chore(deps): update dependency posthog-js to v1.438.7

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
posthog-js (source)	1.435.9 → 1.438.7

---

Release Notes

PostHog/posthog-js (posthog-js)

v1.438.7

Compare Source

1.438.7

Patch Changes

• #​4990 a66cada Thanks @​dustinbyrne! - Share browser logging across SDKs with consistent initialization and cleanup; captureLog and logger calls before logging setup are now dropped instead of buffered.
  (2026-10-09)
• Updated dependencies [a66cada]:
  • @​posthog/browser-common@0.9.4

v1.438.6

Compare Source

1.438.6

Patch Changes

• #​5218 8bc2df6 Thanks @​lucasheriques! - Skip WebMCP intent and model injection for schemas with constraints that the extra fields could break.
  (2026-10-09)

• #​5217 6af3aa8 Thanks @​lucasheriques! - Export WebMCPExtensions from the slim extension-bundles entry point.
  (2026-10-09)

v1.438.5

Compare Source

1.438.5

Patch Changes

• #​5258 429b5b2 Thanks @​hpouillot! - Recognize native bundler debug IDs and build-time error tracking release IDs.
  (2026-10-09)
• Updated dependencies [429b5b2]:
  • @​posthog/core@1.57.4

v1.438.4

Compare Source

1.438.4

Patch Changes

• #​5245 76b4402 Thanks @​abrahamguo! - Fix type checking in posthog-js 1.438.2 by publishing the feature flag types it imports from @​posthog/browser-common.
  (2026-10-09)
• Updated dependencies [76b4402]:
  • @​posthog/browser-common@0.9.3

v1.438.3

Compare Source

1.438.3

Patch Changes

• #​5200 34cdfa6 Thanks @​hpouillot! - fix(replay): add a private opt-in to preserve application stacks for failed fetch requests
  (2026-10-08)
• Updated dependencies [34cdfa6]:
  • @​posthog/types@1.415.2

v1.438.2

Compare Source

1.438.2

Patch Changes

• #​4988 22dfa4a Thanks @​dustinbyrne! - Share feature flag functionality across browser SDKs while preserving existing behavior.
  (2026-10-07)
• Updated dependencies [ff7582a]:
  • @​posthog/core@1.57.1

v1.438.1

Compare Source

1.438.1

Patch Changes

• #​5004 730d92b Thanks @​posthog! - Stop carousel and pager arrow controls from capturing false $rageclick events. The rageclick content ignorelist, active from the 2025-11-30 config defaults, now also covers arrow glyphs (→, ←, ›, ‹, », «, ▶, ◀, ❯, ❮). The built-in word keywords match whole words wherever they appear, including inside a list you pass yourself, so "Preview" keeps capturing; other word keywords you add still match as substrings. Keywords now match against the clicked control (the nearest button, link, ARIA control or cursor: pointer wrapper), reading its label from the control's whole subtree instead of every ancestor up to the body, so a region labelled "Featured carousel" no longer suppresses the buttons inside it. A control's own text or aria-label wins over an icon's aria-label inside it, so clicking the icon and clicking the text agree. Set rageclick: { content_ignorelist: false } to keep capturing these events.
  (2026-10-06)
• Updated dependencies [730d92b]:
  • @​posthog/browser-common@0.9.2
  • @​posthog/types@1.415.1

v1.438.0

Compare Source

1.438.0

Minor Changes

• #​5191 6cd5496 Thanks @​gesh! - Capture WebMCP tool intent and model metadata by default.
  (2026-10-06)

Patch Changes

• Updated dependencies [6cd5496]:
  • @​posthog/types@1.415.0
  • @​posthog/core@1.57.0

v1.437.0

Compare Source

1.437.0

Minor Changes

• #​5190 6af4c59 Thanks @​gesh! - Add opt-in WebMCP tool call capture for MCP Analytics.
  (2026-10-06)

Patch Changes

• Updated dependencies [6af4c59]:
  • @​posthog/types@1.414.0

v1.436.1

Compare Source

1.436.1

Patch Changes

• #​5203 633f5b2 Thanks @​marandaneto! - Restore batching for events carrying pending Meta $fbc or $fbp identifiers to reduce races with preceding identify() calls.
  (2026-10-05)

v1.436.0

Compare Source

1.436.0

Minor Changes

• #​5083 d576bec Thanks @​61465! - Opt-in WebView bot heuristic for #​2921.
  • posthog-js/customizations exports a new isLikelyWebViewBot(ua) helper that flags the UA pattern described in #​2921 (a Chrome/... token without the usual AppleWebKit/* + Safari/* co-markers that real Chrome always sends). Wire it into before_send to tag or drop the matching events — see isLikelyWebViewBot JSDoc for a usage example. Default SDK behaviour is unchanged; the helper is tree-shaken out unless you import it.
  • @posthog/core keeps isBlockedUA and DEFAULT_BLOCKED_UA_STRS byte-for-byte compatible, and gains session-level memoisation of isBlockedUA results keyed on (ua, customBlockedUserAgents), so repeat calls within the same session are O(1). (2026-10-05)

Patch Changes

• Updated dependencies [d576bec]:
  • @​posthog/core@1.56.0

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • Between 08:00 AM and 05:59 PM, Monday through Friday (* 8-17 * * 1-5)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	launchpad	695abc8	Commit Preview URL Branch Preview URL	Oct 13 2026, 01:24 AM