Update dependency posthog-js to v1.57.2 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
posthog-js	1.51.4 -> 1.57.2

GitHub Vulnerability Alerts

CVE-2023-32325

Impact

Potential for cross-site scripting in posthog-js.

Patches

The problem has been patched in posthog-js version 1.57.2.

Workarounds

• This isn't an issue for sites that have a Content Security Policy in place.
• Using the HTML tracking snippet on PostHog Cloud always guarantees the latest version of the library – in that case no action is required to upgrade to the patched version.

References

We will publish details of the vulnerability in 30 days as per our security policy.

---

Release Notes

PostHog/posthog-js (posthog-js)

v1.57.2

Compare Source

v1.57.1

Compare Source

• fix(decide): Make sure all stored properties are sent on first decide request (#​633)
• fix(identify): actually send $set_once on identify calls (#​629)

v1.57.0

Compare Source

• feat: Added OS version to the OS details (#​624)
• fix: Don't delete existing flags on decide errors (#​621)

v1.56.0

Compare Source

• feat: Allow custom masking of network events (#​620)

v1.55.2

Compare Source

• feat: Added idle timer to recordings (#​626)
• docs: Add Nuxt 3 demo (#​623)

v1.55.1

Compare Source

• fix: Script loading before DOM is ready (#​618)
• Expose options to mask text in session recording (#​595)

v1.55.0

Compare Source

• feat(beta-management): Add opt-in and out functions (#​616)

v1.54.0

Compare Source

• release new version (#​617)
• feat(flags): Allow adding person and group property overrides for flags (#​613)

v1.53.4

Compare Source

• feat: Allow masking of input by referencing the element (#​611)

v1.53.3

Compare Source

• fix: Usage of sessionStorage even if memory persistence (#​609)

v1.53.2

Compare Source

• fix: Don't enable web perf by default for localhost (#​608)

v1.53.1

Compare Source

• chore: bump version (#​607)
• feat: Swap over to storing network events in recordings (#​606)

v1.53.0

Compare Source

• feat: Custom campaign param support (#​603)
• chore(deps): Bump http-cache-semantics from 4.1.0 to 4.1.1 (#​528)
• fix: change user_id -> $user_id in docstring (#​525)
• Remove flag param from useActiveFeatureFlags (#​599)

v1.52.0

Compare Source

• fix: Track referrer/search params per browser session (#​496)
  Note: This change improves the accuracy of properties $referrer and $referring_domain in a major way. Previously, the values of these properties often represented pure backlinks in non-SPAs (non-single-page applications). Now those values will represent the true referrer for the current browser-level session (effectively: for the tab). Due to this, referrer data after this update may look different. It will be significantly more accurate though.
• ci: Point out and close stale issues/PRs (#​602)
• docs(testcafe): update docs removing posthog server requirements (#​594)

v1.51.5

Compare Source

• fix(segment): handle race condition on loading segment integration (#​586)

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
hand-pickr	❌ Failed (Inspect)			Aug 6, 2024 6:06am