posthog-js

Forward generic server-signed identity claims with conversations widget requests.
(2026-09-02)

Prevent failed replay network body reads from escaping into the host page's own fetch() call
(2026-09-01)

Add os.name and os.version resource attributes to logs from the browser SDK, overridable via logs.resourceAttributes
(2026-09-01)

Sanitize legacy product tour HTML before rendering
(2026-09-01)

Prevent stale session recorders from initializing after consent or session teardown, and dispose of recorders when switching to cookieless mode.
(2026-09-01)

Detect the Claude, Codex, and ChatGPT apps from their user agent markers: $browser now reports the app name instead of Chrome.

ChatGPT versions its apps differently per platform, so its $browser_version is not comparable across platforms. (2026-09-01)

Synchronize feature flag and early access enrollment persistence across browser tabs. Keep successful partial evaluations authoritative for payload updates and removals, including falsy payload values, while retaining cached state for failed evaluations.
(2026-09-01)

Prefer data-ph-capture-attribute-* values from the closest element when the same property is defined on multiple ancestors.
(2026-09-01)

Re-translate popover surveys when the display language changes while the survey is on screen, either from a browser languagechange event or from identify() updating the language person property. In-progress answers are preserved. $survey_questions.question and $survey_language on survey sent / survey dismissed now report the text and language the user saw when they answered, not the language active when the event fired. Feedback-button (widget) surveys are unchanged.
(2026-08-28)

Autocapture no longer throws a RangeError into the host page when it sorts element attributes. It now sorts attribute keys with a plain lexical comparator instead of localeCompare, which can throw on browsers with faulty ICU data.
(2026-08-28)

Session replay can now bound DOM mutation bytes with an opt-in budget. Set __mutationBytesBucketSize (e.g. 1MB) to enable: mutations beyond the sustained budget (__mutationBytesRefillRate, default 25KB/s) are dropped and the recording resyncs with a full snapshot, keeping recordings from apps with very high DOM churn playable. Off by default.
(2026-08-28)

Narrow the pinterest entry in the bot-detection blocklist to pinterestbot, so real users on Pinterest's in-app browser (whose UA also contains the substring pinterest) are no longer misclassified as bots and silently excluded from analytics. The crawler's other UA variant remains covered by the existing generic bot.htm entry, so no bot-detection coverage is lost.
(2026-08-27)

Report $sdk_debug_replay_throttled_mutations_dropped on captured events, counting the attribute changes the session recorder discarded during that session. The recorder throttles elements that change hundreds of times a second, and a discarded class or style change never reaches the player — so a recording can keep showing an element the live page had already hidden. Query this property to see whether your app is affected.
(2026-08-27)

Fix request timeouts never firing on pages where a browser extension makes Error.prototype.name non-writable
(2026-08-27)

Fix logs.captureConsoleLogs set in init() not enabling console autocapture, capture console calls made before the logs script loads, and drop captured console records when the user opts out
(2026-08-27)

Fix session replay and posthog-js leaving each other's console wrapper in the call path when either one stops
(2026-08-27)

Use the best available compression for browser feature flag requests, preferring gzip when supported.
(2026-08-27)

Drop sourcesContent from the source maps published to npm. The maps themselves still ship, so downstream source-map chaining and the //# sourceMappingURL references are unaffected — only the copy of our TypeScript sources embedded in each map is gone, taking the package from 40.8 MB to 17.4 MB unpacked. CDN artifacts are built separately and keep their inlined sources.
(2026-08-27)

Add the 2026-08-30 config defaults. These defaults enable sanitized JSON-LD replay events.
(2026-08-26)

Add opt-in Schema.org JSON-LD capture to session replay through session_recording.captureJsonLd. When enabled, the recorder emits sanitized JSON-LD as custom replay events and excludes all script elements from replay snapshots.
(2026-08-26)

Capture paste interactions with clipboard autocapture without collecting pasted text.
(2026-08-26)

Fix session replay playback ending when a recording contains a shadow host the browser refuses. The player now skips that one subtree instead of aborting the rebuild.
(2026-08-26)

Add typed stable-name lookup for installed browser extensions and use it when independently loaded survey code resolves feature flags.
(2026-08-25)

Fix console log autocapture silently failing when an older posthog-js core loads a newer logs bundle.
(2026-08-25)

browser: refresh configured feature flags when a hidden tab becomes visible

Feature flags now own their automatic refresh timer and visibility listener.
Hidden tabs reload due flags when they become visible. The existing five-minute
default and remote_config_refresh_interval_ms behavior remain unchanged. (2026-08-25)

Fix surveys recording a response before the respondent finishes, and reordering questions for surveys that use branching, are prefilled, or are resumed

An initialResponses prefill passed to posthog.displaySurvey() that neither completes the survey nor auto-advances a question no longer sends survey sent, and a partial event carries only the auto-advanced answers. (2026-08-25)

Type declarations no longer import the JSX namespace from react, so they typecheck against @types/react back to the declared 16.8.0 floor. Component return types are now spelled ReactElement<any, any>, which is the definition of JSX.Element — the same type, so consuming code is unaffected.

JSX only became an exported member of the react types module in @types/react@18.2.6, so projects on older React types previously saw TS2305: Module '"react"' has no exported member 'JSX' when checking these declarations with skipLibCheck: false. (2026-08-25)

Declare react and @types/react as optional peer dependencies so the posthog-js/react entry point can resolve React on strict node_modules layouts — pnpm and bun isolated linkers backed by a global store, where the package is installed outside the project tree and Node's directory walk never reaches the app's React.

Projects that do not import posthog-js/react are unaffected: the peers are optional, so npm, pnpm, yarn, and bun install them only when React is already present and emit no unmet-peer warnings. (2026-08-25)

Web vitals now capture attribution by default for INP and LCP, so a slow interaction or paint arrives with the target element and phase breakdown that make it diagnosable. CLS stays without attribution by default, because its attribution holds detached DOM nodes and can leak memory in single-page apps. Set capture_performance.web_vitals_attribution to false to opt out, true for every metric, or an array to name the metrics. The captured metric also drops the empty entries array and bounds attribution to a small set of useful fields, and the attributed INP observer no longer collects the processedEventEntries we never read.
(2026-08-25)

Prevent session recordings from emitting failed CSSOM changes and fix shadow DOM, cross-origin iframe, blocked and unsupported canvas, and deep DOM serialization edge cases.
(2026-08-25)

Share survey property matching between the browser and React Native SDKs while preserving their existing missing-value behavior.
(2026-08-25)

Drop exceptions thrown by user scripts the browser injects into every page (Firefox for iOS, Chrome for iOS) instead of reporting them as the page's own errors. Set error_tracking.captureExtensionExceptions: true to keep capturing them.
(2026-08-24)

Migrate surveys to the shared browser extension lifecycle.
(2026-08-24)

Migrate browser autocapture to the shared extension lifecycle.
(2026-08-24)

Fix logs and metrics batches being dropped instead of retried after HTTP 408
(2026-08-24)

add granular automatic pageview options for SPA navigation

capture_pageview now accepts an object with path, search, and hash options. Each selected URL component triggers a $pageview when it changes, including direct hash changes used by hash-based routers. The existing 'history_change' option continues to capture pathname changes. (2026-08-24)

Session replay: fixed a stale element left rendered in the player when a mutation re-added a node id with changed attributes. Affects both useVirtualDom modes.
(2026-08-24)

Stop adding PostHog's optional feature scripts, such as the session replay recorder and exception autocapture, to the page more than once. Sites that proxy PostHog through their own domain, by setting api_host to a path like /ingest rather than a full URL, ended up with the same <script> tag three or four times: the check meant to spot the duplicate compared the browser's resolved absolute URL against the relative one, so it never matched. The network tab showed a single request either way, because the browser served the repeats from its cache, which is why this was easy to miss. Nothing measurable got slower as a result, so this is a correctness fix rather than a speed one.
(2026-08-24)

When session replay is waiting on a trigger, debug mode now names the conditions that haven't matched yet (for example buffering: URL condition not matched, or the named trigger group whose condition is pending) instead of only reporting buffering. Enable it with posthog.debug(). Logged once per change, not once per flush.
(2026-08-24)

Guard the replayer's hover handling against non-element and detached hover targets, which previously threw an unhandled TypeError (querySelectorAll on a node without that method) and stopped session recording playback mid-stream.
(2026-08-21)

Keep replay playback running when a recording adopts constructed stylesheets across a document swap. A constructed stylesheet can only be adopted by the document that created it, so a sheet held over a swap is rejected and the error previously stopped the player. Adoption now falls back to whatever is already applied.
(2026-08-21)

replay: attribute the backdated sessionIdle marker to the session that went idle, so a rotation-born session's recording no longer starts hours before its first snapshot
(2026-08-21)

Fix logs and metrics being silently dropped when an attribute holds a very large integer, a function, a symbol, a sparse array, or a truncated emoji.
Cap log and metric attributes at 20 levels of nesting, 1,000 entries per object and 10,000 values in total, marking anything beyond as [Truncated].
Type OtlpAnyValue.intValue as string | number — code reading that field must handle both. (2026-08-21)

browser: stop the $posthog_cookieless sentinel from leaking into identify() and real events. A tab that missed a cross-tab consent flip could emit the sentinel as a durable distinct_id — merging distinct real users into a single person. It now adopts the identity persisted by the tab that handled consent, falling back to a fresh anonymous device id when persistence is not shared.
(2026-08-21)

Render React component stacks as linked exception causes so error tracking identifies the crashing component.
(2026-08-21)

Drop events when a before-send hook throws instead of sending the unmodified event.
(2026-08-20)

Stop building a stack frame for a window.onerror report that carries no code position, such as the ResizeObserver loop warning. The frame named the document URL rather than a script, so no source map could resolve it. These exceptions now arrive with no stack trace.
(2026-08-20)

Stop counting Chromium <anonymous> stack frames (extension-injected, devtools or string-evaluated code) as in-app code.
(2026-08-19)

Fix session recording in the full browser bundles. array.full.js and module.full.es.js only inlined rrweb, so they still fetched the recorder script at runtime - the request the full bundles exist to avoid. They now inline the whole recorder. Also flags the session with $sdk_debug_recording_script_not_loaded when the recorder script fails to load, so a blocked recorder is visible in analytics rather than only in the console.
(2026-08-19)

Fall back to the synthetic exception stack when a captured Error has no stack, so frameless failures (such as a Firefox network fetch TypeError) keep their call-site frames and group per call site instead of merging into one issue.
(2026-08-19)

Fix a Chrome renderer crash (grey "Aw, Snap" tab, "Error code: 5") that could still occur when closing an in-app survey on a heavy page such as a large dashboard.

Closing a survey animated the fade-out with document.startViewTransition, which snapshots the entire page viewport. The survey applied no view-transition-name scoping, so on a heavy host page capturing that whole-page snapshot could exhaust renderer memory and crash the tab. A previous fix addressed a related crash (a snapshot pointing at a removed node) but left the document-level transition — and its whole-page snapshot cost — in place.

The survey renders in an isolated shadow root, so it never needed a document-level transition. The close now fades the popup out with a plain CSS opacity transition scoped to the survey's own container, then unmounts it once the fade has run. No whole-page snapshot, no crash, same fade-out UX. (2026-08-19)

Recognise Firefox and Safari extension frames when filtering extension exceptions, and stop counting Safari's masked webkit-masked-url:// frames as in-app code.
(2026-08-18)

Add cookieWinsOnConflict to keep shared cross-subdomain identity and session state ahead of stale per-origin localStorage, deprecate __preview_cookie_wins_on_conflict, and enable the new behavior for the 2026-08-29 defaults.
(2026-08-18)

Take a full snapshot when session recording wakes from idle if DOM mutations were dropped while idle, so replay no longer shows duplicated or overlapping DOM after an idle period.
(2026-08-17)

Restore exception autocapture compatibility for posthog-js clients through version 1.141.0.
(2026-08-17)

Fix error tracking coercion reporting the wrong exception type for non-Error objects (e.g. TypeError, ReferenceError) that are thrown by browser extensions or other cross-realm code. Previously these always reported as type Error, burying the real type in the message string. Also fixed a local isError helper shadowing the more robust cross-realm-aware implementation, which caused some errors thrown from iframes or extension isolated worlds to be misclassified.
(2026-08-17)

Normalize capture timestamp overrides to equivalent UTC ISO strings in the browser and Node.js SDKs and shared core.
(2026-08-14)

Prevent swallowed rrweb observer initialization errors from breaking session replay teardown and subsequent recorder restarts.
(2026-08-14)

dead-clicks: treat visibility and focus changes as liveness signals, not dead-click evidence

The dead-click detector treated a visibilitychange as evidence a click was dead: it measured Math.abs(clickTimestamp - lastVisibilityChange) and, once that exceeded the threshold, timed the click out as dead. Because it only recorded the tab becoming visible, any click in a session where the tab had ever been backgrounded (median gap ~1 minute) was flagged.

A visibility or focus change near a click is the opposite — a sign the click did something (it woke/focused the tab, opened a new tab, or opened a new window/popup) — so these signals now only ever suppress a dead click, never cause one:

Default external dependency loading to versioned asset paths with automatic fallback to legacy paths, and add a strict_script_versioning: 'fallback' mode.
(2026-08-13)

Harden the session replay stylesheet inlining budget (inlineStylesheetBudgetRules):

browser: add rewriteRequestPath to customize API, feature flag, and asset paths for reverse proxies
(2026-08-12)

Add reset options for applying bootstrapped identity, feature flag, and session values after posthog.reset() while preserving the legacy boolean argument.
(2026-08-12)

Migrate browser feature flags to the shared extension lifecycle while preserving the public feature flag facade, persistence compatibility, request behavior, and event enrichment.
(2026-08-12)

Fix session recording starting from arbitrarily old persisted configs.

Recording configs persisted by SDK versions before 1.347.2 carry no cache_timestamp. The core freshness check treated these undated configs as always fresh, so the recorder started immediately under their settings. A device whose stored config predated a customer's config change kept recording under the old triggers, sample rate, and masking settings indefinitely.

The core now treats undated persisted configs as stale. Recording waits for a fresh remote config before it starts, the same path every dated config older than one hour already takes. The lazy recorder bundle is unchanged: it still accepts undated configs, because old cores that load the latest bundle cannot recover from a rejected config (INC-749). (2026-08-11)

Fix a Chrome renderer crash (grey "Aw, Snap" tab) that could occur when closing an in-app survey.

The survey close path wrapped the survey container's DOM removal in document.startViewTransition. Removing the element inside the transition callback left the captured snapshot pointing at a removed node, which on heavy SPAs triggered a Chromium renderer crash and took down the whole tab.

The close path now only animates a fade-out inside the transition and lets React tear the container down once the transition settles. It also guards against overlapping transitions (a second close while one is animating) and always settles the popup state if the transition is skipped or interrupted, so the survey can never be left visible with a stale reference. (2026-08-11)

types: accept current and legacy Segment Analytics SDK types in the Segment integration config
(2026-08-11)