks, limiting output to 50 entries and 1,000 member inspections.
  (2026-09-15)

• #​4898 372afba Thanks @​posthog! - Contain a throw from a third-party patched AbortController.abort() when our own fetch timeout fires, so it is retried instead of escaping as an uncaught error, and report a single outcome per request.
  (2026-09-15)

• #​4910 38b61f9 Thanks @​posthog! - Keep the end of a session recording when one replay event is too large to stringify: that event is dropped and the rest of the buffer still ships, instead of the size estimate throwing and stopping the unload flush.
  (2026-09-15)

• #​4909 5d4f1f7 Thanks @​posthog! - Keep the session recording observers that started when one of them fails to initialize, and report the failed observers in the recorder debug properties.
  (2026-09-15)

• Updated dependencies [07c1045]:

  • @​posthog/core@1.54.1

v1.433.3

Compare Source

1.433.3

Patch Changes

• #​4945 79f02e7 Thanks @​marandaneto! - Default Fetch requests to strict-origin so referrers omit page paths and query strings.
  (2026-09-14)

v1.433.2

Compare Source

1.433.2

Patch Changes

• #​4846 bd4543e Thanks @​posthog! - Keep session recording snapshots from different windows of the same session in separate uploads to preserve their window attribution.
  (2026-09-14)

• #​4954 3c68c08 Thanks @​marandaneto! - Respect Retry-After, including repeated headers, up to 30 seconds on retryable browser responses without shortening exponential backoff.
  (2026-09-14)

• Updated dependencies [3c68c08]:

  • @​posthog/core@1.54.0

v1.433.1

Compare Source

1.433.1

Patch Changes

• #​4949 8f11f5f Thanks @​marandaneto! - Respect autocapture attribute masks for link URLs and legacy class properties.
  (2026-09-14)

v1.433.0

Compare Source

1.433.0

Minor Changes

• #​4916 d037ea1 Thanks @​mayteio! - Read Meta's _fbc and _fbp cookies for the Conversions API. When the Meta pixel is on the page, its _fbc cookie holds the true ad click time, so that value now wins over the time PostHog stamps on the pageview that follows the click, and a click that landed before the SDK loaded is no longer lost. The _fbp browser ID is captured as the $fbp person property, which makes it available to a conversion sent later from a backend. Both cookies are read under the same switches as the URL click ID: save_campaign_params: false turns the reads off, and cookieless mode skips them.
  (2026-09-14)

v1.432.0

Compare Source

1.432.0

Minor Changes

• #​4958 4a46fab Thanks @​marandaneto! - Add a resetError callback to React error-boundary fallbacks so applications can retry rendering without remounting the boundary.
  (2026-09-14)

Patch Changes

• #​4927 62fc60b Thanks @​marandaneto! - Fix lost event retries after restoring a page from the back-forward cache.
  (2026-09-14)

v1.431.8

Compare Source

1.431.8

Patch Changes

• #​4935 6a78625 Thanks @​marandaneto! - Fix false dead clicks after synchronous DOM updates. Clicks stopped from bubbling are now evaluated too, which may increase dead-click counts for inert controls.
  (2026-09-14)

v1.431.7

Compare Source

1.431.7

Patch Changes

• #​4937 a5d094f Thanks @​marandaneto! - Avoid fetch keepalive quota failures when multiple event requests are in flight.
  (2026-09-14)

v1.431.6

Compare Source

1.431.6

Patch Changes

• #​4936 ee6fd02 Thanks @​marandaneto! - Prevent buffered session replay data from crossing projects that share a persistence name during page navigation.
  (2026-09-14)

v1.431.5

Compare Source

1.431.5

Patch Changes

• #​4940 3e12f1d Thanks @​marandaneto! - Discard pending replay network captures after recording stops or restarts.
  (2026-09-14)

v1.431.4

Compare Source

1.431.4

Patch Changes

• #​4952 4f8076b Thanks @​marandaneto! - Support clickable [label](url) links in Conversations widget greetings.
  (2026-09-14)

• #​4835 03e45b6 Thanks @​posthog! - Fix identical person property retries being dropped after the original capture was rejected.
  (2026-09-14)

v1.431.3

Compare Source

1.431.3

Patch Changes

• #​4948 3acf287 Thanks @​marandaneto! - Fix replay cleanup when the host's children are removed before destroying the player.
  (2026-09-14)

v1.431.2

Compare Source

1.431.2

Patch Changes

• #​4938 fea443a Thanks @​marandaneto! - Mark console-captured exceptions as handled and identify their console origin.
  (2026-09-14)

v1.431.1

Compare Source

1.431.1

Patch Changes

• #​4934 b15ae1f Thanks @​marandaneto! - Exclude internal SDK console diagnostics from exception autocapture and report recoverable recorder diagnostics as warnings.
  (2026-09-14)

v1.431.0

Compare Source

1.431.0

Minor Changes

• #​4918 c666606 Thanks @​pauldambra! - Add metrics.network config to record HTTP and HTTPS fetch and XMLHttpRequest durations as histograms, with an optional custom metric name and attributes.
  (2026-09-14)

Patch Changes

• #​4894 d81541b Thanks @​posthog! - Contain replay errors during playback and seeking so a failed event does not stall the remaining events.
  (2026-09-14)
• Updated dependencies [c666606]:
  • @​posthog/types@1.412.0

v1.430.4

Compare Source

1.430.4

Patch Changes

• #​4946 aeaea15 Thanks @​marandaneto! - Fix console capture continuing after stop or duplicating after restart when another library wraps the console.
  (2026-09-14)

v1.430.3

Compare Source

1.430.3

Patch Changes

• #​4923 2ae0f26 Thanks @​marandaneto! - Fix session recording failing to restart after capturing events while stopped with expired config.
  (2026-09-12)

v1.430.2

Compare Source

1.430.2

Patch Changes

• #​4897 a140fa7 Thanks @​fasyy612! - Send each replay session's snapshots in their own request so a session rotation no longer files the new session's first snapshot under the old session.
  (2026-09-11)

v1.430.1

Compare Source

1.430.1

Patch Changes

• #​4913 0224a83 Thanks @​github-actions! - Fix scroll depth metrics carrying over between pages after client-side navigation.
  (2026-09-11)

v1.430.0

Compare Source

1.430.0

Minor Changes

• #​4834 5f2b0fe Thanks @​posthog! - Add posthog-js/full, posthog-js/no-external and posthog-js/full/no-external entry points, so desktop apps and other CSP-restricted builds can require a bundle instead of deep-importing an ES module from dist/
  (2026-09-11)

Patch Changes

• #​4860 8207df8 Thanks @​posthog! - Back off automatic feature flag refreshes on idle visible pages only when remote_config_refresh_interval_ms is omitted, preserving explicitly configured intervals.
  (2026-09-11)

• #​4901 65aafcc Thanks @​marandaneto! - Preserve batched event timestamps so delayed retries do not shift event times and prevent deduplication.
  (2026-09-11)

• Updated dependencies [8207df8]:

  • @​posthog/types@1.411.1

v1.429.5

Compare Source

1.429.5

Patch Changes

• #​4579 19e78cc Thanks @​turnipdabeets! - Cap the retry delay for log exports at 30 seconds, the ceiling the logs contract states. It previously doubled to 64 times the flush interval — 192s on web, 640s on React Native — so a log export now resumes within 30 seconds of a failing endpoint recovering, at the cost of more retry requests while that endpoint is down.
  (2026-09-10)

• #​4579 19e78cc Thanks @​turnipdabeets! - Keep backing off a failing log flush while new records arrive, instead of the next record resetting the retry to the flush interval.
  (2026-09-10)

• #​4579 19e78cc Thanks @​turnipdabeets! - Logs and metrics now always send service.name and telemetry.sdk.*, even when a resourceAttributes value is too large to encode in full. Previously that value could crowd them out, and the records reached PostHog with no service attribution.
  (2026-09-10)

• Updated dependencies [19e78cc, 19e78cc, 19e78cc, 19e78cc, 19e78cc, 19e78cc, 19e78cc]:

  • @​posthog/core@1.53.0
  • @​posthog/types@1.411.0

v1.429.4

Compare Source

1.429.4

Patch Changes

• #​4862 3278cd0 Thanks @​pauldambra! - Call the original console method with the console as its receiver when recording console logs. The wrapper passed undefined instead, and passed no receiver at all when reporting its own failures, which a console implementation is free to reject.
  (2026-09-10)

• #​4887 0da006c Thanks @​posthog! - Error tracking no longer counts an injected script as your own code. A stack frame is in_app only when its filename names a script your app was served — http(s), file, blob, app, capacitor, ionic, a bundler scheme, or a bare path. A frame served over any other scheme, such as an in-app browser bridge on iabjs:// or an extension content script on chrome-extension://, is kept for context but no longer groups the issue under your code.
  (2026-09-10)

• #​4837 99b4fc7 Thanks @​pauldambra! - Stop recording autoplay attribute mutations on <video> and <audio> during session replay. The check compared a lowercase tag name against Element.tagName, which is uppercase for HTML elements, so a looping background video emitted a mutation for every autoplay toggle.
  (2026-09-10)

• Updated dependencies [0da006c]:

  • @​posthog/core@1.52.2

v1.429.3

Compare Source

1.429.3

Patch Changes

• #​4878 14ba783 Thanks @​dustinbyrne! - Allow null bootstrap values and treat null or empty distinct IDs as missing.
  (2026-09-10)

• #​4831 9498567 Thanks @​posthog! - Log a console message when advanced_disable_feature_flags stops surveys from displaying
  (2026-09-10)

• Updated dependencies [14ba783, 9498567]:

  • @​posthog/types@1.410.1

v1.429.2

Compare Source

1.429.2

Patch Changes

• #​4880 412c97c Thanks @​marandaneto! - Fix recording package exports, native ESM loading, and strict TypeScript 4.7 consumer compatibility.
  (2026-09-10)
• Updated dependencies [412c97c]:
  • @​posthog/core@1.52.1

v1.429.1

Compare Source

1.429.1

Patch Changes

• #​4861 61b92f9 Thanks @​pauldambra! - Disable browser autofill on input and textarea fields during session replay.
  (2026-09-09)

v1.429.0

Compare Source

1.429.0

Minor Changes

• #​4707 b441eb2 Thanks @​posthog! - Segment integration: allow segment to accept an integration config with filterProperties, so customers can filter PostHog-generated enrichment properties before Segment sends an event to its destinations. Returning null or throwing leaves the original Segment event unenriched.
  (2026-09-09)

Patch Changes

• #​4876 0c2a15f Thanks @​dustinbyrne! - Fix dead-click detection for text selection and editable caret gestures when mouse release is delayed, while continuing to report inert text clicks.
  (2026-09-09)

• #​4733 24fa541 Thanks @​dustinbyrne! - fix(web): avoid reporting clicks that select or unselect text as dead clicks
  (2026-09-09)

• #​4882 4bd37b7 Thanks @​lucasheriques! - Fix TypeScript compatibility between public replay events and the replay player.
  (2026-09-09)

• #​4833 f1395b6 Thanks @​posthog! - Keep surveys hidden while capture is disabled and preserve answers if capture stops before submission.
  (2026-09-09)

• Updated dependencies [0c2a15f, 24fa541, b441eb2]:

  • @​posthog/types@1.410.0

v1.428.11

Compare Source

1.428.11

Patch Changes

• #​4725 d5abece Thanks @​bs1180! - fix(surveys): don't show the default "Start typing..." placeholder when the survey's placeholder text is empty
  (2026-09-09)

v1.428.10

Compare Source

1.428.10

Patch Changes

• #​4869 891eefa Thanks @​robbie-c! - Apply replay URL privacy settings to URL values in captured JSON-LD payloads.
  (2026-09-09)
• Updated dependencies [891eefa, 891eefa]:
  • @​posthog/types@1.409.4
  • @​posthog/core@1.52.0

v1.428.9

Compare Source

1.428.9

Patch Changes

• #​4864 e8b2be1 Thanks @​robbie-c! - Include the masked page URL with JSON-LD replay events.
  (2026-09-09)
• Updated dependencies [e8b2be1]:
  • @​posthog/types@1.409.3

v1.428.8

Compare Source

v1.428.7

Compare Source

1.428.7

Patch Changes

• #​4842 f93160d Thanks @​marandaneto! - Restore retry queue connectivity tracking when a page returns from the back-forward cache, without reactivating it after an explicit shutdown().
  (2026-09-08)

v1.428.6

Compare Source

1.428.6

Patch Changes

• #​4791 b2affdc Thanks @​posthog! - Prefer sendBeacon for unbatched events, such as { send_instantly: true } captures, once PostHog's own pagehide handler (or unload fallback) marks the page as unloading. Captures from beforeunload or earlier pagehide listeners retain their normal transport. Preserve response-capable transports on active pages so failed requests can be retried, including when fetch is unavailable.
  (2026-09-08)
• Updated dependencies [b2affdc]:
  • @​posthog/types@1.409.2

v1.428.5

Compare Source

v1.428.4

Compare Source

1.428.4

Patch Changes

• #​4828 4ae6405 Thanks @​marandaneto! - Prevent waking an idle tab from extending the previous session recording across the entire idle gap.
  (2026-09-08)

v1.428.3

Compare Source

1.428.3

Patch Changes

• #​4805 4cd5717 Thanks @​marandaneto! - Wait for the initial remote config outcome before using cached autocapture enablement, so a newly disabled project does not capture events while its settings load. Disabled remote requests retain local startup behavior, and failed or incomplete responses retain the cached fallback.
  (2026-09-07)

v1.428.2

Compare Source

1.428.2

Patch Changes

• #​4803 87b34af Thanks @​marandaneto! - Preserve Error details, causes, aggregate errors, and custom enumerable properties in event properties, including cross-realm Errors. Apply string truncation to ordinary capture properties and retain custom toJSON serialization for exception additional properties.
  (2026-09-07)
• Updated dependencies [87b34af]:
  • @​posthog/browser-common@0.8.2

v1.428.1

Compare Source

1.428.1

Patch Changes

• #​4804 988f03a Thanks @​marandaneto! - Recover autocapture targets for dropdown clicks retargeted to the page root, and attribute nested SVG icon clicks to their enclosing button or link while preserving privacy checks.
  (2026-09-07)
• Updated dependencies [988f03a]:
  • @​posthog/browser-common@0.8.1

v1.428.0

Compare Source

1.428.0

Minor Changes

• #​4809 3a5b322 Thanks @​marandaneto! - Add best-effort in-app browser attribution using $webview_app and $webview_app_version, without changing existing $browser or $browser_version values. Detect explicit user-agent markers for Facebook, Facebook Lite, Messenger, Instagram, Threads, LinkedIn, Twitter, TikTok, WhatsApp, Snapchat, WeChat, LINE, Google, Bing, Pinterest, Naver, and KakaoTalk. Unknown apps and versions are omitted; missing markers do not imply a standalone browser.
  (2026-09-07)

Patch Changes

• Updated dependencies [3a5b322]:
  • @​posthog/core@1.51.0
  • @​posthog/browser-common@0.8.0

v1.427.3

Compare Source

1.427.3

Patch Changes

• #​4815 c207020 Thanks @​marandaneto! - Prevent queued session recording mutations from capturing content beneath DOM or shadow ancestors that have become blocked.
  (2026-09-07)

• #​4785 74ca945 Thanks @​marandaneto! - Clarify feature flag return-value terminology across SDK APIs. A false value is a conclusive off evaluation, while undefined means no evaluation is available. Remote evaluation omits globally inactive flags, whereas backend local evaluation can resolve cached inactive definitions to false.
  (2026-09-07)

• #​4797 fd4ece8 Thanks @​posthog! - Prevent exception autocapture from throwing when the handler it wraps belongs to another compartment or a destroyed document.
  (2026-09-07)

• #​4754 d73455e Thanks @​posthog! - Session replay now reports why a recording holds its buffer. An epoch that starts without user interaction keeps its snapshots and uploads nothing, while $recording_status still reads active. Captured events now carry $sdk_debug_replay_flush_hold_reason (no_interaction_since_recording_started or no_interaction_since_session_rotated), and the SDK logs the reason once per held epoch in debug mode. Discarding a recording (for example when the server turns replay off) also no longer uploads the stylesheet mutations the recorder emits as it stops.
  (2026-09-07)

• #​4788 95b159a Thanks @​fasyy612! - fix(replay): reset the idle clock on a session-id rotation so the new session's first snapshot is not dropped as idle and its recording does not start hours early
  (2026-09-07)

• #​4770 24f1937 Thanks @​fasyy612! - fix(replay): drain the compression queue synchronously on a session-id rotation so the old session's unflushed tail ships under the old session id instead of being discarded
  (2026-09-07)

• #​4666 5e74132 Thanks @​robbie-c! - Preserve universally safe JSON-LD properties and allowlisted tree structure when replay redacts other fields. Keep only DOM-backed ID fragments. Keep only @type values shaped like a Schema.org term, and limit types and payloads. Publish a reusable sanitization contract fixture.
  (2026-09-07)

• #​4814 21dcebd Thanks @​posthog! - Prevent invalid clock values from breaking UUID generation and continue capturing replay chunks after a chunk fails.
  (2026-09-07)

• Updated dependencies [74ca945, 5e74132, 21dcebd]:

  • @​posthog/core@1.50.6
  • @​posthog/types@1.409.1
  • @​posthog/browser-common@0.7.3

v1.427.2

Compare Source

1.427.2

Patch Changes

• #​4787 fd87caf Thanks @​marandaneto! - Prevent failures in automatic and manual exception processing from escaping into customer code.
  (2026-09-04)

v1.427.1

Compare Source

1.427.1

Patch Changes

• #​4786 a04c333 Thanks @​marandaneto! - Prevent automatic and manual exception capture from recursively recapturing stack overflows raised while sending an exception.
  (2026-09-04)

v1.427.0

Compare Source

1.427.0

Minor Changes

• #​4774 426e1fd Thanks @​Fhatu12! - Add reuseAnonymousId support to browser identify calls.
  (2026-09-04)

Patch Changes

• #​4782 b64b113 Thanks @​posthog! - Stop counting stack frames that have no filename (in-app browser bridge scripts and other code the runtime reports without a script URL) as in-app code.
  (2026-09-04)

• #​4758 dd74222 Thanks @​marandaneto! - Keep relaying session recording events when a cross-origin iframe redirects through the parent page's origin.
  (2026-09-04)

• Updated dependencies [b64b113, 426e1fd]:

  • @​posthog/core@1.50.5
  • @​posthog/types@1.409.0

v1.426.4

Compare Source

1.426.4

Patch Changes

• #​4764 fa2924d Thanks @​marandaneto! - Preserve previously persisted feature flags as an offline fallback when bootstrap flags are provided.
  (2026-09-04)

v1.426.3

Compare Source

1.426.3

Patch Changes

• #​4761 ebf7318 Thanks @​marandaneto! - Prevent session replay network capture from replacing a downstream fetch wrapper's response with an instrumentation error when the response has no headers.
  (2026-09-04)

v1.426.2

Compare Source

1.426.2

Patch Changes

• #​4763 7b30da7 Thanks @​marandaneto! - Ship the package ESM entrypoint with an .mjs extension so Node recognizes its module format, while retaining the existing .js bundle for backwards compatibility.
  (2026-09-03)

• #​4759 c475070 Thanks @​marandaneto! - Preserve explicitly false feature flag values supplied through bootstrap configuration.
  (2026-09-03)

• #​4767 9d683ca Thanks @​marandaneto! - Preserve the anonymous distinct ID used for feature flag persistence when identify() queues a reload behind an in-flight flags request.
  (2026-09-03)

• #​4766 ed4ba23 Thanks @​marandaneto! - Limit persisted initial URLs by their encoded cookie size to prevent long URLs and referrers from exceeding browser cookie limits.
  (2026-09-03)

• #​4762 fbf10d4 Thanks @​marandaneto! - Merge event-specific $groups with groups registered on the browser client.
  (2026-09-03)

• #​4732 f00e24d Thanks @​posthog! - Polyfill Array.prototype.findLast in the web vitals attribution bundles so they keep capturing on browsers older than Chrome 97 and Safari 15.4
  (2026-09-03)

• Updated dependencies [c475070, f00e24d]:

  • @​posthog/core@1.50.4
  • @​posthog/browser-common@0.7.2

v1.426.1

[Compare Source](

❗ Important

✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	posthog-js@​1.392.0 ⏵ 1.434.0			+3

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Potential security risk (AI signal): npm posthog-js is 72.0% likely risky Notes: No overt signs of traditional malware (no reverse shells, cryptomining, or direct data exfiltration) are visible in this fragment. However, it implements a powerful “remote UI modification” mechanism: it applies server-supplied transforms that can include arbitrary HTML inserted via innerHTML and arbitrary selectors/styles applied to the DOM. If the upstream experiment payloads (or preview-triggered selection) are compromised or insufficiently sanitized server-side, this can enable DOM-based XSS and page takeover. Additionally, the API token is transmitted in a URL query string, increasing the chance of token leakage via logs/history/referrers. Confidence: 0.72 Severity: 0.80 From: package.json → npm/posthog-js@1.434.0 ℹ Read more on: This package | This alert | What are AI-detected potential security risks? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/posthog-js@1.434.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report