chore(deps): update dependency posthog-js to v1.413.3

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
posthog-js (source)	1.410.10 → 1.413.3

---

Release Notes

PostHog/posthog-js (posthog-js)

v1.413.3

Compare Source

1.413.3

Patch Changes

• #​4414 1b88c2f Thanks @​marandaneto! - Clear properties registered for a session when the PostHog session rotates.
  (2026-08-06)

• #​4374 b39b577 Thanks @​dustinbyrne! - Persist in-place object and array mutations when properties are re-registered.
  (2026-08-06)

• #​4434 75fb719 Thanks @​arnohillen! - Make the session replay attribute masking options mutually exclusive: when both maskAllElementAttributes and maskAttributeFn are set, the coarse option wins and the callback is ignored (with a console warning), so a callback can no longer accidentally unmask what maskAllElementAttributes hides.
  (2026-08-06)

• Updated dependencies [64ba193, 75fb719]:

  • @​posthog/core@​1.46.9
  • @​posthog/types@​1.402.2

v1.413.2

Compare Source

1.413.2

Patch Changes

• #​4425 ee7fab0 Thanks @​posthog! - Fix a benign network failure (e.g. TypeError: Failed to fetch) in the async native-gzip request path surfacing as an unhandled promise rejection, which exception autocapture would otherwise pick up
  (2026-08-05)

v1.413.1

Compare Source

1.413.1

Patch Changes

• #​4390 1160403 Thanks @​posthog! - Contain and log recorder-owned callback failures while preserving exceptions from patched native host APIs. Keep recording mutations from adopted cross-realm nodes.
  (2026-08-05)

• #​4286 d108d66 Thanks @​posthog! - fix(replay): preserve privacy masking for initial network metadata

  Initial navigation and performance-timing entries are now passed through maskCapturedNetworkRequestFn, including when they have no method. URL rewrites are respected. When the callback returns nullish for an initial entry, replay-required timing metadata is retained without its URL, headers, or body so method-gated callbacks do not drop the metadata or expose deliberately filtered customer data. Derived server-timing entries are also suppressed when this strict fallback is used. Enforced PostHog filtering and payload cleaning still run first. (2026-08-05)

• Updated dependencies [d108d66]:

  • @​posthog/types@​1.402.1

v1.413.0

Compare Source

1.413.0

Minor Changes

• #​4376 2da12b8 Thanks @​posthog! - Add attribute-level masking to session replay: maskAttributeFn provides per-attribute control over the final serialized value, while maskAllElementAttributes masks all source DOM string attributes (including rendering attributes and synthesized form values) at the cost of replay fidelity.
  (2026-08-05)

Patch Changes

• #​4376 2da12b8 Thanks @​posthog! - fix(replay): discard held interaction-less recordings when a background document unloads without ever becoming visible
  (2026-08-05)
• Updated dependencies [2da12b8]:
  • @​posthog/types@​1.402.0
  • @​posthog/browser-common@​0.4.0

v1.412.2

Compare Source

1.412.2

Patch Changes

• #​4417 3acadfe Thanks @​marandaneto! - fix(replay): discard held interaction-less recordings when a background document unloads without ever becoming visible
  (2026-08-05)

v1.412.1

Compare Source

1.412.1

Patch Changes

• #​4404 a348fb3 Thanks @​dependabot! - Update PostCSS to include upstream security fixes.
  (2026-08-05)

v1.412.0

Compare Source

v1.411.0

Compare Source

1.411.0

Minor Changes

• #​4266 43d1850 Thanks @​posthog! - feat: add opt-in capture_performance.__preview_web_vitals_soft_navs to fix inflated web vitals on single-page apps

  Client-side route changes in SPAs previously left web vitals (LCP especially) accumulating against the original hard-navigation timestamp, inflating the top tail of Core Web Vitals. Setting capture_performance: { __preview_web_vitals_soft_navs: true } now scopes metrics to the browser's Soft Navigation entries so each route change starts a fresh measurement window. It's a preview option because it relies on Chrome's experimental Soft Navigation Detection API and loads pinned stable web-vitals 6.x callbacks; when disabled (the default), the existing web-vitals 5.x behavior remains unchanged. (2026-08-04)

Patch Changes

• #​4287 d3c4538 Thanks @​posthog! - Keep $referring_domain and canonical utm_*/campaign parameters on minimal $feature_flag_called events. Previously the minimal allowlist stripped every campaign parameter, so a flag-called event landing first in a session could set the session's UTM attribution and channel type to NULL in web analytics.
  (2026-08-04)
• Updated dependencies [d3c4538, 43d1850]:
  • @​posthog/core@​1.46.7
  • @​posthog/types@​1.401.0

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • Between 08:00 AM and 05:59 PM, Monday through Friday (* 8-17 * * 1-5)
• Automerge
  • Between 08:00 AM and 05:59 PM, Monday through Friday (* 8-17 * * 1-5)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	launchpad	7682d7d	Commit Preview URL Branch Preview URL	Aug 06 2026, 04:52 PM