Skip to content

build(deps): Bump posthog-node from 5.46.1 to 5.47.3 - #644

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/posthog-node-5.47.3
Closed

build(deps): Bump posthog-node from 5.46.1 to 5.47.3#644
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/posthog-node-5.47.3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 3, 2026

Copy link
Copy Markdown
Contributor

Bumps posthog-node from 5.46.1 to 5.47.3.

Release notes

Sourced from posthog-node's releases.

posthog-node@5.47.3

5.47.3

Patch Changes

  • #4349 0e2b371 Thanks @​marandaneto! - Apply the feature flag definition request timeout while consuming the response body. (2026-07-31)

  • #4349 0e2b371 Thanks @​marandaneto! - Keep the feature flag definition request timeout active until the request settles. (2026-07-31)

posthog-node@5.47.2

5.47.2

Patch Changes

  • #4332 b9a241e Thanks @​ioannisj! - Fix identify() leaving a user anonymous when the supplied ID already matches the persisted distinct ID (for example after a non-identified bootstrap seeded the same ID). The user is now marked identified and a person-processed $set event is captured. Ports the same fix from posthog-js (browser) to the shared core used by React Native, Node, and posthog-js-lite. (2026-07-31)
  • Updated dependencies [b9a241e]:
    • @​posthog/core@​1.46.1

posthog-node@5.47.1

5.47.1

Patch Changes

posthog-node@5.47.0

5.47.0

Minor Changes

  • #4308 6e7f3ae Thanks @​ablaszkiewicz! - Emit the release id that posthog-cli injects into your bundle as $release_id on $exception events, so PostHog can attach exceptions to a release without joining through symbol sets. Adds getInjectedReleaseId() to @posthog/core. The property is only attached when an injected release id can be read. (2026-07-30)

Patch Changes

  • Updated dependencies [6e7f3ae]:
    • @​posthog/core@​1.46.0
Changelog

Sourced from posthog-node's changelog.

5.47.3

Patch Changes

  • #4349 0e2b371 Thanks @​marandaneto! - Apply the feature flag definition request timeout while consuming the response body. (2026-07-31)

  • #4349 0e2b371 Thanks @​marandaneto! - Keep the feature flag definition request timeout active until the request settles. (2026-07-31)

5.47.2

Patch Changes

  • #4332 b9a241e Thanks @​ioannisj! - Fix identify() leaving a user anonymous when the supplied ID already matches the persisted distinct ID (for example after a non-identified bootstrap seeded the same ID). The user is now marked identified and a person-processed $set event is captured. Ports the same fix from posthog-js (browser) to the shared core used by React Native, Node, and posthog-js-lite. (2026-07-31)
  • Updated dependencies [b9a241e]:
    • @​posthog/core@​1.46.1

5.47.1

Patch Changes

5.47.0

Minor Changes

  • #4308 6e7f3ae Thanks @​ablaszkiewicz! - Emit the release id that posthog-cli injects into your bundle as $release_id on $exception events, so PostHog can attach exceptions to a release without joining through symbol sets. Adds getInjectedReleaseId() to @posthog/core. The property is only attached when an injected release id can be read. (2026-07-30)

Patch Changes

  • Updated dependencies [6e7f3ae]:
    • @​posthog/core@​1.46.0
Commits
  • 4e4aab7 chore: update versions and lockfile [version bump]
  • 0e2b371 fix(node): keep feature flag definition timeout active (#4349)
  • 557798d chore: update versions and lockfile [version bump]
  • cbc7b22 chore: update versions and lockfile [version bump]
  • 15aad20 fix(node): isolate NestJS context per subscription (#4351)
  • 4ef8a41 chore: update versions and lockfile [version bump]
  • 6e7f3ae feat: emit $release_id from the injected release id (#4308)
  • 3b2e68d fix: prevent Jest worker resource leaks (#4247)
  • See full diff in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
build(deps): Bump posthog-node from 5.46.1 to 5.47.3
2badba6 
Bumps [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) from 5.46.1 to 5.47.3.
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.47.3/packages/node)

---
updated-dependencies:
- dependency-name: posthog-node
  dependency-version: 5.47.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 3, 2026
@socket-security

socket-security Bot commented Aug 3, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedposthog-node@​5.46.1 ⏵ 5.47.39110079 +1100100

View full report

NiveditJain added a commit that referenced this pull request Aug 4, 2026
@NiveditJain @claude
fix(deps): clear the undici advisories and land Dependabot #641-#649
74b51c9 
The Supply Chain (OSV-Scanner) gate was red on every open PR, including
all nine Dependabot bumps, on a finding none of them introduced: five
undici advisories published after main's last green scan. undici is
transitive under the jsdom test environment and already pinned via
`overrides` from the previous round of this same fix (#446), so the
repair is a one-line bump of that pin to 7.29.0.

With the shared blocker gone, the nine bumps are folded in here rather
than merged one at a time:

  #641 actions/download-artifact  4      -> 8
  #642 docker/login-action        4.5.1  -> 4.6.0
  #643 actions/upload-artifact    4      -> 7
  #644 posthog-node               5.46.1 -> 5.47.7
  #645 jsdom                      30.0.0 -> 30.0.1
  #646 @tanstack/react-virtual    3.14.8 -> 3.14.9
  #647 lucide-react               1.27.0 -> 1.28.0
  #648 @types/node                26.1.1 -> 26.1.2
  #649 @vitejs/plugin-react       6.0.3  -> 6.0.5

The two artifact actions are major bumps and have to land together,
because build-daemon.yml uploads the failproofaid-* binaries that
publish.yml downloads. Every input in use was checked against each
target's action.yml rather than assumed: name/path/if-no-files-found
and pattern/path/merge-multiple all survive, and the new `archive`
input defaults to true so the zip round trip is unchanged.
translate-docs.yml was already on v7/v8, so this leaves the repo on
one major instead of straddling two.

Verified with CI's own scanner image (osv-scanner-action:v2.3.8)
against the updated lockfile: No issues found, exit 0, with
osv-scanner.toml still holding zero ignored vulnerabilities.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013zdtoUrNwGKm7ZYpQTdBZy
@NiveditJain NiveditJain mentioned this pull request Aug 4, 2026
Merged
@NiveditJain

NiveditJain commented Aug 4, 2026

Copy link
Copy Markdown
Member

Superseded by #650, which lands this bump along with the other eight open Dependabot PRs (#641–#649).

This PR's CI was red only on the Supply Chain (OSV-Scanner) gate, and on a finding it did not introduce: five advisories against undici@7.28.0 that published after main's last green scan, so every open PR went red at once. #650 clears that by bumping the existing undici overrides pin to 7.29.0, then folds in all nine bumps together.

Verified there: CI's own scanner image reports No issues found / exit 0 against the updated lockfile, osv-scanner.toml still holds zero ignored vulnerabilities, and the full suite (lint, tsc, unit, build, e2e) is green.

Closing in favour of #650 — no change is lost.

@NiveditJain NiveditJain closed this Aug 4, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 4, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/bun/posthog-node-5.47.3 branch August 4, 2026 06:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@NiveditJain