posthog-js
1.438.13 · 20 Oct 2026(Apache-2.0 AND MIT)10.1M / weekRepositoryHomepagenpmAtom feed
1421 stable releases, newest first, by release line. Notes are quoted as the maintainers published them.
1.438.13
20 Oct 2026Flush buffered web vitals immediately using a beacon when the page is hidden or unloaded.
(2026-10-20)
1.438.12
15 Oct 2026Prevent backward device clock changes from subtracting client rate-limit tokens.
(2026-10-15)
1.438.11
15 Oct 2026Capture WebMCP failures in Error Tracking when exception autocapture is enabled. With
posthog-js/slim, addErrorTrackingExtensionsnext toWebMCPExtensionsto get these events.
(2026-10-15)
1.438.10
14 Oct 2026Capture the Freebuff click identifier (
bfcid) as a campaign parameter, so it is set on events and as$initial_bfcidlike every other ad click ID.
(2026-10-14)
Patch Changes
Capture the Freebuff click identifier (
bfcid) as a campaign parameter, so it is set on events and as$initial_bfcidlike every other ad click ID.
(2026-10-14)
1.438.9
12 Oct 2026Fix
before_sendcallback types to accept non-null events while still allowingnullreturns to drop events.
(2026-10-12)
Patch Changes
Fix
before_sendcallback types to accept non-null events while still allowingnullreturns to drop events.
(2026-10-12)
1.438.8
12 Oct 2026Capture WebMCP error types and sanitized messages.
(2026-10-12)
1.438.7
9 Oct 2026Share browser logging across SDKs with consistent initialization and cleanup;
captureLogandloggercalls before logging setup are now dropped instead of buffered.
(2026-10-09)
Patch Changes
Share browser logging across SDKs with consistent initialization and cleanup;
captureLogandloggercalls before logging setup are now dropped instead of buffered.
(2026-10-09)
1.438.6
9 Oct 2026Skip WebMCP intent and model injection for schemas with constraints that the extra fields could break.
(2026-10-09)Export
WebMCPExtensionsfrom the slimextension-bundlesentry point.
(2026-10-09)
1.438.5
9 Oct 2026Recognize native bundler debug IDs and build-time error tracking release IDs.
(2026-10-09)
Patch Changes
Recognize native bundler debug IDs and build-time error tracking release IDs.
(2026-10-09)
1.438.4
9 Oct 2026Fix type checking in posthog-js 1.438.2 by publishing the feature flag types it imports from @posthog/browser-common.
(2026-10-09)
Patch Changes
Fix type checking in posthog-js 1.438.2 by publishing the feature flag types it imports from @posthog/browser-common.
(2026-10-09)
1.438.3
8 Oct 2026replay: add a private opt-in to preserve application stacks for failed fetch requests
(2026-10-08)
Patch Changes
replay: add a private opt-in to preserve application stacks for failed fetch requests
(2026-10-08)
1.438.2
7 Oct 2026Share feature flag functionality across browser SDKs while preserving existing behavior.
(2026-10-07)
Patch Changes
Share feature flag functionality across browser SDKs while preserving existing behavior.
(2026-10-07)
1.438.1
6 Oct 2026Stop carousel and pager arrow controls from capturing false
$rageclickevents. The rageclick content ignorelist, active from the2025-11-30config defaults, now also covers arrow glyphs (→,←,›,‹,»,«,▶,◀,❯,❮). The built-in word keywords match whole words wherever they appear, including inside a list you pass yourself, so "Preview" keeps capturing; other word keywords you add still match as substrings. Keywords now match against the clicked control (the nearest button, link, ARIA control orcursor: pointerwrapper), reading its label from the control's whole subtree instead of every ancestor up to the body, so a region labelled "Featured carousel" no longer suppresses the buttons inside it. A control's own text oraria-labelwins over an icon'saria-labelinside it, so clicking the icon and clicking the text agree. Setrageclick: { content_ignorelist: false }to keep capturing these events.
(2026-10-06)
Patch Changes
Stop carousel and pager arrow controls from capturing false
$rageclickevents. The rageclick content ignorelist, active from the2025-11-30config defaults, now also covers arrow glyphs (→,←,›,‹,»,«,▶,◀,❯,❮). The built-in word keywords match whole words wherever they appear, including inside a list you pass yourself, so "Preview" keeps capturing; other word keywords you add still match as substrings. Keywords now match against the clicked control (the nearest button, link, ARIA control orcursor: pointerwrapper), reading its label from the control's whole subtree instead of every ancestor up to the body, so a region labelled "Featured carousel" no longer suppresses the buttons inside it. A control's own text oraria-labelwins over an icon'saria-labelinside it, so clicking the icon and clicking the text agree. Setrageclick: { content_ignorelist: false }to keep capturing these events.
(2026-10-06)
1.438.0
6 Oct 2026Capture WebMCP tool intent and model metadata by default.
(2026-10-06)
Minor Changes
Capture WebMCP tool intent and model metadata by default.
(2026-10-06)
1.437.0
6 Oct 2026Add opt-in WebMCP tool call capture for MCP Analytics.
(2026-10-06)
Minor Changes
Add opt-in WebMCP tool call capture for MCP Analytics.
(2026-10-06)
1.436.1
5 Oct 2026Restore batching for events carrying pending Meta
$fbcor$fbpidentifiers to reduce races with precedingidentify()calls.
(2026-10-05)
1.436.0
5 Oct 2026Opt-in WebView bot heuristic for #2921.
Minor Changes
Opt-in WebView bot heuristic for #2921.
posthog-js/customizationsexports a newisLikelyWebViewBot(ua)helper that flags the UA pattern described in #2921 (aChrome/...token without the usualAppleWebKit/*+Safari/*co-markers that real Chrome always sends). Wire it intobefore_sendto tag or drop the matching events — seeisLikelyWebViewBotJSDoc for a usage example. Default SDK behaviour is unchanged; the helper is tree-shaken out unless you import it.@posthog/corekeepsisBlockedUAandDEFAULT_BLOCKED_UA_STRSbyte-for-byte compatible, and gains session-level memoisation ofisBlockedUAresults keyed on(ua, customBlockedUserAgents), so repeat calls within the same session are O(1). (2026-10-05)
1.435.9
5 Oct 2026Stop a SecurityError escaping the recorder when an iframe becomes cross-origin while shadow DOM observation starts.
(2026-10-05)
1.435.8
2 Oct 2026Use the new PostHog logo in the survey footer branding
(2026-10-02)
1.435.7
2 Oct 2026Preserve shared identity while consent is pending and clear it after shared rejection in cookieless mode.
(2026-10-02)
1.435.6
1 Oct 2026Capture the OpenAI Ads click identifier (
oppref) as a campaign parameter, so it is set on events and as$initial_oppreflike every other ad click ID.
(2026-10-01)Fix cross-subdomain identity continuity when opting in after cookie consent.
(2026-10-01)
Patch Changes
Capture the OpenAI Ads click identifier (
oppref) as a campaign parameter, so it is set on events and as$initial_oppreflike every other ad click ID.
(2026-10-01)Fix cross-subdomain identity continuity when opting in after cookie consent.
(2026-10-01)
1.435.5
30 Sep 2026Preserve session attribution and registered properties across initialization and configuration updates when persistence writes are debounced.
(2026-09-30)
1.435.4
30 Sep 2026Fix a
DataCloneErrorwhen session replay records network timing inside a cross-origin iframe.
(2026-09-30)
1.435.3
30 Sep 2026Start session recording at
DOMContentLoaded, so a page whoseloadevent is late or never fires still records, and report$sdk_debug_rrweb_attachedfrom rrweb's own recording state
(2026-09-30)
1.435.2
30 Sep 2026Reduce replay debug properties on captured events while preserving recording status and capture diagnostics. Report cumulative mutation-drop counts and dropped bytes on
$snapshotevents only when greater than zero.
(2026-09-30)
1.435.1
29 Sep 2026PostHogFeature without
matchshows the fallback when the flag evaluates to false.
(2026-09-29)
1.435.0
29 Sep 2026Add
onActiveMatchingSurveysChangedto subscribe to survey eligibility updates with safe unsubscribe and recoverable load-error reporting.
(2026-09-29)
Minor Changes
Add
onActiveMatchingSurveysChangedto subscribe to survey eligibility updates with safe unsubscribe and recoverable load-error reporting.
(2026-09-29)
1.434.18
29 Sep 2026Prevent analytics persistence writes during initialization when persistence is disabled or opted out.
(2026-09-29)Isolate replay network masking callback errors so unrelated network records continue to be captured.
(2026-09-29)Preserve equals signs in survey URL prefill values and ignore malformed URL parameters without blocking surveys.
(2026-09-29)
1.434.17
28 Sep 2026replay: keep a held recording epoch's buffered data when it hits the size cap
(2026-09-28)replay: keep CSS-in-JS styles after a large DOM change in the page head
(2026-09-28)
1.434.16
28 Sep 2026- deprecated
Honor the modern replay network masking callback when both modern and deprecated hooks are configured.
(2026-09-28)
1.434.15
26 Sep 2026Fix SPA
$pageviewevents frompushState/replaceStatenavigations carrying the previous page'stitle
(2026-09-26)
1.434.14
25 Sep 2026Fix
useThumbSurveyfrom@posthog/react/surveysandposthog-js/react/surveysignoring the client passed toPostHogProvider, which left it capturing no survey events.
(2026-09-25)
1.434.13
24 Sep 2026Replay loads a recorded font under the replay iframe's content security policy, not the embedding page's.
(2026-09-24)
1.434.12
23 Sep 2026The replayer no longer freezes the tab on a mutation that adds tens of thousands of nodes at once. It now applies a batch of 1,000 or more adds against a detached subtree, so the document updates style and layout once instead of per insert. A recorded batch of 25,746 style elements went from 92 seconds of blocked main thread to 1.5 seconds.
(2026-09-23)
1.434.11
23 Sep 2026Avoid cross-domain cookie probes when cross-subdomain cookies are disabled.
(2026-09-23)
1.434.10
23 Sep 2026Fix SDK initialization when a script loader pre-creates window.posthog as a placeholder object.
(2026-09-23)
1.434.9
22 Sep 2026Session replay no longer defers its input setter hooks on zone.js's patched
setTimeout. In Angular apps each of those timers ended a zone task and triggered another change detection, so any component writing an input property on every cycle drove the tab into an endless loop at 100% CPU.
(2026-09-22)
1.434.8
22 Sep 2026dead-clicks: survive a denied property access in Firefox
Firefox denies property access on a DOM node from another origin or from a realm that was torn down. The detector reads
isConnectedandnodeTypeon mutation records and on composed paths, and readsgetRootNodeon selection endpoints, so the denial escaped the MutationObserver callback and stopped the rest of the batch from refreshing the liveness timestamp. A node that cannot be read is now treated as a node that cannot be inspected. (2026-09-22)
1.434.7
22 Sep 2026Session replay network capture no longer fails to start in frames without
PerformanceObserveror itssupportedEntryTypes; those frames record without live network timing.
(2026-09-22)
1.434.6
22 Sep 2026Keep session recording active when a cross-origin image or video taints a canvas.
(2026-09-22)
1.434.5
21 Sep 2026Stop reporting dead clicks on controls inside open shadow roots (such as web components or micro-frontends) when the click updates content inside the shadow root.
(2026-09-21)
1.434.4
21 Sep 2026Fix
$session_idbeing sent asnullwhen a sibling tab resets the session before this tab captures its first event
(2026-09-21)
1.434.3
21 Sep 2026Retry
/flagsin the browser SDK on HTTP 502/504 and on request timeouts, bounded by the newfeature_flag_request_max_retriesconfig (default 1, set 0 to disable). Plain transport failures are deliberately left to the existing status-zero circuit breaker.
(2026-09-21)
Patch Changes
Retry
/flagsin the browser SDK on HTTP 502/504 and on request timeouts, bounded by the newfeature_flag_request_max_retriesconfig (default 1, set 0 to disable). Plain transport failures are deliberately left to the existing status-zero circuit breaker.
(2026-09-21)
1.434.2
18 Sep 2026Share survey answer snapshots and response event properties with React Native for consistent partial response reporting.
(2026-09-18)
Patch Changes
Share survey answer snapshots and response event properties with React Native for consistent partial response reporting.
(2026-09-18)
1.434.1
18 Sep 2026Capture the document navigation timing in the replay network waterfall when recording starts after the page has loaded, and stop recording a partial duplicate of that entry when recording starts while the page is still loading
(2026-09-18)
1.434.0
17 Sep 2026Rename the
metrics.networkdefault attributes to the OTel HTTP client semantic conventions:http.request.method,server.address,server.port,url.scheme,url.template,http.response.status_codeanderror.typereplacemethod,host,pathandstatus_class.
(2026-09-17)
Minor Changes
Rename the
metrics.networkdefault attributes to the OTel HTTP client semantic conventions:http.request.method,server.address,server.port,url.scheme,url.template,http.response.status_codeanderror.typereplacemethod,host,pathandstatus_class.
(2026-09-17)
1.433.10
17 Sep 2026Log a console warning when session replay stops capturing canvas frames (browser without
OffscreenCanvas, a CSP that blocksblob:workers, or a failingcanvasCapture.maskRegionsFn), and stop changing WebGL and WebGPU canvas settings when canvas capture fails to start
(2026-09-17)Share survey choice and question shuffling between web and React Native through surveys core. Use Fisher-Yates for web questions, preserve Other-last choice ordering, and avoid mutating configured choices.
(2026-09-17)
Patch Changes
Log a console warning when session replay stops capturing canvas frames (browser without
OffscreenCanvas, a CSP that blocksblob:workers, or a failingcanvasCapture.maskRegionsFn), and stop changing WebGL and WebGPU canvas settings when canvas capture fails to start
(2026-09-17)Share survey choice and question shuffling between web and React Native through surveys core. Use Fisher-Yates for web questions, preserve Other-last choice ordering, and avoid mutating configured choices.
(2026-09-17)
1.433.9
17 Sep 2026Add a session diagnostic when stale replay configuration cannot be refreshed, without changing recording behavior.
(2026-09-17)
1.433.8
17 Sep 2026Prefer synchronous compression for events captured with
send_instantly, including the initial$pageview, to avoid delaying request dispatch on asynchronous compression.
(2026-09-17)
1.433.7
16 Sep 2026surveys: keep URL prefill working when localStorage is unavailable, such as on a page with an opaque origin or in private browsing
(2026-09-16)
Patch Changes
surveys: keep URL prefill working when localStorage is unavailable, such as on a page with an opaque origin or in private browsing
(2026-09-16)