Skip to content

chore(deps): bump posthog-node from 5.49.1 to 5.51.2 - #321

Merged
htilly merged 1 commit into
masterfrom
dependabot/npm_and_yarn/posthog-node-5.51.1
Aug 28, 2026
Merged

chore(deps): bump posthog-node from 5.49.1 to 5.51.2#321
htilly merged 1 commit into
masterfrom
dependabot/npm_and_yarn/posthog-node-5.51.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 28, 2026

Copy link
Copy Markdown
Contributor

Bumps posthog-node from 5.49.1 to 5.51.2.

Release notes

Sourced from posthog-node's releases.

posthog-node@5.51.2

5.51.2

Patch Changes

  • #4639 1faeb74 Thanks @​marandaneto! - Handle empty feature flag evaluation key scopes without running local or remote evaluation. (2026-08-25)

  • #4610 930de19 Thanks @​marandaneto! - Share feature flag matching, hashing, variant, and payload evaluation helpers across the Node.js and Convex SDKs without changing their runtime-specific SemVer behavior. (2026-08-25)

  • Updated dependencies [930de19, d4eee8f]:

    • @​posthog/core@​1.48.11

posthog-node@5.51.1

5.51.1

Patch Changes

  • #4614 3593c43 Thanks @​iamomiid! - The Node SDK now sends the raw gzip bytes as the request body instead of wrapping them in a Blob. On Node 24.16 and later, reading a Blob request body leaks a native BlobReader that is never released, so a service calling capture() and flush() once per request grew by roughly 2.3 KB of heap per event and never gave it back. This completes the work in #4423: switching to node:zlib removed the compression-time Blob reads, but the body itself was still a Blob and still got read once per request. Compression behaviour, headers and the wire format are unchanged, and the edge build keeps using CompressionStream. (2026-08-24)
  • Updated dependencies [3593c43]:
    • @​posthog/core@​1.48.9

posthog-node@5.51.0

5.51.0

Minor Changes

  • #4564 233ac88 Thanks @​marandaneto! - Fall back to remote evaluation when a requested flag is missing from loaded local definitions. This changes scoped calls that previously omitted the flag without making a request. (2026-08-24)

posthog-node@5.50.0

5.50.0

Minor Changes

  • #4484 557140e Thanks @​posthog! - FeatureFlagEvaluations.isEnabled() now accepts an optional defaultValue option, returned whenever the flag has no value (missing key, not loaded, or a failed request). A flag with a present value — including false and variant strings — always wins over defaultValue. Purely additive; omitting the option preserves the existing false-on-miss behavior. (2026-08-21)

posthog-node@5.49.4

5.49.4

Patch Changes

  • #4569 00d22ea Thanks @​v11t! - fix getFeatureFlagResult returning null variant instead of undefined when remotely evaluated (2026-08-21)

posthog-node@5.49.3

5.49.3

... (truncated)

Changelog

Sourced from posthog-node's changelog.

5.51.2

Patch Changes

  • #4639 1faeb74 Thanks @​marandaneto! - Handle empty feature flag evaluation key scopes without running local or remote evaluation. (2026-08-25)

  • #4610 930de19 Thanks @​marandaneto! - Share feature flag matching, hashing, variant, and payload evaluation helpers across the Node.js and Convex SDKs without changing their runtime-specific SemVer behavior. (2026-08-25)

  • Updated dependencies [930de19, d4eee8f]:

    • @​posthog/core@​1.48.11

5.51.1

Patch Changes

  • #4614 3593c43 Thanks @​iamomiid! - The Node SDK now sends the raw gzip bytes as the request body instead of wrapping them in a Blob. On Node 24.16 and later, reading a Blob request body leaks a native BlobReader that is never released, so a service calling capture() and flush() once per request grew by roughly 2.3 KB of heap per event and never gave it back. This completes the work in #4423: switching to node:zlib removed the compression-time Blob reads, but the body itself was still a Blob and still got read once per request. Compression behaviour, headers and the wire format are unchanged, and the edge build keeps using CompressionStream. (2026-08-24)
  • Updated dependencies [3593c43]:
    • @​posthog/core@​1.48.9

5.51.0

Minor Changes

  • #4564 233ac88 Thanks @​marandaneto! - Fall back to remote evaluation when a requested flag is missing from loaded local definitions. This changes scoped calls that previously omitted the flag without making a request. (2026-08-24)

5.50.0

Minor Changes

  • #4484 557140e Thanks @​posthog! - FeatureFlagEvaluations.isEnabled() now accepts an optional defaultValue option, returned whenever the flag has no value (missing key, not loaded, or a failed request). A flag with a present value — including false and variant strings — always wins over defaultValue. Purely additive; omitting the option preserves the existing false-on-miss behavior. (2026-08-21)

5.49.4

Patch Changes

  • #4569 00d22ea Thanks @​v11t! - fix getFeatureFlagResult returning null variant instead of undefined when remotely evaluated (2026-08-21)

5.49.3

Patch Changes

  • #4583 6322f09 Thanks @​turnipdabeets! - Fix logs and metrics being silently dropped when an attribute holds a very large integer, a function, a symbol, a sparse array, or a truncated emoji. Cap log and metric attributes at 20 levels of nesting, 1,000 entries per object and 10,000 values in total, marking anything beyond as [Truncated]. Type OtlpAnyValue.intValue as string | number — code reading that field must handle both. (2026-08-21)
  • Updated dependencies [6322f09]:

... (truncated)

Commits
  • d22676a chore: update versions and lockfile [version bump]
  • 1faeb74 fix(flags): handle empty evaluation key scopes (#4639)
  • d4eee8f refactor(surveys): share property matching helpers (#4611)
  • 930de19 refactor(feature-flags): share local evaluation helpers (#4610)
  • 0540533 chore: update versions and lockfile [version bump]
  • 3593c43 fix(node): send gzip bytes instead of a Blob request body (#4614)
  • cedf844 chore: update versions and lockfile [version bump]
  • 233ac88 feat(node): fall back for requested flags missing locally (#4564)
  • 3508c05 chore: update versions and lockfile [version bump]
  • 557140e feat(node): isEnabled() accepts a caller-supplied default value (#4484)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Aug 28, 2026
@htilly

htilly commented Aug 28, 2026

Copy link
Copy Markdown
Owner

@dependabot rebase

Bumps [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) from 5.49.1 to 5.51.2.
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.51.2/packages/node)

---
updated-dependencies:
- dependency-name: posthog-node
  dependency-version: 5.51.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title chore(deps): bump posthog-node from 5.49.1 to 5.51.1 chore(deps): bump posthog-node from 5.49.1 to 5.51.2 Aug 28, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/posthog-node-5.51.1 branch from f8c49ef to d3e1d63 Compare August 28, 2026 21:11
@htilly
htilly merged commit 789c307 into master Aug 28, 2026
5 checks passed
@htilly
htilly deleted the dependabot/npm_and_yarn/posthog-node-5.51.1 branch August 28, 2026 21:34
htilly pushed a commit that referenced this pull request Aug 28, 2026
Security: fixed GHSA-hq3h-g68c-hp78 / CVE-2026-55553 (credential
leak on cross-origin redirect) by removing the unused
@jsfeb26/urllib-sync dependency (#322).

Dependency upgrade: posthog-node 5.49.1 -> 5.51.2, including an
upstream fix for a Node 24.16+ memory leak (#321).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant