@posthog/core

Local flag evaluation now matches a null property with string operators like the flags service, so negated operators such as not_icontains match instead of failing.
(2026-10-21)

Capture the Freebuff click identifier (bfcid) as a campaign parameter, so it is set on events and as $initial_bfcid like every other ad click ID.
(2026-10-14)

Attach trace exemplars to metrics recorded inside sampled spans.
(2026-10-13)

Fix before_send callback types to accept non-null events while still allowing null returns to drop events.
(2026-10-12)

Change properties passed to capture() and the other event methods to override SDK context properties such as $app_version, $os_name and $lib, matching posthog-js and posthog-android
(2026-10-10)

Recognize native bundler debug IDs and build-time error tracking release IDs.
(2026-10-09)

Stop keeping $react_native_version on minimal $feature_flag_called events
(2026-10-08)

Sanitize each tool response once instead of twice, and replace image, audio and binary blocks before the scan, so tool calls with large results cost less CPU. Redact PostHog tokens that URL field decoding exposes.
(2026-10-07)

Fix Unable to resolve module @posthog/core/surveys when bundling posthog-react-native on React Native 0.71–0.78 without Metro package exports. posthog-react-native 4.47.0 and later also pick up the fix by updating @posthog/core.
(2026-10-07)

Capture WebMCP tool intent and model metadata by default.
(2026-10-06)

Keep $react_native_version on minimal $feature_flag_called events
(2026-10-05)

Opt-in WebView bot heuristic for #2921.

Capture the OpenAI Ads click identifier (oppref) as a campaign parameter, so it is set on events and as $initial_oppref like every other ad click ID.
(2026-10-01)

Honor filters.holdout during local feature flag evaluation. A user in an experiment holdout now receives the holdout-<id> variant instead of being bucketed into a regular variant, matching how the server evaluates the same flag. The holdout is resolved before the release conditions, so a held-out user never reaches the flag's targeting — including when those conditions would have excluded them, so isFeatureEnabled can return true where it previously returned false. Experiments with an active holdout will see variant assignment change for the held-out share of traffic on upgrade, bringing locally evaluated assignments in line with server-evaluated ones.
(2026-09-23)

Stop dropping long spans that end: maxSpanAgeMs now evicts spans only once maxLiveSpans is reached, so a span that runs past the age limit and then ends is exported, and its children are no longer orphaned.
(2026-09-21)

Respect the definitions response's property_matching_version during local feature flag evaluation. Version 2 uses explicit boolean/string equality and per-member array matching, while missing or other versions retain service legacy matching (including empty-array truthiness). Preserve the version in Node definition caches and Convex persisted definitions, and propagate it through person, group, cohort and dependency evaluation without mixing snapshots during reloads. Existing numeric ambiguity fallback and SemVer parsing policies are unchanged.
(2026-09-21)

Support partial survey responses and persistent resume in React Native, moving surveys toward feature parity across SDKs.
(2026-09-18)

Coerce survey and product tour property filter values to strings before matching, so a numeric filter value from the /surveys response no longer throws in icontains/not_icontains
(2026-09-18)

Share survey choice and question shuffling between web and React Native through surveys core. Use Fisher-Yates for web questions, preserve Other-last choice ordering, and avoid mutating configured choices.
(2026-09-17)

Fix declaration source mappings for DOMExceptionCoercer.
(2026-09-17)

Server-side feature flags now resolve in posthog-node and posthog-edge even when a proxy rewrites the request's User-Agent. Flags restricted to the client runtime now resolve to undefined in these SDKs, where a rewritten User-Agent previously let them through.
(2026-09-15)

Capture causes and AggregateError members with relationship metadata and individual stacks, limiting output to 50 entries and 1,000 member inspections.
(2026-09-15)

Export the shared Retry-After parser with safe integer caps, GMT HTTP-date handling and rejection of non-HTTP dates.
(2026-09-14)

Require final 2xx responses for successful writes while preserving immediate-call error handling.
(2026-09-14)

Share the trySafe utility through @posthog/core.
(2026-09-11)

Child spans now share their parent's clock, so a child no longer appears to start before or end after its parent by up to a millisecond, or by more when the system clock is adjusted mid-trace.
(2026-09-11)

Add experimental distributed tracing to posthog-node: startSpan, withSpan and getActiveSpan record spans against a new traces client option. A service with tracing off still forwards an inbound traceparent, including from spans nested inside the one that received it, so a distributed trace is not severed. A traceparent may be passed as the one-element array req.headersDistinct gives. A beforeSpanSend hook sees every span before it is exported and may edit or drop it, and maxAttributesPerSpan, maxEventsPerSpan, maxAttributeValueLength, maxLiveSpans and maxSpanAgeMs bound what a single span and a single process may hold.
(2026-09-10)

Cap the retry delay for log exports at 30 seconds, the ceiling the logs contract states. It previously doubled to 64 times the flush interval — 192s on web, 640s on React Native — so a log export now resumes within 30 seconds of a failing endpoint recovering, at the cost of more retry requests while that endpoint is down.
(2026-09-10)

Keep backing off a failing log flush while new records arrive, instead of the next record resetting the retry to the flush interval.
(2026-09-10)

Error tracking no longer counts an injected script as your own code. A stack frame is in_app only when its filename names a script your app was served — http(s), file, blob, app, capacitor, ionic, a bundler scheme, or a bare path. A frame served over any other scheme, such as an in-app browser bridge on iabjs:// or an extension content script on chrome-extension://, is kept for context but no longer groups the issue under your code.
(2026-09-10)

Fix recording package exports, native ESM loading, and strict TypeScript 4.7 consumer compatibility.
(2026-09-10)

Add a shared isUrl helper for HTTP(S) URLs and explicit relative paths.
(2026-09-09)

Include the root license and attribution notices in the published core package.
(2026-09-09)

error-tracking: collapse repeated frame cycles in parsed stack traces to reduce grouping differences caused by recursion depth, while preserving distinct throw locations
(2026-09-09)

Add best-effort in-app browser attribution using $webview_app and $webview_app_version, without changing existing $browser or $browser_version values. Detect explicit user-agent markers for Facebook, Facebook Lite, Messenger, Instagram, Threads, LinkedIn, Twitter, TikTok, WhatsApp, Snapchat, WeChat, LINE, Google, Bing, Pinterest, Naver, and KakaoTalk. Unknown apps and versions are omitted; missing markers do not imply a standalone browser.
(2026-09-07)

Clarify feature flag return-value terminology across SDK APIs. A false value is a conclusive off evaluation, while undefined means no evaluation is available. Remote evaluation omits globally inactive flags, whereas backend local evaluation can resolve cached inactive definitions to false.
(2026-09-07)

Stop counting stack frames that have no filename (in-app browser bridge scripts and other code the runtime reports without a script URL) as in-app code.
(2026-09-04)

Preserve explicitly false feature flag values supplied through bootstrap configuration.
(2026-09-03)

Fix clampToRange discarding a valid fallback value of 0. It used fallbackValue || max, so a 0 fallback (a legitimate value) was treated as absent and replaced by max; it now uses ?? so 0 is honored.
(2026-09-03)

Drop attributes with an empty key from exported logs and metrics instead of sending them. OTLP requires a non-empty key, and the server stored one verbatim, where it appeared as a nameless attribute that filters could not match.
(2026-09-01)

Add os.name and os.version resource attributes to logs from the browser SDK, overridable via logs.resourceAttributes
(2026-09-01)

Detect the Claude, Codex, and ChatGPT apps from their user agent markers: $browser now reports the app name instead of Chrome.

ChatGPT versions its apps differently per platform, so its $browser_version is not comparable across platforms. (2026-09-01)

Match local feature flag string operators, exact-value coercion, and JSON stringification with the flags service.
(2026-09-01)

Change bigint attributes on logs, metrics and spans to send as an int64 rather than as a string.
(2026-09-01)

Re-translate popover surveys when the display language changes while the survey is on screen, either from a browser languagechange event or from identify() updating the language person property. In-progress answers are preserved. $survey_questions.question and $survey_language on survey sent / survey dismissed now report the text and language the user saw when they answered, not the language active when the event fired. Feedback-button (widget) surveys are unchanged.
(2026-08-28)

Narrow the pinterest entry in the bot-detection blocklist to pinterestbot, so real users on Pinterest's in-app browser (whose UA also contains the substring pinterest) are no longer misclassified as bots and silently excluded from analytics. The crawler's other UA variant remains covered by the existing generic bot.htm entry, so no bot-detection coverage is lost.
(2026-08-27)

Add capturedAt to PostHogLogs.captureLog() for stamping a record with the time and context of when the event occurred, and PostHogLogs.clearQueue() for dropping every queued record
(2026-08-27)

Fix request timeouts never firing on pages where a browser extension makes Error.prototype.name non-writable
(2026-08-27)

Stop crashing when the environment's Math.random() misbehaves. The vendored UUIDv7 generator builds its random fields from a Math.random()-based nextUint32(), and a nonconformant implementation that returns a value of 1 or greater, or NaN, pushed those fields out of range, so fromFieldsV7 threw RangeError: invalid field value on every event captured. On React Native this is not hypothetical: Hermes implements Math.random with C++ std::uniform_real_distribution, which is documented to occasionally return its upper bound, and affected Android devices crash-looped on startup during the SDK's internal event-queue flush — a path applications cannot wrap in a try/catch. nextUint32() now clamps its result to a valid unsigned 32-bit integer (>>> 0), so a bad random value degrades UUID entropy for that id instead of taking the app down; the timestamp bits are untouched and generated ids remain spec-valid UUIDv7.
(2026-08-27)

Treat omitted local evaluation properties as inconclusive for is_not_set.
(2026-08-27)

Share feature flag matching, hashing, variant, and payload evaluation helpers across the Node.js and Convex SDKs without changing their runtime-specific SemVer behavior.
(2026-08-25)

Share survey property matching between the browser and React Native SDKs while preserving their existing missing-value behavior.
(2026-08-25)

Fix buffered logs being dropped instead of retried after HTTP 408, 429 or 5xx
(2026-08-24)

The Node SDK now sends the raw gzip bytes as the request body instead of wrapping them in a Blob. On Node 24.16 and later, reading a Blob request body leaks a native BlobReader that is never released, so a service calling capture() and flush() once per request grew by roughly 2.3 KB of heap per event and never gave it back. This completes the work in #4423: switching to node:zlib removed the compression-time Blob reads, but the body itself was still a Blob and still got read once per request. Compression behaviour, headers and the wire format are unchanged, and the edge build keeps using CompressionStream.
(2026-08-24)

Fix reloadFeatureFlags and reloadFeatureFlagsAsync returning flags evaluated before the caller's most recent identity or person-property change when several reloads overlap, and stop overlapping reloads from skipping the remote config refresh
(2026-08-21)

Fix logs and metrics being silently dropped when an attribute holds a very large integer, a function, a symbol, a sparse array, or a truncated emoji.
Cap log and metric attributes at 20 levels of nesting, 1,000 entries per object and 10,000 values in total, marking anything beyond as [Truncated].
Type OtlpAnyValue.intValue as string | number — code reading that field must handle both. (2026-08-21)

Drop events when a before-send hook throws instead of sending the unmodified event.
(2026-08-20)

Stop building a stack frame for a window.onerror report that carries no code position, such as the ResizeObserver loop warning. The frame named the document URL rather than a script, so no source map could resolve it. These exceptions now arrive with no stack trace.
(2026-08-20)

Stop counting Chromium <anonymous> stack frames (extension-injected, devtools or string-evaluated code) as in-app code.
(2026-08-19)