chore(deps): update all non-major dependencies#446
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
9c4e39b to
5bfebea
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
5bfebea to
7804f68
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
7804f68 to
2d975ff
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
2d975ff to
0104ff1
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
0104ff1 to
8120e32
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
8120e32 to
5ec9f5e
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
5ec9f5e to
efcb3b7
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
efcb3b7 to
1a61aec
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
1a61aec to
cf8e7f8
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
cf8e7f8 to
2b13cf8
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
6132302 to
360e116
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
360e116 to
aa97a8b
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
aa97a8b to
714cf9d
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
714cf9d to
bdbb60c
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
bdbb60c to
9343bf3
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
9343bf3 to
fb7fea7
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
fb7fea7 to
556aaae
Compare
commit: |
![vercel[bot]](https://avatars.githubusercontent.com/in/8329?s=60&v=4){kind=small}
| "@nuxt/image": "^1.11.0", | ||
| "@nuxt/scripts": "workspace:*", | ||
| "@nuxt/ui": "4.0.0", | ||
| "@nuxt/ui": "4.2.1", |
There was a problem hiding this comment.
| "@nuxt/ui": "4.2.1", | |
| "@nuxt/ui": "^4.2.1", |
The @nuxt/ui dependency is pinned to 4.2.1 without a caret, which is inconsistent with all other dependencies in this file that use flexible versioning with the ^ prefix.
View Details
Analysis
Inconsistent version pinning for @nuxt/ui dependency
What fails: docs/package.json line 20 specifies @nuxt/ui as pinned version 4.2.1 (without caret prefix), while all 13 other dependencies use caret versioning (^) for flexible version constraints within the major version.
How to reproduce:
cat docs/package.json | grep -A 15 '"dependencies"'Result: Shows "@nuxt/ui": "4.2.1" (pinned) while all surrounding dependencies have caret prefix:
"@nuxt/content": "^3.8.2""@nuxt/fonts": "^0.12.1""@nuxthq/studio": "^2.2.1"- All other 10 dependencies also use
^prefix
Expected behavior: According to npm semantic versioning, caret versioning allows compatible updates (minor/patch versions) within a major version. The project consistently uses this pattern for all other dependencies, so @nuxt/ui should be ^4.2.1 to match the established convention and allow patch/minor updates like other dependencies.
Root cause: Automated dependency update (Renovate bot commit 0b37709) preserved the previous pinned format when bumping the version from 4.0.0 to 4.2.1, rather than applying the project's standard caret versioning pattern used throughout the file.
| "posthog-js": "^1.0.0" | ||
| "@types/youtube": "^0.1.2", | ||
| "@unhead/vue": "^2.1.2", | ||
| "posthog-js": "^1.321.2" |
There was a problem hiding this comment.
| "posthog-js": "^1.321.2" | |
| "posthog-js": "^1.0.0" |
The posthog-js peer dependency constraint changed from ^1.0.0 to ^1.321.2, which is unusually restrictive and appears unintentional given the patch version bump in devDependencies (1.321.1 → 1.321.2).
View Details
Analysis
Overly restrictive posthog-js peer dependency breaks backward compatibility
What fails: The posthog-js peer dependency constraint in package.json was changed from ^1.0.0 to ^1.321.2 (commit 1536ad2), restricting supported versions to 1.321.2+ and rejecting all prior versions (1.0.0-1.321.1) that would previously install.
How to reproduce:
# User has posthog-js 1.200.0 installed (legitimate version under old ^1.0.0 constraint)
npm install @nuxt/scripts
# After update, npm now rejects this version because 1.200.0 does not satisfy ^1.321.2Result: npm/pnpm install fails with: "posthog-js@1.200.0 not satisfied by ^1.321.2"
Expected: The peer dependency should remain at ^1.0.0 (or similar permissive constraint) since:
- Code only uses
posthog.init()and basic config options (api_host,capture_pageview,disable_session_recording) available since 1.0.0 - The devDependency update was only a patch bump (1.222.0 → 1.321.2), not a major version requiring API changes
- Peer dependencies should be permissive to maximize compatibility
- Semantic versioning guidance indicates patch/minor version updates within the same major version should be backward compatible
This change appears to be an error from automated dependency update tooling (Renovate) that applied the same pinpoint version to both devDependencies and peerDependencies.
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
This PR contains the following updates:
^4.8.1→^4.8.2^9.7.0→^9.8.0^4.1.0→^4.2.0^4.1.0→^4.2.0^3.65.0→^3.65.1^3.58.1→^3.65.1^25.9.1→^25.9.3^0.2.0→^0.3.0^0.1.0→^0.3.0^2.4.10→^2.4.11v0.0.9-mp→v0.0.9v6.0.1→v6.0.3v10.0.0→v10.3.0^10.4.1→^10.5.0^20.9.0→^20.10.3^0.134.0→^0.135.011.5.0→11.6.0^1.378.1→^1.386.6^1.0.0→^1.386.6^4.60.4→^4.62.0^4.1.0→^4.2.0^3.0.0→^3.1.4^4.1.7→^4.1.8^3.5.35→^3.5.38^3.3.3→^3.3.5Release Notes
nuxt/ui (@nuxt/ui)
v4.8.2Compare Source
Bug Fixes
nameattribute (#6539) (f8186e2)localeprop (#6546) (ed2f955)paypal/paypal-js (@paypal/paypal-js)
v9.8.0Compare Source
Minor Changes
0ff45b7: Consolidating the shared GooglePay types to paypal-js package.Patch Changes
9007a82: Add optional submit options to CardFields submit() method, including billingAddress and name fields for 3DS authentication support6e1de75: Fix a typescript bug that was making .start options required.164d373: Update paypal one time payment session start options to be optional.shikijs/shiki (@shikijs/langs)
v4.2.0Compare Source
🚀 Features
🐞 Bug Fixes
View changes on GitHub
vuejs/test-utils (@vue/test-utils)
v2.4.11Compare Source
compare changes
🩹 Fixes
setData()correctly for components using bothsetup()anddata()(#2846)GlobalMountOptionstype (#2851)event.codeonkeydown/keyup(#2850)❤️ Contributors
Hebilicious/reproduire (Hebilicious/reproduire)
v0.0.9Compare Source
compare changes
actions/checkout (actions/checkout)
v6.0.3Compare Source
v6.0.2Compare Source
actions/stale (actions/stale)
v10.3.0Compare Source
What's Changed
Bug Fix
Dependency Updates
New Contributors
Full Changelog: actions/stale@v10...v10.3.0
v10.2.0Compare Source
v10.1.1Compare Source
What's Changed
Bug Fix
only-issue-typesby @Bibo-Joshi in #1298Improvement
Dependency Upgrades
New Contributors
Full Changelog: actions/stale@v10...v10.1.1
v10.1.0Compare Source
What's Changed
only-issue-typesoption to filter issues by type by @Bibo-Joshi in #1255New Contributors
Full Changelog: actions/stale@v10...v10.1.0
eslint/eslint (eslint)
v10.5.0Compare Source
capricorn86/happy-dom (happy-dom)
v20.10.3Compare Source
v20.10.2Compare Source
👷♂️ Patch fixes
v20.10.1Compare Source
v20.10.0Compare Source
oxc-project/oxc (oxc-parser)
v0.135.0pnpm/pnpm (pnpm)
v11.6.0Compare Source
Minor Changes
pnpm installcompletes without re-resolving whenpnpm-lock.yamlwas deleted butnode_modulesis intact: the up-to-date check now treats the current lockfile (node_modules/.pnpm/lock.yaml) — the record of what the previous install materialized — as the wanted lockfile, verifies the manifests still match it, restorespnpm-lock.yamlfrom it, and reports "Already up to date". Previously this scenario triggered a full resolution and a re-verification of every locked package against the registry.615c669: Added support for configuring URL-scoped registry settings throughnpm_config_//…andpnpm_config_//…environment variables, for example:This provides a file-free way to supply registry authentication. Because the registry a value applies to is encoded in the (trusted) environment variable name, it is host-scoped by construction and cannot be redirected to another registry by repository-controlled config. The environment value is treated as trusted config: it takes precedence over a project/workspace
.npmrcbut is still overridden by command-line options. When the same key is provided through both prefixes,pnpm_config_wins.Raised the default network concurrency from
min(64, max(cpuCores * 3, 16))tomin(96, max(cpuCores * 3, 64)). Package downloads are I/O-bound, not CPU-bound, so deriving the floor from the core count left machines with few cores (for example 4-vCPU CI runners) downloading only 16 tarballs at a time and unable to saturate a low-latency registry. ThenetworkConcurrencysetting still overrides the default.Patch Changes
.npmrcuses an environment variable in a registry/proxy URL or in registry credentials. The message now explains why the setting was ignored and how to migrate it to a trusted source — for example by moving the line to the user-level~/.npmrcor runningpnpm config set "<key>" <value>— with a link to https://pnpm.io/npmrc. Thepnpm config setexample is only suggested when the key has no${...}placeholder, so the snippet is always safe to copy-paste.os/cpu/libcfields are missing from the registry metadata or the lockfile. Some registries strip these fields from the package metadata, which made pnpm download and install the binaries of every platform regardless ofsupportedArchitectures. The missing platform fields of an optional dependency are now inferred from its name (e.g.@nx/nx-win32-arm64-msvc→os: win32,cpu: arm64), so foreign-platform binaries are skipped without even downloading them #11702.v11.5.3Compare Source
Patch Changes
Stopped expanding environment variables in repository-controlled registry/proxy request destinations and registry credential values from
.npmrc, and in workspace registry URLs frompnpm-workspace.yaml. Move dynamic registry URL and token configuration to trusted user, global, CLI, or environment config.Resolve package-manager bootstrap dependencies with trusted user or CLI registry and network config, and reject package-manager env-lockfile records that do not use registry package paths with integrity-only resolutions before auto-switch execution.
Avoid writing
packageManagerDependenciestopnpm-lock.yamlwhen package manager policy is set toonFail: ignoreorpmOnFail: ignore#12228.Avoid running dependency-status auto-install when the dependency status is unavailable without a project manifest.
Using the
$version reference syntax inoverrides(e.g."react": "$react") now prints a deprecation warning. The syntax still works, but catalogs are the recommended way to keep an overridden version in sync with the rest of the workspace. Reference a catalog entry with thecatalog:protocol instead.Fixed
pnpm config get globalconfigto return the globalconfig.yamlpath again pnpm/pnpm#11962.Fixed bare
--colorso it does not consume the following CLI flag, allowing command shorthands like--parallelto expand correctly and forms likepnpm --color with current <command>to dispatch the inner command instead of failing withMISSING_WITH_CURRENT_CMD.Fix
pnpm installignoringenableGlobalVirtualStoretoggle by including it in the workspace state settings check #12142.Security: pnpm now verifies the npm registry signature of a package-manager binary before spawning it, so a cloned repository cannot make pnpm download and execute an arbitrary native binary.
This covers two paths that select an executable from repository-controlled input:
pacquet(or@pnpm/pacquet) inconfigDependenciesopts in to pnpm's Rust install engine. pnpm now verifies that the installedpacquetshim and the host's@pacquet/<platform>-<arch>binary carry a valid npm registry signature for their exactname@version, and refuses to run pacquet (failing the command) if the signature does not verify or cannot be checked. The only graceful fallback to pnpm's own engine is when pacquet has no binary for the current platform.self-update— thepackageManager/devEngines.packageManagerfield makes pnpm download and run a specific pnpm version. pnpm now verifies the registry signature ofpnpm,@pnpm/exe, and the host platform binary before installing/spawning them, and refuses to run an engine whose signature does not match a published, signed release. The check runs only on an actual download (store cache miss), so it does not add a network round trip to every command.In both cases the signature is verified over the installed integrity, against npm's public signing keys that ship embedded in the pnpm CLI (like corepack), so bytes substituted via a tampered lockfile or a repository-controlled registry fail verification — and a registry the user did not vouch for cannot supply its own signing keys. The signed packument is fetched from the configured registry, so an npm mirror works transparently. Verification fails closed: if it cannot be completed (for example, the registry is unreachable), the command fails rather than running an unverified binary. The embedded keys are kept current by a release-time check against npm's signing-keys endpoint.
Made peer-dependent deduplication deterministic. When a peer-suffixed package variant was a subset of two or more mutually incompatible larger variants, the variant it collapsed into depended on the order importers were resolved in, which varies between machines. This could resolve the same workspace to different lockfiles on different platforms and make
pnpm dedupe --checkalternate between passing and failing.Reject invalid package names and versions from staged tarball manifests before deriving filenames for
pnpm stage download.Clarified in CLI help that the pnpm store is trusted shared state and store integrity checks are corruption detection, not a tamper boundary for untrusted store writers.
Reject reserved manifest
binnames ("",".","..", and scoped forms such as@scope/..) when resolving a package's bins. These names previously passed the bin-name guard and, when joined to the global bin directory during global remove/update/add operations, could resolve to the global bin directory itself or its parent and have it recursively deleted.Require trusted package identity before package-name
allowBuildsentries can approve lifecycle scripts for git, git-hosted tarball, direct tarball, and local directory artifacts. To approve one of those artifacts explicitly, use its peer-suffix-free lockfile depPath as theallowBuildskey. Lockfile verification now rejects lockfiles where a registry-style dependency path (name@semver) is backed by a git, directory, or git-hosted tarball resolution (ERR_PNPM_RESOLUTION_SHAPE_MISMATCH), so the dependency path is a reliable artifact identity by the time scripts can run.Security: pnpm now verifies the OpenPGP signature of a downloaded Node.js runtime's
SHASUMS256.txtbefore trusting its integrity hashes.When a repository requests a Node.js runtime (e.g. via
devEngines.runtime/useNodeVersion), the download mirror is repository-configurable throughnode-mirror:<channel>. The integrity of the downloaded binary was only checked againstSHASUMS256.txtfetched from that same mirror — a circular check that a malicious mirror could satisfy by serving a tampered binary together with a matchingSHASUMS256.txt. pnpm then executes the binary (for example to run lifecycle scripts).pnpm now fetches
SHASUMS256.txt.sigand verifies the detached OpenPGP signature against the Node.js release team's public keys, which ship embedded in the pnpm CLI. A mirror that serves a tampered binary cannot also produce a valid signature, so the download fails to verify. The embedded keys are kept current by a release-time check against the canonicalnodejs/release-keyslist.The musl variants from the hardcoded
unofficial-builds.nodejs.orgmirror are not repository-configurable and are signed by a different key, so they continue to be trusted over TLS.v11.5.2Compare Source
Patch Changes
Peer dependency resolution now reuses the peer contexts already recorded in the lockfile when those providers are still present in the dependency graph and still satisfy the peer ranges. This avoids unnecessary peer-context rewrites during lockfile regeneration. Current manifest choices remain authoritative: a newly added, explicitly updated, or aliased direct provider, a changed nested provider, or a locked version that no longer satisfies the range still takes precedence.
The lockfile verifier now checks that a registry entry pinning an explicit
tarballURL points at the artifact the registry's own metadata lists for thatname@version. Previously a tampered lockfile could pair a trustedname@versionwith an attacker-chosen tarball URL (and a matching integrity for those bytes), so the install fetched the attacker's bytes. A mismatch — or any entry that can't be confirmed against the registry — is rejected withERR_PNPM_TARBALL_URL_MISMATCH. Non-registry resolutions (file:, git-hosted, etc.) and registry entries without an explicit tarball URL (the URL is reconstructed from name+version+registry, so it is inherently bound) are unaffected; non-standard registry tarball URLs (npm Enterprise, GitHub Packages) still pass because they match the metadata.Fix
pnpm update --recursive --lockfile-only <pkg>@​<version>crashing withInvalid Versionwhen the catalog entry for<pkg>is a version range (e.g.^21.2.10) andcatalogModeisstrictorprefer. The catalog–version comparison now skips the equality check when either side is a range rather than passing a range tosemver.eq(), so range specifiers fall through to the existing mismatch handling instead of throwing #11570.Avoided a Node.js crash when pnpm exits after network requests on Windows.
Fixed packages being materialized into the virtual store without their root-level files (
package.json,LICENSE, README, root entrypoints) when multiplepnpm installprocesses ran against the same store/workspace concurrently. The fast import path used to destructively empty the shared target directory, so a concurrent importer could wipe files another importer had already written; if the surviving files included thepackage.jsoncompletion marker, every later install treated the broken directory as complete and never repaired it. The fast path now imports directly only when it can create the target directory exclusively, and otherwise builds the package in a private temp directory and atomically renames it into place #12197.Fix dependency build scripts not running under the global virtual store (
enableGlobalVirtualStore).In a workspace install, dependency build scripts are deferred to a single
rebuildpass (buildProjects). That pass resolved each package's location from the classicnode_modules/.pnpm/<depPathToFilename>layout, which does not exist under the global virtual store — so native dependencies (e.g. packages usingnode-gyp/prebuild-install) were never built and failed to load at runtime (Cannot find module .../build/Release/*.node).buildProjectsnow resolves the global-virtual-store projection directory (<storeDir>/links/<hash>, computed with the same graph hash the installer uses) whenenableGlobalVirtualStoreis set, and serializes concurrent builds of the same shared projection so parallel workspace projects don't race on the same directory.Don't promote a
runtime:dependency (such as the Node.js version fromdevEngines.runtimeorpnpm runtime set) into a catalog whencatalogModeisstrictorprefer. Aruntime:dependency round-trips todevEngines.runtime, which only recognizes theruntime:protocol; cataloging it rewrote the manifest entry tocatalog:, which broke that round-trip, stranded it indevDependencies, and leftdevEngines.runtimeuntouched.Skip lockfile
minimumReleaseAge/trustPolicyverification for non-registry tarball protocols (for examplefile:), so local tarball dependencies are not incorrectly checked against npm registry metadata.v11.5.1Compare Source
Patch Changes
pnpm auditperformance by pruning non-vulnerable lockfile subtrees and stopping path enumeration once vulnerable findings reach the path cap.npm_config_user_agentfor root lifecycle scripts during headless installs.integrityfield of a remote (non-registry) tarball dependency when its lockfile entry is rebuilt. Re-resolving such a dependency without re-fetching it (for example viapnpm update, or when another dependency changes) produced a resolution with no integrity — URL/tarball resolvers only learn the integrity after the tarball is downloaded — so the previously recorded integrity was dropped, making later installs fail withERR_PNPM_MISSING_TARBALL_INTEGRITY#12067.repositoryfield into the{ type, url }object form when creating the publish manifest, matching npm's behavior. Some registries (e.g. Gitea/Codeberg) reject a stringrepositorywith a 500 Internal Server Error duringpnpm publish#12099.@typescript-eslint/eslint-pluginpeer-depends on both@typescript-eslint/parserandtypescript, and@typescript-eslint/parserpeer-depends ontypescript), pnpm no longer reuses a hoisted instance of the shared peer that was resolved against a different version #12079.PostHog/posthog-js (posthog-js)
v1.386.6Compare Source
1.386.6
Patch Changes
#3804
a27b163Thanks @pauldambra! - fix(product-tours): drop the cached tours blob when product tours is not enabledTours fetched while product tours was enabled are cached under
ph_product_toursin the main persistence blob. Once product tours is disabled (remote config or thedisable_product_toursoption) that cache was never cleaned up, so a potentially large stale blob kept riding on every persistence write — and on every cross-tabstorageevent those writes broadcast.onRemoteConfignow clears the cached tours whenever product tours resolves to disabled; they are re-fetched if it is ever re-enabled. (2026-06-11)v1.386.5Compare Source
1.386.5
Patch Changes
bd06ac7Thanks @ksvat! - fix(replay): prevent silent recorder teardown on session-id rotation. When the session id rotates during active rrweb capture,_updateWindowAndSessionIdscallsstop()then synchronouslystart('session_id_changed'). Ifstop()took the_stopAfterCompressionQueueDrainspath (which fires whenever the compression queue is non-empty — common during steady recording), its async cleanup would later resolve and call_teardown()against the freshly-started recorder, stopping rrweb, removing event listeners, and emptying the V2 trigger-group matchers. From that point on, the recorder'sstatusgetter kept reportingactive/sampled(the_strategyreference was still set), but rrweb was no longer producing events, no listeners were registered, and no$snapshotdata reached the server — the session looked recording-eligible from event metadata yet produced no replay.start()now invalidates the compression-queue state (generation bump plus reset of the stop-in-progress flag and queued-event count), so any pending cleanup from a priorstop()bails at its existing generation check and a laterstop()of the new recorder is not mistaken for the old in-progress one. Affects long-running tabs that rotate session id mid-use (idle timeout, session-past-max-length, orposthog.reset()).(2026-06-11)
v1.386.4Compare Source
1.386.4
Patch Changes
fdc07f3Thanks @arnohillen! - replay: jump scrolls instantly when seeking past pages that usescroll-behavior: smooth. During fast-forward the replayer applied scrolls withbehavior: 'auto', which inherits the page's CSSscroll-behavior— so on sites that setscroll-behavior: smooth(e.g. Silk bottom sheets/modals) a seeked scroll animated from 0 instead of jumping, leaving scroll-revealed content (the open sheet) out of view and showing only the backdrop until the animation caught up. Sync scrolls now usebehavior: 'instant', matching the method's stated intent that smooth scrolling be disabled while fast-forwarding. Full snapshot rebuilds apply their initial offset withbehavior: 'instant'too, so the document-level scroll doesn't animate either.(2026-06-11)
v1.386.3Compare Source
1.386.3
Patch Changes
#3760
5ddfd44Thanks @benben! - fix(conversations): re-attach the support widget after SPA navigations that replacedocument.body(e.g. Turbo Drive), so the widget no longer disappears until a full page reload(2026-06-11)
#3690
dbf2377Thanks @pauldambra! - fix(sessionid): keep the session id stable across tabsA session now rotates only when every tab has been idle past the timeout, rather than whenever a single background tab decides it is idle. On the active event path an idle tab re-reads the session id from storage before rotating: if a sibling tab kept the session alive it does not rotate, and if a sibling already rotated it adopts that id instead of minting a new one. This removes spurious cross-tab session fragmentation (inflated session counts, truncated session durations, split replays). When a sibling session is adopted,
onSessionIdhandlers fire withchangeReason.crossTabAdoption: trueso session recording, pageview state, and session-scoped properties follow the new session. Whenpersistence_save_debounce_ms > 0(the2026-05-30default) the refresh reads only the session-id key so it cannot clobber a sibling's write.Note: projects with significant multi-tab usage will see fewer but longer sessions after upgrading — this is a correction of previously over-counted sessions, not a traffic change. (2026-06-11)
#3795
21441a8Thanks @pauldambra! - fix(persistence): stop per-request metadata rewriting the split-storage entries on every load$feature_flag_evaluated_at,$feature_flag_request_id, and$surveys_loaded_atchange on every/flags(or/surveys) load even when the flag and survey content is unchanged. Withsplit_storageenabled that made the multi-hundred-KB__flags/__surveyslocalStorage entries dirty on every SPA navigation, re-broadcasting the full payload to every open same-origin tab via cross-tabstorageevents — the exact pressure the split exists to remove. These keys are now marked volatile: a value-only change neither dirties the group nor alters its fingerprint, so the write is skipped and the freshest value rides along on the next real content write. Adding or deleting a volatile key still writes through (presence is fingerprinted, the moving value is not), and the in-memory value is always current — only the on-disk copy may lag until the next content change. (2026-06-11)Updated dependencies [
dbf2377]:v1.386.2Compare Source
1.386.2
Patch Changes
25822ac]:v1.386.1Compare Source
v1.386.0Compare Source
1.386.0
Minor Changes
#3634
612f97aThanks @lucasheriques! - feat(surveys): add opt-inappearance.allowGoBackfor multi-question surveys, and make button labels translatableRenders a "Back" button on web surveys after the first question. Default is off — existing surveys are unchanged. Uses a visited-index history stack so back-navigation respects branching paths (
response_based,specific_question), and abandoned-branch responses are pruned before submission so analytics aren't polluted. Returning to a question pre-fills the prior answer.appearance.backButtonTextoverrides the default label. The button uses the survey's text color so it stays readable on any background, and it also shows in survey previews.Also adds
submitButtonTextandbackButtonTextto survey-level translations, so both the submit and back button labels can be localized viaappearancetranslations (previously only the per-question button text was translatable). (2026-06-10)Patch Changes
612f97a]:v1.385.0Compare Source
1.385.0
Minor Changes
f601c49Thanks @dustinbyrne! - Promote external dependency script versioning to supportedstrict_script_versioningandasset_hostconfig options.(2026-06-10)
Patch Changes
#3753
c11794dThanks @dustinbyrne! - Reload feature flags by default when resetting person properties for flags.(2026-06-10)
#3742
23b2af1Thanks @arnohillen! - record: capture resting scroll offset onscrollendwhen a reveal scroll clamps to 0 before its target is scrollable (e.g. Silk sheets). Deduped againstscrollso normal gestures don't double event volume.(2026-06-10)
Updated dependencies [
c11794d,f601c49]:v1.384.3Compare Source
1.384.3
Patch Changes
2d21adaThanks @marandaneto! - Deprecate__preview_disable_beaconin favor ofdisable_beaconand mark__preview_disable_xhr_credentialsas a no-op.(2026-06-10)
2d21ada]:v1.384.2Compare Source
1.384.2
Patch Changes
d9462b3Thanks @marandaneto! - Deprecate__preview_eager_load_replayas a no-op now that session replay lazy loading is the default.(2026-06-10)
d9462b3]:v1.384.1Compare Source
1.384.1
Patch Changes
0e22d77Thanks @TueHaulund! - replayer: stop corrupting recordings when events are added behind the playhead.addEvent()used to apply any event older than the playback baseline synchronously onto the current DOM — correct for live-mode catch-up, but wrong for on-demand playback where snapshot chunks can finish loading after the user has seeked ahead. Applying those past mutations onto a DOM at a different position made theirremovesfail mirror lookups, andapplyMutationthen deleted the failed entries from the event objects themselves, so every later seek rebuilt from corrupted data (DOM nodes accumulating, e.g. duplicated text) and exports serialized the stripped events. Past events are now only applied synchronously in live mode (otherwise they are just inserted for the next seek to pick up), andapplyMutationfilters removes into a local copy instead of mutating the event data.(2026-06-10)
v1.384.0Compare Source
v1.383.3Compare Source
1.383.3
Patch Changes
783ba46Thanks @marandaneto! - Deprecate the no-op__preview_flags_v2browser SDK config option. The SDK already uses the/flags/?v=2endpoint by default.(2026-06-09)
783ba46]:v1.383.2Compare Source
1.383.2
Patch Changes
7820929Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.