posthog-js

Stop treating a <link rel=preload as=style> resource hint as a stylesheet when recording. Because it carries the URL of the sheet it preloads, the recorder matched it to the loaded stylesheet and inlined the whole sheet onto it, putting the CSS in every full snapshot twice and reporting a failed stylesheet deferral on every snapshot.
(2026-09-16)

Docstrings for identity_hash and setIdentity() now say the hash is signed with the Secret API key from Support settings, not a project secret API key or a personal API key.
(2026-09-15)

Capture causes and AggregateError members with relationship metadata and individual stacks, limiting output to 50 entries and 1,000 member inspections.
(2026-09-15)

Contain a throw from a third-party patched AbortController.abort() when our own fetch timeout fires, so it is retried instead of escaping as an uncaught error, and report a single outcome per request.
(2026-09-15)

Keep the end of a session recording when one replay event is too large to stringify: that event is dropped and the rest of the buffer still ships, instead of the size estimate throwing and stopping the unload flush.
(2026-09-15)

Default Fetch requests to strict-origin so referrers omit page paths and query strings.
(2026-09-14)

Keep session recording snapshots from different windows of the same session in separate uploads to preserve their window attribution.
(2026-09-14)

Respect Retry-After, including repeated headers, up to 30 seconds on retryable browser responses without shortening exponential backoff.
(2026-09-14)

Respect autocapture attribute masks for link URLs and legacy class properties.
(2026-09-14)

Read Meta's _fbc and _fbp cookies for the Conversions API. When the Meta pixel is on the page, its _fbc cookie holds the true ad click time, so that value now wins over the time PostHog stamps on the pageview that follows the click, and a click that landed before the SDK loaded is no longer lost. The _fbp browser ID is captured as the $fbp person property, which makes it available to a conversion sent later from a backend. Both cookies are read under the same switches as the URL click ID: save_campaign_params: false turns the reads off, and cookieless mode skips them.
(2026-09-14)

Add a resetError callback to React error-boundary fallbacks so applications can retry rendering without remounting the boundary.
(2026-09-14)

Fix lost event retries after restoring a page from the back-forward cache.
(2026-09-14)

Fix false dead clicks after synchronous DOM updates. Clicks stopped from bubbling are now evaluated too, which may increase dead-click counts for inert controls.
(2026-09-14)

Avoid fetch keepalive quota failures when multiple event requests are in flight.
(2026-09-14)

Prevent buffered session replay data from crossing projects that share a persistence name during page navigation.
(2026-09-14)

Discard pending replay network captures after recording stops or restarts.
(2026-09-14)

Support clickable [label](url) links in Conversations widget greetings.
(2026-09-14)

Fix identical person property retries being dropped after the original capture was rejected.
(2026-09-14)

Fix replay cleanup when the host's children are removed before destroying the player.
(2026-09-14)

Mark console-captured exceptions as handled and identify their console origin.
(2026-09-14)

Exclude internal SDK console diagnostics from exception autocapture and report recoverable recorder diagnostics as warnings.
(2026-09-14)

Add metrics.network config to record HTTP and HTTPS fetch and XMLHttpRequest durations as histograms, with an optional custom metric name and attributes.
(2026-09-14)

Contain replay errors during playback and seeking so a failed event does not stall the remaining events.
(2026-09-14)

Fix console capture continuing after stop or duplicating after restart when another library wraps the console.
(2026-09-14)

Fix session recording failing to restart after capturing events while stopped with expired config.
(2026-09-12)

Send each replay session's snapshots in their own request so a session rotation no longer files the new session's first snapshot under the old session.
(2026-09-11)

Fix scroll depth metrics carrying over between pages after client-side navigation.
(2026-09-11)

Add posthog-js/full, posthog-js/no-external and posthog-js/full/no-external entry points, so desktop apps and other CSP-restricted builds can require a bundle instead of deep-importing an ES module from dist/
(2026-09-11)

Back off automatic feature flag refreshes on idle visible pages only when remote_config_refresh_interval_ms is omitted, preserving explicitly configured intervals.
(2026-09-11)

Preserve batched event timestamps so delayed retries do not shift event times and prevent deduplication.
(2026-09-11)

Cap the retry delay for log exports at 30 seconds, the ceiling the logs contract states. It previously doubled to 64 times the flush interval — 192s on web, 640s on React Native — so a log export now resumes within 30 seconds of a failing endpoint recovering, at the cost of more retry requests while that endpoint is down.
(2026-09-10)

Keep backing off a failing log flush while new records arrive, instead of the next record resetting the retry to the flush interval.
(2026-09-10)

Logs and metrics now always send service.name and telemetry.sdk.*, even when a resourceAttributes value is too large to encode in full. Previously that value could crowd them out, and the records reached PostHog with no service attribution.
(2026-09-10)

Call the original console method with the console as its receiver when recording console logs. The wrapper passed undefined instead, and passed no receiver at all when reporting its own failures, which a console implementation is free to reject.
(2026-09-10)

Error tracking no longer counts an injected script as your own code. A stack frame is in_app only when its filename names a script your app was served — http(s), file, blob, app, capacitor, ionic, a bundler scheme, or a bare path. A frame served over any other scheme, such as an in-app browser bridge on iabjs:// or an extension content script on chrome-extension://, is kept for context but no longer groups the issue under your code.
(2026-09-10)

Stop recording autoplay attribute mutations on <video> and <audio> during session replay. The check compared a lowercase tag name against Element.tagName, which is uppercase for HTML elements, so a looping background video emitted a mutation for every autoplay toggle.
(2026-09-10)

Allow null bootstrap values and treat null or empty distinct IDs as missing.
(2026-09-10)

Log a console message when advanced_disable_feature_flags stops surveys from displaying
(2026-09-10)

Fix recording package exports, native ESM loading, and strict TypeScript 4.7 consumer compatibility.
(2026-09-10)

Disable browser autofill on input and textarea fields during session replay.
(2026-09-09)

Segment integration: allow segment to accept an integration config with filterProperties, so customers can filter PostHog-generated enrichment properties before Segment sends an event to its destinations. Returning null or throwing leaves the original Segment event unenriched.
(2026-09-09)

Fix dead-click detection for text selection and editable caret gestures when mouse release is delayed, while continuing to report inert text clicks.
(2026-09-09)

web: avoid reporting clicks that select or unselect text as dead clicks
(2026-09-09)

surveys: don't show the default "Start typing..." placeholder when the survey's placeholder text is empty
(2026-09-09)

Apply replay URL privacy settings to URL values in captured JSON-LD payloads.
(2026-09-09)

Include the masked page URL with JSON-LD replay events.
(2026-09-09)

error-tracking: collapse repeated frame cycles in parsed stack traces to reduce grouping differences caused by recursion depth, while preserving distinct throw locations
(2026-09-09)

Restore retry queue connectivity tracking when a page returns from the back-forward cache, without reactivating it after an explicit shutdown().
(2026-09-08)

Prefer sendBeacon for unbatched events, such as { send_instantly: true } captures, once PostHog's own pagehide handler (or unload fallback) marks the page as unloading. Captures from beforeunload or earlier pagehide listeners retain their normal transport. Preserve response-capable transports on active pages so failed requests can be retried, including when fetch is unavailable.
(2026-09-08)

Stop the internal SCRIPT_PLACEHOLDER from rendering during replay. A recorded <script> is rebuilt as <noscript>, whose text shows when scripting is off in the replay iframe. The document-scoped hide style never reaches shadow roots, so the placeholder leaked over third-party widgets recorded in a shadow root. Rebuild now emits an empty text node for the placeholder, so it cannot render in any context.
(2026-09-08)

Reduce session replay DOM traversal overhead by reusing native-accessor cache keys instead of constructing a new string for every node access.
(2026-09-08)

Avoid repeatedly traversing the same subtree during session replay mirror cleanup when it moves multiple times in one mutation batch.
(2026-09-08)

Prevent waking an idle tab from extending the previous session recording across the entire idle gap.
(2026-09-08)

Wait for the initial remote config outcome before using cached autocapture enablement, so a newly disabled project does not capture events while its settings load. Disabled remote requests retain local startup behavior, and failed or incomplete responses retain the cached fallback.
(2026-09-07)

Preserve Error details, causes, aggregate errors, and custom enumerable properties in event properties, including cross-realm Errors. Apply string truncation to ordinary capture properties and retain custom toJSON serialization for exception additional properties.
(2026-09-07)

Recover autocapture targets for dropdown clicks retargeted to the page root, and attribute nested SVG icon clicks to their enclosing button or link while preserving privacy checks.
(2026-09-07)

Add best-effort in-app browser attribution using $webview_app and $webview_app_version, without changing existing $browser or $browser_version values. Detect explicit user-agent markers for Facebook, Facebook Lite, Messenger, Instagram, Threads, LinkedIn, Twitter, TikTok, WhatsApp, Snapchat, WeChat, LINE, Google, Bing, Pinterest, Naver, and KakaoTalk. Unknown apps and versions are omitted; missing markers do not imply a standalone browser.
(2026-09-07)

Prevent queued session recording mutations from capturing content beneath DOM or shadow ancestors that have become blocked.
(2026-09-07)

Clarify feature flag return-value terminology across SDK APIs. A false value is a conclusive off evaluation, while undefined means no evaluation is available. Remote evaluation omits globally inactive flags, whereas backend local evaluation can resolve cached inactive definitions to false.
(2026-09-07)

Prevent exception autocapture from throwing when the handler it wraps belongs to another compartment or a destroyed document.
(2026-09-07)

Prevent failures in automatic and manual exception processing from escaping into customer code.
(2026-09-04)

Prevent automatic and manual exception capture from recursively recapturing stack overflows raised while sending an exception.
(2026-09-04)

Add reuseAnonymousId support to browser identify calls.
(2026-09-04)

Stop counting stack frames that have no filename (in-app browser bridge scripts and other code the runtime reports without a script URL) as in-app code.
(2026-09-04)

Keep relaying session recording events when a cross-origin iframe redirects through the parent page's origin.
(2026-09-04)

Preserve previously persisted feature flags as an offline fallback when bootstrap flags are provided.
(2026-09-04)

Prevent session replay network capture from replacing a downstream fetch wrapper's response with an instrumentation error when the response has no headers.
(2026-09-04)

Ship the package ESM entrypoint with an .mjs extension so Node recognizes its module format, while retaining the existing .js bundle for backwards compatibility.
(2026-09-03)

Preserve explicitly false feature flag values supplied through bootstrap configuration.
(2026-09-03)

Preserve the anonymous distinct ID used for feature flag persistence when identify() queues a reload behind an in-flight flags request.
(2026-09-03)

Initialize the Segment enrichment integration when Segment is configured through set_config, so Segment events include PostHog properties such as active feature flags.
(2026-09-03)

Capture Meta's $fbc person property when a new fbclid is observed.
(2026-09-03)

Require a distinct ID when calling identify and correct its API documentation to match the existing runtime validation.
(2026-09-03)

Gate $groupidentify on person processing. Under identified_only, a group() call promotes the user to identified so the event is kept instead of dropped. Under never, the local group association is retained for subsequent events and feature flags, but $groupidentify is not sent because the server always drops it.
(2026-09-03)

replay: re-adopt constructed stylesheets when a shadow host is removed and re-added mid-replay. An SPA navigation can detach and reattach the same web component element; the browser keeps its shadow root and adopted sheets, so the recorder (which already tracks that shadow root) emits no new AdoptedStyleSheet event. The replayer rebuilds the element with a fresh shadow root and previously dropped the adopted styles for the rest of playback, rendering the component unstyled. The replayer now remembers the last adopted styleIds per host and re-adopts them when the shadow root is rebuilt, in both live playback and fast-forward. Fixes playback of existing recordings.
(2026-09-02)

replay: keep recording through a session-id rotation when the persisted remote config is past its TTL. A rotation restart transits through stop() before start(), which made the config TTL check treat it as a cold boot: the stale config was discarded, start() bailed silently, and the recorder died with session attribution stuck on the old session id. The rotated session then shipped events with no initial full snapshot, producing recordings whose prefix cannot be played until something else restarted recording. Affects any rotation on a session older than one hour, most visibly posthog.reset() on logout. Cold-boot TTL behavior is unchanged.
(2026-09-02)