[dependabot]

Bumps posthog-js from 1.438.12 to 1.438.19.

Release notes

Sourced from posthog-js's releases.

posthog-js@1.438.19

1.438.19

Patch Changes

• #4994 bcd33ce Thanks @​dustinbyrne! - Share autocapture across browser SDKs while preserving existing event capture behavior. (2026-10-22)
• Updated dependencies [bcd33ce]:
  • @​posthog/browser-common@​0.9.9

posthog-js@1.438.18

1.438.18

Patch Changes

• #5189 2aacdcb Thanks @​posthog! - Log why capture() dropped an event (capturing disabled or a bot user agent) when debug: true is set (2026-10-22)

• #5383 0faf643 Thanks @​sarankumar1325! - Conversations: the widget now comes back after reset(), and after a cookieless (on_reject) visitor calls opt_in_capturing(), instead of staying unavailable until the next page load. (2026-10-22)

posthog-js@1.438.17

1.438.17

Patch Changes

• #5367 23b287f Thanks @​sarankumar1325! - Session replay records mouse movement inside same-origin iframes as mouse movement instead of touch movement, so the replay cursor stays visible. (2026-10-22)

• #5348 45f6cd6 Thanks @​ayushjhanwar-png! - Keep session replay data URI filtering output valid JSON and match svg+xml and parameterised data URIs. (2026-10-22)

• #5325 21a2559 Thanks @​Majny! - Session replay no longer installs the network plugin when the client sets session_recording.recordHeaders and recordBody to false and turns network timing off, even if the project enables network payload capture. Previously request URLs and timings were still recorded. (2026-10-22)

posthog-js@1.438.16

1.438.16

Patch Changes

• #5370 a50fa7a Thanks @​sarankumar1325! - Conversations: a reset() or opt-out that happens while the widget is still loading its tickets (or a restore link) no longer brings the widget back, restarts polling, or writes the old ticket id back to storage. (2026-10-22)

• #5365 964e736 Thanks @​gustavohstrassburger! - Feature flags read before the user opts in to capturing now send $feature_flag_called the next time they are read after opt in. (2026-10-22)

• #5256 e7c87fa Thanks @​jakesciotto! - Session replay: a scroll on a scroll-snap-type container now lands instantly during real-time playback, so a sheet or carousel that a scroll reveals shows the same content in Safari as in Chrome. Scrolls on other elements still animate. (2026-10-22)

• Updated dependencies [964e736]:

  • @​posthog/browser-common@​0.9.8

... (truncated)

Commits

• effd8ee chore: update versions and lockfile [version bump]
• e027825 fix(ai): keep the refusal of OpenAI chat completions in the captured output (...
• 9d20861 feat(browser-next): integrate dynamically loaded autocapture (#4995)
• bcd33ce refactor(browser-common): extract autocapture extension (#4994)
• 3e91597 chore: update versions and lockfile [version bump]
• 2aacdcb fix(browser): log why capture drops an event and clarify cookieless opt-out d...
• 0faf643 fix(conversations): reload the widget after reset() and cookieless opt-in (#5...
• fc606c8 chore(llma): bump @​modelcontextprotocol/server from 2.0.0 to 2.3.0 (#5343)
• 6897dc8 chore: update versions and lockfile [version bump]
• 1991b99 feat(node): report unresolved local flags on evaluateFlags snapshots (#5234)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: pierreb-devkit/Vue
• Branch: master
• File: .coderabbit.yaml
• Commit: b1ccd1e
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: a2c82827-9c13-4c68-a52b-503f48f9321b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}