chore(deps): update all non-major dependencies#446
chore(deps): update all non-major dependencies#446renovate[bot] wants to merge 1 commit intomainfrom
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
9c4e39b to
5bfebea
Compare
5bfebea to
7804f68
Compare
7804f68 to
2d975ff
Compare
2d975ff to
0104ff1
Compare
0104ff1 to
8120e32
Compare
8120e32 to
5ec9f5e
Compare
5ec9f5e to
efcb3b7
Compare
efcb3b7 to
1a61aec
Compare
1a61aec to
cf8e7f8
Compare
cf8e7f8 to
2b13cf8
Compare
64d7d5a to
6132302
Compare
6132302 to
360e116
Compare
360e116 to
aa97a8b
Compare
aa97a8b to
714cf9d
Compare
714cf9d to
bdbb60c
Compare
bdbb60c to
9343bf3
Compare
9343bf3 to
fb7fea7
Compare
fb7fea7 to
556aaae
Compare
commit: |
docs/package.json
Outdated
| "@nuxt/image": "^1.11.0", | ||
| "@nuxt/scripts": "workspace:*", | ||
| "@nuxt/ui": "4.0.0", | ||
| "@nuxt/ui": "4.2.1", |
There was a problem hiding this comment.
| "@nuxt/ui": "4.2.1", | |
| "@nuxt/ui": "^4.2.1", |
The @nuxt/ui dependency is pinned to 4.2.1 without a caret, which is inconsistent with all other dependencies in this file that use flexible versioning with the ^ prefix.
View Details
Analysis
Inconsistent version pinning for @nuxt/ui dependency
What fails: docs/package.json line 20 specifies @nuxt/ui as pinned version 4.2.1 (without caret prefix), while all 13 other dependencies use caret versioning (^) for flexible version constraints within the major version.
How to reproduce:
cat docs/package.json | grep -A 15 '"dependencies"'Result: Shows "@nuxt/ui": "4.2.1" (pinned) while all surrounding dependencies have caret prefix:
"@nuxt/content": "^3.8.2""@nuxt/fonts": "^0.12.1""@nuxthq/studio": "^2.2.1"- All other 10 dependencies also use
^prefix
Expected behavior: According to npm semantic versioning, caret versioning allows compatible updates (minor/patch versions) within a major version. The project consistently uses this pattern for all other dependencies, so @nuxt/ui should be ^4.2.1 to match the established convention and allow patch/minor updates like other dependencies.
Root cause: Automated dependency update (Renovate bot commit 0b37709) preserved the previous pinned format when bumping the version from 4.0.0 to 4.2.1, rather than applying the project's standard caret versioning pattern used throughout the file.
package.json
Outdated
| "posthog-js": "^1.0.0" | ||
| "@types/youtube": "^0.1.2", | ||
| "@unhead/vue": "^2.1.2", | ||
| "posthog-js": "^1.321.2" |
There was a problem hiding this comment.
| "posthog-js": "^1.321.2" | |
| "posthog-js": "^1.0.0" |
The posthog-js peer dependency constraint changed from ^1.0.0 to ^1.321.2, which is unusually restrictive and appears unintentional given the patch version bump in devDependencies (1.321.1 → 1.321.2).
View Details
Analysis
Overly restrictive posthog-js peer dependency breaks backward compatibility
What fails: The posthog-js peer dependency constraint in package.json was changed from ^1.0.0 to ^1.321.2 (commit 1536ad2), restricting supported versions to 1.321.2+ and rejecting all prior versions (1.0.0-1.321.1) that would previously install.
How to reproduce:
# User has posthog-js 1.200.0 installed (legitimate version under old ^1.0.0 constraint)
npm install @nuxt/scripts
# After update, npm now rejects this version because 1.200.0 does not satisfy ^1.321.2Result: npm/pnpm install fails with: "posthog-js@1.200.0 not satisfied by ^1.321.2"
Expected: The peer dependency should remain at ^1.0.0 (or similar permissive constraint) since:
- Code only uses
posthog.init()and basic config options (api_host,capture_pageview,disable_session_recording) available since 1.0.0 - The devDependency update was only a patch bump (1.222.0 → 1.321.2), not a major version requiring API changes
- Peer dependencies should be permissive to maximize compatibility
- Semantic versioning guidance indicates patch/minor version updates within the same major version should be backward compatible
This change appears to be an error from automated dependency update tooling (Renovate) that applied the same pinpoint version to both devDependencies and peerDependencies.
|
This PR contains the following updates:
^7.7.2→^7.7.3^3.2.3→^3.2.4^3.2.3→^3.2.4^3.2.3→^3.2.4^3.2.3→^3.2.4^0.1.0→^0.1.2^8.57.0→^8.57.1^2.0.3→^2.1.12v6.0.1→v6.0.2v10.0.0→v10.2.0^0.5.17→^0.5.21^0.118.0→^0.120.0^1.0.0→^1.360.2Release Notes
antfu/eslint-config (@antfu/eslint-config)
v7.7.3Compare Source
🐞 Bug Fixes
View changes on GitHub
nuxt/devtools (@nuxt/devtools-kit)
v3.2.4Compare Source
Bug Fixes
Features
ua-parser-modern(114aa17)typescript-eslint/typescript-eslint (@typescript-eslint/typescript-estree)
v8.57.1Compare Source
This was a version bump only for typescript-estree to align it with other projects, there were no code changes.
See GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
unjs/unhead (@unhead/vue)
v2.1.12Compare Source
🐞 Bug Fixes
View changes on GitHub
v2.1.11Compare Source
🐞 Bug Fixes
View changes on GitHub
v2.1.10Compare Source
🐞 Bug Fixes
View changes on GitHub
v2.1.9Compare Source
🐞 Bug Fixes
View changes on GitHub
v2.1.8Compare Source
🐞 Bug Fixes
View changes on GitHub
v2.1.7Compare Source
🐞 Bug Fixes
View changes on GitHub
v2.1.6Compare Source
🐞 Bug Fixes
View changes on GitHub
v2.1.5Compare Source
🐞 Bug Fixes
useScript- by @cernymatej in #660 (e8f5b)View changes on GitHub
v2.1.4Compare Source
🐞 Bug Fixes
<link rel="alternate">by hreflang/type only, drop href from key - by @harlan-zw in #656 (86175)View changes on GitHub
v2.1.3Compare Source
🐞 Bug Fixes
<link rel="alternate">- by @danielroe and onmax in #655 (fdabe)s._statusRef- by @danielroe in #642 (4ef03)🏎 Performance
View changes on GitHub
v2.1.2Compare Source
🐞 Bug Fixes
View changes on GitHub
v2.1.1Compare Source
No significant changes
View changes on GitHub
v2.1.0Compare Source
🚀 Features
🐞 Bug Fixes
🏎 Performance
View changes on GitHub
v2.0.19Compare Source
🐞 Bug Fixes
View changes on GitHub
v2.0.18Compare Source
🏎 Performance
View changes on GitHub
v2.0.17Compare Source
No significant changes
View changes on GitHub
v2.0.14Compare Source
🐞 Bug Fixes
View changes on GitHub
v2.0.13Compare Source
🐞 Bug Fixes
View changes on GitHub
v2.0.12Compare Source
🐞 Bug Fixes
View changes on GitHub
v2.0.11Compare Source
🐞 Bug Fixes
View changes on GitHub
v2.0.10Compare Source
🐞 Bug Fixes
View changes on GitHub
v2.0.9Compare Source
🏎 Performance
View changes on GitHub
v2.0.8Compare Source
No significant changes
View changes on GitHub
v2.0.7Compare Source
🐞 Bug Fixes
unheadhoisting issue - by @harlan-zw (bb0e4)View changes on GitHub
v2.0.6Compare Source
🐞 Bug Fixes
View changes on GitHub
v2.0.5Compare Source
🐞 Bug Fixes
setTimeoutas render's debounced delayer - by @kricsleo in #540 (8f7c5)View changes on GitHub
v2.0.4Compare Source
🐞 Bug Fixes
View changes on GitHub
actions/checkout (actions/checkout)
v6.0.2Compare Source
actions/stale (actions/stale)
v10.2.0Compare Source
v10.1.1Compare Source
What's Changed
Bug Fix
only-issue-typesby @Bibo-Joshi in #1298Improvement
Dependency Upgrades
New Contributors
Full Changelog: actions/stale@v10...v10.1.1
v10.1.0Compare Source
What's Changed
only-issue-typesoption to filter issues by type by @Bibo-Joshi in #1255New Contributors
Full Changelog: actions/stale@v10...v10.1.0
harlan-zw/eslint-plugin-harlanzw (eslint-plugin-harlanzw)
v0.5.21Compare Source
🚀 Features
vue-no-resolve-component-in-composables- by @harlan-zw (f26aa)View changes on GitHub
v0.5.19Compare Source
🐞 Bug Fixes
View changes on GitHub
v0.5.18Compare Source
🚀 Features
View changes on GitHub
oxc-project/oxc (oxc-parser)
v0.120.0⚡ Performance
9cd612flinter/plugins: Recycle comment objects (#20362) (overlookmotel)v0.119.0📚 Documentation
e4aa5b5parser/napi, linter/plugins: Add JSDoc comments to raw transfer constants (#20286) (overlookmotel)PostHog/posthog-js (posthog-js)
v1.360.2Compare Source
1.360.2
Patch Changes
bc30c2dThanks @dustinbyrne! - fix: Calling reset() now automatically reloads feature flags(2026-03-13)
bc30c2d,bc30c2d]:v1.360.1Compare Source
1.360.1
Patch Changes
4009c15]:v1.360.0Compare Source
1.360.0
Patch Changes
#3213
db089fdThanks @TueHaulund! - fix(replay): treat legacy configs without cache_timestamp as freshConfigs persisted by older SDK versions never include a cache_timestamp.
Defaulting to 0 treats them as always stale, causing the persisted config
to be cleared before start() runs — so recording never starts for
customers on older core SDK versions paired with the latest CDN recorder. (2026-03-09)
#3207
c5a37cbThanks @dustinbyrne! - fix: PostHogFeatureFlags uses a TreeShakeable type(2026-03-09)
Updated dependencies [
c5a37cb]:v1.359.1Compare Source
1.359.1
Patch Changes
2b0cd52Thanks @marandaneto! - chore: upgrade dompurify to 3.3.2(2026-03-06)
v1.359.0Compare Source
1.359.0
Minor Changes
9180726Thanks @dustinbyrne! - feat: Tree-shake feature flags(2026-03-05)
Patch Changes
v1.358.1Compare Source
1.358.1
Patch Changes
#3191
9f41d26Thanks @TueHaulund! - fix(replay): fall back to persisted config when remote config fetch failsWhen the remote config fetch failed (network error, ad blocker, CDN outage), the SDK received an empty
{}response with nosessionRecordingkey. TheonRemoteConfighandler returned early without ever setting_receivedFlags = true, leaving the recording permanently stuck inpending_configstatus for the entire page session.This removes the
_receivedFlagsgate entirely. The 1-hour TTL on persisted config (added in #3051, increased from 5 minutes) and the stale-config retry in_onScriptLoaded(added in #3093) already prevent recording from starting with outdated config. The additional gate was redundant and created a deadlock when the config fetch failed.Now when the config fetch fails,
startIfEnabledOrStop()is called and falls back to persisted config from a previous page load. If no persisted config exists (first-ever visit), recording is correctly disabled rather than silently stuck. (2026-03-04)#3198
9d0df0eThanks @TueHaulund! - Reduce session replay memory pressure by tracking per-event sizes in SnapshotBuffer, eliminating redundant JSON.stringify calls during buffer operations. Also bumps @posthog/rrweb to 0.0.46 which uses FNV-1a hash-based canvas frame deduplication instead of storing full base64 strings.(2026-03-04)
Updated dependencies []:
v1.358.0Compare Source
1.358.0
Minor Changes
0e08337Thanks @dustinbyrne! - feat: Tree-shake surveys, toolbar, exceptions, conversations, logs, experiments(2026-03-03)
Patch Changes
20c1ff2Thanks @dustinbyrne! - Add Extension interface for tree-shakable extensions(2026-03-03)
v1.357.2Compare Source
1.357.2
Patch Changes
f485c92Thanks @slshults! - fix: Move tablet detection logic into detectDeviceType for consistent classification across all call sites(2026-03-03)
v1.357.1Compare Source
1.357.1
Patch Changes
91223c5Thanks @adboio! - avoid re-checking URLs if they have not changed(2026-03-02)
5e8d5fc]:v1.357.0Compare Source
1.357.0
Minor Changes
4f885c0Thanks @marandaneto! - feat: add local sampleRate config for session recording(2026-03-02)
Patch Changes
0dce119Thanks @TueHaulund! - Bump @posthog/rrweb-* to 0.0.45 — reuses a single OffscreenCanvas in the canvas recording worker instead of allocating a new one per frame, fixing a memory leak in Safari where GPU-backed canvas resources were not being garbage collected promptly(2026-03-02)
4f885c0]:v1.356.2Compare Source
1.356.2
Patch Changes
#3174
e9127d8Thanks @TueHaulund! - Detect and report when rrweb fails to initialize. rrweb'srecord()silently swallows startup errors and returnsundefined, which previously left the SDK reporting an active recording status while capturing zero data. The SDK now checks the return value and reports a newrrweb_errorstatus, making the failure visible in debug properties.(2026-03-02)
#3175
6ee5f12Thanks @TueHaulund! - Fix memory leak in canvas recording on Safari < 16.4 where ImageBitmaps were never closed when OffscreenCanvas was unavailable in the web worker.(2026-03-02)
#3178
186871aThanks @TueHaulund! - Skip canvas FPS recording entirely on browsers without OffscreenCanvas support (Safari < 16.4) instead of running a wasteful requestAnimationFrame loop that can never produce data. Also includes displayWidth/displayHeight in canvas mutation data for correct replay sizing.(2026-03-02)
#3176
87bae20Thanks @dustinbyrne! - fix: Drop explicit exports(2026-03-02)
#3172
2e46959Thanks @dustinbyrne! - fix: Compressed requests use ArrayBuffer(2026-03-02)
Updated dependencies []:
v1.356.1Compare Source
1.356.1
Patch Changes
a500d14Thanks @ksvat! - wait for fresh config before recording start decision, add new recorder status, output recording started event(2026-02-27)
v1.356.0Compare Source
1.356.0
Minor Changes
ec54fd8Thanks @dmarticus! - Add feature_flag_cache_ttl_ms config to prevent stale flag values(2026-02-26)
Patch Changes
#3154
a47179cThanks @slshults! - fix: Improve tablet device type detection when Chrome sends desktop-like UA stringsChrome on Android tablets defaults to "request desktop site" mode, sending a UA string
indistinguishable from desktop Linux. This uses the Client Hints API (navigator.userAgentData.platform)
and touch capability (navigator.maxTouchPoints) to correctly classify these devices as Tablet or Mobile
when UA-based detection falls through to the Desktop default. (2026-02-26)
#3145
d741668Thanks @dmarticus! - Adds a remote_config_refresh_interval_ms config option to control how often feature flags are automatically refreshed in long-running sessions.(2026-02-26)
Updated dependencies [
ec54fd8,d741668]:v1.355.0Compare Source
1.355.0
Minor Changes
1d3f14cThanks @adboio! - add product tour wait period support(2026-02-26)
Patch Changes
v1.354.4Compare Source
1.354.4
Patch Changes
d6fd9c9Thanks @ksvat! - add re-entrancy guard for cases where ALL + regex + event trigger matching is configured(2026-02-26)
v1.354.3Compare Source
1.354.3
Patch Changes
77261d8Thanks @adboio! - add product tours device type targeting(2026-02-25)
v1.354.2Compare Source
1.354.2
Patch Changes
67cf41eThanks @dustinbyrne! - fix: Add additional legacy exports for fully qualified dist and lib exports(2026-02-25)
v1.354.1Compare Source
1.354.1
Patch Changes
9ae20e7Thanks @dustinbyrne! - fix: Expose all export paths(2026-02-25)
v1.354.0Compare Source
1.354.0
Minor Changes
4d0c783Thanks @dustinbyrne! - feat: Introduce internal config to improve tree-shaking(2026-02-25)
Patch Changes
v1.353.1Compare Source
1.353.1
Patch Changes
0b86924Thanks @adboio! - fix autofill bug in hosted surveys(2026-02-24)
v1.353.0Compare Source
1.353.0
Minor Changes
fba7e5bThanks @dustinbyrne! - feat: Persist $user_state to cookie for server-side access(2026-02-23)
Patch Changes
v1.352.1Compare Source
1.352.1
Patch Changes
#3129
6bfa003Thanks @pauldambra! - fix: no need to put rrweb and friends directly on window in posthog-recorder(2026-02-23)
#3131
ad26474Thanks @veryayskiy! - Fix issue with toolbar interferring distinct id in conversations(2026-02-23)
Updated dependencies []:
v1.352.0Compare Source
1.352.0
Minor Changes
c3c9780Thanks @veryayskiy! - Ability to retrieve previous conversations(2026-02-20)
Patch Changes
v1.351.4Compare Source
1.351.4
Patch Changes
2649a9aThanks @dmarticus! - Adds a fresh option to getFeatureFlag(), getFeatureFlagResult(), and isFeatureEnabled() that only returns values loaded from the server, not cached localStorage values.(2026-02-19)
2649a9a]:v1.351.3Compare Source
1.351.3
Patch Changes
1a53e8cThanks @adboio! - add animation option for tour banners(2026-02-19)
v1.351.2[Compare Source](https://redirect.github.com/PostHog/posthog-js/compare/posthog-js@1.351.1...posthog-
Configuration
📅 Schedule: Branch creation - "on Monday" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.