[dependabot]

Bumps posthog-js from 1.438.21 to 1.447.5.

Release notes

Sourced from posthog-js's releases.

posthog-js@1.447.5

1.447.5

Patch Changes

• #5559 9fe341d Thanks @​adityareddy-dev! - Continue replaying mutation batches when a removal has the wrong parent or an addition targets a leaf node. (2026-11-09)

• #5610 eaab1fc Thanks @​posthog! - Fix session replay failing to rebuild a snapshot when the replay document already has a root element (2026-11-09)

• #5546 21bd08e Thanks @​adityareddy-dev! - Collapse buffered text changes to the final value per node and simplify attribute mutation storage. (2026-11-09)

posthog-js@1.447.4

1.447.4

Patch Changes

• #5433 7ceaa14 Thanks @​ioannisj! - Stop parsing the persistence entry on every capture() to refresh the Meta $fbc and $fbp identifiers; capture() now compares the stored text and only parses it when a sibling tab or subdomain changed it. (2026-11-09)

posthog-js@1.447.3

1.447.3

Patch Changes

• #5562 8e042cb Thanks @​adityareddy-dev! - Preserve non-empty CDATA content with text masking and rebuild it as text in HTML documents. (2026-11-06)

posthog-js@1.447.2

1.447.2

Patch Changes

• #5561 ab49034 Thanks @​adityareddy-dev! - Mask hidden input values in session replay when maskAllInputs is enabled, and accept hidden in maskInputOptions. (2026-11-06)
• Updated dependencies [ab49034]:
  • @​posthog/types@​1.421.1

posthog-js@1.447.1

1.447.1

Patch Changes

• #5576 9ee327d Thanks @​lucasheriques! - Reworded the description of the llm_model argument that capture_webmcp adds to WebMCP tools, so it no longer points the model at its system prompt. (2026-11-05)

posthog-js@1.447.0

1.447.0

... (truncated)

Commits

• 852ee06 chore: update versions and lockfile [version bump]
• 441658f fix(react-native): forward shared Android upload conflict options (#5586)
• eaab1fc fix(replay): remove existing root element before rebuilding the document (#5610)
• 9fe341d fix(replay): skip mutation operations with invalid parents (#5559)
• 21bd08e perf(replay): collapse repeated buffered text mutations (#5546)
• f2bd65d docs(examples): use claude-sonnet-5-5 in the Anthropic AI examples (#5581)
• 79be73b chore(deps): bump the github-actions group across 1 directory with 3 updates ...
• c9c47d3 chore: update versions and lockfile [version bump]
• 7ceaa14 fix(browser): cut per-capture storage reads for Meta identifiers (#5433)
• 08654ff chore: update versions and lockfile [version bump]
• Additional commits viewable in compare view

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: a620ae4d-902b-4908-b691-7ec292bbbdb0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/posthog-js	^1.447.5	Unknown	Unknown
npm/@posthog/browser-common	0.10.7	🟢 7.9	Details Check Score Reason Code-Review 🟢 5 Found 16/30 approved changesets -- score normalized to 5 Maintained 🟢 10 30 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Binary-Artifacts 🟢 7 binaries present in source code License 🟢 9 license file detected Branch-Protection 🟢 4 branch protection is not maximal on development and all release branches Security-Policy 🟢 10 security policy file detected Signed-Releases ⚠️ -1 no releases found Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 Fuzzing 🟢 10 project is fuzzed SAST ⚠️ -1 internal error: internal error: Client.Checks.ListCheckRunsForRef: error during graphqlHandler.setupCheckRuns: Although you appear to have the correct authorization credentials, the `cursor` organization has an IP allow list enabled, and your IP address is not permitted to access this resource.
npm/@posthog/core	1.65.0	🟢 7.9	Details Check Score Reason Code-Review 🟢 5 Found 16/30 approved changesets -- score normalized to 5 Maintained 🟢 10 30 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Binary-Artifacts 🟢 7 binaries present in source code License 🟢 9 license file detected Branch-Protection 🟢 4 branch protection is not maximal on development and all release branches Security-Policy 🟢 10 security policy file detected Signed-Releases ⚠️ -1 no releases found Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 Fuzzing 🟢 10 project is fuzzed SAST ⚠️ -1 internal error: internal error: Client.Checks.ListCheckRunsForRef: error during graphqlHandler.setupCheckRuns: Although you appear to have the correct authorization credentials, the `cursor` organization has an IP allow list enabled, and your IP address is not permitted to access this resource.
npm/@posthog/types	1.422.0	🟢 7.9	Details Check Score Reason Code-Review 🟢 5 Found 16/30 approved changesets -- score normalized to 5 Maintained 🟢 10 30 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Binary-Artifacts 🟢 7 binaries present in source code License 🟢 9 license file detected Branch-Protection 🟢 4 branch protection is not maximal on development and all release branches Security-Policy 🟢 10 security policy file detected Signed-Releases ⚠️ -1 no releases found Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 Fuzzing 🟢 10 project is fuzzed SAST ⚠️ -1 internal error: internal error: Client.Checks.ListCheckRunsForRef: error during graphqlHandler.setupCheckRuns: Although you appear to have the correct authorization credentials, the `cursor` organization has an IP allow list enabled, and your IP address is not permitted to access this resource.
npm/core-js	3.51.0	🟢 5.3	Details Check Score Reason Code-Review 🟢 3 Found 8/22 approved changesets -- score normalized to 3 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10 Security-Policy 🟢 10 security policy file detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo License 🟢 10 license file detected Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/posthog-js	1.447.5	🟢 7.9	Details Check Score Reason Code-Review 🟢 5 Found 16/30 approved changesets -- score normalized to 5 Maintained 🟢 10 30 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Binary-Artifacts 🟢 7 binaries present in source code License 🟢 9 license file detected Branch-Protection 🟢 4 branch protection is not maximal on development and all release branches Security-Policy 🟢 10 security policy file detected Signed-Releases ⚠️ -1 no releases found Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 Fuzzing 🟢 10 project is fuzzed SAST ⚠️ -1 internal error: internal error: Client.Checks.ListCheckRunsForRef: error during graphqlHandler.setupCheckRuns: Although you appear to have the correct authorization credentials, the `cursor` organization has an IP allow list enabled, and your IP address is not permitted to access this resource.
npm/web-vitals	6.2.3	🟢 5.9	Details Check Score Reason Maintained 🟢 10 27 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo Code-Review 🟢 4 Found 13/30 approved changesets -- score normalized to 4 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Pinned-Dependencies 🟢 5 dependency not pinned by hash detected -- score normalized to 5 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Security-Policy ⚠️ 0 security policy file not detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST 🟢 4 SAST tool is not run on all commits -- score normalized to 4

Scanned Files

• apps/web/package.json
• pnpm-lock.yaml