beasty/beastypage

Fork 0

chore(deps): update non-major dependencies #22

Merged

beasty merged 1 commit from renovate/all-minor-patch into main

2026-07-22 19:21:49 +00:00

renovate-bot commented

2026-07-20 03:35:34 +00:00

Collaborator

This PR contains the following updates:

Package	Change	Age	Confidence
@biomejs/biome (source)	`2.4.10` → `2.5.5`
@clerk/ui (source)	`1.3.0` → `1.25.7`
@hono/zod-validator (source)	`^0.7.6` → `^0.9.0`
@scalar/nextjs-api-reference (source)	`^0.9.18` → `^0.11.0`
@tailwindcss/postcss (source)	`4.1.18` → `4.3.3`
@types/node (source)	`25.2.0` → `25.9.5`
@types/node (source)	`22.19.10` → `22.20.1`
@types/react (source)	`19.2.14` → `19.2.17`
autoprefixer	`10.4.24` → `10.5.4`
binpackingjs	`3.0.2` → `3.1.0`
concurrently	`9.2.1` → `9.2.4`
convex (source)	`1.39.1` → `1.42.3`
discord.js (source)	`14.25.1` → `14.27.0`
fuse.js (source)	`7.1.0` → `7.5.0`
jimp	`1.6.0` → `1.6.1`
lucide-react (source)	`^0.563.0` → `^0.577.0`
motion	`12.38.0` → `12.42.2`
pixelmatch	`7.1.0` → `7.2.0`
posthog-js (source)	`1.364.6` → `1.407.0`
react (source)	`19.2.4` → `19.2.8`
react-colorful (source)	`5.6.1` → `5.8.0`
react-dom (source)	`19.2.4` → `19.2.8`
tailwind-merge	`3.4.0` → `3.6.0`
tailwindcss (source)	`4.1.18` → `4.3.3`
tsx (source)	`4.21.0` → `4.23.1`
typescript (source)	`6.0.2` → `6.0.3`
vitest (source)	`4.1.2` → `4.1.10`
zod (source)	`4.3.6` → `4.4.3`

Release Notes

biomejs/biome (@biomejs/biome)

`v2.5.5`

Compare Source

Patch Changes

#10972 ab8c21b Thanks @ematipico! - Fixed useExhaustiveSwitchCases for unions of bigint literals. The rule now reports missing bigint cases and compares bigint literals by value, including binary, octal, hexadecimal, and separator-containing spellings. For example, this switch now reports the missing 2n case:
```
declare const value: 1n | 2n;
switch (value) {
  case 1n:
    break;
}
```
#10972 ab8c21b Thanks @ematipico! - Fixed false positives in noBaseToString and useNullishCoalescing when member, stringification, or nullish inference cannot complete. These rules now suppress diagnostics instead of reporting from partial type information. For example, neither expression is reported when a recursive type cannot be fully resolved:
```
type Recursive = Recursive;
declare const value: Recursive;

String(value);
value || "fallback";
```
#10977 0bf7486 Thanks @ematipico! - Fixed #10922: the action useSortedAttributes no longer triggers for HTML instructions.
#10957 cf263c4 Thanks @dyc3! - Fixed noThenProperty failing to detect Object.fromEntries, Object.defineProperty, and Reflect.defineProperty calls with comments between their tokens.
#10983 edc0ed7 Thanks @ayaangazali! - Fixed #10980: useAriaPropsSupportedByRole no longer reports false positives when the attribute that determines an element's implicit ARIA role is written as a shorthand attribute, such as <a {href} aria-label="..."> in Astro and Svelte files.

Shorthand attributes are now taken into account when computing the implicit role, so the anchor above correctly resolves to the link role instead of generic.

#10889 89526e3 Thanks @denbezrukov! - Fixed CSS formatter casing for syntax-owned names while preserving author-defined names, including scoped keyframes and container scroll-state queries.

- A:HOVER { COLOR: INITIAL; }
+ A:hover { color: initial; }
- @&#8203;KEYFRAMES :GLOBAL KeepFrames { FROM { COLOR: RED; } }
+ @&#8203;keyframes :GLOBAL KeepFrames { from { color: RED; } }
- @&#8203;CONTAINER scroll-state((SCROLLED: TOP) AND (STUCK)) { A:HOVER { COLOR: RED; } }
+ @&#8203;container scroll-state((SCROLLED: TOP) AND (STUCK)) { A:hover { color: RED; } }

#10964 794ccd0 Thanks @denbezrukov! - Fixed CSS formatting for comments between declaration values and !important.
```
-a { color: /* before */ /* after */ red !important; }
+a { color: /* before */ red /* after */ !important; }
```
#10993 b7a9694 Thanks @denbezrukov! - Fixed the CSS formatter to preserve comments on the correct side of selector combinators and before declaration blocks.
```
-.before > /* comment */ .after {}
+.before /* comment */ > .after {}
```
It now also keeps selectors with escaped newlines in attribute values inline when they fit.
```
-div
-  span[foo="bar\
+div span[foo="bar\
 value"] {}
```
#10978 8ebafe1 Thanks @ematipico! - Fixed #10870: noUnresolvedImports no longer reports false positives such as import type { NextRequest } from "next/server".
#10901 68c10e6 Thanks @Socialpranker! - Fixed #10622: the HTML/Vue parser no longer panics on the argument-less v-bind shorthand (:="props").

This syntax is valid Vue and equivalent to v-bind="props", so the parser now accepts it (along with the longhand v-bind:="props") instead of crashing while building a diagnostic for a missing argument.
#10936 7df46f5 Thanks @ematipico! - Improved generic tuple inference for useIncludes. The rule now recognizes specialised tuple element types returned through generic aliases.
#10941 f787725 Thanks @siketyan! - Fixed #10855: Biome now supports parsing and formatting CSS custom media queries declared with @custom-media.
#10969 72d309b Thanks @ematipico! - Fixed an issue where Biome logs became too verbose, dumping information not relevant to user's operations.
e62f6b6 Thanks @ematipico! - Fixed #10963: Biome no longer panics when a type-aware rule such as noFloatingPromises checks a call to a function with multiple call signatures imported from another module.
#10931 899c60d Thanks @ematipico! - Fixed check --write command. Now the command reports code frame of the formatted code, if the formatter is enabled.
#10904 ceee4f4 Thanks @qzwxsaedc! - Fixed #10892: noUnnecessaryConditions no longer reports a false positive when checking a member of a discriminated union that is accessed through a default type-only namespace import. The following code is no longer flagged:
```
import type Types from "./types";

declare function parse(): Types.Result<string>;
const result = parse();
if (!result.success) {
}
```
#10962 f0a67f2 Thanks @ematipico! - Biome no longer removes embedded styles and scripts in HTML files.
#11000 5039a1e Thanks @ematipico! - Fixed a bug where closing one editor stopped a shared Biome daemon used by other editors. LSP proxy processes now exit when either the editor or daemon disconnects.
#10957 cf263c4 Thanks @dyc3! - Improved the performance of the noThenProperty lint rule by about 50%.
#10992 4bf9b21 Thanks @ematipico! - Fixed noMisusedPromises: The rule now reports Promise-returning callbacks where a synchronous callback is expected when calls use tuple spreads or tuple rest parameters, including generic and deeply nested tuples, and when constructor signatures come from interface or object types. Recursive or excessively nested tuple spreads use a conservative fallback so analysis terminates.

For example, the following callback is now reported.
```
declare function consume(...args: [number, () => void]): void;
const prefix: [number] = [1];

consume(...prefix, async () => {});
```
#10915 b3b12b3 Thanks @Functionhx! - Added the rule noNegationInEqualityCheck. The rule flags negated expressions on the left side of strict equality checks like !foo === bar — due to operator precedence this evaluates as (!foo) === bar which is almost always a mistake for foo !== bar.

The rule provides an unsafe fix that flips the operator.
```
// Invalid
!foo === bar;
!foo !== bar;

// Valid
foo !== bar;
foo === bar;
```
#10970 bd1038b Thanks @ematipico! - Improved overload selection for noMisusedPromises. Biome now handles overloaded calls, overloaded constructors, rest parameters, union arguments, and generic constraints without selecting an incompatible signature. For example, noMisusedPromises now reports the async callback passed to the synchronous overload:
```
declare function consume(kind: "async", callback: () => Promise<void>): void;
declare function consume(kind: "sync", callback: () => void): void;
consume("sync", async () => {});
```
#10933 48a4abb Thanks @ematipico! - Fixed useArrayFind to recognize bigint zero indexes.
#10931 899c60d Thanks @ematipico! - Fixed an orchestration issue that could lead to deadlocks when type-aware rules are enabled.
#10969 72d309b Thanks @ematipico! - Hardened the Biome Language Server by improving its synchronisation logic.
#10972 ab8c21b Thanks @ematipico! - Fixed false positives in noMisusedPromises and useAwaitThenable when Promise or thenable inference cannot complete. These rules now suppress diagnostics instead of treating incomplete type information as a definite result. For example, useAwaitThenable no longer reports await value when the value's thenability is unknown:
```
declare const value: unknown;

async function consume() {
  await value;
}
```

`v2.5.4`

Compare Source

Patch Changes

#10665 55ff995 Thanks @dyc3! - Improved the performance of the HTML parser slightly in our synthetic benchmarks.
#10894 f4fb10e Thanks @ematipico! - Fixed #6392: On-type formatting no longer moves comments before an if statement into its body.
#10939 f2799db Thanks @Netail! - Fixed #10930: noLabelWithoutControl now correctly detects text interpolation in Astro, Svelte & Vue as valid accessible content.
#10945 ae15d98 Thanks @Netail! - Fixed #10942: Svelte directives don't throw an accidental debug log anymore.
#10842 5e1abfe Thanks @JamBalaya56562! - Fixed #9196: biome check --write --unsafe no longer hangs forever when applying the noCommentText code fix.

The rule's fix now wraps the comment in a real JSX expression container ({/* comment */}) instead of re-inserting the braces as plain JSX text, so the fixed code is no longer reported again by the same rule.
#10891 ecca79e Thanks @ematipico! - Fixed #10885: prevented a module-inference regression introduced by a housekeeping change.

#10886 60c8043 Thanks @dyc3! - Fixed #10727: Biome now breaks the arguments of curried test.each, it.each, describe.each, and test.for calls when they exceed the configured line width.

- test.each([[1, 2]])("a description that is long enough to push the hugged opening line beyond the print width", (a, b) => {
-   expect(a).toBe(b);
- });
+ test.each([[1, 2]])(
+   "a description that is long enough to push the hugged opening line beyond the print width",
+   (a, b) => {
+     expect(a).toBe(b);
+   },
+ );

#10895 01a85f0 Thanks @ematipico! - Biome will now remove stale Unix daemon sockets from older Biome versions when starting a newer daemon.

`v2.5.3`

Compare Source

Patch Changes

#10815 86613d5 Thanks @WaterWhisperer! - Fixed a parser panic reported in #10708: Biome now recovers when unsupported CSS Modules @value rules or scoped @keyframes names end at EOF.
#10534 da9b403 Thanks @Mokto! - Fixed noUnusedVariables false positives in Svelte files: Svelte store subscriptions ($store references in templates now keep the underlying store binding from being flagged), and $bindable() props that are only written to in the script block (write-only is intentional for bindable props) are no longer reported as unused.
#10827 098ba41 Thanks @Aqu1bp! - Fixed #10698: The noUnsafeOptionalChaining rule now reports unsafe optional chains wrapped in TypeScript as, satisfies, type assertion, and instantiation expressions, such as new (value?.constructor as Constructor)().
#10773 3c6513d Thanks @otkrickey! - Fixed #10772: useVueValidVOn no longer reports a missing handler for v-on directives using a verb modifier (.stop / .prevent) without an expression, e.g. <div @click.stop></div>. The rule also accepts the arg-less object syntax <div v-on="$listeners"></div> instead of reporting a missing event name.
#10721 d83c66b Thanks @minseong0324! - Improved type-aware lint rule inference for built-in globals and indexed function calls. Biome now resolves Error(...), new Error(...), optional Error#stack, and calls through indexed function values such as handlers[0]() more accurately.
#10865 6450276 Thanks @ematipico! - Fixed #10845. Biome Language Server no longer goes in deadlock when the scanner is enabled.
#10853 93d8e53 Thanks @Netail! - Fixed #10840: Astro shorthand attribute syntax is now correctly being parsed from embedded nodes.
#10820 bba3092 Thanks @JamBalaya56562! - Fixed #10619: noProcessEnv now also reports computed (bracket) member access. Previously only dot access was checked, so process["env"] and env["NODE_ENV"] (where env is imported from node:process) were missed. Both static and computed accesses are now reported.
#10835 3447b2f Thanks @dyc3! - Fixed #10824: useDomQuerySelector now supports an ignore option for receiver identifiers that should not be reported.
#10875 b12e486 Thanks @dyc3! - Fixed #10795: --profile-rules now reports timings for each plugin separately as plugin/<pluginName>, matching the naming used by plugin suppressions, instead of aggregating all plugins under a single plugin/plugin entry.
#10877 d6bc447 Thanks @ematipico! - Fixed biome-zed#164: Biome no longer inserts stray whitespace when format-on-type runs after closing delimiters such as ), ], and }.
#10867 a21463e Thanks @dyc3! - Fixed #10864: Biome no longer crashes when checking or linting HTML files with unquoted attribute values such as <textarea rows=4></textarea>.

`v2.5.2`

Compare Source

Patch Changes

#10595 f458028 Thanks @pkallos! - Added the option ignoreBooleanCoercion to useNullishCoalescing. When enabled, Biome ignores || and ||= used inside a Boolean() call, where coalescing on falsy values is intentional.
#10798 4a32b63 Thanks @pkallos! - Added the option ignorePrimitives to useNullishCoalescing. When enabled, Biome ignores ||, ||=, and ternary expressions whose non-nullish operands are all primitives the option opts out of. Use true to ignore all primitives, or an object selecting string, number, boolean, or bigint.
#10545 f3d4c00 Thanks @Mokto! - Added the new nursery rule noSvelteUnnecessaryStateWrap, which reports unnecessary $state() wrapping of classes from svelte/reactivity that are already reactive.
```
<script>
import { SvelteMap } from "svelte/reactivity";
const map = $state(new SvelteMap()); // redundant
</script>
```
#10752 f62fb8b Thanks @ematipico! - Fixed #10739. Now the rule useValidAutocomplete correctly flags the autoComplete attribute.
#10796 f1b3ab2 Thanks @ematipico! - Fixed #10768. Improved the performance of the Biome Language Server by cancelling certain in-flight operations when there are fast updates.
#10719 aa649b5 Thanks @minseong0324! - Fixed noMisleadingReturnType false positive on returns that use a widening type assertion: "a" as string is no longer reported as misleading. The rule now also reports a literal-pinning assertion such as false as false, matching the existing as const behavior.
```
// No longer flagged (returns are `string`):
function getValue(b: boolean): string {
  if (b) return "a" as string;
  return "b" as string;
}

// Now also reported, like `as const` (returns `false`):
function isReady(): boolean {
  return false as false;
}
```
#10678 8f073a7 Thanks @PranavAchar01! - Fixed #7718: Biome now correctly parses CSS nesting selectors when & appears as a trailing sub-selector after a type selector, e.g. h1& { color: red; }.
#10756 5ec965a Thanks @denbezrukov! - Fixed CSS formatter output for selector lists with allowWrongLineComments and // comments after a selector comma. Biome now keeps the selector before the line comment inline instead of breaking it across descendant combinators.
```
-.powerPathNavigator
-  .helm
-  button.pressedButton, // pressed
+.powerPathNavigator .helm button.pressedButton, // pressed
 .powerPathNavigator .helm button:active:not(.disabledButton) {
 }
```
#10757 6232fcd Thanks @PranavAchar01! - Fixed #8269: the CSS parser now accepts Tailwind @variant and @utility names that start with a digit, such as the 2xl breakpoint.
```
@&#8203;utility container {
  @&#8203;variant 2xl {
    max-width: 1400px;
  }
}
```
#10777 575ced6 Thanks @WaterWhisperer! - Fixed an issue reported in #10708: the GitLab reporter now handles --verbose diagnostics filtering correctly.
#10281 0efe244 Thanks @Zelys-DFKH! - Fixed a bug where GritQL patterns rejected positional (unkeyed) arguments.
#10758 e36fd8a Thanks @henrybrewer00-dotcom! - Fixed #10697: The formatter no longer removes the parentheses around an await or yield expression used as the target of a TypeScript instantiation expression. For example, (await makeFactory)<Value> is no longer reformatted to await makeFactory<Value>, which would change the meaning of the code.

#10586 3617094 Thanks @IxxyDev! - Fixed #9568: noFloatingPromises no longer reports a false positive when calling an overloaded function and the selected overload does not return a promise.

function bestEffort(cb: () => Promise<number>): Promise<number>;
function bestEffort(cb: () => number): number;
function bestEffort(
  cb: () => number | Promise<number>,
): Promise<number> | number {
  return cb() as Promise<number> | number;
}

// This resolves to the second overload, which returns `number`, so it is no
// longer flagged as a floating promise.
bestEffort(() => 42);

#10766 7aff4c1 Thanks @JamBalaya56562! - Fixed #2862: noInteractiveElementToNoninteractiveRole no longer reports custom elements (a tag name containing a dash, e.g. <my-button role="img" />). Per the W3C HTML-ARIA specification, a custom element may be given any role or none.
#10680 771daa4 Thanks @WaterWhisperer! - Fixed #10635: Biome now recognizes chained
table tests such as test.concurrent.each() and it.concurrent.each() as test calls, fixing
noMisplacedAssertion false positives and improving formatting for those test declarations.
#10759 34570b5 Thanks @henrybrewer00-dotcom! - Fixed #10636: noStaticElementInteractions no longer reports a false positive for event handlers on Svelte special elements such as <svelte:window>, <svelte:document>, and <svelte:body>. These are not real DOM elements, so they are now ignored by the rule.
#10741 bd2364e Thanks @JamBalaya56562! - Fixed #6686: the rage command now respects the --config-path option and the BIOME_CONFIG_PATH environment variable when loading the Biome configuration. Previously it always used the default configuration resolution and reported the configuration as Not set when no biome.json existed in the working directory.
#10763 2c3e82d Thanks @Aqu1bp! - Fixed #10742: noSolidDestructuredProps now reports destructured props in Solid function components and JSX children.
#10606 a4cc4ab Thanks @Mokto! - Fixed false positives in noUnusedImports, noUnusedVariables, and useImportType for Svelte components that use both a <script module> and a <script> block. The two blocks compile to a single module and share a top-level scope, so a binding (import, function, or variable) declared in one block and used only in the other is no longer reported as unused.
#10767 36d5aa7 Thanks @otkrickey! - Fixed #10754: useVueValidVBind no longer reports the Vue 3.4+ same-name shorthand as missing a value. :foo and v-bind:foo are now accepted as equivalent to :foo="foo", while v-bind, v-bind:[dynamicArg], and :[dynamicArg] without a value continue to be reported.
#10775 a918af0 Thanks @WaterWhisperer! - Fixed an issue reported in #10708: biome rage didn't detect running Biome daemon pipes on Windows.
#10730 5a2e65b Thanks @dinocosta! - Fixed an issue where Biome was resolving the well-known Zed settings file from the wrong location on macOS and Windows.
#10807 d97fffe Thanks @ematipico! - Fixed an issue where .scss files were incorrectly analyzed when running biome check.
#10672 53c6efc Thanks @ematipico! - Fixed a bug where Biome incorrectly formatted snippets that have parsing errors.
#10719 aa649b5 Thanks @minseong0324! - Fixed useAwaitThenable false positive when awaiting a custom thenable that is not the global Promise. A value with a callable then member is now recognized as awaitable.
```
interface Thenable<T> {
  then(onfulfilled: (value: T) => void): void;
}
declare const t: Thenable<number>;
async function f() {
  await t;
}
```
#10734 4396496 Thanks @BangDori! - Fixed #10708: biome migrate now preserves trivia when migrating the deprecated recommended option to preset.
#10683 ae31a00 Thanks @Netail! - Fixed #10657 #10671 #10661 #10637 #10718: HTML rules now correctly handle dynamic attributes.
#10746 54e8239 Thanks @ematipico! - Fixed an issue where noUndeclaredClasses didn't correctly detect styles defined inside the Astro directive is:global.
#10770 dd1429c Thanks @ematipico! - Improved the Biome Language Server DX by orchestrating certain operations, so that they won't block the editor during typing. This improvement is more visible in large documents.
#10473 d9b5133 Thanks @Mokto! - Improved noUnusedImports, noUnusedVariables, noUnusedFunctionParameters, and useImportType for Svelte, Vue, and Astro files (with html.experimentalFullSupportEnabled). Bindings used only in the template — including component tags, attribute interpolations, directives, bind: shorthand, and snippet parameters — are no longer reported as unused, while genuinely unused ones still are.
#10796 f1b3ab2 Thanks @ematipico! - Fixed an issue where the Biome Language Server didn't enable project or type-aware lint rules, even when they were explicitly enabled.
#10746 54e8239 Thanks @ematipico! - Fixed an issue where noUndeclaredClasses didn't detect styles declared inside HTML documents.
#10774 bde945b Thanks @pattrickrice! - Fixed #10268 where a race condition resulted in internal errors such as: The file biome.json does not exist in the workspace.

`v2.5.1`

Compare Source

Patch Changes

#10722 f8a303d Thanks @denbezrukov! - Fixed CSS formatter output for comments between import media queries.

-@&#8203;import url("print.css") print,
-/* comment */
-screen;
+@&#8203;import url("print.css") print, /* comment */ screen;

#10738 9fdc560 Thanks @JamBalaya56562! - Fixed #9899: the json and json-pretty reporters now escape backslashes in a diagnostic's location.path. Previously, paths containing backslashes (such as Windows-style paths) were emitted unescaped, producing invalid JSON.
```
-    "path": "src\account\setup-passkey.tsx",
+    "path": "src\\account\\setup-passkey.tsx",
```
#10626 5f837df Thanks @tom-groves! - Fixed #10625: biome migrate no longer emits an invalid trailing comma when a renamed rule (such as noConsoleLog → noConsole) is the last member of its rule group. Previously this produced malformed output that aborted the migration of a strict-JSON biome.json with a parsing error.
#10535 c245f9d Thanks @Mokto! - Fixed a false positive in noUnusedVariables for Svelte files where variables referenced inside {@html expr} blocks were incorrectly reported as unused.
#10668 a0f197e Thanks @Netail! - The biome init command has been updated to include a more up-to-date URL to the first-party extensions page.
#10667 d8c3e87 Thanks @Netail! - Fixed #10664: useErrorCause now correctly detects a shorthand property.
#10696 ef2373f Thanks @ematipico! - Fixed #9566. Improved how the Biome Language Server loads multiple configuration files inside a workspace.
#10705 4ccb410 Thanks @ematipico! - Fixed #10652. Biome plugins are now properly filtered when using --only and --skip flags.
#10669 aa0a6eb Thanks @Netail! - Fixed #10651: useInlineScriptId now correctly trims trivia to detect if an id attribute has been set.
#10689 844b1be Thanks @ematipico! - Fixed #10658. The issue was caused by the "Go-to definition" editor feature, which was enabled by default. The feature is now disabled by default. To work, the feature triggers the scanner to build the module graph. This caused memory leak issues in cases where Biome starts in the home directory to modify files.

If you relied on this new feature, you must now turn on using the [editor settings] of the extension e.g. Zed and VSCode.
#10695 043fbb5 Thanks @ematipico! - Fixed #10674. Biome now throws an error when the field level is missing from a rule option.
#10712 5941df2 Thanks @Conaclos! - Improved the diagnostic and the documentation of useFlatMap.
#10615 23814f1 Thanks @qwertycxz! - Improved the DX the JSON schema when it's used by certain code editors like VSCode.
#10688 ec69489 Thanks @ematipico! - Fixed a bug where the Biome Daemon did not correctly shut down when the editor was closed during an in-progress operation, especially while scanning.
#10701 6c2e0d7 Thanks @ematipico! - Fixed #10694. The Biome Language Server no longer prints an error when the user hovers a variable imported from node_modules.
#10681 888515b Thanks @Conaclos! - Fixed useExportType that reported useless details in some diagnostics.
#10220 3694a13 Thanks @theBGuy! - Fixed useAnchorContent false positive for <a> elements used as render prop values (e.g. render={<a href="..." />}), a pattern where the receiving component renders its children inside the anchor element.
#10702 98823fb Thanks @ematipico! - Fixed #10612. The Biome parser now correctly parses processing instructions. The following SVG doesn't throw errors anymore:
```
<?xml version="1.0" encoding="UTF-8" ?>

<svg></svg>
```

#9539 f0615fd Thanks @ematipico! - Added a new reporter called concise. When --reporter=concise is passed the commands format, lint, check and ci, the diagnostics are printed in a compact manner:

! index.ts:2:10: lint/correctness/noUnusedImports: Several of these imports are unused.
! main.ts:9:7: lint/correctness/noUnusedVariables: This variable f is unused.
× index.ts:8:5: lint/suspicious/noImplicitAnyLet: This variable implicitly has the any type.
× main.ts:2:10: lint/suspicious/noRedeclare: Shouldn't redeclare 'z'. Consider to delete it or rename it.

#9495 2056b23 Thanks @aviraldua93! - Added the useKeyWithClickEvents a11y lint rule for HTML files (.html, .vue, .svelte, .astro). This is a port of the existing JSX rule. The rule enforces that elements with an onclick handler also have at least one keyboard event handler (onkeydown, onkeyup, or onkeypress) to ensure keyboard accessibility.

Inherently keyboard-accessible elements (<a>, <button>, <input>, <select>, <textarea>, <option>) are excluded, as are elements hidden from assistive technologies (aria-hidden) or with role="presentation" / role="none".
```

<div onclick="handleClick()">Click me</div>


<div onclick="handleClick()" onkeydown="handleKeyDown()">Click me</div>


<button onclick="handleClick()">Submit</button>
```
#9152 9ec8500 Thanks @ematipico! - Added new nursery lint rule noUndeclaredClasses for HTML, JSX, and SFC files (Vue, Astro, Svelte). The rule detects CSS class names used in class="..." (or className) attributes that are not defined in any <style> block or linked stylesheet reachable from the file.
```

<html>
  <head>
    <style>
      .button {
        color: blue;
      }
    </style>
  </head>
  <body>
    <div class="button typo"></div>
  </body>
</html>
```
#9152 9ec8500 Thanks @ematipico! - Added new nursery lint rule noUnusedClasses for CSS. The rule detects CSS class selectors that are never referenced in any HTML or JSX file that imports the stylesheet. This is a project-domain rule that requires the module graph.
```
/* styles.css — .ghost is never used in any importing file */
.button {
  color: blue;
}
.ghost {
  color: red;
}
```
```
/* App.jsx */
import "./styles.css";
export default () => <div className="button" />;
```
#9546 6567efa Thanks @nhedger! - Added a biome upgrade command for standalone installations. It upgrades Homebrew installs with brew upgrade biome, updates manually installed binaries from the latest GitHub release, and tells npm users to upgrade with their package manager instead.

#9716 701767a Thanks @faizkhairi! - Added the HTML version of the useHeadingContent rule. The rule now enforces that heading elements (h1-h6) have content accessible to screen readers in HTML, Vue, Svelte, and Astro files.

<!-- Invalid: empty heading -->
<h1></h1>

<!-- Invalid: heading hidden from screen readers -->
<h1 aria-hidden="true">invisible content</h1>

<!-- Valid: heading with text content -->
<h1>heading</h1>

<!-- Valid: heading with accessible name -->
<h1 aria-label="Screen reader content"></h1>

#9582 f437ef8 Thanks @rahuld109! - Added the HTML version of the useKeyWithMouseEvents rule. The rule now enforces that onmouseover is accompanied by onfocus and onmouseout is accompanied by onblur in HTML, Vue, Svelte, and Astro files.
```

<div onmouseover="handleMouseOver()"></div>


<div onmouseover="handleMouseOver()" onfocus="handleFocus()"></div>
```
#9275 1fdbcee Thanks @ff1451! - Added the new assist action useSortedTypeFields, which sorts the fields of GraphQL object types, interface types and input object types alphabetically, e.g. name, age, id becomes age, id, name.
#10561 78075b7 Thanks @Conaclos! - Added a new style option to useExportType,
which enforces a style for exporting types.
This is the same option as the one provided by useImportType.
#8987 d16e32b Thanks @DerTimonius! - Ported the useValidAnchor rule to HTML. This rule enforces that all anchors are valid and that they are navigable elements.
#9533 4d251d4 Thanks @ematipico! - The init command now prints the Biome logo.
#10069 0eb9310 Thanks @Netail! - Added the HTML lint rule noStaticElementInteractions, which enforces that static, visible elements (such as <div>) that have click handlers use the valid role attribute.

Invalid:
```
<div onclick="myFunction()"></div>
```
#9134 2a43488 Thanks @ematipico! - Added the assist action useSortedPackageJson.

This action organizes package.json fields according to the same conventions as the popular sort-package-json tool.
#9309 7daa18b Thanks @Bertie690! - The allowDoubleNegation option has been added to noImplicitCoercions to allow ignoring double negations inside code.

With the option enabled, the following example is considered valid and is ignored by the rule:
```
const truthy = !!value;
```
#9700 894f3fb Thanks @ematipico! - The Biome Language server now supports the "go-to definition" feature.

When the cursor of the mouse is hovering an entity (variable, CSS class, type, etc.), and the command CTRL + click is triggered, the editor jumps to where this entity is defined, if the language server can find it.

Here's what Biome is able to resolve:
- Variables and types used in JavaScript modules, defined in the same file or imported from another module.
- JSX Components used in JavaScript modules, defined in the same file or imported from another module.
- CSS classes used in JSX and HTML-ish files (Vue, Svelte and Astro), and defined in CSS files.
- Components used in HTML-ish files and defined in other HTML-ish.
- Variables used in HTML-ish files and defined in the same file or imported from another module (JavaScript or HTML-ish).

#10070 bae0710 Thanks @Conaclos! - Added the :STYLE: group matcher for organizeImports that matches style imports.

For example, the following configuration...

{
  "assist": {
    "actions": {
      "source": {
        "organizeImports": {
          "level": "on",
          "options": {
            "groups": ["**", "!:STYLE:"],
            "sortBareImports": true
          }
        }
      }
    }
  }
}

...places style imports last:

- import "./style.css"
  import A from "./a.js"
+ import "./style.css"

#9170 e3107de Thanks @mdrobny! - Added bundleDependencies option to NoUndeclaredDependencies rule.

This rule now supports imports of packages that are defined only in bundleDependencies and bundledDependencies arrays.
#9547 01f8473 Thanks @mujpao! - Added new assist rule useSortedAttributes for HTML, porting the existing JSX rule. This rule enforces sorted HTML attributes.

Invalid
```
<input type="text" id="name" name="name" />
```
#9366 2ca1117 Thanks @dyc3! - Added the html.parser.vue configuration option. When enabled, it adds support for the parsing of Vue in .html files. Most Vue users don't need to enable this option since Vue files typically use the .vue extension, but it can be useful for projects that embed Vue syntax in regular HTML files.
#9073 74b20ee Thanks @chocky335! - Added support for applying GritQL plugin rewrites as code actions. GritQL plugins that use the rewrite operator (=>) now produce fixable diagnostics for JavaScript, CSS, and JSON files. By default, plugin rewrites are treated as unsafe fixes and require --write --unsafe to apply. Plugin authors can pass fix_kind = "safe" to register_diagnostic() to mark a fix as safe, allowing it to be applied with just --write.

Example plugin (useConsoleInfo.grit):
```
language js

`console.log($msg)` as $call where {
    register_diagnostic(span = $call, message = "Use console.info instead of console.log.", severity = "warn", fix_kind = "safe"),
    $call => `console.info($msg)`
}
```
Running biome check --write applies safe rewrites. Unsafe rewrites (the default, or fix_kind = "unsafe") still require --write --unsafe.

#9384 f4c9edc Thanks @Conaclos! - Added the sortBareImports option to organizeImports,
which allows bare imports to be sorted within other imports when set to false.

{
  "assist": {
    "actions": {
      "source": {
        "organizeImports": {
          "level": "on",
          "options": { "sortBareImports": true }
        }
      }
    }
  }
}

- import "b";
  import "a";
+ import "b";
  import { A } from "a";
+ import "./file";
  import { Local } from "./file";
- import "./file";

#8731 e7872bf Thanks @siketyan! - Added the watch mode (--watch) to the CLI for check/format/lint commands. By enabling this option, Biome will re-run the check automatically when any file in the workspace has changed after the first run.
#10106 9b35f78 Thanks @ematipico! - Biome can now format and lint .svg files.
#9967 e9b6c17 Thanks @dyc3! - Added HTML support for noExcessiveLinesPerFile. Biome now reports HTML files that exceed the configured line limit, including when skipBlankLines is enabled.
#9491 b3eb63c Thanks @IxxyDev! - Added the HTML lint rule noAriaUnsupportedElements. This rule enforces that elements that do not support ARIA roles, states, and properties (meta, html, script, style) do not have role or aria-* attributes.
```

<meta charset="UTF-8" role="meta" />
```
#9306 afd57a6 Thanks @viraxslot! - Added the noNoninteractiveTabindex lint rule for HTML. This rule enforces that tabindex is not used on non-interactive elements, as it can cause usability issues for keyboard users.
```
<div tabindex="0">Invalid: non-interactive element</div>
`
```
#9276 6d041d9 Thanks @IxxyDev! - Added the HTML lint rule noRedundantRoles. This rule enforces that explicit role attributes are not the same as the implicit/default role of an HTML element. It supports HTML, Vue, Svelte, and Astro files.
```

<button role="button"></button>
```
#9813 69aadc2 Thanks @ematipico! - Added a new linter configuration called preset. With the new option, users can enable different kinds of rules at once.

The following presets are available:
- "recommended": it enables all Biome-recommended rules, or recommended rules of a group;
- "all": it enables all Biome rules, or enables all rules of a group;
- "none": it disables all Biome rules, or disable all rules of a group.
You can enable recommended rules:
```
{
  "linter": {
    "rules": {
      "preset": "recommended"
    }
  }
}
```
You can enable all rules at once:
```
{
  linter: {
    rules: {
      preset: "all", // enables all rules
    },
  },
}
```
Or enable all rules for a group:
```
{
  linter: {
    rules: {
      style: {
        preset: "all", // enables all rules in the style group
      },
    },
  },
}
```
This new option, however, doesn't affect how nursery rules work. Nursery rules must be enabled singularly, due to their nature.

This new option is meant to replace recommended, so make sure to run the migrate command.
#10022 3422d71 Thanks @Netail! - Added the HTML lint rule noNoninteractiveElementToInteractiveRole, which enforces that interactive ARIA roles are not assigned to non-interactive HTML elements.

Invalid:
```
<h1 role="checkbox"></h1>
```
#8396 13785fc Thanks @apple-yagi! - Biome now supports pnpm catalogs (default and named) when resolving dependencies for linting. This behavior is opt-in and requires setting javascript.resolver.experimentalPnpmCatalogs to true.
#10028 1009414 Thanks @Netail! - Added the HTML lint rule noInteractiveElementToNoninteractiveRole, which enforces that non-interactive ARIA roles are not assigned to interactive HTML elements.

Invalid:
```
<input role="img" />
```
#9853 816302f Thanks @Netail! - Added the new assist action useSortedSelectionSet, which sorts GraphQL selection sets alphabetically, e.g. name, age, id becomes age, id, name.

Invalid:
```
query {
  name
  age
  id
}
```

#10074 9c7c6eb Thanks @georgephillips! - Added a kind field to the ImportMatcher used by the organizeImports assist action. The new field selects imports by their syntactic kind and currently supports bare (matching side-effect imports such as import "polyfill") with optional ! negation (!bare). The matcher composes with the existing type and source fields, so users can express patterns such as "only bare imports that import a CSS file" ({ "kind": "bare", "source": "**/*.css" }).

For example, with the following configuration:

{
  "assist": {
    "actions": {
      "source": {
        "organizeImports": {
          "level": "on",
          "options": {
            "sortBareImports": true,
            "groups": [
              { "kind": "!bare" },
              ":BLANK_LINE:",
              { "kind": "bare" }
            ]
          }
        }
      }
    }
  }
}

...the following code:

import "./register-my-component";
import { render } from "react-dom";
import "./polyfill";
import { Button } from "@&#8203;/components/Button";

...is organized as:

import { render } from "react-dom";
import { Button } from "@&#8203;/components/Button";

import "./polyfill";
import "./register-my-component";

#9171 ce65710 Thanks @chocky335! - Added includes option for plugin file scoping. Plugins can now be configured with glob patterns to restrict which files they run on. Use negated globs for exclusions.
```
{
  "plugins": [
    "global-plugin.grit",
    {
      "path": "scoped-plugin.grit",
      "includes": ["src/**/*.ts", "!**/*.test.ts"]
    }
  ]
}
```
#9617 dcb99ef Thanks @faizkhairi! - Ported useAriaActivedescendantWithTabindex a11y rule to HTML.
#9496 1dfb829 Thanks @aviraldua93! - Added HTML support for the noAriaHiddenOnFocusable accessibility lint rule, which enforces that aria-hidden="true" is not set on focusable elements. Focusable elements include native interactive elements (<button>, <input>, <select>, <textarea>), elements with href (<a>, <area>), elements with tabindex >= 0, and editing hosts (contenteditable). Includes an unsafe fix to remove the aria-hidden attribute.
```

<button aria-hidden="true">Submit</button>


<div aria-hidden="true">decorative content</div>
```
#9792 f516854 Thanks @Maximiliano-Zeballos! - Added the useSemanticElements lint rule for HTML. The rule now detects the use of role attributes in HTML elements and suggests using semantic elements instead.

For example, the following code is now flagged:
```
<div role="navigation"></div>
```
The rule suggests using <nav> instead.
#9761 cbbb7d5 Thanks @Maximiliano-Zeballos! - Ported the useValidAriaProps lint rule to HTML. This rule checks that all aria-* attributes used in HTML elements are valid ARIA attributes as defined by the WAI-ARIA specification.
#9928 aa82576 Thanks @aviraldua93! - Ported useValidAriaValues to HTML. Biome now validates static aria-* attribute values in HTML elements against WAI-ARIA types, catching invalid values such as aria-hidden="yes".
#10562 6642895 Thanks @ematipico! - Promoted 73 nursery rules to stable groups.

Four rules were renamed as part of the promotion:
- noFloatingClasses is now noUnusedInstantiation, because the rule checks any discarded new expression, not only classes.
- noMultiStr is now noMultilineString.
- useFind is now useArrayFind.
- useSpread is now useSpreadOverApply, because the rule enforces spread call arguments over Function.apply(), not array or object spread.

Correctness

Promoted the following rules to the correctness group:

noBeforeInteractiveScriptOutsideDocument
noUnusedInstantiation
useInlineScriptId (recommended, Next.js domain)
noVueVIfWithVFor (recommended, Vue domain)
useVueValidVBind (recommended, Vue domain)
useVueValidVElse (recommended, Vue domain)
useVueValidVElseIf (recommended, Vue domain)
useVueValidVHtml (recommended, Vue domain)
useVueValidVIf (recommended, Vue domain)
useVueValidVOn (recommended, Vue domain)
useVueValidVText (recommended, Vue domain)
useVueValidTemplateRoot (recommended, Vue domain)
useVueValidVCloak (recommended, Vue domain)
useVueValidVOnce (recommended, Vue domain)
useVueValidVPre (recommended, Vue domain)
useVueVForKey (recommended, Vue domain)
noDuplicateAttributes (recommended)
noDuplicateArgumentNames (recommended)
noDuplicateInputFieldNames (recommended)
noDuplicateVariableNames (recommended)
noDuplicateEnumValueNames (recommended)
useLoneAnonymousOperation (recommended)

Suspicious

Promoted the following rules to the suspicious group:

noShadow
noUnnecessaryConditions
noParametersOnlyUsedInRecursion
noUnknownAttribute
useArraySortCompare
noForIn
noDuplicatedSpreadProps
noEqualsToNull
noProto (recommended)
noUndeclaredEnvVars (recommended, Turborepo domain)
noReturnAssign (default severity: error)
noDuplicateEnumValues (recommended)
noVueArrowFuncInWatch (recommended, Vue domain)
noNestedPromises
noLeakedRender
noDeprecatedMediaType (recommended)
noDuplicateGraphqlOperationName
useRequiredScripts

Style

Promoted the following rules to the style group:

useVueMultiWordComponentNames (recommended, Vue domain)
useVueDefineMacrosOrder
noIncrementDecrement
noContinue
useSpreadOverApply
noTernary
noMultilineString
noMultiAssign
noExcessiveClassesPerFile
noExcessiveLinesPerFile
noVueOptionsApi
useErrorCause
useConsistentEnumValueType
useConsistentMethodSignatures
useGlobalThis (default severity: warn)
useDestructuring
useVueHyphenatedAttributes (recommended, Vue domain)
useVueConsistentVBindStyle (recommended, Vue domain)
useVueConsistentVOnStyle (recommended, Vue domain)
noHexColors
useConsistentGraphqlDescriptions
noRootType
useLoneExecutableDefinition
useInputName

Complexity

Promoted the following rules to the complexity group:

useArrayFind
noRedundantDefaultExport (default severity: warn)
noUselessReturn
noDivRegex

Performance

Promoted the following rules to the performance group:

Security

Promoted the following rules to the security group:

noScriptUrl (recommended)

Promoted the following rules to the a11y group:

noAmbiguousAnchorText (recommended)
#10121 450f8e1 Thanks @jongwan56! - Biome now applies Git's local exclude file when VCS ignore files are enabled. Files listed in .git/info/exclude are skipped the same way as files listed in .gitignore, including in linked worktrees.
#9397 d5913c9 Thanks @mvarendorff! - Added ignore option to the noUnusedVariables rule. The option allows excluding identifiers by providing a list of ignored names. It also allows excluding kinds of identifiers from this rule entirely, which may be useful when loading classes dynamically.

For example, unused classes as well as all unused variables, functions, etc. called "unused" may be ignored entirely with the following configuration:
```
{
  "ignore": {
    "*": ["unused"],
    "class": ["*"]
  }
}
```
#10089 71a21f0 Thanks @Netail! - Added the lint rule noLabelWithoutControl to HTML, which enforces that a label element or component has a text label and an associated input.
```
<label></label>
```
#10015 1828261 Thanks @Netail! - Added the HTML lint rule useAriaPropsSupportedByRole, which enforces that ARIA properties are valid for the roles that are supported by the element.
```
<a href="#" aria-checked></a>
```
#10234 1a51569 Thanks @ematipico! - Added the delimiterSpacing formatter option. This option inserts spaces inside delimiters (after the opening delimiter and before the closing delimiter) when the content fits on a single line. Empty delimiters are not affected, and no space is added before the opening delimiter. The specific delimiters affected depend on the language. It can be configured globally via formatter.delimiterSpacing or per-language via javascript.formatter.delimiterSpacing, json.formatter.delimiterSpacing, and css.formatter.delimiterSpacing. Defaults to false.
```
- callFn(foo)
+ callFn( foo )
```
```
- const arr = [1, 2, 3];
+ const arr = [ 1, 2, 3 ];
```
JavaScript

When enabled, Biome inserts spaces inside parentheses (e.g., foo( a, b )), square brackets (e.g., [ a, b ]), template literal interpolations (e.g., ${ expr }), and the logical NOT operator (e.g., ! x, but in chains only after the last one: !! x). Only applies when the content fits on a single line. Empty delimiters and the space before the opening delimiter are not affected.
```
- if (condition) {}
+ if ( condition ) {}
```
```
- `Hello ${name}!`
+ `Hello ${ name }!`
```
JSX

When enabled, Biome inserts spaces inside JSX expression braces (e.g., attr={ value }) and spread attributes (e.g., { ...props }). Only applies when the content fits on a single line. Empty delimiters are not affected.
```
- <Foo bar={value} />
+ <Foo bar={ value } />
```
TypeScript

When enabled, Biome inserts spaces inside TypeScript angle brackets (e.g., foo< T >()), indexed access types (e.g., T[ K ]), mapped types, tuple types, type parameters, and index signatures. Only applies when the content fits on a single line. Empty delimiters are not affected.
```
- type Result = Map<string, number>;
+ type Result = Map< string, number >;
```
JSON

When enabled, Biome inserts spaces inside square brackets when the content fits on a single line. Empty brackets are not affected.
```
- [1, 2, 3]
+ [ 1, 2, 3 ]
```
CSS

When enabled, Biome inserts spaces inside parentheses and square brackets when the content fits on a single line. Empty delimiters are not affected.
```
- rgba(0, 0, 0, 1)
+ rgba( 0, 0, 0, 1 )
```
```
- [data-attr]
+ [ data-attr ]
```
#10461 6bac1c3 Thanks @TXWSLYF! - Implements #9445. Added the allowImplicit option to useIterableCallbackReturn. When enabled, callbacks can use return; to implicitly return undefined, matching ESLint's array-callback-return rule.

#9571 5a8eb75 Thanks @dyc3! - Added configurable options to the useNumericSeparators rule. Users can now customize the minimum number of digits required before adding separators and the group length for each type of numeric literal (binary, octal, decimal, hexadecimal).

{
  "linter": {
    "rules": {
      "style": {
        "useNumericSeparators": {
          "level": "error",
          "options": {
            "decimal": {
              "minimumDigits": 7,
              "groupLength": 3
            },
            "hexadecimal": {
              "minimumDigits": 4,
              "groupLength": 2
            }
          }
        }
      }
    }
  }
}

#10067 6064312 Thanks @Netail! - Added the lint rule useFocusableInteractive to HTML, which enforces elements with an interactive role and interaction handler to be focusable.

Invalid:
```
<div role="button"></div>
```
#10026 fb42ac4 Thanks @Netail! - Added the HTML lint rule noNoninteractiveElementInteractions, which disallows use event handlers on non-interactive elements.

Invalid:
```
<div onclick="myFunction()">button</div>
```
#10000 2093e3e Thanks @Netail! - Added the new assist action useSortedEnumMembers, which sorts TypeScript & GraphQL enum members.

Invalid:
```
enum Role {
  SUPER_ADMIN
  ADMIN
  USER
  GOD
}
```
#10013 ad01d3d Thanks @Netail! - Added the HTML lint rule useValidAutocomplete, which enforces using valid values for the autocomplete attribute on input elements.
```
<input autocomplete="incorrect" />
```

Patch Changes

#10498 995c1ff Thanks @citadelgrad! - Added the nursery rule useReactFunctionComponentDefinition, which enforces a consistent function type for named React function components.

For example, the following snippet triggers the rule by default.
```
const MyComponent = (props) => {
  return <div>{props.name}</div>;
};
```
#9974 ff635a9 Thanks @pkallos! - Added ignoreMixedLogicalExpressions to useNullishCoalescing, partially addressing #9232. When enabled, Biome ignores || and ||= mixed with && in the same expression tree.
#10503 c656679 Thanks @Mokto! - Added the new nursery rule useSvelteRequireEachKey, a Svelte lint rule that reports {#each} blocks with item bindings that are missing a key.
#10516 0f29b83 Thanks @Dotify71! - Added useIncludes to the nursery group. This rule flags comparisons of String.prototype.indexOf() or Array.prototype.indexOf() against -1 and suggests replacing them with the clearer includes() / !includes() form.
#10487 0c03ee3 Thanks @Mokto! - Fixed a Svelte parser error that incorrectly required a binding variable after {:then} and {:catch}. Biome now correctly accepts {:then} and {:catch} without a binding, as well as the {#await expr then} and {#await expr catch} shorthand forms.
#10566 a4a294c Thanks @dyc3! - Fixed useVueHyphenatedAttributes: The rule now only reports diagnostics in Vue files and ignores SVG elements.
#10565 72ccf3b Thanks @dyc3! - Fixed useVueConsistentVBindStyle: The rule no longer reports argument-less v-bind directives because they cannot be converted to shorthand syntax.
#10591 6e8557b Thanks @xsourabhsharma! - Fixed #10563: Biome now parses comma-separated CSS Modules composes values, such as composes: classA from "./a.css", classB from "./b.css";.
#10603 174b21b Thanks @denbezrukov! - Fixed CSS formatting for grid-template-areas declarations with comments before multiline values. Biome now keeps grid area rows aligned instead of adding an extra declaration-boundary indent.
```
 .grid {
   grid-template-areas:
 /* row */
-      "header header"
-      "footer footer";
+    "header header"
+    "footer footer";
 }
```
#10542 c3f07f7 Thanks @dyc3! - Fixed #10513: Biome no longer rejects literal \u sequences in quoted HTML attribute values.
#10108 24e51d6 Thanks @IxxyDev! - Fixed #6611: noUnnecessaryConditions now uses type information to detect more redundant conditions, including ?., ??, ||, &&, comparisons against null/undefined on non-nullish operands, and case clauses that can never match the switch value.
#10568 eb1ed0e Thanks @harsha-cpp! - Fixed #10564: useAriaPropsForRole no longer reports false positives for Vue v-bind shorthand bindings (:aria-checked, :aria-level, etc.).
#10570 2ceb4fe Thanks @Conaclos! - Improved noTsIgnore.
The rule now reports more precisely the range of the @ts-ignore comment.
#10520 b55d10f Thanks @dyc3! - Fixed #10519: Vue v-on event handlers with multiple inline statements are now parsed consistently with Vue.
#10204 ebbf0bd Thanks @ematipico! - Improved the performance of the Biome linter. The improvements are more visible in bigger projects that have more than ~1k files. Early tests showed that in a code base with ~2k files, Biome took less than 26% of time to finish the command.
#10546 e39bb2c Thanks @tim-we! - Fixed #10536: noUnknownFunction no longer flagged CSS contrast-color() as unknown. contrast-color() is Baseline 2026.
#8012 2be0264 Thanks @denbezrukov! - Improved the performance of the formatter in some cases. The formatter is now up to ~20% faster at formatting files.
#10467 9a5855e Thanks @Netail! - Added a new nursery rule noRestrictedDependencies, which flags imports and package.json dependency entries that have better alternatives in e18e's module replacement data.

For example, the package globby is reported because there's a better alternative:
```
import glob from "globby";
```
```
{
  "dependencies": {
    "globby": "x.x.x"
  }
}
```
#10470 84b43c5 Thanks @ShaharAviram1! - Fixed #10447: now the rule noProcessEnv detects the use of env when it's imported from process and node:process.
#10556 7ff6b16 Thanks @ematipico! - Fixed #10492: Biome no longer crashes with a stack overflow on certain code when a type-aware rule such as noFloatingPromises, noMisusedPromises, or noUnnecessaryConditions is enabled. For example, the following code used to crash Biome:
```
function f(visitor) {
  let ctrl = visitor();
  for (const x of [0]) ctrl = ctrl();
}
```

#10532 1da3c75 Thanks @denbezrukov! - CSS declarations with comments before : or after !important now preserve spaces before : and ;.

 .selector {
-  padding/* name */: 1px;
-  color: red !important /* note */;
+  padding/* name */ : 1px;
+  color: red !important /* note */ ;
 }

#10491 a1b5834 Thanks @Mokto! - Fixed the Svelte parser rejecting {#each} blocks where the binding uses object destructuring with property renaming, e.g. {#each items as { id, component: Filter }}. Biome now correctly parses and formats these rename bindings.
#10490 99bc7df Thanks @Mokto! - Fixed the CSS parser rejecting comma-separated selector lists inside :global() and :local() pseudo-class functions. Biome now correctly parses :global(.foo, .bar).
#10543 c394fae Thanks @mangod12! - Fixed #10477: The RDJSON reporter now emits code replacement text for fix suggestions instead of the human-readable fix description.
#10530 e8e1e6a Thanks @Conaclos! - Fixed #10493: useImportType now correctly separates types from a default named import when all imports are types and the style option is set to separatedType.
#10555 263c7cc Thanks @Mokto! - Improved Svelte lint rule accuracy for quoted attribute values containing {expression} interpolations.
- noRedundantAlt no longer emits false positives when the alt text contains an interpolation, e.g. alt="image of {person}".
- useButtonType no longer emits false positives for dynamic button types written as type="{dynamicType}".
- noScriptUrl no longer emits false positives for dynamic hrefs such as href="{url}".
#10489 96ef9a4 Thanks @Mokto! - Fixed Svelte {#each} parser incorrectly rejecting TypeScript as const type assertions in the iterable expression. Biome now correctly parses {#each arr as const as item}.
#10539 935c59a Thanks @dyc3! - Improved how diagnostics print long lines of code, for example minified files where the entire source code is printed in one line.

`v2.4.16`

Compare Source

Patch Changes

#10329 ef764d5 Thanks @Conaclos! - Fixed an issue where diagnostics showed an incorrect location in Astro files.

#10363 50aa415 Thanks @dyc3! - Fixed HTML formatting for a case where comments could cause the formatter to split up a closing tag, which would cause the resulting HTML to be syntactically invalid.

Input:

<span
  ><!-- 1
--><span>a</span
  ><!-- 2
--><span>b</span
  ><!-- 3
--></span>

Output:

  <span
	  ><!-- 1
- --> <span>a</span<!-- 2
- --> ><span>b</span><!-- 3
+ --><span>a</span><!-- 2
+ --><span>b</span><!-- 3
  --></span
  >

#10465 0c718da Thanks @dfedoryshchev! - Fixed diagnostics emitted by the noUntrustedLicenses rule.
#10358 05c2617 Thanks @dyc3! - Fixed #10356: biome rage --linter now displays rules enabled through linter domains in the enabled rules list.
#10300 950247c Thanks @dyc3! - Fixed #10265: Svelte function bindings such as bind:value={get, set} are now parsed more precisely, so noCommaOperator won't emit false positives for that syntax anymore.
#9786 e71f584 Thanks @MeGaNeKoS! - Fixed #8480: useDestructuring now provides variableDeclarator and assignmentExpression options to control which contexts enforce destructuring, matching ESLint's prefer-destructuring configuration. Both default to {array: true, object: true}. The diagnostic for object destructuring in assignment expressions now instructs users to wrap the assignment in parentheses.
#10425 1948b72 Thanks @sjh9714! - Fixed #10244: The useOptionalChain rule now detects negated guard inequality chains like !foo || foo.bar !== "x".
#10442 001f94f Thanks @ematipico! - Fixed #10411: noMisusedPromises no longer causes a stack overflow when a nested function returns an object with shorthand properties that shadow destructured variables from an outer scope.
#10318 9b1577f Thanks @dyc3! - Added support for formatter.trailingCommas in overrides. This option was previously available in the top-level formatter configuration but missing from formatter overrides.
#10319 2e37709 Thanks @dyc3! - Fixed Vue and Svelte formatting for standalone interpolations in inline elements. Biome now preserves existing newlines in cases like:
```
- <span> {{ value }} </span>
+ <span>
+   {{ value }}
+ </span>
```
#10365 0a58eb0 Thanks @Netail! - Fixed #10361: noUnusedFunctionParameters now mentions the parameter name in the diagnostic.
#10439 df6b867 Thanks @denbezrukov! - Fixed CSS and SCSS formatting for comments around declaration colons so comments between property names, colons, and values stay at the same boundary as Prettier.
```
 .selector {
-  color: /* red, */
-    blue;
+  color: /* red, */ blue;
 }
```
#10344 b30208c Thanks @siketyan! - Fixed #10123: Corrected the noReactNativeDeepImports source rule to point to the proper upstream rule, so users can migrate from the original rule correctly.
#10328 b59133f Thanks @dyc3! - Fixed #10309: Biome no longer adds newlines to Astro frontmatter when linter or assist --write mode is enabled.

`v2.4.15`

Compare Source

Patch Changes

#9394 ba3480e Thanks @dyc3! - Added the nursery rule useTestHooksInOrder in the test domain. The rule enforces that Jest/Vitest lifecycle hooks (beforeAll, beforeEach, afterEach, afterAll) are declared in the order they execute, making test setup and teardown easier to reason about.
#10254 e0a54cc Thanks @dyc3! - Added a new nursery rule useVueNextTickPromise, which enforces Promise syntax when using Vue nextTick.

For example, the following snippet triggers the rule:
```
import { nextTick } from "vue";

nextTick(() => {
  updateDom();
});
```
#10219 64aee45 Thanks @dyc3! - Added a new nursery rule noVueVOnNumberValues, that disallows deprecated number modifiers on Vue v-on directives.

For example, the following snippet triggers the rule:
```
<input @&#8203;keyup.13="submit" />
```
#10195 7b8d4e1 Thanks @dyc3! - Added the new nursery rule useVueValidVFor, which validates Vue v-for directives and reports invalid aliases, missing component keys, and keys that do not use iteration variables.
#10238 1110256 Thanks @dyc3! - Added the recommended nursery rule noVueImportCompilerMacros, which disallows importing Vue compiler macros such as defineProps from vue because they are automatically available.
#10201 1a08f89 Thanks @realknove! - Fixed #10193: style/useReadonlyClassProperties no longer reports class properties as readonly-able when they are assigned inside arrow callbacks nested in class property initializers.
#9574 3bd2b6a Thanks @Conaclos! - Fixed #9530. The diagnostics of organizeImports are now more detailed and more precise. They are also better at localizing where the issue is.
#10205 a704a6c Thanks @Conaclos! - Fixed #10185. `organizeImports now errors when it encounters an unknown predefined group.

The following configuration is now reported as invalid because :INEXISTENT: is an unknown predefined group.
```
{
  "assist": {
    "actions": {
      "source": {
        "organizeImports": { "options": { "groups": [":INEXISTENT:"] } }
      }
    }
  }
}
```
#10052 b565bed Thanks @minseong0324! - Improved noMisleadingReturnType: it now flags union annotations whose extra variants are never returned, and suggests the narrower type (e.g. string | null → string).

These functions are now reported because null and number are included in the return annotations but never returned:
```
function getUser(): string | null {
  return "hello";
} // null is never returned
function getCode(): string | number {
  return "hello";
} // number is never returned
```
#10213 ac30057 Thanks @dyc3! - Fixed #9450: HTML and Vue element formatting now preserves child line breaks when an element contains another element child on its own line, instead of collapsing the child element onto the same line.
#10275 9ee6c03 Thanks @solithcy! - Fixed #10274: Svelte templates with missing expressions no longer parsed as HtmlBogusElement
#10143 56798a7 Thanks @minseong0324! - noMisleadingReturnType now detects misleading return type annotations when object literal properties are initialized with as const.

This function is now reported because the return annotation widens a property initialized with as const:
```
function f(): { value: string } {
  return { value: "text" as const };
}
```
#10143 56798a7 Thanks @minseong0324! - noUselessTypeConversion now detects redundant conversions on object literal properties initialized with as const.

This conversion is now reported because message.value is inferred as a string literal:
```
const message = { value: "text" as const };
String(message.value);
```
#9807 0ae5840 Thanks @dyc3! - Added the new nursery rule useThisInClassMethods, based on ESLint's class-methods-use-this.

The rule now reports instance methods, getters, setters, and function-valued instance fields that do not use this, and biome migrate eslint preserves the supported ignoreMethods, ignoreOverrideMethods, and ignoreClassesWithImplements options.

Invalid:
```
class Foo {
  bar() {
    // does not use `this`, invalid
    console.log("Hello Biome");
  }
}
```
#10258 e7b18f7 Thanks @ematipico! - Improved linter performance by narrowing the query nodes for several lint rules, reducing how often they are evaluated.
#10273 04e22a1 Thanks @dyc3! - Fixed #10271: The HTML parser now correctly parses of as text content when in text contexts.
#9838 83f7385 Thanks @dyc3! - Added the nursery rule noBaseToString, which reports stringification sites that fall back to Object's default "[object Object]" formatting. The rule also supports the ignoredTypeNames option.
#10143 56798a7 Thanks @minseong0324! - useExhaustiveSwitchCases now checks switch statements over object literal properties initialized with as const.

This switch is now reported because status.kind is inferred as the string literal "ready" but no case handles it:
```
const status = { kind: "ready" as const };
switch (status.kind) {
}
```
#10143 56798a7 Thanks @minseong0324! - useStringStartsEndsWith now detects string index comparisons on object literal properties initialized with as const.

This comparison is now reported because message.value is inferred as a string literal:
```
const message = { value: "hello" as const };
message.value[0] === "h";
```

`v2.4.14`

Compare Source

Patch Changes

#9393 491b171 Thanks @dyc3! - Added the nursery rule useTestHooksOnTop in the test domain. The rule flags lifecycle hooks (beforeEach, beforeAll, afterEach, afterAll) that appear after test cases in the same block, enforcing that hooks are defined before any test case.
#10157 eefc5ab Thanks @dyc3! - Fixed #7882: The HTML parser will now emit better diagnostics when it encounters a void element with a closing tag, such as <br></br>. Previously, the parser would emit multiple diagnostics with conflicting advice. Now it emits a single diagnostic that clearly states that void elements should not have closing tags.
#10054 0e9f569 Thanks @minseong0324! - noMisleadingReturnType no longer misses widening from concrete object types, class instances, object literals, tuples, functions, and regular expressions to : object.

A function annotated : object returning an object literal:
```
function f(): object {
  return { retry: true };
}
```
#10116 53269eb Thanks @jiwon79! - Fixed #6201: noUselessEscapeInRegex no longer flags an escaped backslash followed by - as a useless escape. Patterns like /[\\-]/ are now considered valid because the second \ is the escaped backslash, not an unnecessary escape of the trailing dash.
#10092 33d8543 Thanks @Conaclos! - Fixed #9097: organizeImports no longer adds a blank line between a never-matched group and a matched group.

Given the following organizeImports options:
```
{
  "groups": [":NODE:", ":BLANK_LINE:", ":PACKAGE:", ":BLANK_LINE:", ":PATH:"]
}
```
The following code...
```
// Comment
import "package";
import "./file.js";
```
...was organized as:
```
+
  // Comment
  import "package";
+
  import "./file.js";
```
A blank line was added even though the group ':NODE:' doesn't match any imports here.
:BLANK_LINE: between never-matched groups and matched groups are now ignored.
The code is now organized as:
```
  // Comment
  import "package";
+
  import "./file.js";
```
#10138 a10b6c1 Thanks @dyc3! - Fixed Vue v-for handling for noUndeclaredVariables and noUnusedVariables. Biome now recognizes variables declared by v-for directives and references to iterated values in Vue templates.
#10115 d428d76 Thanks @minseong0324! - noMisleadingReturnType no longer reports false positives when a union return type's boolean variant is covered by both true and false returns.
#9922 7acf1e0 Thanks @dyc3! - Added the new nursery rule noReactStringRefs, which disallows legacy React string refs such as ref="hello" and this.refs.hello.

Biome also reports template-literal refs such as ref={`hello`}, so React code can consistently migrate to callback refs, createRef(), or useRef().
#10010 f3e76ab Thanks @dyc3! - Fixed a bug in the LSP file watcher registration so Biome now watches .biome.json and .biome.jsonc configuration files and reloads workspace settings when they change.
#10176 8a40ef8 Thanks @dyc3! - Fixed #10011: The noThisInStatic rule no longer reports this when it is used as the constructor target in new this(...), which is required for inherited static factory methods.
#10163 6867e96 Thanks @jiwon79! - Fixed #9884: The useSortedAttributes auto-fix no longer corrupts source code when both an outer JSX element and a nested JSX-valued attribute have unsorted attributes in the same pass. Multiple unsorted groups separated by spread or shorthand attributes within the same JSX element are now reported as a single diagnostic.
#10079 d29dd19 Thanks @Damix48! - Fixed false positive in noAssignInExpressions for Svelte {@const} blocks. Assignments in {@const name = value} are now correctly recognized as declarations rather than accidental assignments in expressions.
#10080 5d8fdac Thanks @Damix48! - Fixed parsing of closing parentheses in Svelte {#each} block key expressions. Biome now correctly parses method calls and other parenthesised expressions used as keys.

For example, the following snippets are now parsed correctly:
```
{#each numbers as number, index (number.toString())}
  <p>{number}</p>
{/each}

{#each numbers as number (key(number))}
  <p>{number}</p>
{/each}
```
#10140 e7024b9 Thanks @solithcy! - Fixed #10135: Biome no longer crashes on missing Svelte template expressions.

The following code snippet longer panics:
```
{#if }
 <p>^ this would previously crash</p>
{/if}
{@&#8203;const }
<p>    ^ this would also crash</p>
```
#10111 7818009 Thanks @jiwon79! - Fixed #9997: noDuplicateSelectors no longer reports false positives for selectors inside @scope queries. Biome now treats @scope as a separate at-rule context, like @media, @supports, @container, and @starting-style.

The following snippet is no longer flagged as a duplicate:
```
.Example {
  padding: 0;
}

@&#8203;scope (.theme-dark) {
  .Example {
    color: white;
  }
}
```
#9926 d62b331 Thanks @dyc3! - Added the nursery lint rule useMathMinMax, which prefers Math.min() and Math.max() over equivalent ternary comparisons.

For example, this code:
```
const min = a < b ? a : b;
```
is much more readable when rewritten as:
```
const min = Math.min(a, b);
```
#10115 d428d76 Thanks @minseong0324! - useExhaustiveSwitchCases now flags missing true/false cases for boolean discriminants, including when boolean is a union variant.
#10125 a55a0b6 Thanks @bmish! - Fixed a resolver bug where packages that define a typed entry point through package.json's main field but omit types were ignored during type-aware resolution. Type-aware rules such as noFloatingPromises can now inspect imports from those packages.
#10117 895e809 Thanks @denizdogan! - Added support for the corner-shape family of CSS properties and the superellipse()/squircle() value functions, so noUnknownProperty and noUnknownFunction no longer flag them as unknown.

New known properties: corner-shape, corner-block-end-shape, corner-block-start-shape, corner-bottom-left-shape, corner-bottom-right-shape, corner-bottom-shape, corner-end-end-shape, corner-end-start-shape, corner-inline-end-shape, corner-inline-start-shape, corner-left-shape, corner-right-shape, corner-start-end-shape, corner-start-start-shape, corner-top-left-shape, corner-top-right-shape, corner-top-shape.

New known value functions: superellipse(), squircle().
#8620 8df8f73 Thanks @dyc3! - Fixed #8062: Added support for parsing Vue v-for directives more accurately.
#10191 aa055cd Thanks @guney! - Now the rule noStaticElementInteractions doesn't trigger custom elements.
#9757 2c62594 Thanks @dyc3! - Fixed #9099: the HTML formatter collapsing non-text children (inline elements, Svelte expressions, comments) onto a single line when the source had them on separate lines. Biome now preserves the user's intended line breaks for exclusively non-text children.

For example, the following Svelte snippet is now preserved instead of being collapsed to <div>{name}</div>:
```
<div>
  {name}
</div>
```
Similarly, HTML elements like <span> inside a <div> are now preserved when written on their own line:
```
<div>
  <span>text</span>
</div>
```
#10105 e7c1a6d Thanks @jiwon79! - Fixed #10039: useReadonlyClassProperties now detects unreassigned private members in class expressions and export default classes, not only in class declarations.

The following patterns are now correctly flagged:
```
const AnonClass = class {
  #prop = 123;
  constructor() {
    console.log(this.#prop);
  }
};

export default class {
  #prop = 123;
  constructor() {
    console.log(this.#prop);
  }
}
```
#10141 46a77d0 Thanks @minseong0324! - Improved noUnnecessaryConditions to detect conditions that are always truthy because they check built-in global class instances such as Date, Map, Set, WeakMap, and Error.
#10178 7b05a89 Thanks @dyc3! - Fixed #10177: The HTML parser no longer reports lowercase html or doctype text as invalid after void elements such as <br>.
#10155 0d4595d Thanks @jiwon79! - Fixed #10045: the CSS formatter no longer compounds indentation inside nested functional pseudo-classes such as :not(:where(...)), :is(:where(...)), and similar combinations. The same fix also removes one level of unnecessary indentation that was added inside any pseudo-class function whose argument list wrapped onto multiple lines, including :nth-child(... of ...), ::part(...), and :active-view-transition-type(...).
The following snippet is now correctly formatted, matching Prettier.
```
input:not(
  :where(
    [type="submit"],
    [type="checkbox"],
    [type="radio"],
    [type="button"],
    [type="reset"]
  )
) {
  inline-size: 100%;
}
```
#10112 6f0251e Thanks @dyc3! - Fixed #10110: Biome's parser now accepts surrogate code points in JavaScript string \u{...} escapes.
#10141 46a77d0 Thanks @minseong0324! - Improved noMisleadingReturnType to detect object return annotations that hide built-in global class instances such as Date, Map, Set, WeakMap, and Error.
#10083 4a664c1 Thanks @ematipico! - Added two new options to noShadow, both defaulting to true to match typescript-eslint's behavior.

Fixed #9482: Added ignoreFunctionTypeParameterNameValueShadow option. When enabled, parameter names inside function type annotations (e.g. (options: unknown) => void) are not flagged as shadowing outer variables.

Fixed #7812: Added ignoreTypeValueShadow option. When enabled, a value binding that shares its name with a type-only declaration (type alias or interface) is not flagged, since types and values occupy separate namespaces in TypeScript.
#9286 52695cf Thanks @Hugo-Polloli! - Fixed #6316: Biome now resolves Svelte $store references to the underlying store binding in semantic analysis, preventing false noUndeclaredVariables diagnostics when the store is declared.
#10188 ae659dd Thanks @dyc3! - Added a new nursery rule noExcessiveNestedCallbacks, which disallows callbacks nested deeper than the configured maximum.
#9757 2c62594 Thanks @dyc3! - Fixed #9450: the HTML formatter now correctly preserves multiline formatting for nested <template> elements (e.g. <template #body>) when the source has children on separate lines. Previously, the children were collapsed onto a single line.
```
 <template>
   <UModal>
-    <template #body> <p>content</p> </template>
+    <template #body>
+      <p>content</p>
+    </template>
   </UModal>
 </template>
```
#10118 c6edcb4 Thanks @Netail! - Fixed #10024: biome migrate eslint correctly migrates eslint rules that belong to multiple Biome rules.

`v2.4.13`

Compare Source

Patch Changes

#9969 c5eb92b Thanks @officialasishkumar! - Added the nursery rule noUnnecessaryTemplateExpression, which disallows template literals that only contain string literal expressions. These can be replaced with a simpler string literal.

For example, the following code triggers the rule:
```
const a = `${"hello"}`; // can be 'hello'
const b = `${"prefix"}_suffix`; // can be 'prefix_suffix'
const c = `${"a"}${"b"}`; // can be 'ab'
```

#10037 f785e8c Thanks @minseong0324! - Fixed #9810: noMisleadingReturnType no longer reports false positives on a getter with a matching setter in the same namespace.

class Store {
  get status(): string {
    if (Math.random() > 0.5) return "loading";
    return "idle";
  }
  set status(v: string) {}
}

#10084 5e2f90c Thanks @jiwon79! - Fixed #10034: noUselessEscapeInRegex no longer flags escapes of ClassSetReservedPunctuator characters (&, !, #, %, ,, :, ;, <, =, >, @, `, ~) inside v-flag character classes as useless. These characters are reserved as individual code points in v-mode, so the escape is required.

The following pattern is now considered valid:
```
/[a-z\&]/v;
```
#10063 c9ffa16 Thanks @Netail! - Added extra rule sources from ESLint CSS. biome migrate eslint should do a bit better detecting rules in your eslint configurations.
#10035 946b50e Thanks @Netail! - Fixed #10032: useIframeSandbox now flags if there's no initializer value.
#9865 68fb8d4 Thanks @dyc3! - Added the new nursery rule useDomNodeTextContent, which prefers textContent over innerText for DOM node text access and destructuring.

For example, the following snippet triggers the rule:
```
const foo = node.innerText;
```
#10023 bd1e74f Thanks @ematipico! - Added a new nursery rule noReactNativeDeepImports that disallows deep imports from the react-native package. Internal paths like react-native/Libraries/... are not part of the public API and may change between versions.

For example, the following code triggers the rule:
```
import View from "react-native/Libraries/Components/View/View";
```
#9885 3dce737 Thanks @dyc3! - Added a new nursery rule useDomQuerySelector that prefers querySelector() and querySelectorAll() over older DOM query methods such as getElementById() and getElementsByClassName().
#9995 4da9caf Thanks @siketyan! - Fixed #9994: Biome now parses nested CSS rules correctly when declarations follow them inside embedded snippets.
#10009 b41cc5a Thanks @Jayllyz! - Fixed #10004: noComponentHookFactories no longer reports false positives for object methods and class methods.
#9988 eabf54a Thanks @Netail! - Tweaked the diagnostics range for useAltText, useButtonType, useHtmlLang, useIframeTitle, useValidAriaRole & useIfameSandbox to report on the opening tag instead of the full tag.
#10043 fc65902 Thanks @mujpao! - Fixed #10003: Biome no longer panics when parsing Svelte files containing {#}.
#9815 5cc83b1 Thanks @dyc3! - Added the new nursery rule noLoopFunc. When enabled, it warns when a function declared inside a loop captures outer variables that can change across iterations.
#9702 ef470ba Thanks @ryan-m-walker! - Added the nursery rule useRegexpTest that enforces RegExp.prototype.test() over String.prototype.match() and RegExp.prototype.exec() in boolean contexts. test() returns a boolean directly, avoiding unnecessary computation of match results.

Invalid
```
if ("hello world".match(/hello/)) {
}
```
Valid
```
if (/hello/.test("hello world")) {
}
```
#9743 245307d Thanks @leetdavid! - Fixed #2245: Svelte <script> tag language detection when the generics attribute contains > characters (e.g., <script lang="ts" generics="T extends Record<string, unknown>">). Biome now correctly recognizes TypeScript in such script blocks.

#10046 0707de7 Thanks @Conaclos! - Fixed #10038: organizeImports now sorts imports in TypeScript modules and declaration files.

  declare module "mymodule" {
-  	import type { B } from "b";
  	import type { A } from "a";
+  	import type { B } from "b";
  }

#10012 94ccca9 Thanks @ematipico! - Added the nursery rule noReactNativeLiteralColors, which disallows color literals inside React Native styles.

The rule belongs to the reactNative domain. It reports properties whose name contains color and whose value is a string literal when they appear inside a StyleSheet.create(...) call or inside a JSX attribute whose name contains style.
```
// Invalid
const Hello = () => <Text style={{ backgroundColor: "#FFFFFF" }}>hi</Text>;

const styles = StyleSheet.create({
  text: { color: "red" },
});
```
```
// Valid
const red = "#f00";
const styles = StyleSheet.create({
  text: { color: red },
});
```
#10005 131019e Thanks @ematipico! - Added the nursery rule noReactNativeRawText, which disallows raw text outside of <Text> components in React Native.

The rule belongs to the new reactNative domain.
```
// Invalid
<View>some text</View>
<View>{'some text'}</View>
```
```
// Valid
<View>
  <Text>some text</Text>
</View>
```
Additional components can be allowlisted through the skip option:
```
{
  "options": {
    "skip": ["Title"]
  }
}
```
#9911 1603f78 Thanks @Netail! - Added the nursery rule noJsxLeakedDollar, which flags text nodes with a trailing $ if the next sibling node is a JSX expression. This could be an unintentional mistake, resulting in a '$' being rendered as text in the output.

Invalid:
```
function MyComponent({ user }) {
  return <div>Hello ${user.name}</div>;
}
```
#9999 f42405f Thanks @minseong0324! - Fixed noMisleadingReturnType incorrectly flagging functions with reassigned let variables.
#10075 295f97f Thanks @ematipico! - Fixed #9983: Biome now parses functions declared inside Svelte #snippet blocks without throwing errors.
#10006 cf4c1c9 Thanks @minseong0324! - Fixed #9810: noMisleadingReturnType incorrectly flagging nested object literals with widened properties.
#10033 11ddc05 Thanks @ematipico! - Added the nursery rule useReactNativePlatformComponents that ensures platform-specific React Native components (e.g. ProgressBarAndroid, ActivityIndicatorIOS) are only imported in files with a matching platform suffix. It also reports when Android and iOS components are mixed in the same file.

The following code triggers the rule when the file does not have an .android.js suffix:
```
// file.js
import { ProgressBarAndroid } from "react-native";
```

`v2.4.12`

Compare Source

Patch Changes

#9376 9701a33 Thanks @dyc3! - Added the nursery/noIdenticalTestTitle lint rule. This rule disallows using the same title for two describe blocks or two test cases at the same nesting level.

describe("foo", () => {});
describe("foo", () => {
  // invalid: same title as previous describe block
  test("baz", () => {});
  test("baz", () => {}); // invalid: same title as previous test case
});

#9889 7ae83f2 Thanks @dyc3! - Improved the diagnostics for useForOf to better explain the problem, why it matters, and how to fix it.

#9916 27dd7b1 Thanks @Jayllyz! - Added a new nursery rule noComponentHookFactories, that disallows defining React components or custom hooks inside other functions.

For example, the following snippets trigger the rule:

function createComponent(label) {
  function MyComponent() {
    return <div>{label}</div>;
  }
  return MyComponent;
}

function Parent() {
  function Child() {
    return <div />;
  }
  return <Child />;
}

#9980 098f1ff Thanks @ematipico! - Fixed #9941: Biome now emits a warning diagnostic when a file exceed the files.maxSize limit.
#9942 9956f1d Thanks @dyc3! - Fixed #9918: useConsistentTestIt no longer panics when applying fixes to chained calls such as test.for([])("x", () => {});.
#9891 4d9ac51 Thanks @dyc3! - Improved the noGlobalObjectCalls diagnostic to better explain why calling global objects like Math or JSON is invalid and how to fix it.
#9902 3f4d103 Thanks @ematipico! - Fixed #9901: the command lint --write is now idempotent when it's run against HTML-ish files that contains scripts and styles.
#9891 4d9ac51 Thanks @dyc3! - Improved the noMultiStr diagnostic to explain why escaped multiline strings are discouraged and what to use instead.
#9966 322675e Thanks @siketyan! - Fixed #9113: Biome now parses and formats @media and other conditional blocks correctly inside embedded CSS snippets.
#9835 f8d49d9 Thanks @bmish! - The noFloatingPromises rule now detects floating promises through cross-module generic wrapper functions. Previously, patterns like export const fn = trace(asyncFn) — where trace preserves the function signature via a generic <F>(fn: F): F — were invisible to the rule when the wrapper was defined in a different file.
#9981 02bd8dd Thanks @siketyan! - Fixed #9975: Biome now parses nested CSS selectors correctly inside embedded snippets without requiring an explicit &.
#9949 e0ba71d Thanks @Netail! - Added the nursery rule useIframeSandbox, which enforces the sandbox attribute for iframe tags.

Invalid:
```
<iframe></iframe>
```
#9913 d417803 Thanks @Netail! - Added the nursery rule noJsxNamespace, which disallows JSX namespace syntax.

Invalid:
```
<ns:testcomponent />
```
#9892 e75d70e Thanks @dyc3! - Improved the noSelfCompare diagnostic to better explain why comparing a value to itself is suspicious and what to use for NaN checks.
#9861 2cff700 Thanks @dyc3! - Added the new nursery rule useVarsOnTop, which requires var declarations to appear at the top of their containing scope.

For example, the following code now triggers the rule:
```
function f() {
  doSomething();
  var value = 1;
}
```
#9892 e75d70e Thanks @dyc3! - Improved the noThenProperty diagnostic to better explain why exposing then can create thenable behavior and how to avoid it.
#9892 e75d70e Thanks @dyc3! - Improved the noShorthandPropertyOverrides diagnostic to explain why later shorthand declarations can unintentionally overwrite earlier longhand properties.
#9978 4847715 Thanks @mdevils! - Fixed #9744: useExhaustiveDependencies no longer reports false positives for variables obtained via object destructuring with computed keys, e.g. const { [KEY]: key1 } = props.
#9892 e75d70e Thanks @dyc3! - Improved the noRootType diagnostic to better explain that the reported root type is disallowed by project configuration and how to proceed.
#9927 7974ab7 Thanks @dyc3! - Added eslint-plugin-unicorn's no-nested-ternary as a rule source for noNestedTernary
#9873 19ff706 Thanks @minseong0324! - noMisleadingReturnType now checks class methods, object methods, and getters in addition to functions.
#9888 362b638 Thanks @dyc3! - Updated metadata for biome migrate eslint to better reflect which ESLint rules are redundant versus unsupported versus unimplemented.
#9892 e75d70e Thanks @dyc3! - Improved the noAutofocus diagnostic to better explain why autofocus harms accessibility outside allowed modal contexts.
#9982 d6bdf4a Thanks @dyc3! - Improved performance of noMagicNumbers.
Biome now maps ESLint no-magic-numbers sources more accurately during biome migrate eslint.
#9889 7ae83f2 Thanks @dyc3! - Improved the diagnostics for noConstantCondition to better explain the problem, why it matters, and how to fix it.
#9866 40bd180 Thanks @dyc3! - Added a new nursery rule noExcessiveSelectorClasses, which limits how many class selectors can appear in a single CSS selector.
#9796 f1c1363 Thanks @dyc3! - Added a new nursery rule useStringStartsEndsWith, which prefers startsWith() and endsWith() over verbose string prefix and suffix checks.

The rule uses type information, so it only reports on strings and skips array lookups such as items[0] === "a".
#9942 9956f1d Thanks @dyc3! - Fixed the safe fix for noSkippedTests so it no longer panics when rewriting skipped test function names such as xit(), xtest(), and xdescribe().
#9874 9e570d1 Thanks @minseong0324! - Type-aware lint rules now resolve members through Pick<T, K> and Omit<T, K> utility types.
#9909 0d0e611 Thanks @Netail! - Added the nursery rule useReactAsyncServerFunction, which requires React server actions to be async.

Invalid:
```
function serverFunction() {
  "use server";
  // ...
}
```
#9925 29accb3 Thanks @ematipico! - Fixed #9910: added support for parsing member expressions in Svelte directive properties. Biome now correctly parses directives like in:renderer.in|global, use:obj.action, and deeply nested forms like in:a.b.c|global.
#9904 e7775a5 Thanks @ematipico! - Fixed #9626: noUnresolvedImports no longer reports false positives for named imports from packages that have a corresponding @types/* package installed. For example, import { useState } from "react" with @types/react installed is now correctly recognised.
#9942 9956f1d Thanks @dyc3! - Fixed the safe fix for noFocusedTests so it no longer panics when rewriting focused test function names such as fit() and fdescribe().
#9577 c499f46 Thanks @tt-a1i! - Added the nursery rule useReduceTypeParameter. It flags type assertions on the initial value passed to Array#reduce and Array#reduceRight and recommends using a type parameter instead.
```
// before: type assertion on initial value
arr.reduce((sum, num) => sum + num, [] as number[]);

// after: type parameter on the call
arr.reduce<number[]>((sum, num) => sum + num, []);
```
#9895 1c8e1ef Thanks @Netail! - Added extra rule sources from react-xyz. biome migrate eslint should do a bit better detecting rules in your eslint configurations.
#9891 4d9ac51 Thanks @dyc3! - Improved the noInvalidUseBeforeDeclaration diagnostic to better explain why using a declaration too early is problematic and how to fix it.
#9889 7ae83f2 Thanks @dyc3! - Improved the diagnostics for noRedeclare to better explain the problem, why it matters, and how to fix it.
#9875 a951586 Thanks @minseong0324! - Type-aware lint rules now resolve members through Partial<T>, Required<T>, and Readonly<T> utility types, preserving optional, readonly, and nullable member flags.

`v2.4.11`

Compare Source

Patch Changes

#9350 4af4a3a Thanks @dyc3! - Added the new nursery rule useConsistentTestIt in the test domain. The rule enforces consistent use of either it or test for test functions in Jest/Vitest suites, with separate control for top-level tests and tests inside describe blocks.

Invalid:
```
test("should fly", () => {}); // Top-level test using 'test' flagged, convert to 'it'

describe("pig", () => {
  test("should fly", () => {}); // Test inside 'describe' using 'test' flagged, convert to 'it'
});
```
#9429 a2f3f7e Thanks @ematipico! - Added the new nursery lint rule useExplicitReturnType. It reports TypeScript functions and methods that omit an explicit return type.
```
function toString(x: any) {
  // rule triggered, it doesn't declare a return type
  return x.toString();
}
```
#9828 9e40844 Thanks @ematipico! - Fixed #9484: the formatter no longer panics when formatting files that contain graphql tagged template literals combined with parenthesized expressions.
#9886 e7c681e Thanks @ematipico! - Fixed an issue where, occasionally, some bindings and references were not properly tracked, causing false positives from noUnusedVariables and noUndeclaredVariables in Svelte, Vue, and Astro files.
#9760 5b16d18 Thanks @myx0m0p! - Fixed #4093: the noDelete rule no longer triggers for delete process.env.FOO, since delete is the documented way to remove environment variables in Node.js.
#9799 2af8efd Thanks @minseong0324! - Added the rule noMisleadingReturnType. The rule detects when a function's return type annotation is wider than what the implementation actually returns.
```
// Flagged: `: string` is wider than `"loading" | "idle"`
function getStatus(b: boolean): string {
  if (b) return "loading";
  return "idle";
}
```
#9880 7f67749 Thanks @dyc3! - Improved the diagnostics for useFind to better explain the problem, why it matters, and how to fix it.
#9755 bff7bdb Thanks @ematipico! - Improved performance of fix-all operations (--write). Biome is now smarter when it runs lint rules and assist actions. First, it runs only rules that have code fixes, and then runs the rest of the rules.
#8651 aafca2d Thanks @siketyan! - Add a new lint rule useDisposables for JavaScript, which detects disposable objects assigned to variables without using or await using syntax. Disposable objects that implement the Disposable or AsyncDisposable interface are intended to be disposed of after use. Not disposing them can lead to resource or memory leaks, depending on the implementation.

Invalid:
```
function createDisposable(): Disposable {
  return {
    [Symbol.dispose]() {
      // do something
    },
  };
}

const disposable = createDisposable();
```
Valid:
```
function createDisposable(): Disposable {
  return {
    [Symbol.dispose]() {
      // do something
    },
  };
}

using disposable = createDisposable();
```
#9788 53b8e57 Thanks @MeGaNeKoS! - Fixed #7760: Added support for CSS scroll-driven animation timeline-range-name keyframe selectors (cover, contain, entry, exit, entry-crossing, exit-crossing). Biome no longer reports parse errors on keyframes like entry 0% { ... } or exit 100% { ... }.
#9728 5085424 Thanks @mkosei! - Fixed #9696: Astro frontmatter now correctly parses regular expression literals like /\d{4}/.
#9261 16b6c49 Thanks @ematipico! - Fixed #8409: CSS formatter now correctly places comments after the colon in property declarations.

Previously, comments that appeared after the colon in CSS property values were incorrectly moved before the property name:
```
[lang]:lang(ja) {
-  /* system-ui,*/ font-family:
+  font-family: /* system-ui,*/
    Hiragino Sans,
    sans-serif;
}
```
#9441 957ea4c Thanks @soconnor-seeq! - Fixed #1630: LSP project selection now prefers the most specific project root in nested workspaces.
#9878 de6210f Thanks @ematipico! - Fixed #9118: noUnusedImports no longer reports false positives for default imports used inside Svelte, Vue and Astro components.
#9879 ce7e2b7 Thanks @dyc3! - Fixed a parser diagnostic's message when vue syntax is disabled so that it no longer references the non-existant html.parser.vue option. This option will become available in 2.5.
#9880 7f67749 Thanks @dyc3! - Improved the diagnostics for useRegexpExec to better explain the problem, why it matters, and how to fix it.
#9846 b7134d9 Thanks @ematipico! - Fixed #9140: Biome now parses Astro's attribute shorthand inside .astro files. The following snippet no longer reports a parse error:
```
---
const items = ['a', 'b'];
---
<ul>
  {items.map((item) => <li {item}>row</li>)}
</ul>
```
#9790 67df09d Thanks @dyc3! - Fixed #9781: Trailing comments after a top-level biome-ignore-all format suppression are now preserved instead of being dropped. This applies to JavaScript, CSS, HTML, JSONC, GraphQL, and Grit files.
#9745 d87073e Thanks @ematipico! - Fixed #9741: the LSP server now correctly returns the organizeImports code action when the client requests it via source.organizeImports.biome in the only filter. Previously, editors with codeAction/resolve support (e.g. Zed) received an empty response because the action was serialized with the wrong kind (source.biome.organizeImports instead of source.organizeImports.biome).
#9880 7f67749 Thanks @dyc3! - Improved the diagnostics for useArraySome to better explain the problem, why it matters, and how to fix it.
#9795 1d09f0f Thanks @dyc3! - Relaxed useExplicitType for trivially inferrable types.

Type annotations can now be omitted when types are trivially inferrable from:
- Binary expressions (const sum = 1 + 1)
- Comparison expressions (const isEqual = 'a' === 'b', const isTest = process.env.NODE_ENV === 'test')
- Logical expressions (const and = true && false)
- Class instantiation (const date = new Date())
- Array literals (const arr = [1, 2, 3])
- Conditional expressions (const val = true ? 'yes' : 'no')
- Function calls (const num = Math.random())
- Parameter defaults - any expression is now allowed (const fn = (max = MAX_ATTEMPTS) => ...)
Comparison expressions always return boolean, so any operands are now allowed
(including property access like process.env.NODE_ENV).

Parameters with default values no longer require type annotations, as TypeScript
can infer the type from the default value (even when referencing variables).

Also removed the redundant any type validation from this rule. The any type
is now only validated by the dedicated noExplicitAny rule, following the
Single Responsibility Principle.
#9809 e8cad58 Thanks @Netail! - Added the new nursery rule useQwikLoaderLocation, which enforces that Qwik loader functions are declared in the correct location.
#9877 fc9d715 Thanks @ematipico! - Fixed #9136 and #9653: noUndeclaredVariables and noUnusedVariables no longer report false positives on several Svelte template constructs that declare or reference bindings in the host grammar:
- {#snippet name(params)} — the snippet name and its parameters (including object, array, rest, and nested destructuring) are now tracked.
- {@render name(args)} — the snippet name used at the render site is now resolved against the snippet declaration.
- {#each items as item, index (key)} — the item binding (plain identifier or destructured), the optional index, and the optional key expression are now tracked.
- {@const name = value} — the declared name is now tracked as a binding and the initializer is analyzed for undeclared references.
- {@debug a, b, c} — each debugged identifier is now analyzed and reported if undeclared.
- Shorthand attributes <img {src} /> — the curly-shorthand attribute is now analyzed as an expression, so undeclared references inside it are reported.
For example, the following template no longer triggers either rule:
```
<script>
let items = [];
let total = 0;
</script>

{#snippet figure(image)}
    <figure>
        <img src={image.src} alt={image.caption} />
        <figcaption>{image.caption}</figcaption>
    </figure>
{/snippet}

{#each items as item}
    {@&#8203;const price = item.price}
    {@&#8203;render figure(item)}
    <span>{price}</span>
{/each}

{@&#8203;debug items, total}
```
#9869 78bce77 Thanks @Netail! - Updated noDuplicateFieldDefinitionNames to also flag duplicate fields within type extensions, interface extensions & input extensions.
#9739 0bc2198 Thanks @dyc3! - Fixed Grit queries that use native Biome AST node names with the native field names that are in our .ungram grammar files. Queries such as JsConditionalExpression(consequent = $cons, alternate = $alt) now compile successfully in biome search and grit plugins.
#9811 2dddca3 Thanks @dyc3! - Updated noImpliedEval to flag new Function() usages, as its a form of indirect eval, and to include no-new-func as a rule source.
#9870 ccf9770 Thanks @Netail! - Marked eslint-qwik-plugin's unused-server as redundant since it was covered by noUnusedVariables.
#9701 1417c3b Thanks @dyc3! - Added the new nursery rule noUselessTypeConversion, which reports redundant primitive conversion patterns such as String(value) when value is already a string.
#9248 49f00a3 Thanks @pkallos! - useNullishCoalescing now also detects ternary expressions that check for null or undefined and suggests rewriting them with ??. A new ignoreTernaryTests option allows disabling this behavior.
#9863 6a44619 Thanks @ematipico! - Fixed #9690: biome check --write is now idempotent on HTML files that contain embedded <style> or <script> blocks. Previously, each run reported "Fixed 1 file" even when the file content did not actually change, because the embedded language formatter's output was not re-indented to match the surrounding HTML block.

clerk/javascript (@clerk/ui)

`v1.25.7`

Compare Source

Patch Changes

Ensure the keyless prompt renders above application content by setting an explicit z-index. (#9211) by @alexcarpenter
The OAuth consent screen now shows a recognizable brand mark for well-known OAuth clients (Claude, ChatGPT) when the requesting application has not uploaded its own logo. (#9158) by @alexcarpenter

`v1.25.6`

Compare Source

Patch Changes

Add an experimental oidcSelfServe option to enable the self-serve OIDC configuration flow in <ConfigureSSO />. (#9198) by @NicolasLopes7
Updated dependencies [858a689, c904fb4]:
- @clerk/shared@4.25.6
- @clerk/localizations@4.13.6

`v1.25.5`

Compare Source

Patch Changes

Fix pressing Escape while a Select is open inside a Drawer (for example the payment method picker in Checkout) dismissing the entire Drawer. Escape now closes only the open Select and leaves the Drawer open. The Select now wires up its floating interaction props so it handles Escape itself, and the Drawer roots a floating tree so nested floating elements are recognized as its children. (#9176) by @alexcarpenter
Improve Select keyboard and screen reader support by routing navigation through floating-ui's interaction hooks. Pressing ArrowUp/ArrowDown on a focused, closed Select now opens the listbox, and the active option is announced via aria-activedescendant. The searchable variant (for example the PhoneInput country picker) now exposes a proper combobox: its input is marked role="combobox" with aria-controls, aria-autocomplete="list", and aria-activedescendant, while the plain variant keeps its listbox semantics. (#9179) by @alexcarpenter
Updated dependencies [bcbdda6]:
- @clerk/shared@4.25.5
- @clerk/localizations@4.13.5

`v1.25.4`

Compare Source

Patch Changes

Reduce layout shift while loading the organization and billing UI. The domain list, billing subscription section, and payment methods now reserve their loaded height while data is fetched, and the subscription section shows a loading indicator instead of rendering nothing. (#9169) by @alexcarpenter
Improve phone input country selector and menu item styling, refining hover and focus states, spacing, and scroll padding. (#9161) by @alexcarpenter
Fix table row hover styling so the rounded bottom corners are only applied to the last row, matching the table's border radius. Previously any hovered row showed a stray corner radius. (#9170) by @alexcarpenter
Headings now use text-wrap: balance and body text uses text-wrap: pretty to reduce widows and orphans when text wraps across lines. This is a progressive enhancement that falls back to normal wrapping in browsers without support. (#9157) by @alexcarpenter
Updated dependencies [e162b71]:
- @clerk/shared@4.25.4
- @clerk/localizations@4.13.4

`v1.25.3`

Compare Source

Patch Changes

Fix small actions button border radius to ensure consistency. (#9146) by @alexcarpenter
Reduce the organization avatar's border radius in the OrganizationSwitcher trigger so it stays proportional at the smaller trigger size. (#9148) by @alexcarpenter
Set box-sizing: border-box on the spinner so its border no longer changes the rendered size and causes a layout shift. (#9147) by @alexcarpenter
Updated dependencies [d8fc1d7, 1d0e78c]:
- @clerk/shared@4.25.3
- @clerk/localizations@4.13.3

`v1.25.2`

Patch Changes

Add a clear button to search inputs for quickly resetting the current query. It appears in the <APIKeys /> search and the <OrganizationProfile /> members search. (#9098) by @alexcarpenter

Search inputs now expose a shared searchInput appearance element (layered alongside any existing component-specific element), and the clear button is themeable via the new shared searchInputClearButton element. The clear button's label can be customized with the new shared searchInput.action__clear localization key.
Fix org invitation and request action descriptions alignment. (#9118) by @alexcarpenter
Polish the <OrganizationSwitcher />: (#9112) by @maxyinger
- Decode avatar images synchronously so a freshly mounted avatar (e.g. when the popover opens) paints on its first frame instead of briefly flashing the avatar background.
- Highlight the trigger while its popover is open.
- Align the "Create organization" action's height with the other rows for a consistent list.
Increase the default height of buttons and inputs by 2px for larger, easier-to-tap touch targets, especially on mobile. (#9061) by @alexcarpenter
Updated dependencies [8dbf343]:
- @clerk/localizations@4.13.2
- @clerk/shared@4.25.2

`v1.25.1`

Patch Changes

Updated dependencies [62f6702]:
- @clerk/shared@4.25.1
- @clerk/localizations@4.13.1

`v1.25.0`

Compare Source

Minor Changes

Add support for Clerk Protect mid-flow SDK challenges (protect_check) on both sign-up and sign-in. (#8329) by @zourzouvillys

When the Protect antifraud service issues a challenge, responses now carry a protectCheck field
with { status, token, sdkUrl, expiresAt?, uiHints? }. Clients resolve the gate by loading the
SDK at sdkUrl, executing the challenge, and submitting the resulting proof token via
signUp.submitProtectCheck({ proofToken }) or signIn.submitProtectCheck({ proofToken }). The
response may carry a chained challenge, which the SDK resolves iteratively.

Sign-in adds a new 'needs_protect_check' value to the SignInStatus union. Upgrading this
package is type-only and does not change runtime behavior: the server returns the new status
(and the protectCheck field) only for instances where Protect mid-flow challenges have been
explicitly enabled — the feature is off by default and is not enabled for existing instances by
upgrading. The server additionally only emits the new status value to SDK versions that
understand it, so older clients never receive an unknown status.

If an exhaustive switch on signIn.status flags the new value after upgrading, handle it by
running the challenge described by protectCheck and submitting the proof via
submitProtectCheck(). Clients should treat the protectCheck field as the authoritative gate
signal and fall back to the status value for defense in depth.

The pre-built <SignIn /> and <SignUp /> components handle the gate automatically by routing
to a new protect-check route that runs the challenge SDK and resumes the flow on completion.

Patch Changes

Fix the payment method form getting stuck in a loading state after a failed card setup. Non-validation errors such as 3DS authentication failures are now displayed. (#9080) by @aeliox
Fix the organization profile modal close button overlapping the SSO configuration wizard's step header. (#9089) by @iagodahlem
Enlarge the show/hide password toggle button's hit area with added padding and rounded corners, making it easier to tap and giving it a clearer hover/focus target. (#9096) by @alexcarpenter
Polish the Protect check card: the loading spinner now hides while a challenge widget (e.g. Turnstile) is visible instead of spinning alongside it, only appears after a short delay so near-instant checks never flash it, and the card no longer reserves empty space above the spinner before a widget has rendered. (#9099) by @mwickett
Fix standalone <SignUp /> Protect checks so the verification card stays mounted while a solved challenge routes to the next step, while stale direct visits to the protect-check route return to the start of the sign-up flow. (#9082) by @mwickett
Fix tooltips rendering behind modals (for example on the organization profile Security page). Tooltips now layer above modal content, and pressing Escape or clicking outside while a tooltip is open inside a modal closes only the tooltip instead of also dismissing the modal. (#9093) by @alexcarpenter
Updated dependencies [6f97ef5, bab1f29, f2d9e4b]:
- @clerk/shared@4.25.0
- @clerk/localizations@4.13.0

`v1.24.2`

Compare Source

Patch Changes

Fix the checked checkbox appearing as a blank filled box in dark themes. The checkmark now uses the colorPrimaryForeground theme color, so it stays legible against the checkbox background across light, dark, and custom themes. (#9074) by @alexcarpenter
On the Test step of the self-serve SSO configuration flow, clicking Continue now re-checks for a successful test run before blocking, so a successful run completed in a separate browser tab is recognized without first clicking Refresh logs. (#9046) by @iagodahlem
Use locale and currency aware formatting for negative money amounts (#9064) by @dstaley
Fix icon-only social buttons rendering taller than the ones with text. They now size to the same height as the text (block) buttons across all appearance spacing and font-size settings, keeping every social button in a row consistent. (#9058) by @alexcarpenter
Stop truncateWithEndVisible from splitting characters outside the BMP (such as CJK Extension B kanji and emoji) into a broken replacement character when truncating to a very small width. The short-width fallback now slices by code point, matching the main truncation path. (#9047) by @alexcarpenter
Updated dependencies [1efc7e5, 5028b54, 2e1fec7]:
- @clerk/shared@4.24.0
- @clerk/localizations@4.12.1

`v1.24.1`

Compare Source

Patch Changes

Add an accessible name to the API Keys search input so screen readers announce it correctly. (#9055) by @wobsoriano

`v1.24.0`

Compare Source

Minor Changes

Add account credits section and credit history page to the billing tab for payers with an existing credit balance. (#8977) by @l-armstrong

Patch Changes

Fix <UserButton /> session actions alignment. (#9034) by @andrewtam
Updated dependencies [4306146, 533f0b1]:
- @clerk/localizations@4.12.0
- @clerk/shared@4.23.0

`v1.23.1`

Compare Source

Patch Changes

UserProfile should show attributes enabled for sign in (#8042) by @dmoerner
Fix missing redirect URL protocol validation for Clerk UI browser navigations, including the multi-session add-account flow. (#8961) by @jacekradko

Internal browser navigations now consistently honor configured redirect protocols and fail closed across mixed ClerkJS/UI bundle versions.
Updated dependencies [cb76aa2]:
- @clerk/shared@4.22.1
- @clerk/localizations@4.11.1

`v1.23.0`

Minor Changes

Handle expired organization domains on self-serve SSO flow, allowing to trigger a new verification (#9000) by @LauraBeatris
Add drag-to-upload support in AvatarUploader (#8348) by @alexcarpenter

Patch Changes

Fix the self-serve SSO configuration wizard losing your place when organization data refetches mid-flow. After submitting a Configure step (for example saving an identity provider's metadata), a background refetch on the OrganizationProfile Security page could unmount the open ConfigureSSO wizard and re-render it on an earlier step. The wizard now stays on its current step while data loads in the background. (#8999) by @iagodahlem
Fix focus ring visibility on Tab elements for keyboard navigation. (#8998) by @alexcarpenter
Updated dependencies [19ce04a, 3e036f4]:
- @clerk/localizations@4.11.0
- @clerk/shared@4.22.0

`v1.22.0`

Minor Changes

Monetary amounts are now formatted using your application's locale. For example, with the locale set to fr-FR, a USD 1000 amount now renders as 1 000,00 $US; previously, it rendered as $1,000.00 regardless of your application's configured locale. (#8918) by @dstaley

Patch Changes

Fix the <ConfigureSSO /> wizard header on small screens: the back link now stacks above the step indicators and the step separators are hidden, so the steps no longer wrap onto a second line. (#8984) by @iagodahlem
Updated dependencies [fd7b824, af0eb3f, 8024cac]:
- @clerk/localizations@4.10.0

`v1.21.0`

Compare Source

Minor Changes

Migrate from :focus to :focus-visible so focus rings only appear during keyboard navigation (#8595) by @alexcarpenter
Improve UserButton and OrganizationSwitcher accessibility. The trigger button now announces itself as a dialog trigger (aria-haspopup="dialog") and the popover uses role="dialog" instead of role="menu". UserButton and OrganizationSwitcher popovers now receive focus when opened, and actions are logically grouped with labelled role="group" elements for screen readers. (#8325) by @alexcarpenter

Patch Changes

Condense the OrganizationProfile Security page SSO overview to a single summary row (one-line description, domains as chips, status badge, actions under the overflow menu) and remove the now-unused ssoSection provider/sign-on URL/issuer/descriptionLine2 localization keys. (#8915) by @iagodahlem
Updates development mode indicator styling. (#8917) by @alexcarpenter
Add a generic FLOW_STEP_MOUNTED telemetry event (eventFlowStepMounted) for measuring multi-step flow funnels, and wire it into the self-serve SSO flow (#8951) by @LauraBeatris
Add localization support for OAuth access denied errors. (#8786) by @wobsoriano
Allow changing enterprise connection provider between self-serve SSO steps (#8881) by @LauraBeatris
The Security tab in <OrganizationProfile /> is now hidden for members who lack the manage enterprise connections permission (org:sys_entconns:manage), instead of rendering a permission-denied state. This matches how the Members, Billing, and API keys tabs are gated. (#8971) by @iagodahlem
Self-serve SSO: fix the configuration wizard rendering a blank step when a connection is reset from the first configuration step. Resetting now returns to the provider selection step. (#8970) by @iagodahlem
Self-serve SSO: restore keyboard-accessible provider selection, mark configuration wizard steps complete based on connection state rather than position, and fix the organization Security page loading state. (#8940) by @iagodahlem
Updated dependencies [c38d853, 7e3174a, 97039bb, f43071d, 0e0ff11, 0039618, a536a0d]:
- @clerk/localizations@4.9.3
- @clerk/shared@4.21.0

`v1.20.0`

Compare Source

Minor Changes

Introduces organization membership feature. (#8933) by @NicolasLopes7

Organizations can enforce exclusive membership, limiting users to a single organization. During the choose-organization session task, members of such an organization are automatically activated instead of seeing the picker. Organization.exclusiveMembership is now exposed on the Organization resource.

Patch Changes

Updated dependencies [01789b4]:
- @clerk/shared@4.20.0
- @clerk/localizations@4.9.2

`v1.19.0`

Minor Changes

When an interactive bot-protection challenge appears during sign-in or sign-up, the card now brings the challenge to the foreground — hiding the other fields and buttons until it's solved — so it's clear the "Verify you are human" check must be completed. Invisible challenges are unaffected. (#8907) by @alexcarpenter

`v1.18.1`

Patch Changes

Improve the accessible label for identity edit buttons in verification flows. (#8902) by @austincalvelage
Remove hidden password input from accessibility tree when hidden (#8899) by @alexcarpenter
Add support for the inert attribute usage under React 19. Inert content is now correctly non-interactive on both React 18 and 19. (#8820) by @alexcarpenter
Fix checkbox default styles when using the simple theme. (#8922) by @alexcarpenter
Improve Menu keyboard navigation and accessibility. Menus now support Enter/Space to open from the trigger, ArrowDown/ArrowUp/Home/End to move focus, Escape to close and return focus to the trigger, and skip disabled items during arrow-key navigation. Menus no longer mark the rest of the page as aria-hidden while open, so assistive technologies can still reach surrounding content. (#8333) by @alexcarpenter
The SSO setup flow now ends on an explicit Activate step: after configuring and testing a connection you confirm activation with an Activate SSO action (or skip and activate later) instead of a static confirmation summary. (#8882) by @iagodahlem
Fix the X (formerly Twitter) provider logo being nearly invisible in dark mode by recoloring it to match the foreground color, consistent with other monochrome provider icons. (#8912) by @jordan-bott
Updated dependencies [c84f8df, 53e7b11, e51e22a]:
- @clerk/localizations@4.9.1
- @clerk/shared@4.19.1

`v1.18.0`

Minor Changes

Introduce organization domains with TXT verification on self-serve SSO flow (#8788) by @LauraBeatris
Improve OrganizationProfile UI: (#8898) by @LauraBeatris
- Hide the Verified domains section when there are no domains and the user lacks permission to add them
- Rename the Organization profile section to Profile for consistency with UserProfile
- Align the enterprise accounts section with the account data

Patch Changes

When inviting organization members requires purchasing additional seats, invitations are now sent automatically after checkout completes successfully. (#8869) by @dstaley
Add confirmation dialog for organization domain deletion as part of self-serve SSO (#8866) by @LauraBeatris
The Security page's SSO wizard now has a back-to-Security control, and Start/Edit open the wizard at the first step (Continue resumes where you left off). (#8864) by @iagodahlem
Updated dependencies [d5968d0, 431e16c, ffbc650]:
- @clerk/localizations@4.9.0
- @clerk/shared@4.19.0

`v1.17.0`

Compare Source

Minor Changes

Add internal OAuth transport support for native desktop SDK wrappers to run Clerk's prebuilt OAuth flows through a system browser. (#8831) by @wobsoriano

Patch Changes

Add an overview to the organization profile Security page. The page now lands on a summary of the SSO connection — a status badge (Unconfigured, In Progress, Active, Inactive), the configuration details framed in a card (provider, domain, sign-on URL, issuer, certificate), and an actions menu with Edit, Activate / Deactivate, and Remove — and switches into the existing configuration flow on Start, Continue, or Edit. (#8813) by @iagodahlem
Rename the <OrganizationProfile /> SSO page to "Security". The navbar entry is now labeled "Security" with a shield icon, its route path changed from organization-self-serve-sso to organization-security, and a new organizationProfile.navbar.security localization key replaces organizationProfile.navbar.selfServeSSO. (#8796) by @iagodahlem
Upgrade build tooling to Rspack 2 (No user-facing API changes). (#8382) by @jacekradko
Updated dependencies [f4167ec, 17e4164, ed2cf75, 67c04a4, 51c8fdc, c2ba971, 8744728, d9b5c7d]:
- @clerk/shared@4.18.0
- @clerk/localizations@4.8.2

`v1.16.1`

Compare Source

Patch Changes

Fix checkout button label showing "Start free trial" when adding seats during a free trial period (#8829) by @mauricioabreu
Migrate the build pipeline to tsdown and TypeScript 6.0. This is an internal tooling change with no intended changes to the public API or runtime behavior. (#8177) by @dstaley
Updated dependencies [f046c49, b5fa9f6, 3d5b2fe]:
- @clerk/localizations@4.8.1
- @clerk/shared@4.17.1

`v1.16.0`

Compare Source

Minor Changes

Add support for Clerk Billing plans with per-seat costs. (#8629) by @dstaley
- New invite-to-checkout flow when inviting members while on a plan that uses per-seat costs.
- New localization values to support UI additions.
- Support for the orgId and minSeats parameters to getPlans().
- Support for the seatsQuantity and priceId parameters to checkout creation.
- New totals field on payments.
- New availablePrices field on plans.
- New nextPayment field on subscription items.
- New discounts field on checkouts.
- Additional fields on nextPayment for more granularity.

Patch Changes

Display the scope description for user:org:read organization access in the OAuth Consent dialog so users understand organization membership information is being shared with the OAuth client. (#8798) by @jfoshee
Fix alignment of the domain section subtitle in the organization profile to match the button above it. (#8795) by @alexcarpenter
Updated dependencies [a5c7bc7]:
- @clerk/localizations@4.8.0
- @clerk/shared@4.17.0

`v1.15.1`

Compare Source

Patch Changes

Fix Chrome-specific scroll jump when toggling the billing period switch on the pricing table. (#8742) by @alexcarpenter
Fix a circular import in the styled-system that could crash module initialization under bundler configurations with tree-shaking disabled. (#8754) by @jacekradko
Internal refactor for self-serve SSO wizard navigation to leverage a guard-based state machine. (#8715) by @iagodahlem

It makes the step navigation more predictable: the step you land on (including after a reload) and which steps you can move to are derived from the connection's state, the connection reset flow lands you on the right step.
Correctly display OAuth consent redirect domains for known multi-label public suffixes. (#8700) by @wobsoriano
Fix modal backdrop appearing light in dark mode (#8743) by @alexcarpenter
Add a "Forgot password?" action on the sign-in start page when the password field is shown. This improves the account recovery UX when strict user enumeration protection is enabled. (#8733) by @Ephem
Add and improve JSDoc comments across public types and methods to support generated reference documentation for the /objects docs section. Exports a few previously-internal types (OnEventListener, OffEventListener, ClerkOptionsNavigation) so they can be referenced from the generated docs. (#8276) by @alexisintech
Updated dependencies [2d6670c, af706e3, 032632c, 0fece6f, b295af3, 8e1bd48, 90bc732]:
- @clerk/shared@4.16.0
- @clerk/localizations@4.7.2

`v1.15.0`

Compare Source

Minor Changes

Internal <ConfigureSSO /> refactor to call new org-scoped enterprise connections FAPI endpoints, replacing the /me/ deprecated scope. (#8671) by @iagodahlem

Patch Changes

Add support for Google Workspace SAML provider to self-serve SSO (#8690) by @LauraBeatris
Layer architecture for configure steps per IdP and protocol on <ConfigureSSO /> (#8651) by @LauraBeatris
Reworks the <ConfigureSSO /> confirmation step and adds a dedicated reset connection dialog: (#8706) by @iagodahlem
- Introduces <ResetConnectionDialog /> — a modal-based, type-to-confirm dialog scoped to the wizard container that replaces the inline reset confirmation card. Wraps the destructive delete behind useReverification, clears the local provider selection, and rewinds the wizard to provider selection on success.
- Restyles the confirmation step body: unified status header with an inline Active / Inactive badge, grouped Enable SSO and Domain rows, two-column configuration details rendered through ProfileSection.ItemList, outlined Configure again, destructive Reset connection, and an inactive-state banner inside the step footer.
- Step.Header now accepts a badge prop so a step can render an inline status pill next to its title without crowding the right-aligned children slot.
- OrganizationProfile forwards the shared content ref to <ConfigureSSO /> so the new dialog portals into the wizard chrome when the component is embedded inside the organization profile.
"Fix rendering issue for free trial badge." (#8712) by @l-armstrong
Fix the legal consent checkbox growing in size when its label wraps to a second line while using the simple theme. The checkbox is now aligned to the start of the row so it no longer stretches to match the label height. (#8705) by @dmoerner
Avoid sending duplicate verification codes when persisted email or phone code verifications are already pending. (#8548) by @jacekradko
Adds a wizard-wide reset connection entry on the <ConfigureSSO /> step footers: (#8711) by @iagodahlem
- New Step.Footer.Reset compound part that renders a destructive ghost button on the leading edge of the footer and opens the existing ResetConnectionDialog. The slot owns its own open state and gates itself on the current enterprise connection, so it stays hidden on the provider selection step.
- Wires the reset entry into the Verify Domain, Configure (Okta and Custom SAML), and Test steps so the reset action is reachable from anywhere in the wizard. The confirmation step keeps its in-body destructive button.
- Exposes a configureSSOFooterResetButton element descriptor so the new button surface can be themed via appearance customizations.
Fix stepper chevron wrapping in <ConfigureSSO /> (#8693) by @alexcarpenter
Add support for Microsoft Entra SAML provider to self-serve SSO (#8695) by @LauraBeatris
Add mobile support for <ConfigureSSO /> navbar to display application name, logo and organization name (#8675) by @LauraBeatris
Scope the UserProfile active-devices fetch cache by user.id so a session switch or sign-out/sign-in on a shared device no longer renders the previous user's device activity (IP, location, browser/device) from the module-scoped cache. (#8703) by @dominic-clerk
Updated dependencies [afb75e6, c3df67a, 86fd38f, 8d6bb56, 43dfefa, 5fc7b21, c2ba134]:
- @clerk/localizations@4.7.1
- @clerk/shared@4.15.0

`v1.14.0`

Compare Source

Minor Changes

Migrate to new icon set to create consistency across components. (#8319) by @alexcarpenter
Display "Single Sign-on (SSO)" section in OrganizationProfile if self-serve SSO is enabled on the current active organization (#8600) by @LauraBeatris

Patch Changes

Simplify ActionCard shadow styling. (#8625) by @alexcarpenter
Add a visible radio indicator to each provider card on the <ConfigureSSO /> Select Provider step. (#8664) by @iagodahlem
Introduce UX improvements for <ConfigureSSO /> such as: (#8601) by @LauraBeatris
- Render attribute-mapping and service-provider field labels per IdP nomenclature
- Add "Open test URL" button and surface a clear empty state
- Expand the appearance descriptor surface across step content so developers can override styling
Updated dependencies [e538525, 79cdd1f, 0937b5d, 48e3f64, 4af9389, 4d5027b, 10d36ab, 4e08924, bcf0e77]:
- @clerk/localizations@4.7.0
- @clerk/shared@4.14.0

`v1.13.1`

Compare Source

Patch Changes

Fix the Manage Subscription button in <UserProfile /> / <OrganizationProfile /> and the Cancel / Re-subscribe actions in <SubscriptionDetails /> so they are shown for paid seat-based plans that have no base fee. A shared isManageableSubscriptionItem helper now drives both places, treating "free / unmanageable" as "the instance's default plan" instead of "the plan has no base fee". (#8375) by @mauricioabreu
Updated dependencies [a036ce8]:
- @clerk/shared@4.13.1
- @clerk/localizations@4.6.8

`v1.13.0`

Compare Source

Minor Changes

Remove <ConfigureSSO /> from experimental path (#8588) by @LauraBeatris
Add elevation appearance option with 'raised' (default) and 'flush' values. When set to flush, card-based components render without border, box-shadow, border-radius, outer padding, and footer background, allowing them to sit flat against their container. Applies to <SignIn />, <SignUp />, <Waitlist />, <CreateOrganization />, <OrganizationList />, <OAuthConsent />, <UserVerification />, and session task components. Profile and popover components always render as raised. Modal components always render as raised regardless of this setting. (#8510) by @alexcarpenter

The cardBox element exposes a data-elevation="flush" attribute when flush is active, giving className-based themes a hook to neutralize their card chrome via attribute selectors. The shadcn theme uses this hook to drop its shadow-sm border utilities under flush.

Patch Changes

Add ProfileCard.Page for UserProfile and OrganizationProfile pages (#8602) by @LauraBeatris
Fix layout shift when Copy test URL button enters loading state in <ConfigureSSO /> (#8592) by @alexcarpenter
Improve ClipboardInput positioning and accessibility by using readOnly instead of isDisabled (#8593) by @alexcarpenter
Updated dependencies [6eaf4d6, 1aab31e]:
- @clerk/shared@4.13.0
- @clerk/localizations@4.6.7

`v1.12.1`

Patch Changes

Fix attribute statement section in <ConfigureSSO /> with claim name for Custom SAML provider (#8586) by @LauraBeatris
Updated dependencies [95f6c2f]:
- @clerk/localizations@4.6.6
- @clerk/shared@4.12.2

`v1.12.0`

Minor Changes

Add autoFocus appearance option to disable automatic input focusing (#8521) by @alexcarpenter

Patch Changes

Improve Floating UI usage: fix arialLabel typo in MenuTrigger, replace imperative floating ref in MenuList with useMergeRefs, remove manual position offset in SelectOptionList, add aria-haspopup to MenuTrigger, and add missing ARIA attributes (aria-expanded, aria-haspopup, role, aria-selected) to Select components. (#8328) by @alexcarpenter
Add support for custom SAML provider in <ConfigureSSO /> (#8564) by @LauraBeatris
Update NavBar to receive containerSx prop (#8568) by @LauraBeatris
Updated dependencies [4fc38a0]:
- @clerk/localizations@4.6.5
- @clerk/shared@4.12.1

`v1.11.0`

Compare Source

Minor Changes

Add highlightedPlan prop to PricingTable default layout to render a "Popular" badge on the matching plan (#8554) by @alexcarpenter
Add support for inline <bold> markup in localization values, rendered as <strong> elements. Translators can now write 'Agree to <bold>Terms</bold>' in a single key instead of splitting into prefix/bold/suffix fragments. Token values are substituted only into parsed text leaves, so user-controlled data can never become markup. Also hardens applyTokensToString to use Object.prototype.hasOwnProperty.call when filtering token names, preventing prototype-chain names like {{hasOwnProperty}} from crashing rendering. (#8539) by @alexcarpenter

Patch Changes

Add a two-mode segmented control to the SAML config submission sub-step in <__experimental_ConfigureSSO />. Users pick between Add via metadata URL (default) and Configure manually. The metadata URL form is unchanged; the manual entry form ships in a follow-up commit. Locale keys added under configureSSO.configureStep.samlOkta.modes in en-US. (#8553) by @iagodahlem
Add confirmation step for <__experimental_ConfigureSSO /> (#8531) by @LauraBeatris
Add test step for <__experimental_ConfigureSSO /> (#8544) by @LauraBeatris
Updated dependencies [9fa6642, 930047f, b45777c, 5a7225e]:
- @clerk/shared@4.12.0
- @clerk/localizations@4.6.4

`v1.10.0`

Compare Source

Minor Changes

Add fontFamilyMono appearance variable for customizing the monospace font used in Clerk components. Defaults to ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace and is exposed as the --clerk-font-family-mono CSS variable. (#8546) by @alexcarpenter

Patch Changes

Implement the Okta SAML metadata URL submission path in the Configure step of <__experimental_ConfigureSSO />. Adds a single text input for the IdP metadata URL; Continue posts { saml: { idpMetadataUrl } } via user.updateEnterpriseConnection wrapped in useReverification, with useCardState driving the loading state and handleError routing backend errors inline to the field or to the card-level error surface. Locale keys added under configureSSO.configureStep in en-US. Manual entry, file upload, SP-side copy rows, and the Okta admin-console walkthrough ship in follow-up PRs. (#8535) by @iagodahlem
Implement the provider selection step of <__experimental_ConfigureSSO />. Renders the two SAML provider tiles (Okta Workforce and Custom SAML Provider) with real icons sourced from img.clerk.com, tracks the picked provider in local state, and gates Step.Footer.Continue on a selection. Includes a warning callout about provider lock-in and a minor Step.Header alignment tweak. All user-visible strings are wired through @clerk/localizations, with translations for every supported locale. (#8503) by @iagodahlem

Also extends the flow context with provider and setProvider, adds the deriveInitialStep helper, and wires the wizard's initialStepId so the configure flow remounts on the right step after a reload. Continue on Select Provider stages the chosen provider and advances to the next step; the enterprise connection is created on Verify Domain once the user's email is verified and primary.
Update <ConfigureSSO /> in the context of organizations to only allow managing enterprise connections based on system permission (#8515) by @LauraBeatris
fix(ui): don't treat numeric usernames as phone numbers (#8532) by @thiskevinwang
Fixed custom page icons not rendering in React 19 due to a forwarded ref overwriting the internal node reference. (#8534) by @wobsoriano
Add verify/add email address step to <__experimental_ConfigureSSO /> (#8520) by @LauraBeatris
Refactor <__experimental_ConfigureSSO /> into a layered primitive set: a state-driven Wizard, a UI-only Stepper, a Step compound, and ProfileCard chrome. No public component API change. Drops the central FooterActionsContext registry — each step now renders its own footer via Step.Footer.Previous / Step.Footer.Continue purely-presentational compounds. Adds a SelectProviderStep boilerplate filtered out of the breadcrumb. (#8493) by @iagodahlem
Updated dependencies [1a4d7d1, a6916b1, 1084180, 39099b6, 18e0a1a]:
- @clerk/localizations@4.6.3
- @clerk/shared@4.11.0

`v1.9.1`

Compare Source

Patch Changes

Fixed unhandled TypeError when unsafeMetadata is passed to <SignUp /> (#8500) by @wobsoriano
Updated dependencies [5cda3ee]:
- @clerk/shared@4.10.2
- @clerk/localizations@4.6.2

`v1.9.0`

Compare Source

Minor Changes

Removed unused internal OAuthConsent prop. (#8492) by @wobsoriano

Patch Changes

Add wizard steps for the <__experimental_ConfigureSSO /> component (#8468) by @LauraBeatris
Remove back button on the sign-in password compromised/pwned error screen. (#8280) by @Ephem

These errors are not recoverable by re-entering the password, so the back button led to a confusing dead end that would always take you back to the same error.
Updated dependencies [7a5892f]:
- @clerk/shared@4.10.1
- @clerk/localizations@4.6.1

`v1.8.0`

Compare Source

Minor Changes

Add experimental <ConfigureSSO /> component. Not ready for usage yet. (#8427) by @LauraBeatris

Patch Changes

Localize API keys table headers (#8462) by @jebibot
Surface initialization errors and stalled mounts in the component renderer. The internal ensureMounted pipeline now logs a [Clerk UI] error to the console when the lazy module import rejects, and emits a diagnostic warning if the renderer has not mounted within 10 seconds. Makes silent failures (e.g. failed dev-server chunk loads, unresolved lazy-compilation proxies) surface with an actionable message instead of hanging without feedback. (#8379) by @jacekradko
Updated dependencies [9e9230c, 68d32df, 1c27d4d, 1001193]:
- @clerk/localizations@4.6.0
- @clerk/shared@4.10.0

`v1.7.0`

Compare Source

Minor Changes

Render OAuthConsent organization selector from user:org:read scope. (#8415) by @wobsoriano

Expose OAuthConsent as a public component export across React-based SDKs. (#8381) by @wobsoriano

Example:

import { OAuthConsent } from '@&#8203;clerk/react';

export default function Page() {
  return <OAuthConsent />;
}

`v1.6.7`

Patch Changes

Updated dependencies [da76490]:
- @clerk/shared@4.8.5
- @clerk/localizations@4.5.5

`v1.6.6`

Patch Changes

Display web3wallet in UserProfile when added by administrator (#7981) by @dmoerner
Updated dependencies [083c4c5, dcaf694, 4b62ce8]:
- @clerk/shared@4.8.4
- @clerk/localizations@4.5.4

`v1.6.5`

Patch Changes

Fixed OAuth redirect_url for openSignIn modal. (#8385) by @wobsoriano

`v1.6.4`

Patch Changes

Default the organization selection in <OAuthConsent /> to the user's last active organization, falling back to the first membership when it is not set or no longer available. (#8362) by @kylemac
Updated dependencies [d52b311]:
- @clerk/shared@4.8.3
- @clerk/localizations@4.5.3

`v1.6.3`

Compare Source

Patch Changes

Fix EnableOrganizationsPrompt in keyless mode: show "Claim your application" CTA instead of broken "Sign in to continue" when organizations are enabled on an unclaimed keyless app with no signed-in user. (#8341) by @mwickett
Use user.organizationMemberships from the already-loaded user object to populate the org select in the OAuth consent screen, avoiding a redundant memberships fetch. (#8350) by @wobsoriano
Correctly display IP redirect URIs in OAuth consent. (#8342) by @wobsoriano
Add scroll-driven fade overlays to ListGroupContent in the OAuthConsent component so overflowing scope lists visually indicate more content above and below. (#8339) by @alexcarpenter

`v1.6.2`

Compare Source

Patch Changes

Add infinite loading to organization selection in <OAuthConsent />. (#8309) by @wobsoriano
Fix OAuthConsent always redirecting to sign-in by adopting the AuthenticatedRoutes pattern used by other full-page components (#8327) by @alexcarpenter
Updated dependencies [c7b0f47, 34762e8]:
- @clerk/shared@4.8.2
- @clerk/localizations@4.5.2

`v1.6.1`

Patch Changes

Updated dependencies [b0b6675]:
- @clerk/shared@4.8.1
- @clerk/localizations@4.5.1

`v1.6.0`

Minor Changes

Introduce internal <OAuthConsent /> component for rendering a zero-config OAuth consent screen on an OAuth authorize redirect page. (#8289) by @wobsoriano

Usage example:
```
import { OAuthConsent } from '@&#8203;clerk/nextjs';

export default function OAuthConsentPage() {
  return <OAuthConsent />;
}
```

Patch Changes

Updated dependencies [dc2de16]:
- @clerk/shared@4.8.0
- @clerk/localizations@4.5.0

`v1.5.1`

Compare Source

Patch Changes

Updated dependencies [3fd586d, f9ff9e9]:
- @clerk/shared@4.7.0
- @clerk/localizations@4.4.1

`v1.5.0`

Compare Source

Minor Changes

Add support for rendering the Banned badge in the organization members list. (#8261) by @dstaley

Patch Changes

Updated dependencies [fdac10e, 4e3cb0a, aa32bbc]:
- @clerk/shared@4.6.0
- @clerk/localizations@4.4.0

`v1.4.0`

Compare Source

Minor Changes

API keys is now generally available. (#8059) by @wobsoriano

`<APIKeys />` component

import { APIKeys } from '@&#8203;clerk/react';

export default function Page() {
  return <APIKeys />;
}

`useAPIKeys()` hook

import { useAPIKeys } from '@&#8203;clerk/react';

export default function CustomAPIKeys() {
  const { data, isLoading, page, pageCount, fetchNext, fetchPrevious } = useAPIKeys({
    pageSize: 10,
    initialPage: 1,
  });

  if (isLoading) return <div>Loading...</div>;

  return (
    <ul>
      {data?.map(key => (
        <li key={key.id}>{key.name}</li>
      ))}
    </ul>
  );
}

Patch Changes

Adjust padding and display logo on OrganizationList header (#8229) by @LauraBeatris
Updated dependencies [2c06a5f]:
- @clerk/shared@4.5.0
- @clerk/localizations@4.3.2

honojs/middleware (@hono/zod-validator)

`v0.9.0`

Compare Source

Minor Changes

#2038 7bc11dffa7dd5b639c614b12c34bd76722d76354 Thanks @yusukebe! - Use InferInput from hono/validator instead of a local copy to avoid duplication (requires hono >=4.11.2)

`v0.8.0`

Compare Source

Minor Changes

#1881 e90e4fb30877f3e3f4b0588bdb2bbfc337efbf67 Thanks @T4ko0522! - fix(zod-validator): surface the default 400 failure response so it propagates to the RPC schema (refs honojs/hono#3746).
- Widen the no-hook overload return type to MiddlewareHandler<E, P, V, TypedResponse<ZodValidatorFailureBody<T>, 400, 'json'>>, so the default c.json(result, 400) body reaches MergeMiddlewareResponse<M_k> on the Hono side and shows up in hc<typeof app> as a typed 400 branch.
- Intersect the inferred middleware response with Response (Response & TypedResponse<...>) in both ZodValidatorFailureResponse<T> and ExtractValidationResponse<VF> so a zValidator(...) middleware remains assignable to a plain MiddlewareHandler (avoids a TS2322 regression caused by bare TypedResponse).
- Collapse the no-hook overload to also accept undefined for the hook parameter together with the options.validationFunction, allowing zValidator(target, schema, undefined, { validationFunction }) to match the typed-failure path.
- Bump peerDependencies.hono to >=4.10.0 because this PR now relies on the 4-argument MiddlewareHandler<E, P, I, R> signature introduced in Hono v4.10.0; on hono <4.10.0, MiddlewareHandler only accepts 3 type arguments and consumers would hit TS2707 even though peer ranges currently allow it.

scalar/scalar (@scalar/nextjs-api-reference)

`v0.11.11`

Patch Changes

#9719: docs: update the Scalar platform overview block in the README

`v0.11.10`

Patch Changes

#9710: Republish so the updated README (with the Scalar platform overview) reaches npm. Also renames the README generator metadata in package.json from readme to scalarReadme: npm treats a readme field as the readme text itself, so affected packages were published with a literal [object Object] readme on the registry instead of README.md.

`v0.11.9`

`v0.11.8`

`v0.11.7`

`v0.11.6`

`v0.11.5`

`v0.11.4`

`v0.11.3`

`v0.11.2`

`v0.11.1`

Patch Changes

#9719: docs: update the Scalar platform overview block in the README

`v0.11.0`

Minor Changes

#9422: Add a nonce option for Content Security Policy support.

When you pass a nonce, the rendered HTML stamps it onto the inline <script> and the CDN <script> tag (and Scalar's own <style> tags, plus a matching <meta property="csp-nonce">). This lets the API Reference run under a strict script-src with no unsafe-inline and no unsafe-eval.
```
ApiReference({
  url: '/openapi.json',
  // Match this value in your `script-src` CSP directive.
  nonce: 'r4nd0m',
})
```
Note: style-src still needs 'unsafe-inline'. The reference renders inline style="…" attributes, which a CSP nonce can never authorize (nonces only apply to <script>, <style> and <link> elements), so a nonce-only style-src is not possible. The win is a fully strict script-src.

`v0.10.20`

`v0.10.19`

`v0.10.18`

`v0.10.17`

`v0.10.16`

`v0.10.14`

`v0.10.13`

`v0.10.12`

`v0.10.11`

`v0.10.10`

`v0.10.9`

Patch Changes

#8873: refactor: migrate integrations to client-side rendering package

`v0.10.8`

`v0.10.7`

`v0.10.6`

`v0.10.5`

`v0.10.4`

Patch Changes

#8466: chore: new build pipeline

`v0.10.3`

Patch Changes

Updated Dependencies

@scalar/core@0.4.3

`v0.10.2`

`v0.10.1`

`v0.10.0`

Minor Changes

#8322: chore: bump required node version to >=22 (LTS)

Patch Changes

Updated Dependencies

@scalar/core@0.4.0
- #8322: chore: bump required node version to >=22 (LTS)

tailwindlabs/tailwindcss (@tailwindcss/postcss)

`v4.3.3`

Compare Source

Fixed

Support --watch --poll[=ms] in @tailwindcss/cli when filesystem events are unreliable or unavailable (#20297)
Canonicalization: match arbitrary hex colors against theme colors case-insensitively (e.g. bg-[#fff] and bg-[#FFF] → bg-white) (#20298)
Prevent Preflight from overriding Firefox's native iframe:focus-visible outline styles (#20292)
Ensure theme('colors.foo') in JS plugins resolves correctly when both --color-foo and --color-foo-bar exist (#20299)
Ensure fractional opacity modifiers work with named shadow sizes like shadow-sm/12.5, text-shadow-sm/12.5, drop-shadow-sm/12.5, and inset-shadow-sm/12.5 (#20302)
Parse selectors like [data-foo]div as two selectors instead of one (#20303)
Ensure @tailwindcss/postcss rebuilds when a preprocessor like Sass changes the input CSS without changing the input file on disk (#20310)
Ensure CSS nesting is handled even when Lightning CSS isn't run, such as in @tailwindcss/browser and Tailwind Play (#20124)
Prevent achromatic theme colors from shifting hue when mixed in polar color spaces like oklch (#20314)
Ensure --spacing(0) is optimized to 0px instead of 0 so it remains a <length> when used in calc(…) (#20319)
Load @parcel/watcher only when needed in @tailwindcss/cli --watch mode, so one-off builds and --watch --poll work when @parcel/watcher can't be loaded (#20325)
Use explicit platform fonts instead of system-ui and ui-sans-serif so CJK text respects the page's lang attribute on Windows (#20318)
Prevent @tailwindcss/upgrade from rewriting ignored files when run from a subdirectory (#20329)
Ensure earlier @source rules pointing to nested files are scanned when later @source rules point to files in parent folders (#20335)
Prevent @tailwindcss/vite from triggering full page reloads when scanned files are processed by Vite but haven't been loaded as modules yet (#20336)

`v4.3.2`

Compare Source

Fixed

Support bare spacing values for auto-rows-* and auto-cols-* utilities (e.g. auto-rows-12 and auto-cols-16) (#20229)
Prevent @tailwindcss/cli in --watch mode from crashing on Windows when @source points to a directory that doesn't exist (#20242)
Prevent @tailwindcss/vite from crashing in Deno v2.8.x when context.parentURL is not a valid URL (#20245)
Ensure @tailwindcss/cli in --watch mode rebuilds when the input CSS file changes in an ignored directory (#20246)
Allow @variant rules used in addBase(…) to use custom variants defined later (#20247)
Prevent @tailwindcss/vite from crashing during HMR when scanned files or directories are deleted (#20259)
Generate font-size instead of color declarations for text-[--spacing(…)] (#20260)
Prevent @source patterns from scanning unrelated sibling files and folders (#20263)
Extract class candidates adjacent to Template Toolkit delimiters like %]…[% in .tt, .tt2, and .tx files (#20269)
Extract class candidates from conditional Maud syntax like p.text-black[condition] (#20269)
Prevent @position-try rules from triggering unknown at-rule warnings when optimizing CSS (#20277)
Support class suggestions for named opacity modifiers from --opacity theme values (#20287)
Prevent type errors in @tailwindcss/postcss when used with newer PostCSS patch releases (#20289)

`v4.3.1`

Compare Source

Added

Add --silent option to suppress output in @tailwindcss/cli (#20100)

Fixed

Remove deprecation warnings by using Module#registerHooks instead of Module#register on Node 26+ (#20028)
Canonicalization: don't crash when plugin utilities throw for unsupported values (#20052)
Allow @apply to be used with CSS mixins (#19427)
Ensure not-* correctly negates @container queries, including style(…) queries (#20059)
Ensure drop-shadow-* color utilities work with custom shadow values containing calc(…) (#20080)
Fix 'Sourcemap is likely to be incorrect' warnings when using @tailwindcss/vite (#20103)
Ensure @tailwindcss/webpack can be installed in Rspack projects without requiring webpack as a peer dependency (#20027)
Canonicalization: don't suggest invalid calc(…) expressions (e.g. px-[calc(1rem+0px)] → px-[calc(1rem+0)]) (#20127)
Canonicalization: avoid suggesting large spacing-scale values for arbitrary lengths (e.g. left-[99999px] → left-[99999px], not left-24999.75) (#20130)
Ensure @tailwindcss/cli in --watch mode recovers when a tracked dependency is deleted and restored (#20137)
Ensure standalone @tailwindcss/cli binaries are ignored when scanning for class candidates (#20139)
Ensure class candidates are extracted from Twig addClass(…) and removeClass(…) calls (#20198)
Don't crash in the Ruby or Vue preprocessors when scanning files containing invalid UTF-8 bytes (#19588)
Allow @variant to be used inside addBase (#19480)
Ensure @source globs with symlinks are preserved (#20203)
Ensure later @source rules can re-include files excluded by earlier @source not rules (#20203)
Upgrade: don't migrate empty class rules to invalid @utility rules (#20205)
Ensure transitions between inset-shadow-none and other inset shadows work correctly (#20208)
Ensure explicitly referenced @source directories are scanned even when ignored by git (#20214)
Ensure @source globs ending in **/* preserve dynamic path segments to avoid scanning too many files (#20217)
Canonicalization: don't fold calc(…) divisions when the result would require high precision (e.g. w-[calc(100%/3.5)] → w-[calc(100%/3.5)], not w-[28.571428571428573%]) (#20221)
Serve ESM type declarations to ESM importers of @tailwindcss/postcss (#20228)

Changed

Generate 0 instead of calc(var(--spacing) * 0) for spacing utilities like m-0 and left-0 (#20196)
Generate var(--spacing) instead of calc(var(--spacing) * 1) for spacing utilities like m-1 and left-1 (#20196)

`v4.3.0`

Compare Source

Added

Add @container-size utility (#18901)
Add scrollbar-{auto,thin,none} utilities for scrollbar-width, and scrollbar-thumb-* / scrollbar-track-* color utilities for scrollbar-color (#19981, #20019)
Add scrollbar-gutter-* utilities (#20018)
Add zoom-* utilities (#20020)
Add tab-* utilities (#20022)
Allow using @variant with stacked variants (e.g. @variant hover:focus { … }) (#19996)
Allow using @variant with compound variants (e.g. @variant hover, focus { … }) (#19996)
Support --default(…) in --value(…) and --modifier(…) for functional @utility definitions (#19989)

Fixed

Ensure @plugin resolves package JavaScript entries instead of browser CSS entries when using @tailwindcss/vite (#19949)
Fix relative @import and @plugin paths resolving from the wrong directory when using @tailwindcss/vite (#19965)
Ensure CSS files containing @variant are processed by @tailwindcss/vite (#19966)
Resolve imports relative to base when result.opts.from is not provided when using @tailwindcss/postcss (#19980)
Canonicalization: preserve significant _ whitespace in arbitrary values (#19986)
Canonicalization: add parentheses when removing whitespace from arbitrary values would hurt readability (e.g. w-[calc(100%---spacing(60))] → w-[calc(100%-(--spacing(60)))]) (#19986)
Canonicalization: preserve the original unit in arbitrary values instead of normalizing to base units (e.g. -mt-[20in] → mt-[-20in], not mt-[-1920px]) (#19988)
Canonicalization: migrate arbitrary :has() variants from [&:has(…)] to has-[…] (#19991)
Upgrade: don’t migrate inline style attributes (e.g. style="flex-grow: 1" → style="flex-grow: 1", not style="grow: 1") (#19918)
Allow multiple @utility definitions with the same name but different value types (#19777)
Export missing PluginWithConfig type from tailwindcss/plugin to fix errors when inferring plugin config types (#19707)
Ensure start and end legacy utilities without values do not generate CSS (#20003)
Ensure --value(…) is required in functional @utility definitions (#20005)
Canonicalization: preserve required whitespace around operators in negated arbitrary values (e.g. -left-[(var(--a)+var(--b))]) (#20011)

`v4.2.4`

Compare Source

Fixed

Ensure imports in @import and @plugin still resolve correctly when using Vite aliases in @tailwindcss/vite (#19947)

`v4.2.3`

Compare Source

Fixed

Canonicalization: improve canonicalization for tracking-* utilities by preferring non-negative utilities (e.g. -tracking-tighter → tracking-wider) (#19827)
Fix crash due to invalid characters in candidate (exceeding valid unicode code point range) (#19829)
Ensure query params in imports are considered unique resources when using @tailwindcss/webpack (#19723)
Canonicalization: collapse arbitrary values into shorthand utilities (e.g. px-[1.2rem] py-[1.2rem] → p-[1.2rem]) (#19837)
Canonicalization: collapse border-{t,b}-* into border-y-*, border-{l,r}-* into border-x-*, and border-{t,r,b,l}-* into border-* (#19842)
Canonicalization: collapse scroll-m{t,b}-* into scroll-my-*, scroll-m{l,r}-* into scroll-mx-*, and scroll-m{t,r,b,l}-* into scroll-m-* (#19842)
Canonicalization: collapse scroll-p{t,b}-* into scroll-py-*, scroll-p{l,r}-* into scroll-px-*, and scroll-p{t,r,b,l}-* into scroll-p-* (#19842)
Canonicalization: collapse overflow-{x,y}-* into overflow-* (#19842)
Canonicalization: collapse overscroll-{x,y}-* into overscroll-* (#19842)
Read from --placeholder-color instead of --background-color for placeholder-* utilities (#19843)
Upgrade: ensure files are not emptied out when killing the upgrade process while it's running (#19846)
Upgrade: use config.content when migrating from Tailwind CSS v3 to Tailwind CSS v4 (#19846)
Upgrade: never migrate files that are ignored by git (#19846)
Add .env and .env.* to default ignored content files (#19846)
Canonicalization: migrate overflow-ellipsis into text-ellipsis (#19849)
Canonicalization: migrate start-full → inset-s-full, start-auto → inset-s-auto, start-px → inset-s-px, and start-<number> → inset-s-<number> as well as negative versions (#19849)
Canonicalization: migrate end-full → inset-e-full, end-auto → inset-e-auto, end-px → inset-e-px, and end-<number> → inset-e-<number> as well as negative versions (#19849)
Canonicalization: move the - sign inside the arbitrary value -left-[9rem] → left-[-9rem] (#19858)
Canonicalization: move the - sign outside the arbitrary value ml-[calc(-1*var(--width))] → -ml-(--width) (#19858)
Improve performance when scanning JSONL / NDJSON files (#19862)
Support NODE_PATH environment variable in standalone CLI (#19617)

`v4.2.2`

Compare Source

Fixed

Don't crash when candidates contain prototype properties like row-constructor (#19725)
Canonicalize calc(var(--spacing)*…) expressions into --spacing(…) (#19769)
Fix crash in canonicalization step when handling utilities containing @property at-rules (e.g. shadow-sm border) (#19727)
Skip full reload for server only modules scanned by client CSS when using @tailwindcss/vite (#19745)
Add support for Vite 8 in @tailwindcss/vite (#19790)
Improve canonicalization for bare values exceeding default spacing scale suggestions (e.g. w-1234 h-1234 → size-1234) (#19809)
Fix canonicalization resulting in empty list (e.g. w-5 h-5 size-5 → '' instead of size-5) (#19812)
Resolve tsconfig paths to allow for @import '@/path/to/file'; when using @tailwindcss/vite (#19803)

`v4.2.1`

Compare Source

Fixed

Allow trailing dash in functional utility names for backwards compatibility (#19696)
Properly detect classes containing . characters within curly braces in MDX files (#19711)

`v4.2.0`

Compare Source

Added

Add mauve, olive, mist, and taupe color palettes to the default theme (#19627)
Add @tailwindcss/webpack package to run Tailwind CSS as a webpack plugin (#19610)
Add pbs-* and pbe-* utilities for padding-block-start and padding-block-end (#19601)
Add mbs-* and mbe-* utilities for margin-block-start and margin-block-end (#19601)
Add scroll-pbs-* and scroll-pbe-* utilities for scroll-padding-block-start and scroll-padding-block-end (#19601)
Add scroll-mbs-* and scroll-mbe-* utilities for scroll-margin-block-start and scroll-margin-block-end (#19601)
Add border-bs-* and border-be-* utilities for border-block-start and border-block-end (#19601)
Add inline-*, min-inline-*, max-inline-* utilities for inline-size, min-inline-size, and max-inline-size (#19612)
Add block-*, min-block-*, max-block-* utilities for block-size, min-block-size, and max-block-size (#19612)
Add inset-s-*, inset-e-*, inset-bs-*, inset-be-* utilities for inset-inline-start, inset-inline-end, inset-block-start, and inset-block-end (#19613)
Add font-features-* utility for font-feature-settings (#19623)

Fixed

Prevent double @supports wrapper for color-mix values (#19450)
Allow whitespace around @source inline() argument (#19461)
Emit comment when source maps are saved to files when using @tailwindcss/cli (#19447)
Detect utilities containing capital letters followed by numbers (#19465)
Fix class extraction for Rails' strict locals (#19525)
Align @utility name validation with Oxide scanner rules (#19524)
Fix infinite loop when using @variant inside @custom-variant (#19633)
Allow multiples of .25 in aspect-* fractions (e.g. aspect-8.5/11) (#19688)
Ensure changes to external files listed via @source trigger a full page reload when using @tailwindcss/vite (#19670)
Improve performance of Oxide scanner in bigger projects by reducing file system walks (#19632)
Ensure import aliases in Astro v5 work without crashing when using @tailwindcss/vite (#19677)
Allow escape characters in @utility names to improve support with formatters such as Biome (#19626)
Fix incorrect canonicalization results when canonicalizing multiple times (#19675)
Add .jj to default ignored content directories (#19687)

Deprecated

Deprecate start-* and end-* utilities in favor of inset-s-* and inset-e-* utilities (#19613)

postcss/autoprefixer (autoprefixer)

`v10.5.4`

Compare Source

Fixed prefixed rule duplication (by @xianjianlf2).

`v10.5.3`

Compare Source

Fixed brackets and gradient parser (@alanturing881).

`v10.5.2`

Compare Source

Moved -webkit-fill-available before -moz-available, so Firefox
will use -webkit- version which is closer to stretch.

`v10.5.1`

Compare Source

Fixed grid-area span reset for overriding areas (by @puneetdixit200).

`v10.5.0`

Compare Source

Added mask-position-x and mask-position-y support (by @toporek).

`v10.4.27`

Compare Source

Removed development key from package.json.

`v10.4.26`

Compare Source

Reduced package size.

`v10.4.25`

Compare Source

Fixed broken gradients on CSS Custom Properties (by @serger777).

olragon/binpackingjs (binpackingjs)

`v3.1.0`

Compare Source

Bug Fixes

Fix 2D pruneFreeList bug: i++ moved to outer loop so free rectangles are not skipped during pruning (#42, credit to @traaan PR #27)
Fix 3D scoreRotation heuristic: use tiling efficiency instead of squared dimension ratios (#37)
Fix broken 2D paper link in README (#29)

Other

Add bug reproduction tests for #42 and #37
Upgrade all dependencies, fix security vulnerabilities
Upgrade mocha 8 to 11

open-cli-tools/concurrently (concurrently)

`v9.2.4`

Compare Source

upgrade shell-quote to 1.9.0 - #597, #600

Full Changelog: https://github.com/open-cli-tools/concurrently/compare/v9.2.3...v9.2.4

`v9.2.3`

Compare Source

Address vulnerability in shell-quote - #591, #596

get-convex/convex-backend (convex)

`v1.42.3`

Fixed a bug where the codegen would not sort module paths in
an order consistent with other platforms when running
on Windows. This completes a fix that was only partially
applied in 1.42.2.

`v1.42.2`

Mutations and actions can now read the raw authentication
token used in the request by accessing authToken in
ctx.meta.getRequestMetadata().
Fixed a circular import in convex/browser that caused issues
when using the ConvexHttpClient in some JavaScript
environments.
Fixed a bug in ConvexProviderWithClerk that caused
the Convex client to ignore session changes in some situations.
Fixed a bug where the codegen would not sort module paths in
an order consistent with other platforms when running
on Windows.
When running npx convex dev outside a Convex project,
the CLI now returns an error message immediately instead of
first asking the user to select a project and then failing
later.

`v1.42.1`

Fixed an issue where the CLI would be unable to find the tsgo binary in
newer versions of @typescript/native-preview.
Added a new initialAuthTokenReuse option to ConvexReactClient that
prevents extra function calls when users re-authenticate.

`v1.42.0`

Added a new npx convex project create command that can be used
to create new projects programmatically.
Added a new --names-only flag to npx convex env list
(and npx convex env default list). This flag shows the names of
the env vars that are set, without the values. It can be useful
to let AI coding agents know the variables that are set on a deployment,
without giving them the actual values.
Added a new useStaleSnapshot option to the arguments for runQuery.
This is an advanced feature that can be used to allow mutations
to avoid optimistic concurrency control (OCC) conflicts in some cases
where they can commit even though they depend on conflicting reads.
This change allows us to improve the performance of some of the
official Convex components, including Workpool.
Improved the documentation of db.* methods to more clearly explain
the difference between the old APIs without table names
(e.g. db.get(userId)) and the new APIs with table names
(e.g. db.get("users", userId)).
Fixed an issue where the CLI would not surface permission errors
correctly when the user or token doesn’t have permission to do something.
Exposes the current scheduled function's ID as scheduledFunctionId in
ctx.meta.getRequestMetadata().
npx convex insights has a new --json flag that makes the command
output easier to parse programmatically.
File storage: marked a few TypeScript types in convex/server as @deprecated
(FileMetadata, FileStorageId, StorageId). These types are used
only by file storage APIs that were deprecated in convex@1.6.0,
so we also marked them as @deprecated for clarity.
Bumps the ws peer dependency to avoid a vulnerable range.

`v1.41.0`

It is now possible to set limits on nested queries and mutations
with the new transactionLimits option in runQuery/runMutation.
npx convex ai-files now installs skills with separate copies of
each skill for each coding agent instead of using symlinks.
We made this change to avoid known issues with symlinks on Windows.
When using Convex in anonymous mode (without a Convex account),
npx convex dev now starts a different dashboard server for each
deployment. This ensures the dashboard always connects to the
right deployment when multiple deployments are running at the same time.

`v1.40.0`

You can now create a local deployment in a specific Convex cloud project with
npx convex deployment create team-slug:project-slug:local.
You can now move a local deployment to another cloud project
using npx convex deployment select team-slug:project-slug:local. This command warns
when it moves the deployment to another project.
The CLI now shows more clearly which deployment is targeted when running commands
such as npx convex dev and npx convex deploy.
Added a new <AuthRefreshing /> helper component, used to show indicators when
function calls are paused because the authentication token is refreshing.
Removed --local and --cloud flags from npx convex dev. The behavior of these flags
was misleading when a deployment was already selected. Instead, use
npx convex deployment select local to use a local deployment, and
npx convex deployment select dev to use your personal cloud dev deployment.
The CLI now provides guidance when TypeScript type checking is taking too long.
Improved the CLI command documentation to include more details and examples.
npx convex logs: --tail is now accepted as an alias for the --history flag.
When creating a local deployment, the CLI now skips importing the default environment variables
from the Convex cloud project if you don’t have permission to view the default environment
variables instead of crashing.

discordjs/discord.js (discord.js)

`v14.27.0`

Compare Source

Bug Fixes

Update clientReady event name references (#10632) (9592aea)
InteractionResponses: Optional parameter for update() (#10797) (fbda4fe)
guide: Miscellaneous fixes (#11147) (c53c8c2)
GuildChannel: Manageable perm check (#11166) (8b342a1)
StageInstanceManager#create: Correctly resolve guildScheduledEvent (#11540) (0aabb6c)
RoleManager: Allow null in RoleColorsResolvable to clear gradient colors (#11536) (221680d)
GuildChannel: Handle empty overwrite must only handle @everyone (#11221) (1e2fdf4)

Documentation

Attachment: string property (d646a13)
Fix close tags (#10756) (4349e10)
Replace Discord API with Discord Developers (#10968) (538457c)
Clarify wording for maximum values (#11231) (9ec73fa)
Fix incorrect casing in the ready event deprecation (#11574) (0df0628)
Fix typos and duplicated words in comments and guide (#11502) (63cd992)

Features

Send voice messages (#11493) (fed811a)
Guild: Add maximumStageBitrate (#11313) (6d2cd99)
Proper authorizing integration owners structure (#11366) (b6db455)
RoleManager: Add fetchMemberCounts (#11352) (3b738ee)
Emit voiceServerUpdate event (#11414) (74a42bf)
GuildMember: Add collectibles (#11468) (b0e6aff)
Add shared client theme support (#11454) (16fd248)
ClientApplication: Add fetchActivityInstance method (#11481) (24a0606)

Refactor

Reorder imports (40b7a60)

Typings

WebhookMessageCreateOptions: Omit sharedClientTheme (b816b79)
Message: Specify rawData arg type (#11123) (c4531d4)
UserManager: Fix send() return type to Promise<Message> (#11337) (07c4127)

`v14.26.5`

Compare Source

Bug Fixes

Detect spoiler attachments with flag (v14) (#11561) (ce29ae9)

`v14.26.4`

Compare Source

Bug Fixes

MessageCreateAction: Receive DMs in uncached DMChannels again (#11495) (b8d8812)

`v14.26.3`

Compare Source

Bug Fixes

TeamMember: Allow a default permissions (dced197)

`v14.26.2`

Compare Source

Bug Fixes

Action: Don't add recipients to guild channels (#11479) (b86573d)

`v14.26.1`

Compare Source

Bug Fixes

Only return DMChannel that have the user as known recipient (#11478) (67566d0)

`v14.26.0`

Compare Source

Bug Fixes

Remove manage messages check for pinnable (#11453) (1a0da18)
DJSError: Differentiate error type (#11295) (f5b3f84)

Features

Allow partial DMChannel without client user (#11462) (45bd430)
Modal radio group and checkbox components for v14 (#11437) (b42e499)

Refactor

DJSError: Prefer this.constructor.name (#11294) (e32f0c1)

Typings

BroadcastEval overload order (#11422) (16d70b9)

krisk/Fuse (fuse.js)

`v7.5.0`

Compare Source

⚠️ Behavior changes

Every change in this release is a bug fix, but each one corrects a scoring or ranking bug. Scores and result ordering will shift for some queries. That is why this ships as a minor rather than a patch: the public API is unchanged and upgrading is a drop-in, but the results you get back can differ, and that should not arrive silently in a patch bump.

If you assert on exact score values or on a specific result order, expect those assertions to need updating. Re-baseline them against 7.5.0 rather than pinning to 7.4.x, since the 7.4.x behavior was wrong in the cases below.

Field-length normalisation now counts words correctly. Tabs and newlines were not treated as word separators, so a multi-line or tab-delimited field was scored as though it were one long word, making it look far shorter than it is. Fields containing \t, \n, or \r now score differently (#830).
Key weights are now normalised in object and keyless-logical search. Weights that did not sum to 1 were applied unnormalised, skewing the relative influence of each key. If your keys weights do not already sum to 1, your relative ranking changes (#833).
limit now returns the correct top-N when scores tie. A tie at the cutoff boundary could evict a result that should have been kept, so limit could return the wrong items, not merely the right items in a different order (#835).
Bitap respects minMatchCharLength in the exact-match shortcut. Matches shorter than minMatchCharLength were still reported via the exact-match fast path, so the matches array could contain entries it was configured to exclude (#831).

Bug Fixes

bitap: respect minMatchCharLength in exact-match shortcut (dbb98b6), closes #831
fieldNorm: count tabs and newlines as word separators (6fe85b0), closes #830
fieldNorm: count word-starts instead of space transitions (2946f97)
scoring: normalise key weights in object and keyless-logical search (e164b61), closes #833
search: keep the correct top-N under limit when scores tie (437f8f3), closes #835, thanks @spokodev for the report and the fix

7.4.2 (2026-06-05)

Bug Fixes

types: emit CommonJS declarations (.d.cts) for node16/nodenext (#780) (33f5d29)

7.4.1 (2026-06-02)

Bug Fixes

types: add TypeScript declarations for fuse.js/worker-script (6ef6c33), closes #828
types: ship TypeScript declarations for fuse.js/worker (572ad1e), closes #828

`v7.4.2`

Compare Source

`v7.4.1`

Compare Source

`v7.4.0`

Compare Source

`v7.3.0`

Compare Source

Features

add BigInt support for indexing and search (0ae662c), closes #814
add static Fuse.match() for single string matching (460eb5b)
add token search — per-term fuzzy matching with IDF scoring (68c1dcf)
getFn null return, escaped pipe in extended search, empty query returns all (d33b735), closes #800 #765 #728
removeAt() now returns the removed item (8cec7e2), closes #675
search: support keyless string entries in logical queries (8695556), closes #736

Bug Fixes

index: coerce non-string array values to strings during indexing (db0e181), closes #738
index: strip getFn from keys in toJSON() for safe serialization (0f2a69b), closes #798
lint: suppress unused var in toJSON destructure (d63c0e8)
merge overlapping match indices in extended search (06c5e97)
search: handle non-decomposable diacritics in stripDiacritics (5a01f29), closes home-assistant/frontend#30399 #816
search: handle quoted tokens with inner spaces and quotes in extended search (c226523), closes #810
search: inverse patterns now work correctly across multiple keys (9351882), closes #712

`v7.2.0`

Compare Source

Features

add Fuse.use() for runtime plugin registration (8546a9b)

Performance

inline Bitap score computation to reduce object allocation in hot loops (8546a9b)
batch removeAll for O(n) bulk removes instead of O(n*k) (8546a9b)
heap-based top-k selection when limit is set (8546a9b)
cache compiled searcher for repeated queries (8546a9b)

Bug Fixes

search: deduplicate and merge overlapping match indices (60c393a), closes #735
search: preserve original array indices in nested path traversal (a1451be), closes #786
types: correct key type in FuseSortFunctionMatch (fecee16), closes #811
types: correct keys type in parseIndex parameter (58c7c73), closes #794

jimp-dev/jimp (jimp)

`v1.6.1`

Compare Source

🎉 This release contains work from new contributors! 🎉

Thanks for all your work!

❤️ Denys Kashkovskyi (@Kashkovsky)

❤️ Viki (@vikiboss)

🐛 Bug Fix

fix docs imports (@hipstersmoothie)
@jimp/core, @jimp/plugin-quantize, @jimp/wasm-avif, @jimp/wasm-jpeg, @jimp/wasm-png, @jimp/wasm-webp
- Update file-type from ^16 to ^21.3.3 in @jimp/core #1400 (@Kashkovsky @hipstersmoothie)

⚠️ Pushed to `main`

@jimp/core
- Doc updates (closes #1342) (@hipstersmoothie)

📝 Documentation

docs: correct GitHub repo link #1340 (@vikiboss)

Authors: 3

Andrew Lisowski (@hipstersmoothie)
Denys Kashkovskyi (@Kashkovsky)
Viki (@vikiboss)

lucide-icons/lucide (lucide-react)

`v0.577.0`: Version 0.577.0

Compare Source

What's Changed

chore(deps): bump rollup from 4.53.3 to 4.59.0 by @dependabot[bot] in #4106
fix(repo): correctly ignore docs/releaseMetadata via .gitignore by @bhavberi in #4100
feat(icons): added ellipse icon by @KISHORE-KUMAR-S in #3749

New Contributors

@bhavberi made their first contribution in #4100
@KISHORE-KUMAR-S made their first contribution in #3749

Full Changelog: https://github.com/lucide-icons/lucide/compare/0.576.0...0.577.0

`v0.576.0`: Version 0.576.0

Compare Source

What's Changed

Added zodiac signs by @karsa-mistmere in #712
fix(icons): fixes guideline violations in package-* icons. by @karsa-mistmere in #4074
fix(icons): changed receipt icon by @karsa-mistmere in #4075
fix(icons): updated cuboid icon tags and categories by @karsa-mistmere in #4095
fix(icons): changed cuboid icon by @jamiemlaw in #4098
fix(lucide-font, lucide-static): Fixing stable code points by @ericfennis in #3894
feat(icons): added fishing-rod icon by @7ender in #3839

Full Changelog: https://github.com/lucide-icons/lucide/compare/0.575.0...0.576.0

`v0.575.0`: Version 0.575.0

Compare Source

What's Changed

feat(icons): added message-square-check icon by @karsa-mistmere in #4076
fix(lucide): Fix ESM Module output path in build by @ericfennis in #4084
feat(icons): added metronome icon by @edwloef in #4063
fix(icons): remove execution permission of SVG files by @duckafire in #4053
fix(icons): changed file-pen-line icon by @jguddas in #3970
feat(icons): added square-arrow-right-exit and square-arrow-right-enter icons by @EthanHazel in #3958
fix(icons): renamed flip-* to square-centerline-dashed-* by @jguddas in #3945

New Contributors

@edwloef made their first contribution in #4063
@duckafire made their first contribution in #4053

Full Changelog: https://github.com/lucide-icons/lucide/compare/0.573.0...0.575.0

`v0.574.0`: Version 0.574.0

Compare Source

What's Changed

fix(icons): changed rocking-chair icon by @jamiemlaw in #3445
fix(icons): flipped coins icon by @jguddas in #3158
feat(icons): added x-line-top icon by @jguddas in #2838
feat(icons): added mouse-left icon by @marvfash in #2788
feat(icons): added mouse-right icon by @marvfash in #2787

New Contributors

@marvfash made their first contribution in #2788

Full Changelog: https://github.com/lucide-icons/lucide/compare/0.572.0...0.574.0

`v0.573.0`: Version 0.573.0

Compare Source

What's Changed

fix(icons): changed rocking-chair icon by @jamiemlaw in #3445
fix(icons): flipped coins icon by @jguddas in #3158
feat(icons): added x-line-top icon by @jguddas in #2838
feat(icons): added mouse-left icon by @marvfash in #2788
feat(icons): added mouse-right icon by @marvfash in #2787

New Contributors

@marvfash made their first contribution in #2788

Full Changelog: https://github.com/lucide-icons/lucide/compare/0.572.0...0.573.0

`v0.572.0`: Version 0.572.0

Compare Source

What's Changed

feat(icons): added message-circle-check icon by @Shrinks99 in #3770

New Contributors

@Shrinks99 made their first contribution in #3770

Full Changelog: https://github.com/lucide-icons/lucide/compare/0.571.0...0.572.0

`v0.571.0`: Version 0.571.0

Compare Source

What's Changed

fix(icons): rearange circle-icons path and circle order by @adamlindqvist in #3746
feat(icons): added shelving-unit icon by @karsa-mistmere in #3041

New Contributors

@adamlindqvist made their first contribution in #3746

Full Changelog: https://github.com/lucide-icons/lucide/compare/0.570.0...0.571.0

`v0.570.0`: Version 0.570.0

Compare Source

What's Changed

feat(icons): added towel-rack icon by @jguddas in #3350

Full Changelog: https://github.com/lucide-icons/lucide/compare/0.569.0...0.570.0

`v0.569.0`: Version 0.569.0

Compare Source

What's Changed

fix(icons): changed clipboard-pen icon by @Spleefies in #4006
feat(icons): add mirror-round and mirror-rectangular by @Muhammad-Aqib-Bashir in #3832

Full Changelog: https://github.com/lucide-icons/lucide/compare/0.568.0...0.569.0

`v0.568.0`: Version 0.568.0

Compare Source

What's Changed

fix(icons): adjusted clapperboard so slash is no longer protruding by @torfmuer in #3764
feat(icons): Add git-merge-conflict icon by @timmy471 in #3008

New Contributors

@torfmuer made their first contribution in #3764
@timmy471 made their first contribution in #3008

Full Changelog: https://github.com/lucide-icons/lucide/compare/0.567.0...0.568.0

`v0.567.0`: Version 0.567.0

Compare Source

What's Changed

chore(tags): added tags to info by @jamiemlaw in #4047
fix(icons): changed gift icon by @jguddas in #3977
feat(icons): added line-dot-right-horizontal icon by @nathan-de-pachtere in #3742

Full Changelog: https://github.com/lucide-icons/lucide/compare/0.566.0...0.567.0

`v0.566.0`: Version 0.566.0

Compare Source

What's Changed

fix(icons): changed forklift icon by @jguddas in #4069
fix(icons): changed rocket icon by @jguddas in #4067
feat(icons): added globe-off icon by @TimNekk in #4051

New Contributors

@TimNekk made their first contribution in #4051

Full Changelog: https://github.com/lucide-icons/lucide/compare/0.565.0...0.566.0

`v0.565.0`: Version 0.565.0

Compare Source

What's Changed

feat(icons): add lens-concave and lens-convex by @Muhammad-Aqib-Bashir in #3831

Full Changelog: https://github.com/lucide-icons/lucide/compare/0.564.0...0.565.0

`v0.564.0`: Version 0.564.0

Compare Source

What's Changed

chore(docs): Improve SEO icon detail pages by @ericfennis in #4040
feat(icons): added database-search icon by @Spleefies in #4003
fix(icons): changed user-lock icon by @jguddas in #3971
fix(icons): changed bug-off icon by @jguddas in #3972
fix(icons): changed bell-dot icon by @jguddas in #3973
fix(icons): changed bandage icon by @jguddas in #3967
fix(icons): changed hard-drive icon by @jguddas in #3622
fix(icons): changed git-branch icon by @jguddas in #3938
fix(icons): changed file-cog icon by @jguddas in #3965
fix(icons): changed cloud-alert and cloud-check icon by @jguddas in #3976
feat(icons): adds user-key and user-round-key, updates other -key icons to match by @karsa-mistmere in #4044

New Contributors

@Spleefies made their first contribution in #4003

Full Changelog: https://github.com/lucide-icons/lucide/compare/0.563.1...0.564.0

motiondivision/motion (motion)

`v12.42.2`

Compare Source

Fixed

animateView: Cropped group layers now animate border-radius from the old to new radius.

`v12.42.1`

Compare Source

Fixed

animateView: Old layer fade out now cancelled when defining .new().

`v12.42.0`

Compare Source

Changed

animateView: Layers are automatically grouped to match their DOM-hierarchy. New .group(false) method opts-out.

Fixed

animateView: Auto-crop is now aspect-ratio aware, disabling crops for matching aspect-ratios.
animateView: Disabled automatic border-radius animation.

`v12.41.0`

Compare Source

Added

animateView: Moves from Motion+ Early Access and alpha to main library.
animateView: .add() resolves a CSS selector or Element to automatically generate, apply and remove view-transition-name.
animateView: .new() and .old() configures values to animate on new and old layers.
animateView: .layout() can set a custom transition on the size/position animation of the currently selected elements.
animateView: Group layers now automatically crop with children set to cover, with border-radius animating from old radius to new. .crop(false) disables this behaviour.
animateView: .class(name) tags currently selected elements with a view-transition-class as a custom CSS hook.

Fixed

AnimatePresence: Prevent stuck exit animations when children interrupt.
drag: Child e.stopPropagation() no longer break drag end.
Fixing Next.js OOM on Windows when importing via motion package.
animateLayout: Improve handling of parallel/interleaved calls.

Changed

animateView: .enter() and .exit() now refer specifically to new and old layers where there are no matching old or new layers.
animateView: Interrupted transition setups now return resolved animation rather than throwing.

`v12.40.0`

Compare Source

Added

path option to transition.
arc() for motion along an arc.

`v12.39.0`

Compare Source

Added

Support for repeatType and repeatDelay in animation sequences.

Fixed

Variants: Re-run keyframe animations when switching between variant labels even when they share identical keyframe arrays.
Drag: Preserve in-flight motion value animations across React 19 reorder unmount/remount so dragSnapToOrigin no longer leaves the drag transform stranded after a layout swap.
LazyMotion: Share React contexts between the framer-motion and framer-motion/m (and therefore motion/react and motion/react-m) CJS bundles so that <m.div> from the /m subpath picks up features loaded by <LazyMotion> from the main entry point.
useScroll: Support hydrating target and container refs from anywhere in the tree.
Drag: Gesture no longer starts from incorrect start point when rendered inside <AnimatePresence initial={false} />.
Drag: dragConstraints, when set as viewport-relative ref, no longer break on scroll.§
Updated visualElement hydration order.
useAnimate: Now respects skipAnimations.
AnimatePresence: Fix object-form initial values not applied on re-entry after exit completes.
scroll: Fixed callback progress when tracking an element.
useScroll: Fix hardware acceleration when tracking an element.

mapbox/pixelmatch (pixelmatch)

`v7.2.0`

Compare Source

Add a checkerboard option that controls whether to blend semi-transparent pixels against a checkerboard pattern (true, default) or plain white (false, pre-v7 behavior) when comparing images.

`v7.1.1`

Compare Source

Improve performance by ~8%. #165
Clearer errors on image size mismatch. #161 (by @VendorMap)
Skip antialiasing checks when includeAA is true. #160 (by @mongoose700)

PostHog/posthog-js (posthog-js)

`v1.407.0`

Compare Source

1.407.0

Minor Changes

#4222 0f2407b Thanks @turnipdabeets! - feat: add a default-value option to isFeatureEnabled

isFeatureEnabled(key, { defaultValue: false }) now returns the given default when the flag has no value — flags not loaded yet, or no flag with that key — and the return type narrows to boolean. The option name is the same in posthog-js, posthog-js-lite, and posthog-react-native. Without defaultValue, behavior is unchanged: boolean | undefined. (2026-07-22)

Patch Changes

#4203 90e7483 Thanks @posthog! - fix(conversations): let users start a new conversation while a ticket is still open

The support widget now surfaces the ticket list navigation (and its "New conversation"
button) whenever the user has any ticket, instead of only when they have multiple tickets
or a single resolved one. Previously a user sitting on one open, unresolved ticket was
locked into that conversation with no way to raise a second issue. (2026-07-22)
#4221 da6e082 Thanks @posthog! - fix(exception-autocapture): don't throw when the page's onerror handler is non-callable

The wrapped window.onerror, window.onunhandledrejection, and console.error handlers
chained to the page's original handler using optional chaining, which only guards against
null/undefined. When a page had one of these set to a truthy non-callable value (e.g.
via Object.defineProperty, or clobbered by another script/extension), our wrapper threw a
TypeError from inside its own handler. We now check the original handler is actually
callable before invoking it and fall back to false otherwise. (2026-07-22)
#4209 569fc62 Thanks @posthog! - Session recording no longer emits an uncaught TypeError: Illegal invocation from the input observer's synchronous native-setter call. The previous fix only guarded the deferred hooked setter; the synchronous original.set.call(this, value) still ran with a non-native this (a proxy, custom element, or cross-realm object) and threw inside the host page's own assignment. The recorder now probes the native getter — which fails the same internal-slot brand check as the setter — before forwarding: a non-native this is skipped, so the recorder no longer re-throws from its own frame, while genuine elements (including file inputs that legitimately throw on a programmatic value) keep their native behavior. The input event handler and getInputType are similarly guarded against reading native accessors on a non-native this.
(2026-07-22)
#4068 d5e1188 Thanks @posthog! - Fix event-triggered surveys re-displaying in a fresh session without their trigger firing. A non-repeatable event/action-triggered survey that was shown but never dismissed or answered had its activation persisted indefinitely, so it kept being treated as "triggered" on later page loads. The persisted activation is now scoped to the triggering session: it still survives a reload within that session, but a brand-new session drops it until the trigger fires again. Repeatable surveys are unaffected.
(2026-07-22)
#4205 de3ad61 Thanks @posthog! - Warn when session recording masking options in posthog.init shadow the project-level "Privacy and masking" setting. Client-side masking still intentionally takes precedence, but previously the override was silent — a developer could set masking in the dashboard and see it quietly ignored because their SDK config diverged. The recorder now logs a console warning (in debug mode) naming the diverging fields so the precedence is self-explaining.
(2026-07-22)
Updated dependencies [0f2407b]:
- @posthog/core@1.45.0
- @posthog/types@1.398.0

`v1.406.2`

Compare Source

1.406.2

Patch Changes

#4206 a3112d9 Thanks @posthog! - fix(surveys): stop recurring surveys re-showing off a stale internal targeting flag

Recurring surveys could re-display and record a duplicate response when the eligibility
check ran against a cached internal targeting flag before fresh flags had loaded. The
display loop now waits for feature flags to actually load before trusting the internal
targeting flag, and forces a flag reload after a survey is completed so the flag recomputes
promptly. (2026-07-21)

`v1.406.1`

Compare Source

1.406.1

Patch Changes

#4127 220fa2c Thanks @sarmah-rup! - Don't let save_referrer overwrite a $referrer / $referring_domain that was explicitly set via posthog.register(), so registered attribution values survive pageviews in SPA and iframe contexts
(2026-07-21)

`v1.406.0`

Compare Source

1.406.0

Minor Changes

#4194 d39b903 Thanks @dustinbyrne! - Move shared browser utility implementations into @posthog/browser-common and consume them directly from posthog-js.
(2026-07-21)

Patch Changes

#4204 ba977d0 Thanks @turnipdabeets! - Keep autocapture off when a remote config response omits autocapture_opt_out. The SDK now retains the last known server value for the missing-field case, the same as when the config fetch fails, instead of enabling autocapture. Values persisted by earlier SDK versions are still trusted; a browser holding a stale value corrects itself on the first config response that includes the field.
(2026-07-21)
Updated dependencies [d39b903]:
- @posthog/browser-common@0.2.0

`v1.405.3`

Compare Source

1.405.3

Patch Changes

#4200 91505ba Thanks @pauldambra! - fix: apply the active full snapshot interval as soon as a recording trigger matches
(2026-07-21)

`v1.405.2`

Compare Source

1.405.2

Patch Changes

#4198 fbfc84f Thanks @pauldambra! - feat: make the pending session recording trigger buffer interval configurable
(2026-07-20)
Updated dependencies [fbfc84f]:
- @posthog/types@1.397.1

`v1.405.1`

Compare Source

1.405.1

Patch Changes

#4193 dec8fe7 Thanks @turnipdabeets! - Internal restructuring of remote config failure handling across SDK extensions; no behavior change.
(2026-07-20)

`v1.405.0`

Compare Source

1.405.0

Minor Changes

#4172 9621830 Thanks @haacked! - send minimal $feature_flag_called events when the server enables it

When the v2 /flags response carries minimalFlagCalledEvents: true (or, for posthog-node local evaluation, the flag-definitions payload carries minimal_flag_called_events: true) and the evaluated flag is not linked to an experiment ($feature_flag_has_experiment === false), $feature_flag_called events are rebuilt from a strict allowlist of flag-evaluation, processing-control, and SDK-identity properties. Super properties, $set/$set_once, the $feature/<key> enumeration, $active_feature_flags, and the context envelope are stripped. Any missing signal (no gate on the response, bootstrapped or locally injected flags, has_experiment unknown) falls back to the full event, and experiment-linked flags always send the full envelope. The gate is stored alongside the cached flags (posthog-js persistence, posthog-node poller state) and is server-controlled, with no SDK-side configuration. before_send runs after the filter and may re-add stripped properties. (2026-07-20)

Patch Changes

Updated dependencies [9621830]:
- @posthog/core@1.44.0

`v1.404.1`

Compare Source

1.404.1

Patch Changes

#4191 66c1666 Thanks @turnipdabeets! - Honour the project-level autocapture opt-out when the remote config request fails. Previously a failed config fetch (network error, timeout, blocked request) enabled autocapture on opted-out projects and persisted that state for later page loads. Autocapture now keeps the last successfully received server value, and stays off until the first successful config response.
(2026-07-17)

`v1.404.0`

Compare Source

1.404.0

Minor Changes

#4149 607bf54 Thanks @pauldambra! - Add dead swipe detection to dead clicks autocapture. When dead clicks autocapture is enabled, touch swipe gestures that produce no observable screen change (no scroll, mutation, selection or visibility change) are now captured as $dead_swipe events, surfacing failed navigations on touch devices. Configurable via capture_dead_swipes (default true) and swipe_threshold_px (default 30) on the capture_dead_clicks config. Swipes over surfaces whose response cannot be observed (canvas, video and other media elements under the finger) are skipped, and captures are limited per page load via max_dead_swipes_per_page_load (default 10).
(2026-07-16)

Patch Changes

#4171 df17ddc Thanks @posthog! - Catch synchronous throws from a monkey-patched window.fetch so they no longer escape as unhandled exceptions. A synchronous throw is now routed through the same handling as an async rejection, so the request queue retries instead of the error leaking into error tracking.
(2026-07-16)
Updated dependencies [607bf54]:
- @posthog/types@1.397.0

`v1.403.0`

Compare Source

1.403.0

Minor Changes

#4159 fad6d9a Thanks @haacked! - add $feature_flag_has_experiment to $feature_flag_called events

$feature_flag_called events now carry a $feature_flag_has_experiment boolean sourced from the server's has_experiment flag metadata (the /flags?v=2 response for remote evaluation, the /api/feature_flag/local_evaluation definitions for posthog-node local evaluation). The property is only sent when the server explicitly reports has_experiment; it is omitted entirely when the value is unknown (older servers, missing metadata, bootstrapped or locally injected flags). (2026-07-16)

Patch Changes

Updated dependencies [fad6d9a]:
- @posthog/core@1.43.0
- @posthog/types@1.396.0

`v1.402.3`

Compare Source

1.402.3

Patch Changes

#4157 4a2ecf5 Thanks @posthog! - Session recording no longer emits an uncaught NotAllowedError ("Sharing constructed stylesheets in multiple documents is not allowed") when a page assigns a CSSStyleSheet constructed in a different document to adoptedStyleSheets. That assignment is the host page's own invalid operation, but the recorder's patched setter sat on the call stack, so the exception was attributed to rrweb and churned fingerprints in error tracking. The recorder now contains this specific rejection (matched by its standardized NotAllowedError name, so it works even when the setter throws from an iframe realm) and skips recording those sheets, while still re-throwing any other native-setter error so host-page behaviour is preserved.
(2026-07-15)
#4158 0dc389e Thanks @posthog! - fix(replay): session recording no longer throws TypeError: Converting circular structure to JSON when replay event data contains a circular reference. The circular-reference guard now also detects cycles that pass through an array, and affected events are captured with [Circular] markers instead of surfacing an unhandled error and being dropped.
(2026-07-15)
Updated dependencies [fc2cb2e]:
- @posthog/core@1.42.1

`v1.402.2`

Compare Source

1.402.2

Patch Changes

#4151 81adbfd Thanks @posthog! - Session recording no longer emits an uncaught TypeError: Illegal invocation when a programmatic input-value change happens on an object that is not a genuine native input element (for example a proxy on the element prototype chain). The recorder drops that one replay update instead of throwing.
(2026-07-15)

`v1.402.1`

Compare Source

1.402.1

Patch Changes

#4117 1eddff7 Thanks @DanielVisca! - add the posthog.metrics API (count, gauge, histogram) to posthog-node — alpha

Backend services can now record metrics through the same statsd-style pre-aggregating client the browser SDK ships, with no OpenTelemetry setup:
```
const client = new PostHog('phc_...', { metrics: { serviceName: 'billing-worker' } })
client.metrics.count('invoices.processed', 1, { attributes: { plan: 'pro' } })
client.metrics.gauge('queue.depth', 42)
client.metrics.histogram('job.duration', 187, { unit: 'ms' })
```
Samples aggregate in memory and flush as OTLP/JSON to /i/v1/metrics (one data point per series per window). Pending metrics are flushed on shutdown(). Core gains _sendMetricsBatch on PostHogCoreStateless (same outcome contract as _sendLogsBatch) and a shared resolveMetricsConfig, so any core-based SDK can host PostHogMetrics. (2026-07-15)
Updated dependencies [1eddff7]:
- @posthog/core@1.42.0

`v1.402.0`

Compare Source

1.402.0

Minor Changes

#4143 0e8ad14 Thanks @robbie-c! - Stamp the current hostname as $snapshot_host on every $snapshot event the session recorder sends. The value is derived from the page URL after it passes through the existing replay URL masking pipeline (maskCapturedNetworkRequestFn / deprecated maskNetworkRequestFn, hash stripping, personal-data query-param masking), so it cannot bypass a customer's masking config. When masking removes the URL or the masked result doesn't parse as a URL, the property is omitted entirely. This gives ingestion consumers a per-message host signal even for mid-session snapshot batches that contain no URL-bearing events.
(2026-07-15)

`v1.401.0`

Compare Source

1.401.0

Minor Changes

#4129 800af7c Thanks @pauldambra! - feat: add session_recording.attributeFilter option that passes an attribute allowlist through to the native MutationObserver, so mutations to unlisted attributes (e.g. animation-driven inline style churn) never cost recording CPU (port of upstream rrweb #1873)
(2026-07-15)

Patch Changes

Updated dependencies [800af7c]:
- @posthog/types@1.395.0

`v1.400.1`

Compare Source

1.400.1

Patch Changes

#4090 6dd8827 Thanks @lucasheriques! - chore: survey seen-key and repeat-activation helpers now live in @posthog/core, shared by the web and React Native SDKs. Core's survey enums are now const-object literal unions (matching the web SDK's existing pattern), so the same values type-check across both SDKs. No behavior change. Type-level note: enum members no longer work as standalone type annotations (e.g. SurveyType.Popover as a type); use the exported union types instead. Runtime values are unchanged.
(2026-07-14)
Updated dependencies [6dd8827]:
- @posthog/core@1.41.1

`v1.400.0`

Compare Source

1.400.0

Minor Changes

#4101 dc2aa5b Thanks @posthog! - Normalize the error tracking rate-limiter config to first-class options. The browser SDK now reads exceptionRateLimiterRefillRate / exceptionRateLimiterBucketSize on error_tracking, with the previous double-underscore __exceptionRateLimiterRefillRate / __exceptionRateLimiterBucketSize options deprecated but still honoured as a fallback. The option shape (ExceptionRateLimiterConfig) and default-resolution logic (resolveExceptionRateLimiterConfig) now live in @posthog/core and are shared between the browser and Node SDKs.
(2026-07-14)

Patch Changes

#4140 1eabd30 Thanks @turnipdabeets! - Handle sendBeacon quota rejections instead of silently dropping events. A beacon rejected by the browser (over the page's shared ~64KiB in-flight keepalive quota) is now split in half and re-sent recursively so the batch delivers as far as the quota allows; a rejected payload that cannot be split falls back to a non-keepalive fetch and logs a warning. Previously the boolean return of sendBeacon was ignored and an over-quota unload batch was lost with no signal.
(2026-07-14)
Updated dependencies [dc2aa5b]:
- @posthog/core@1.41.0
- @posthog/types@1.394.0

`v1.399.5`

Compare Source

1.399.5

Patch Changes

#4134 ab10064 Thanks @posthog! - Bound autocapture's DOM ancestor walks against abnormal host-page DOM trees. autocapturePropertiesForElement and shouldCaptureElement now stop climbing the parentNode chain after 1000 ancestors or if they revisit a node (only possible when a page patches parentNode, since native DOMs cannot contain cycles), instead of walking indefinitely. When shouldCaptureElement cannot finish checking ancestors for ph-no-capture/ph-sensitive, it fails closed and reports the element as not capturable. Behavior on normal DOM trees is unchanged.
(2026-07-14)
#4141 17d956c Thanks @posthog! - Log network-level fetch failures from posthog-js's own request layer (ad blocker, dropped connection, CORS, page teardown) at warn instead of error. The browser rejects these with a generic TypeError (Failed to fetch, Firefox's NetworkError..., or Safari's Load failed); they are already caught and retried by the request queue, so they are expected noise rather than SDK errors — _fetch now gives them the same warn treatment as our own timeout aborts. Genuine, unexpected errors still log at error.
(2026-07-14)

`v1.399.4`

Compare Source

1.399.4

Patch Changes

#4139 7c339be Thanks @turnipdabeets! - Encode uncompressed sendBeacon bodies as base64 form data so the beacon keeps a CORS-simple content type. Previously an uncompressed unload beacon was sent as application/json, which forces a CORS preflight — a preflight cannot complete while the page unloads, so on cross-origin hosts the browser silently dropped the POST and the final batch of events was lost. Compression is inactive whenever the remote config request fails (flaky network, blocked endpoint), when the config response omits supportedCompression, or with disable_compression: true.
(2026-07-13)

`v1.399.3`

Compare Source

1.399.3

Patch Changes

#4133 4ebb618 Thanks @mikenicholls88! - Make jsonStringify circular-safe so event serialization never throws. Previously a captured property holding a circular value — most commonly a DOM node that retains a React fiber pointing back at the element — made JSON.stringify throw Converting circular structure to JSON; with capture_exceptions enabled that throw was recaptured as a new $exception, at times in a loop. On a throw we now fall back to safeJsonStringify from @posthog/core. The fast (non-circular) path is unchanged, and only true cycles become "[Circular]", so shared-but-acyclic references keep their real values.
(2026-07-13)

`v1.399.2`

Compare Source

1.399.2

Patch Changes

#4118 f630394 Thanks @posthog! - Fix a RangeError: Maximum call stack size exceeded originating from the shared rrweb patch() helper. It patches shared globals such as Element.prototype.attachShadow (shadow-dom-manager) and the DOM/canvas observers, so multiple recorder instances or repeated start/stop cycles wrap the same global more than once. Previously an out-of-order restore silently no-op'd, leaving the wrapper in the call path; repeated cycles grew the wrapper chain without bound until a real call walked a chain deep enough to overflow the stack. Wrappers now delegate through a mutable per-layer link so any layer can be torn down even when newer wrappers sit on top of it, keeping the chain bounded. Recording behavior is unchanged. This applies the same fix as #4063 (fetch/XHR) to the shared helper so every rrweb-record caller inherits the bounded-chain behavior.
(2026-07-10)

`v1.399.1`

Compare Source

1.399.1

Patch Changes

#4122 c915581 Thanks @github-actions! - Fix TypeError: handlePageUnload is not a function thrown on page unload when a version-skewed lazy-loaded surveys chunk produces a survey manager whose prototype lacks handlePageUnload. The delegated call in PostHogSurveys.handlePageUnload() now guards the method as well as the receiver.
(2026-07-09)
#4124 562ceeb Thanks @posthog! - Session recording no longer crashes on startup when a CDN-loaded recorder chunk runs against an older bundled core. Calls into SessionIdManager.on/onSessionId are now guarded so a core without those methods degrades gracefully instead of throwing a TypeError during start().
(2026-07-09)

`v1.399.0`

Compare Source

1.399.0

Minor Changes

#4115 86bb3a5 Thanks @DanielVisca! - add the posthog.metrics API (count, gauge, histogram) — alpha

A statsd-style pre-aggregating metrics client for the PostHog Metrics product (alpha). Samples are folded into per-series aggregates in memory (counts sum, gauges keep the last value, histograms accumulate buckets) and flushed periodically as OTLP/JSON to /i/v1/metrics — one data point per series per flush window, no matter how many calls. No OpenTelemetry SDK setup required:
```
posthog.metrics.count('orders_created', 1)
posthog.metrics.gauge('active_connections', 42)
posthog.metrics.histogram('api_latency', 187, { unit: 'ms' })
```
Configure via metrics: { serviceName, environment, flushIntervalMs, maxSeriesPerFlush, beforeSend, ... }. (2026-07-08)

Patch Changes

Updated dependencies [86bb3a5]:
- @posthog/core@1.40.0
- @posthog/types@1.393.0

`v1.398.7`

Compare Source

1.398.7

Patch Changes

#4113 45f17ee Thanks @TueHaulund! - fix session replay leaking a shadow-root observer when a same-origin iframe is removed

Follow-up to the shadow-observer iframe-teardown fix: takeFullSnapshot's onSerialize registers every shadow root with the top-level document, so a root nested in a same-origin iframe was keyed to the wrong document and its observer/buffer were not disconnected when that iframe was removed (they lingered until the next full snapshot). addShadowRoot now derives the owning document from the host element, so per-document teardown matches iframe-nested roots too. (2026-07-08)

`v1.398.6`

Compare Source

1.398.6

Patch Changes

#4114 c75c0ba Thanks @hpouillot! - fix: avoid throwing when rrweb recorder cleanup cannot remove a listener
(2026-07-08)

`v1.398.5`

Compare Source

1.398.5

Patch Changes

#4103 be8242a Thanks @rafaeelaudibert! - Publish the code-split ESM toolbar bundle when the build emits one. The release tooling now recursively includes dist/toolbar/ (with explicit JS content types for the strict-MIME ESM chunks) across the immutable, major-alias, and compatibility upload prefixes, and the workflow accepts the canonical toolbar.js/toolbar.css layout. This is a no-op against today's single-file build.
(2026-07-08)

`v1.398.4`

Compare Source

1.398.4

Patch Changes

#4104 ec5e401 Thanks @TueHaulund! - fix session recordings missing their initial full snapshot after an idle session-id rotation

When the session id rotated while the recorder was idle, the restarted recorder's Meta and FullSnapshot were appended to the previous session's buffer and shipped under the old session id, leaving the new recording unplayable until the next periodic snapshot. The buffer now rebinds on any session-id change regardless of idle state, and as a safety net the recorder requests a full snapshot whenever an incremental is about to ship for a session that has not produced one. (2026-07-08)

`v1.398.3`

Compare Source

1.398.3

Patch Changes

#4112 38bb185 Thanks @TueHaulund! - fix session replay silently dropping shadow DOM mutations after an iframe teardown

The single shared ShadowDomManager observes every shadow root on the page, but MutationBuffer.reset() disconnected it. That reset fires whenever any one buffer is torn down, so an iframe being removed or navigating away disconnected every shadow-root observer page-wide. Shadow DOM content (for example a widget mounted in an open shadow root) then stopped recording until the next periodic full snapshot re-registered it. Buffer teardown now releases only its own resources; global shadow observation is reset by takeFullSnapshot and on recording stop. (2026-07-08)

`v1.398.2`

Compare Source

1.398.2

Patch Changes

#4063 24aadd5 Thanks @posthog! - Fix a RangeError: Maximum call stack size exceeded that could originate from the shared patch() fetch/XHR wrapper. posthog-js wraps window.fetch in two independent places (tracing headers and session-recording network capture), so their restores routinely ran out of order. Previously an out-of-order restore silently no-op'd, leaving the wrapper in the call path; repeated start/stop cycles grew the wrapper chain without bound until a real fetch walked a chain deep enough to overflow the stack. Wrappers now delegate through a mutable link so any layer can be torn down even when newer wrappers sit on top of it, keeping the chain bounded. Header-injection and network-capture behavior is unchanged.
(2026-07-07)
#4100 e250a24 Thanks @marandaneto! - Stop adding the gzip compression query parameter to browser SDK requests.
(2026-07-07)
#4083 f07e241 Thanks @posthog! - fix(replay): harden session-replay network capture so instrumentation that throws (e.g. new Request() rejecting a URL/method) degrades gracefully and never breaks or misattributes the host application's own xhr.open() / fetch() calls
(2026-07-07)

`v1.398.1`

Compare Source

1.398.1

Patch Changes

#4096 5013ab6 Thanks @marandaneto! - Stop sending the deprecated ver query parameter to capture and session recording endpoints.
(2026-07-07)

`v1.398.0`

Compare Source

1.398.0

Minor Changes

#4070 ef119bf Thanks @posthog! - Add a disableAutofocus survey appearance option. When set, open-text survey questions no longer steal focus when they render, which is useful for embedded (inline) surveys that shouldn't grab the caret or scroll the page on load. Defaults to false, preserving the existing autofocus behavior.
(2026-07-06)

`v1.397.0`

Compare Source

1.397.0

Minor Changes

#4089 cc340db Thanks @bs1180! - feat(web): add a posthog-js/customizations subpath entry point exposing the optional customizations (setAllPersonProfilePropertiesAsPersonPropertiesForFlags, the before-send sampling helpers, and the redux/kea loggers) as a proper ES module with bundled types, replacing the internal posthog-js/lib/src/customizations deep import. Also fixes the TypeScript definitions so setAllPersonProfilePropertiesAsPersonPropertiesForFlags accepts the instance passed to the loaded callback (the documented usage), and the loaded callback's instance type now includes config.
(2026-07-06)

`v1.396.9`

Compare Source

1.396.9

Patch Changes

#4077 2595440 Thanks @pauldambra! - fix(web): stop retrying log batches forever when requests die before an HTTP response (status 0, e.g. an ad blocker) — after 3 consecutive such failures while the browser reports itself online, the logs pipeline stops sending and drops batches instead of buffering and retrying for the life of the page; the online event reopens it, and genuine offline periods still queue for the reconnect flush
(2026-07-06)

`v1.396.8`

Compare Source

1.396.8

Patch Changes

#4062 2af0026 Thanks @posthog! - fix(web): prevent an infinite-recursion stack overflow in the logs console capture. The console wrapper's own capture path can emit internal debug lines through PostHog's logger, which wrote back to the wrapped console and re-entered capture until the stack blew (RangeError: Maximum call stack size exceeded). The wrapper now exposes the original console method via __rrweb_original__ (so the internal logger bypasses it) and guards against re-entrancy from any code that logs mid-capture.
(2026-07-06)

`v1.396.7`

Compare Source

1.396.7

Patch Changes

#4080 08cd27b Thanks @marandaneto! - fix(web): stop repeatedly hitting blocked feature flag and conversations polling endpoints after consecutive status-0 failures
(2026-07-06)

`v1.396.6`

Compare Source

1.396.6

Patch Changes

#4053 45d1b36 Thanks @posthog! - feat(web): add a graceful shutdown() to the browser client for parity with posthog-node, so isomorphic teardown code (e.g. the Nuxt module) that calls posthog.shutdown() on the client no longer throws TypeError: shutdown is not a function. It best-effort flushes the queued events and always resolves.
(2026-07-03)
#4054 f0657eb Thanks @posthog! - fix(web): detect our own feature-flag request timeouts via a timedOut flag instead of the abort reason, so they are logged at warn (not error) on browsers that don't propagate controller.abort(reason) — keeping benign timeouts out of error tracking's console-error capture
(2026-07-03)
#4031 94a0530 Thanks @posthog! - Improve survey display reliability:
- posthog-js: refresh the cached $surveys definitions after a short TTL (stale-while-revalidate) so server-side changes such as switching a survey from popover to API propagate to long-lived tabs without a page reload.
- posthog-js: add posthog.surveys.markSurveyAsSeen(surveyId, { iteration }) so custom integrators that render surveys through their own backend can honour the "already seen" and wait-period checks.
- posthog-react-native: guarantee the survey Modal notifies its parent on close even when iOS Modal.onDismiss fails to fire, so the transparent full-screen modal can no longer stay mounted intercepting touches and freezing the app. (2026-07-03)
Updated dependencies [45d1b36]:
- @posthog/types@1.392.1

`v1.396.5`

Compare Source

1.396.5

Patch Changes

#4050 d7cf13b Thanks @turnipdabeets! - Prevent uncaught getComputedStyle crashes in heatmaps and autocapture when the event target is a cross-realm element (e.g. from an iframe or synthetic event)
(2026-07-02)
Updated dependencies [5e7e132]:
- @posthog/core@1.39.5

`v1.396.4`

Compare Source

1.396.4

Patch Changes

#4035 18e543b Thanks @posthog! - fix(web): isolate onFeatureFlags callbacks so a throwing user handler no longer breaks the remaining callback chain or gets misattributed as an SDK error
(2026-07-01)
#4039 15bcb42 Thanks @github-actions! - fix(replay): measure $snapshot_bytes as UTF-8 byte length instead of UTF-16 string length, so non-ASCII session replay payloads are counted accurately against the message size limit
(2026-07-01)

`v1.396.3`

Compare Source

1.396.3

Patch Changes

#4020 e0ad8ef Thanks @posthog! - Fix TypeError: ....at is not a function thrown by the bundled web-vitals dependency on browsers that predate Array.prototype.at() (Chrome <92, iOS Safari <15.4). The web-vitals entrypoints now install a tiny Array.prototype.at polyfill before web-vitals runs, so web vitals capture works again on older browsers instead of crashing with an unhandled error.
(2026-06-30)

`v1.396.2`

Compare Source

1.396.2

Patch Changes

#4003 b6261e7 Thanks @marandaneto! - Include a Promise polyfill in the IE11 bundle and avoid Promise-dependent async compression paths when Promise support is unavailable.
(2026-06-29)

`v1.396.1`

Compare Source

1.396.1

Patch Changes

#3999 cdeae17 Thanks @marandaneto! - Fall back to uncompressed browser requests when gzip encoding fails.
(2026-06-29)

`v1.396.0`

Compare Source

1.396.0

Minor Changes

#3987 74cc6bb Thanks @TueHaulund! - Add a get_current_url config option that overrides the URL used for client-side URL targeting — session replay URL triggers, the session replay URL blocklist, survey URL display conditions, product tour URL conditions, web experiment URL conditions, and autocapture URL allow/ignore lists. These match against window.location.href directly, which does not reflect a $current_url rewritten in before_send. Apps where the browser URL is not meaningful for targeting (e.g. Electron/desktop builds served from a generated host) can now return the logical URL to match against. Defaults to window.location.href when not set.
(2026-06-29)

Patch Changes

Updated dependencies [74cc6bb]:
- @posthog/types@1.392.0

`v1.395.0`

Compare Source

1.395.0

Minor Changes

#3977 6200888 Thanks @turnipdabeets! - Add getAllFeatureFlags(), which returns all currently loaded feature flags as structured FeatureFlagResults (key, enabled, variant, payload). It is a synchronous read of the cached flags and does not send a $feature_flag_called event.
(2026-06-26)

Patch Changes

Updated dependencies [6200888]:
- @posthog/core@1.38.0

`v1.394.0`

Compare Source

1.394.0

Minor Changes

#3986 919abca Thanks @ioannisj! - Capture the $device_model super-property on Android Chromium via navigator.userAgentData.getHighEntropyValues(['model']). Resolved once during init and sent on subsequent events; opt out with disableDeviceModel: true.
(2026-06-26)

`v1.393.6`

Compare Source

1.393.6

Patch Changes

#3965 6ef9179 Thanks @marandaneto! - Handle request serialization errors without throwing or blocking queued requests.
(2026-06-26)

`v1.393.5`

Compare Source

1.393.5

Patch Changes

#3960 619d318 Thanks @marandaneto! - Improve console log capture performance for truncated large objects.
(2026-06-25)

`v1.393.4`

Compare Source

1.393.4

Patch Changes

#3942 c9c8925 Thanks @hpouillot! - Fix browser console log capture when session activity timestamps are missing and refresh session attributes for each log.
(2026-06-24)
Updated dependencies [c9c8925]:
- @posthog/core@1.37.2

`v1.393.3`

Compare Source

1.393.3

Patch Changes

#3945 f94deaf Thanks @ioannisj! - fix(surveys): guard handlePageUnload against version-skewed surveys instance missing the method
(2026-06-24)

`v1.393.2`

Compare Source

1.393.2

Patch Changes

#3944 1c9a811 Thanks @ioannisj! - Stop logging a misleading "upgrade your PostHog server" warning for valid v2 flags responses that have no flags.
(2026-06-24)

`v1.393.1`

Compare Source

1.393.1

Patch Changes

#3919 99bad9c Thanks @pauldambra! - Session replay network capture: add an opt-in streaming reader for request/response bodies that stops at the payload size limit instead of buffering the whole body and then discarding it — bounding memory and pre-request latency when a body is very large. It reads only a clone of the body, so it never consumes the stream the page itself reads, and always resolves (never rejects) into the page's fetch. Off by default; enabled for defaults: '2026-06-25' and settable directly via session_recording.streamNetworkBody.
(2026-06-24)
Updated dependencies [99bad9c]:
- @posthog/types@1.391.1

`v1.393.0`

Compare Source

1.393.0

Minor Changes

#3921 c28b161 Thanks @marandaneto! - Add disable_capture_url_hashes to strip URL fragments from automatically captured URLs. It is disabled by default for backwards compatibility, and enabled automatically when config.defaults is '2026-06-25' or later. Enabling it (either explicitly or via the '2026-06-25' defaults) is a breaking behavior change for SPAs that rely on URL hashes for routing or analytics, because hash-based routes will be collapsed to the same URL without the fragment in fields such as $current_url, $initial_current_url, $session_entry_url, autocapture $elements[*].attr__href, $external_click_url, replay href URLs, heatmaps, web vitals $current_url, logs url.full, conversations current_url/request_url, or Next.js Pages Router $pageview $current_url.

If you only want to capture some hashes, leave hash capture enabled and use before_send to remove or redact sensitive hash values before events are sent. (2026-06-23)

Patch Changes

Updated dependencies [c28b161]:
- @posthog/core@1.36.0
- @posthog/types@1.391.0

`v1.392.0`

Compare Source

1.392.0

Minor Changes

#3895 ce528ed Thanks @turnipdabeets! - Console log auto-capture (logs: { captureConsoleLogs: true }) now flows through the same pipeline as posthog.captureLog(), posthog.logger.*, and PostHog's other SDKs, instead of OpenTelemetry. As a result:
- the bundled OpenTelemetry dependencies are removed, shrinking the lazily-loaded logs chunk
- auto-captured console logs now run through logs.beforeSend (the same hook as captureLog/logger.*), so you can redact or drop sensitive console output before it's sent. To treat console logs differently from manual logs, branch on the record's log.source attribute: auto-captured console logs set it to console.<method> (e.g. console.error), while manual captureLog/logger.* logs leave it unset
- console logs now link to the person's profile: they carry the person id as posthogDistinctId, the attribute PostHog uses to associate logs with a person (docs). The old path used distinct_id, which isn't used for person linking by default, so console logs previously didn't appear on person profiles unless you'd configured a custom key.
Console logs keep their posthog-browser-logs service.name, their console instrumentation scope, and their log.source: console.<level> attribute.

As part of moving onto the shared pipeline, console records now use PostHog's standard log field names — the same ones programmatic web logs and other SDKs use, and the ones the Logs UI surfaces. For the fields below the values are unchanged — only the attribute names/locations differ:
- distinct_id → posthogDistinctId (record attribute)
- location.href → url.full (record attribute; same value — the page URL)
- session.id (resource attribute) → sessionId (record attribute) — renamed and moved
- host and window.id move from resource attributes to record attributes (names unchanged)
- records also now carry the standard SDK context shared by other logs, including feature_flags
For most projects this needs no action — these are already the canonical log fields. The only thing to update is a saved Logs query or dashboard built specifically on an old console attribute name, for example:
- attributes.distinct_id → attributes.posthogDistinctId
- attributes.location.href → attributes.url.full
- resource.attributes.session.id → attributes.sessionId
- resource.attributes.host / resource.attributes.window.id → attributes.host / attributes.window.id (2026-06-22)

Patch Changes

Updated dependencies [ce528ed]:
- @posthog/core@1.35.4

`v1.391.9`

Compare Source

1.391.9

Patch Changes

#3922 26aa9ba Thanks @posthog! - Exception autocapture: posthog-js's own fetch timeout now aborts with an explicit, descriptive reason (PostHog request timed out after <n>ms) instead of a reason-less DOMException: AbortError: signal is aborted without reason. This keeps name === 'AbortError' so existing timeout handling (e.g. feature flag timeout detection) is unchanged, but makes our own timeouts identifiable and stops them being re-captured as noise by console-error exception autocapture.
(2026-06-22)

`v1.391.8`

Compare Source

1.391.8

Patch Changes

#3908 1fce04f Thanks @marandaneto! - Apply CSP stylesheet preparation hook to Product Tours styles.
(2026-06-22)

`v1.391.7`

Compare Source

1.391.7

Patch Changes

#3914 dac4edb Thanks @pauldambra! - Session replay network capture: redact credential-bearing headers on both request and response (previously only request), and match credential-shaped custom header names by substring (e.g. x-gist-encoded-user-token) in addition to the exact deny list - avoiding accidental capture of tokens/cookies in recordings.
(2026-06-22)

`v1.391.6`

Compare Source

1.391.6

Patch Changes

#3901 049eeb6 Thanks @marandaneto! - Stop adding the unused beacon query parameter to browser SDK sendBeacon requests.
(2026-06-22)
#3900 3ee8667 Thanks @marandaneto! - Stop adding the unused ip query parameter to browser SDK requests.
(2026-06-22)

`v1.391.5`

Compare Source

1.391.5

Patch Changes

#3915 beaccc3 Thanks @pauldambra! - Session replay: apply the existing base64 image size cap (maxBase64ImageLength) to SVG <image> elements with data: URIs on both href and xlink:href. Previously the cap only covered <img> elements, so large inline data URIs inside SVGs were recorded in full - this also covers them in mutations, replacing oversized ones with the striped placeholder.
(2026-06-22)

`v1.391.4`

Compare Source

1.391.4

Patch Changes

#3913 ee9f2a8 Thanks @pauldambra! - Session replay network capture: expand the default payload host deny list to skip third-party analytics, RUM, and session-replay telemetry whose payloads have no replay value - Datadog, Segment, RudderStack, Amplitude, Mixpanel, Hotjar (both .com and .io), and FullStory. Also covers both Google Analytics beacon hosts (google-analytics.com, plus analytics.google.com which gtag uses when Google Signals is enabled) and widens New Relic to nr-data.net.
(2026-06-22)

`v1.391.3`

Compare Source

1.391.3

Patch Changes

#3909 ab4a220 Thanks @marandaneto! - Avoid style-src-attr CSP violations when diffing rrweb style mutations.
(2026-06-22)
#3912 78ac40c Thanks @pauldambra! - Session replay network capture: never record binary/asset response or request bodies (image, video, audio, font, octet-stream, pdf, zip, wasm) even when recordBody is enabled - they bloat recordings, duplicate what the replay already shows, and the body is no longer read.
(2026-06-22)

`v1.391.2`

Compare Source

1.391.2

Patch Changes

#3903 6b21f77 Thanks @marandaneto! - Validate custom event UUID overrides and generate new UUIDs when invalid.
(2026-06-19)
Updated dependencies [6b21f77]:
- @posthog/core@1.35.3
- @posthog/types@1.390.2

`v1.391.1`

Compare Source

1.391.1

Patch Changes

#3899 d090a7c Thanks @lucasheriques! - Surveys: re-check eligibility when a popover's display delay elapses, instead of only re-checking the URL.

A survey with a display delay could be queued while a visitor was still anonymous (the targeting flag passed for the anonymous profile), and then displayed after the delay even though identify() had reloaded feature flags and the survey's internal targeting flag was now false for the identified profile (e.g. a "show once per user" survey the person had already dismissed). The delayed display now re-runs the full display predicate (eligibility, URL/device/selector conditions, event/action trigger, and feature flags) before rendering, so a survey that became ineligible during the delay is no longer shown. Pending delayed surveys are also cancelled promptly when a later evaluation cycle finds them ineligible. (2026-06-19)

`v1.391.0`

Compare Source

1.391.0

Minor Changes

#3885 5392a55 Thanks @pauldambra! - feat(replay): capture canvas at reduced resolution

Adds session_recording.canvasCapture.resolutionScale - a (0, 1] fraction of the canvas display size to capture replay frames at. The captured bitmap is downscaled (pixel-area savings are quadratic) while the canvas's true display size is still recorded, so playback stretches the smaller frame back to the correct dimensions and aspect ratio - only sharpness drops, never layout. It defaults to 1 (full resolution, matching today's behaviour), and the latest defaults bundle (2026-05-30) opts new installs into 0.6.

The canvas's true display size travels with each frame through the encode worker (as required message fields), so the encoded reply is always drawn back to the correct dimensions — no per-canvas state is retained on the main thread, and downscaling can never mislabel a canvas's dimensions. At full resolution the captured pixels are unchanged (the quality resampling hint is only applied when actually downscaling); the emitted drawImage now always uses the explicit destination-size form, which is pixel-equivalent on replay.

Mechanically, @posthog/rrweb's canvas FPS-snapshot observer takes an optional canvasResolutionScale record option and downscales each captured frame accordingly. (2026-06-19)

Patch Changes

Updated dependencies [5392a55]:
- @posthog/types@1.390.1

`v1.390.2`

Compare Source

1.390.2

Patch Changes

#3868 a5dd54a Thanks @pauldambra! - fix(replay): scope the session-recording flushed-size tracker to the session

$sdk_debug_replay_flushed_size was stored as a single device-global value in persistence and only reset on an in-page session rotation, so it leaked across page loads and tabs and over-counted on returning visitors. The tracker now keys the running total to the current session id, so a new session starts from zero and a fresh load reading an ongoing session sees the correct total.

The internal persistence key backing this counter ($sess_rec_flush_size) was also unintentionally attached to every captured event as a super-property; it is now marked hidden so it no longer ships on events. The value remains available on session-replay debug events as $sdk_debug_replay_flushed_size. (2026-06-17)

`v1.390.1`

Compare Source

1.390.1

Patch Changes

#3784 e25e629 Thanks @lucasheriques! - Surveys: event-triggered surveys are now scoped to the page load the event fired in, and only persist across a page reload once they have actually been shown.

Previously an event armed a survey by writing it to localStorage, where it stayed until shown. Because the activation survived reloads and the URL condition was only checked at display time, a survey armed by an exit-intent event (which fires as the user is leaving or reloading) could surface on a later page load with no event behind it. Activations now live in memory until the survey is shown, so an armed-but-unshown survey no longer reappears after a reload.

Once a survey is shown it is promoted to persistence, so a non-repeatable survey survives a reload and re-displays until the user dismisses or answers it (instead of vanishing if they reload before interacting). Repeatable surveys (schedule: 'always' or "Show every time the event is captured") are still consumed when shown, so each captured trigger shows them once. Product tours follow the same model. Cross-page deferral (arm on one full page load, display on a later one) is no longer supported via event triggers; use audience targeting for that. (2026-06-17)

`v1.390.0`

Compare Source

1.390.0

Minor Changes

#3869 81b79fb Thanks @turnipdabeets! - Add a beforeSend option to the logs config, so you can inspect, redact, or drop log records before they're sent:

posthog.init('<token>', {
    logs: {
        beforeSend: (log) => {
            // return null to drop the log, or return the (optionally modified) log to keep it
            if (log.body.includes('password')) {
                return null
            }
            return log
        },
    },
})

beforeSend accepts a single function or an array of functions (applied left to right); returning null from any of them drops the record. It runs for logs sent via both posthog.captureLog() and posthog.logger.*. (2026-06-17)

Patch Changes

Updated dependencies [81b79fb]:
- @posthog/types@1.390.0

`v1.389.1`

Compare Source

1.389.1

Patch Changes

#3875 43b4137 Thanks @marandaneto! - Limit retries for transport failures without an HTTP response.
(2026-06-17)

`v1.389.0`

Compare Source

1.389.0

Minor Changes

#3865 b469830 Thanks @turnipdabeets! - The browser's programmatic logs API (posthog.captureLog() / posthog.logger.*) now runs through the shared @posthog/core logs pipeline that React Native already uses — no change to the public API or existing behavior. Log delivery is more resilient as a result: oversized batches are split automatically, failed sends retry with exponential backoff, and delivery resumes when the browser comes back online.
(2026-06-17)

Patch Changes

Updated dependencies [b469830]:
- @posthog/core@1.35.0
- @posthog/types@1.389.0

`v1.388.2`

Compare Source

1.388.2

Patch Changes

#3870 5edfee1 Thanks @turnipdabeets! - Fix updateFlags(flags, payloads, { merge: true }) baking an active feature flag override into the stored flags. The merge now seeds from the raw stored flags rather than the override-applied values, so clearing the override afterwards correctly restores the original flag.
(2026-06-17)

`v1.388.1`

Compare Source

1.388.1

Patch Changes

#3851 5c453cd Thanks @marandaneto! - Apply CSP nonce preparation hooks to style and script elements appended by site apps.
(2026-06-17)

`v1.388.0`

Compare Source

1.388.0

Minor Changes

#3863 b6bc9be Thanks @marandaneto! - Add autocapture-only CSS selector opt-outs for web interactions.
(2026-06-17)

Patch Changes

Updated dependencies [b6bc9be]:
- @posthog/types@1.388.0

`v1.387.0`

Compare Source

1.387.0

Minor Changes

#3709 c6c163a Thanks @posthog! - Add unsetPersonProperties() to remove person properties, the counterpart to setPersonProperties(). Previously the only way to unset a person property was to hand-pass a $unset array inside a capture() call.
(2026-06-16)

Patch Changes

#3756 b3ec845 Thanks @archievi! - Drop the event and log a warning when a before_send hook removes the token property, instead of silently sending an event that ingest rejects with a 401.
(2026-06-16)
#3860 c9c7df1 Thanks @marandaneto! - Add $unset to capture options and pass it through in browser capture payloads.
(2026-06-16)
#3855 fadaa4f Thanks @haacked! - Stop sending the ip query parameter on feature flag requests. The flags endpoint ignores it, and some ad blockers match /flags…ip= to block flag evaluation on any domain. Dropping it from flag requests avoids the block with no functional change. Event and session recording requests are unchanged.
(2026-06-16)
#3830 0d837f5 Thanks @dustinbyrne! - Avoid reloading exception and dead-click autocapture external scripts when they are already present.
(2026-06-16)
#3853 f95a0ec Thanks @TueHaulund! - Capture native Fullscreen API transitions in session replay. Entering native fullscreen (element.requestFullscreen()) is rendered by the browser via the UA :fullscreen pseudo-class with no DOM mutation, so the recorder previously captured nothing and replays showed the element at its pre-fullscreen size with drifted click coordinates. The recorder now emits a reserved custom event on fullscreenchange (standard plus webkit/moz/MS prefixes), and the replayer re-applies fullscreen layout to the element on playback (including when scrubbing into a fullscreen region) via a reserved rr_fullscreen attribute, consistent with rrweb's existing rr_* attribute namespace.

Known limitation: fullscreen of an element inside a same-origin iframe is recorded against the <iframe> element rather than the inner element, so replay pins the iframe. (2026-06-16)
Updated dependencies [b3ec845, c9c7df1, c6c163a]:
- @posthog/core@1.33.0
- @posthog/types@1.387.0

`v1.386.8`

Compare Source

1.386.8

Patch Changes

#3838 3094f73 Thanks @TueHaulund! - fix(replay): discard the prior session's buffer when start() bails out a pending stop(). On a stopSessionRecording() → reset() → identify(newUser) → startSessionRecording() sequence, stopSessionRecording() takes the async compression-drain path, deferring its buffer flush and teardown. start() correctly invalidates that pending cleanup so the new recorder survives, but it left the stopped session's snapshot buffer in place. The re-entrant session-id restart then flushed those previous-user snapshots under the OLD session id, producing a mixed-distinct_id session that server-side any(distinct_id) attribution resolves to the wrong person — recordings showing the previous user's identity. start() now clears that stale buffer alongside invalidating the compression queue, matching the drop-trailing-data trade-off the bailed-out stop() path already accepts.
(2026-06-15)

`v1.386.7`

Compare Source

1.386.7

Patch Changes

#3837 29bf8e3 Thanks @marandaneto! - Add missing bugs metadata to package manifests.
(2026-06-15)
#3832 d3a9462 Thanks @archievi! - Surveys: guard the remaining unprotected localStorage accesses (reset() and the lastSeenSurveyDate write) so a SecurityError in cross-origin iframes is swallowed instead of bubbling up to user monitoring.
(2026-06-15)
Updated dependencies [29bf8e3]:
- @posthog/core@1.32.4
- @posthog/types@1.386.4

`v1.386.6`

Compare Source

1.386.6

Patch Changes

#3804 a27b163 Thanks @pauldambra! - fix(product-tours): drop the cached tours blob when product tours is not enabled

Tours fetched while product tours was enabled are cached under ph_product_tours in the main persistence blob. Once product tours is disabled (remote config or the disable_product_tours option) that cache was never cleaned up, so a potentially large stale blob kept riding on every persistence write — and on every cross-tab storage event those writes broadcast. onRemoteConfig now clears the cached tours whenever product tours resolves to disabled; they are re-fetched if it is ever re-enabled. (2026-06-11)

`v1.386.5`

Compare Source

1.386.5

Patch Changes

#3801 bd06ac7 Thanks @ksvat! - fix(replay): prevent silent recorder teardown on session-id rotation. When the session id rotates during active rrweb capture, _updateWindowAndSessionIds calls stop() then synchronously start('session_id_changed'). If stop() took the _stopAfterCompressionQueueDrains path (which fires whenever the compression queue is non-empty — common during steady recording), its async cleanup would later resolve and call _teardown() against the freshly-started recorder, stopping rrweb, removing event listeners, and emptying the V2 trigger-group matchers. From that point on, the recorder's status getter kept reporting active/sampled (the _strategy reference was still set), but rrweb was no longer producing events, no listeners were registered, and no $snapshot data reached the server — the session looked recording-eligible from event metadata yet produced no replay. start() now invalidates the compression-queue state (generation bump plus reset of the stop-in-progress flag and queued-event count), so any pending cleanup from a prior stop() bails at its existing generation check and a later stop() of the new recorder is not mistaken for the old in-progress one. Affects long-running tabs that rotate session id mid-use (idle timeout, session-past-max-length, or posthog.reset()).
(2026-06-11)

`v1.386.4`

Compare Source

1.386.4

Patch Changes

#3767 fdc07f3 Thanks @arnohillen! - replay: jump scrolls instantly when seeking past pages that use scroll-behavior: smooth. During fast-forward the replayer applied scrolls with behavior: 'auto', which inherits the page's CSS scroll-behavior — so on sites that set scroll-behavior: smooth (e.g. Silk bottom sheets/modals) a seeked scroll animated from 0 instead of jumping, leaving scroll-revealed content (the open sheet) out of view and showing only the backdrop until the animation caught up. Sync scrolls now use behavior: 'instant', matching the method's stated intent that smooth scrolling be disabled while fast-forwarding. Full snapshot rebuilds apply their initial offset with behavior: 'instant' too, so the document-level scroll doesn't animate either.
(2026-06-11)

`v1.386.3`

Compare Source

1.386.3

Patch Changes

#3760 5ddfd44 Thanks @benben! - fix(conversations): re-attach the support widget after SPA navigations that replace document.body (e.g. Turbo Drive), so the widget no longer disappears until a full page reload
(2026-06-11)
#3690 dbf2377 Thanks @pauldambra! - fix(sessionid): keep the session id stable across tabs

A session now rotates only when every tab has been idle past the timeout, rather than whenever a single background tab decides it is idle. On the active event path an idle tab re-reads the session id from storage before rotating: if a sibling tab kept the session alive it does not rotate, and if a sibling already rotated it adopts that id instead of minting a new one. This removes spurious cross-tab session fragmentation (inflated session counts, truncated session durations, split replays). When a sibling session is adopted, onSessionId handlers fire with changeReason.crossTabAdoption: true so session recording, pageview state, and session-scoped properties follow the new session. When persistence_save_debounce_ms > 0 (the 2026-05-30 default) the refresh reads only the session-id key so it cannot clobber a sibling's write.

Note: projects with significant multi-tab usage will see fewer but longer sessions after upgrading — this is a correction of previously over-counted sessions, not a traffic change. (2026-06-11)
#3795 21441a8 Thanks @pauldambra! - fix(persistence): stop per-request metadata rewriting the split-storage entries on every load

$feature_flag_evaluated_at, $feature_flag_request_id, and $surveys_loaded_at change on every /flags (or /surveys) load even when the flag and survey content is unchanged. With split_storage enabled that made the multi-hundred-KB __flags / __surveys localStorage entries dirty on every SPA navigation, re-broadcasting the full payload to every open same-origin tab via cross-tab storage events — the exact pressure the split exists to remove. These keys are now marked volatile: a value-only change neither dirties the group nor alters its fingerprint, so the write is skipped and the freshest value rides along on the next real content write. Adding or deleting a volatile key still writes through (presence is fingerprinted, the moving value is not), and the in-memory value is always current — only the on-disk copy may lag until the next content change. (2026-06-11)
Updated dependencies [dbf2377]:
- @posthog/types@1.386.3
- @posthog/core@1.32.3

`v1.386.2`

Compare Source

1.386.2

Patch Changes

Updated dependencies [25822ac]:
- @posthog/core@1.32.2
- @posthog/types@1.386.2

`v1.386.1`

Compare Source

1.386.1

Patch Changes

#3780 93e0461 Thanks @dustinbyrne! - Fix stale sampled-in session replay decisions after the configured replay sample rate changes.
(2026-06-10)
#3788 6da86d0 Thanks @TueHaulund! - fix(replay): never record or flush snapshots while the sampling decision is missing

When the stored sampling decision was wiped while the recorder was running (e.g. by posthog.reset()), the undecided session reported an active status and could leak short junk recordings from sessions that then decided not to record. Sampling decisions are now persisted tagged with the session id they were made for ('!' + sessionId when sampled out), are re-made on every session id change regardless of config availability, and a buffer is never flushed without a decision when sampling is configured. Because the decision is a deterministic hash of the session id, re-deciding never flips the outcome for the same session. This also stops a stale false decision from a previous session being inherited by a new session, which chronically under-recorded returning visitors. (2026-06-10)
Updated dependencies []:
- @posthog/types@1.386.1
- @posthog/core@1.32.1

`v1.386.0`

Compare Source

1.386.0

Minor Changes

#3634 612f97a Thanks @lucasheriques! - feat(surveys): add opt-in appearance.allowGoBack for multi-question surveys, and make button labels translatable

Renders a "Back" button on web surveys after the first question. Default is off — existing surveys are unchanged. Uses a visited-index history stack so back-navigation respects branching paths (response_based, specific_question), and abandoned-branch responses are pruned before submission so analytics aren't polluted. Returning to a question pre-fills the prior answer. appearance.backButtonText overrides the default label. The button uses the survey's text color so it stays readable on any background, and it also shows in survey previews.

Also adds submitButtonText and backButtonText to survey-level translations, so both the submit and back button labels can be localized via appearance translations (previously only the per-question button text was translatable). (2026-06-10)

Patch Changes

Updated dependencies [612f97a]:
- @posthog/core@1.32.0
- @posthog/types@1.386.0

`v1.385.0`

Compare Source

1.385.0

Minor Changes

#3777 f601c49 Thanks @dustinbyrne! - Promote external dependency script versioning to supported strict_script_versioning and asset_host config options.
(2026-06-10)

Patch Changes

#3753 c11794d Thanks @dustinbyrne! - Reload feature flags by default when resetting person properties for flags.
(2026-06-10)
#3742 23b2af1 Thanks @arnohillen! - record: capture resting scroll offset on scrollend when a reveal scroll clamps to 0 before its target is scrollable (e.g. Silk sheets). Deduped against scroll so normal gestures don't double event volume.
(2026-06-10)
Updated dependencies [c11794d, f601c49]:
- @posthog/types@1.385.0
- @posthog/core@1.31.4

`v1.384.3`

Compare Source

1.384.3

Patch Changes

#3791 2d21ada Thanks @marandaneto! - Deprecate __preview_disable_beacon in favor of disable_beacon and mark __preview_disable_xhr_credentials as a no-op.
(2026-06-10)
Updated dependencies [2d21ada]:
- @posthog/types@1.384.3
- @posthog/core@1.31.3

`v1.384.2`

Compare Source

1.384.2

Patch Changes

#3789 d9462b3 Thanks @marandaneto! - Deprecate __preview_eager_load_replay as a no-op now that session replay lazy loading is the default.
(2026-06-10)
Updated dependencies [d9462b3]:
- @posthog/types@1.384.2
- @posthog/core@1.31.2

`v1.384.1`

Compare Source

1.384.1

Patch Changes

#3787 0e22d77 Thanks @TueHaulund! - replayer: stop corrupting recordings when events are added behind the playhead. addEvent() used to apply any event older than the playback baseline synchronously onto the current DOM — correct for live-mode catch-up, but wrong for on-demand playback where snapshot chunks can finish loading after the user has seeked ahead. Applying those past mutations onto a DOM at a different position made their removes fail mirror lookups, and applyMutation then deleted the failed entries from the event objects themselves, so every later seek rebuilt from corrupted data (DOM nodes accumulating, e.g. duplicated text) and exports serialized the stripped events. Past events are now only applied synchronously in live mode (otherwise they are just inserted for the next seek to pick up), and applyMutation filters removes into a local copy instead of mutating the event data.
(2026-06-10)
Updated dependencies []:
- @posthog/types@1.384.1
- @posthog/core@1.31.1

`v1.384.0`

Compare Source

1.384.0

Minor Changes

#3782 0c2acb9 Thanks @pauldambra! - Detect the Google Search App (GSA) as its own $browser value (Google Search App) via the cross-platform GSA/ UA marker, instead of reporting the embedded webview as Mobile Safari (iOS) or Chrome (Android). Gated behind the new detect_google_search_app config option, which the 2026-05-30 config defaults opt into automatically — left off otherwise to keep existing browser attribution backwards-compatible.

Note: $browser_version for Google Search App is not comparable across platforms — iOS yields a version like 284.0 (from GSA/284.0.564099828) while Android yields a version like 14.21 (from GSA/14.21.20.28.arm64), since Google maintains separate versioning schemes for the two apps. Avoid building cross-platform version dashboards on $browser_version for this browser. (2026-06-10)

Patch Changes

Updated dependencies [0c2acb9]:
- @posthog/core@1.31.0
- @posthog/types@1.384.0

`v1.383.3`

Compare Source

1.383.3

Patch Changes

#3776 783ba46 Thanks @marandaneto! - Deprecate the no-op __preview_flags_v2 browser SDK config option. The SDK already uses the /flags/?v=2 endpoint by default.
(2026-06-09)
Updated dependencies [783ba46]:
- @posthog/types@1.383.3
- @posthog/core@1.30.14

`v1.383.2`

Compare Source

1.383.2

Patch Changes

#3748 7820929 Thanks @marandaneto! - Reduce duplicate internal code found by dry4ts.
(2026-06-09)
Updated dependencies []:
- @posthog/types@1.383.2
- @posthog/core@1.30.13

`v1.383.1`

Compare Source

1.383.1

Patch Changes

#3770 e481b0c Thanks @dustinbyrne! - Respect capture_pageview: false when opting out in cookieless on_reject mode.
(2026-06-08)
Updated dependencies []:
- @posthog/types@1.383.1
- @posthog/core@1.30.12

`v1.383.0`

Compare Source

1.383.0

Minor Changes

#3771 227c9b0 Thanks @dustinbyrne! - feat(persistence): add split_storage config option to store the feature-flag config cluster in its own localStorage entry (<name>__flags) instead of the single main persistence blob. This payload is large and changes rarely, so keeping it out of the main blob stops it riding on every high-frequency main-blob write and broadcasting on cross-tab storage events. Reads are unchanged: on load the entry is merged back into the in-memory props, and the old main-blob location is read once and migrated forward so upgrades never miss a cached flag. The split only applies when persistence resolves to localStorage / localStorage+cookie (it is pointless for memory / sessionStorage and impossible for cookie), and reset() / opt-out wipe every entry. Defaults to false for backwards compatibility; the new 2026-05-30 config default opts in automatically.
(2026-06-08)
#3727 393f9e2 Thanks @pauldambra! - feat(surveys): extend split_storage to also move the survey config ($surveys) out of the main persistence blob into its own <name>__surveys localStorage entry, on top of the feature-flag split. Surveys now stamp a $surveys_loaded_at freshness timestamp on every /surveys load — the survey analogue of $feature_flag_evaluated_at — so a stale __surveys entry can no longer win over a fresher survey payload written back into the main blob by a gate-off / older-SDK tab. With no timestamp on either side (migration leftover) the group entry still wins, so the migration path is unchanged. Same backend and reset() / opt-out semantics as the flag split.
(2026-06-08)

Patch Changes

Updated dependencies [227c9b0, 393f9e2]:
- @posthog/types@1.383.0
- @posthog/core@1.30.11

`v1.382.0`

Compare Source

1.382.0

Minor Changes

#3749 9877710 Thanks @pauldambra! - Stop classifying intentional repeated clicks as rageclicks. From the 2026-05-30 config defaults, rageclick detection now ignores:
- text-editing surfaces (textarea, text-like inputs, and contenteditable elements), where rapid clicks are double/triple-click text selection rather than rage (rageclick.ignore_text_selection)
- +/- stepper buttons, added to the default content_ignorelist
Symbol-only keywords in content_ignorelist (e.g. +, -, >, <) now match the element's text exactly instead of as a substring, so labels like sign-up, 5 > 3, or C++ are no longer treated as repeatedly-clicked controls. The heatmaps rageclick marker now applies the same suppression as the $rageclick event.

A partial rageclick config object is now merged with the date-gated defaults instead of replacing them, so e.g. rageclick: { threshold_px: 50 } keeps the default content_ignorelist / ignore_text_selection. Pass an explicit value (e.g. content_ignorelist: false) to override a specific default, or a boolean to opt out entirely.

Behaviour change for existing content_ignorelist: true users (available since 2025-11-30): the default list already includes > and <. After this release, buttons whose text contains > or < but is not exactly that symbol (e.g. Learn more >, < Back, home > settings) will no longer be suppressed. Bare > and < buttons remain suppressed. This is the intended fix, but if you rely on the old substring behaviour for those keywords, replace content_ignorelist: true with an explicit array listing the exact terms you want to suppress. (2026-06-06)

Patch Changes

Updated dependencies []:
- @posthog/types@1.382.0
- @posthog/core@1.30.10

`v1.381.0`

Compare Source

1.381.0

Minor Changes

#3719 a7bd828 Thanks @lricoy! - Add __preview_cookie_wins_on_conflict opt-in config to prefer cookie values over localStorage when merging persistence state in localStorage+cookie mode, fixing cross-subdomain identify and session disconnects.
(2026-06-05)

Patch Changes

Updated dependencies [a7bd828]:
- @posthog/types@1.381.0
- @posthog/core@1.30.9

`v1.380.1`

Compare Source

1.380.1

Patch Changes

#3743 ced0039 Thanks @robbie-c! - fix(surveys): stop the survey CSS from using :has(.survey-question:empty), which crashes some WebKit builds during text-node style invalidation while a survey renders. The empty-header margin tweak now keys off a JS-set question-header--empty class and a sibling selector instead.
(2026-06-05)
Updated dependencies []:
- @posthog/types@1.380.1
- @posthog/core@1.30.8

`v1.380.0`

Compare Source

1.380.0

Minor Changes

#3715 2387084 Thanks @dustinbyrne! - Promote browser tracing header configuration to the public tracing_headers option while keeping addTracingHeaders and __add_tracing_headers as deprecated aliases.
(2026-06-04)

Patch Changes

#3715 2387084 Thanks @dustinbyrne! - When using tracing headers, X-POSTHOG-DISTINCT-ID is read at request time instead of when fetch/XHR is patched, ensuring it reflects bootstrap, identify, reset, and other identity changes.
(2026-06-04)
Updated dependencies [2387084]:
- @posthog/types@1.380.0
- @posthog/core@1.30.7

`v1.379.3`

Compare Source

1.379.3

Patch Changes

#3741 32de5d2 Thanks @clr182! - logs: the console-log integration now respects opt_out_capturing() — it checks is_capturing() before emitting, so log events stop on opt-out (and resume on opt-in).
(2026-06-04)
Updated dependencies []:
- @posthog/types@1.379.3
- @posthog/core@1.30.6

`v1.379.2`

Compare Source

1.379.2

Patch Changes

#3736 374962a Thanks @arnohillen! - replay: re-apply scroll positions after fast-forward/seek. Scrolls applied mid-catch-up could clamp to 0 when the target wasn't scrollable yet (e.g. scroll-revealed sheets/modals whose content sits below the fold), leaving the content scrolled out of view on replay. The last scroll per node is now re-applied in the flush stage once layout has settled. posthog-js is bumped too so the rebuilt bundle containing the fix is published.
(2026-06-03)
Updated dependencies []:
- @posthog/types@1.379.2
- @posthog/core@1.30.5

`v1.379.1`

Compare Source

1.379.1

Patch Changes

#3570 4a27ced Thanks @gruessi! - fix(record): release iframe documents and observers on iframe removal — same-origin iframes mounted and unmounted while session recording is active no longer leak their Document, every node serialized into the mirror, or one MutationObserver per mount. Closes eight retainer chains: load-listener disposers, named pagehide handlers, the recordCrossOriginIframes cleanup gate (now applied to same-origin too), captured Document / Window sets that survive iframe.src swap-to-about:blank before removal, and the global mutationBuffers[] / handlers[] arrays which previously accumulated forever. Validated end-to-end: a host page that mounts/unmounts 5 blob-URL iframes every 2s for 110s went from +118 MB / +390 leaked HTMLDocuments to ~0 MB / 0.
(2026-06-03)
#3717 1688b38 Thanks @turnipdabeets! - Move the OpenTelemetry logs dependencies to devDependencies. They are only used to build the CDN-served logs extension chunk, which inlines them, so consumers no longer install the transitive protobufjs (whose eval("require") tripped unsafe-eval Content Security Policies).

If you imported @opentelemetry/* directly while relying on it being hoisted from posthog-js, add it to your own dependencies. (2026-06-03)
Updated dependencies []:
- @posthog/types@1.379.1
- @posthog/core@1.30.4

`v1.379.0`

Compare Source

1.379.0

Minor Changes

#3722 c487070 Thanks @marandaneto! - Add $sdk_dist_channel event property for browser SDK npm and cdn distribution channels.
(2026-06-02)

Patch Changes

Updated dependencies []:
- @posthog/types@1.379.0
- @posthog/core@1.30.3

`v1.378.1`

Compare Source

1.378.1

Patch Changes

#3706 8fcf40d Thanks @dustinbyrne! - fix(browser): avoid exposing internally-created Request bodies to downstream fetch wrappers in Safari.
(2026-06-01)
Updated dependencies []:
- @posthog/types@1.378.1
- @posthog/core@1.30.2

`v1.378.0`

Compare Source

1.378.0

Minor Changes

#3688 8181354 Thanks @pauldambra! - feat(persistence): add persistence_save_debounce_ms config option to coalesce rapid storage saves into a single write. Setting a positive value debounces writes to localStorage/cookie by that window; the in-memory props object still updates synchronously so within-tab reads see the latest values immediately, and pending writes flush on beforeunload and pagehide so no state is lost on tab close. Cross-tab storage events are reduced proportionally to the debounce window. Defaults to 0 (no debouncing) for backwards compatibility. On pages that capture many events per second, 250 is a reasonable starting point. The new 2026-05-30 config default opts into persistence_save_debounce_ms: 250 automatically.
(2026-06-01)

Patch Changes

Updated dependencies [8181354]:
- @posthog/types@1.378.0
- @posthog/core@1.30.1

`v1.377.0`

Compare Source

1.377.0

Minor Changes

#3708 3d4a76f Thanks @pauldambra! - Detect Brave (desktop, Android, iOS), Vivaldi, Yandex, Naver Whale, DuckDuckGo, Pale Moon, and Waterfox so users on these browsers no longer get bucketed as Chrome or Firefox.

detectBrowser / detectBrowserVersion now accept an optional third argument, BrowserDetectionHints, with a brave flag (set when navigator.brave exists). The browser SDK populates this automatically to catch desktop / Android Brave, which is Chromium-based and carries no UA marker. Brave on iOS is picked up purely from the Brave/ UA marker — WebKit doesn't ship navigator.brave. The original two-argument signature still works for non-DOM callers. (2026-06-01)

Patch Changes

#3703 f3cc6fa Thanks @marandaneto! - Disable/no-op initialization paths instead of throwing or sending requests when PostHog project tokens are missing or blank.
(2026-06-01)
Updated dependencies [3d4a76f]:
- @posthog/core@1.30.0
- @posthog/types@1.377.0

`v1.376.6`

Compare Source

1.376.6

Patch Changes

#3687 663e250 Thanks @pauldambra! - fix(persistence): skip the storage write when the serialized props are unchanged. Callers spam save() after every property change, and many of those changes leave the serialized payload identical (e.g. resetting a value to its current value). Writing identical bytes to localStorage still fires a cross-tab storage event in every same-origin tab, where Chrome allocates the payload buffer in mojo IPC even though no listener reacts. Now save() compares the serialized payload against the last successful write and bails out when nothing changed.
(2026-05-31)
Updated dependencies []:
- @posthog/types@1.376.6
- @posthog/core@1.29.15

`v1.376.5`

Compare Source

1.376.5

Patch Changes

#3686 66cbc59 Thanks @pauldambra! - fix(persistence): throttle session-activity timestamp writes to a 5s granularity. The in-memory value still moves at full resolution; only writes to localStorage/cookie are coalesced. Activity-timestamp-only updates within the granularity window are skipped, dropping localStorage write pressure and cross-tab storage event broadcasts on pages that capture many events per second. The pending in-memory value is flushed on destroy and beforeunload so a tab close inside the window does not leave the persisted value up to 5s stale for sibling tabs. The flush re-reads storage first and bails out if a sibling tab has rotated the session, so the flush cannot clobber the new session with the old id/start.
(2026-05-31)
Updated dependencies [d9ad199]:
- @posthog/core@1.29.14
- @posthog/types@1.376.5

`v1.376.4`

Compare Source

1.376.4

Patch Changes

#3685 f59f35a Thanks @ioannisj! - fix(cookieless): enable request queue when opting out in on_reject mode. When using cookieless_mode: "on_reject", calling opt_out_capturing() correctly switched the SDK into cookieless capturing but never enabled the RequestQueue — so batched events were enqueued but never flushed over the network. At init time the queue was not started because consent was PENDING and is_capturing() returned false; opt_out_capturing() is the first moment capturing becomes active but was missing the _start_queue_if_opted_in() call that opt_in_capturing() already had.
(2026-05-28)
#3692 f01cd93 Thanks @ksvat! - fix(replay): take a fresh full snapshot after session ID rotates via forcedIdleReset. Previously, when the session manager's idle enforcement timer rotated the session id, the recorder tore down rrweb and set _isIdle = 'unknown' before the new session id was observed. Neither restart path then fired (the _onSessionIdCallback guard only restarted when _isIdle === true, and _updateWindowAndSessionIds could not run with rrweb stopped), so the new session received only incremental mutations until a later snapshot — leaving the player stuck on "Buffering". The restart guard now also fires when rrweb isn't running.
(2026-05-28)
#3691 cc71f3f Thanks @ksvat! - fix(replay): ship ph-no-capture absolute-position fix from #3678 to posthog-js. The original changeset only bumped @posthog/rrweb and @posthog/rrweb-snapshot; because posthog-js depends on @posthog/rrweb via workspace:*, the cascade did not bump posthog-js, so the rebuilt bundle containing the fix was not published. This changeset re-publishes posthog-js with the fix.
(2026-05-28)
#3695 e1ff722 Thanks @ksvat! - chore(replay): expose $sdk_debug_rrweb_attached and $sdk_debug_rrweb_start_attempted debug properties on captured events. Today the SDK already stamps several $sdk_debug_* properties (start reason, linked-flag trigger status, recording status) that report the SDK's intent to record — they all flip to "active" as soon as the state machine evaluates the configured triggers. None of them observe whether rrweb actually attached and is producing events. The new booleans close that gap: $sdk_debug_rrweb_start_attempted is set when _startRecorder() is first entered, and $sdk_debug_rrweb_attached reflects whether _stopRrweb is currently a non-falsy stop handle (i.e. rrwebRecord({...}) returned successfully and the recorder has not been torn down). No behavior change — this only adds two booleans to the existing sdkDebugProperties channel, used to diagnose cases where a session reports trigger_activated / recording_status: active but no $snapshot data is ever uploaded.
(2026-05-28)
Updated dependencies [7b84b75]:
- @posthog/core@1.29.13
- @posthog/types@1.376.4

`v1.376.3`

Compare Source

1.376.3

Patch Changes

#3649 9cac1f6 Thanks @marandaneto! - Improve console log serialization performance for large objects.
(2026-05-27)
Updated dependencies []:
- @posthog/types@1.376.3
- @posthog/core@1.29.12

`v1.376.2`

Compare Source

1.376.2

Patch Changes

#3667 cafa9cc Thanks @pauldambra! - fix(replay): stop polling preload-as-style <link> elements forever. Session recorder treated <link rel="preload" as="style" href="*.css"> as if it were a stylesheet and waited for link.sheet to populate. Per spec preload links never instantiate a CSSStyleSheet, so the wait timed out, re-serialized the link, scheduled another wait, and leaked a load listener on every cycle — multiplying further on every real load event. Pages with Next.js-style CSS preloads accumulated thousands of active polling chains, saturating the main thread and freezing the tab on refocus
(2026-05-26)
Updated dependencies []:
- @posthog/types@1.376.2
- @posthog/core@1.29.11

`v1.376.1`

Compare Source

1.376.1

Patch Changes

Updated dependencies [5568f12]:
- @posthog/core@1.29.10
- @posthog/types@1.376.1

`v1.376.0`

Compare Source

1.376.0

Minor Changes

#3655 6e8d349 Thanks @arnaudhillen! - Expose the in-repo @posthog/rrweb, @posthog/rrweb-types, and @posthog/rrweb-plugin-console-record packages as subpath entry points on posthog-js. Consumers can now import { Replayer } from 'posthog-js/rrweb', import type { eventWithTime } from 'posthog-js/rrweb-types', and import { LogLevel } from 'posthog-js/rrweb-plugin-console-record' instead of installing the underlying rrweb packages directly. The rrweb worker sourcemap (image-bitmap-data-url-worker-*.js.map) is also shipped from posthog-js/dist/ so downstream bundlers no longer need to reach into node_modules/@posthog/rrweb.
(2026-05-22)

Patch Changes

#3639 c806cca Thanks @marandaneto! - Use native async gzip compression for session recording events when CompressionStream is available.
(2026-05-22)
Updated dependencies [c806cca]:
- @posthog/core@1.29.9
- @posthog/types@1.376.0

`v1.375.0`

Compare Source

1.375.0

Minor Changes

#3641 2e1d5f4 Thanks @dustinbyrne! - Add flag_keys config to restrict browser feature flag remote evaluation to specific flag keys.
(2026-05-21)

Patch Changes

Updated dependencies [2e1d5f4]:
- @posthog/types@1.375.0
- @posthog/core@1.29.8

`v1.374.4`

Compare Source

1.374.4

Patch Changes

#3638 87e2145 Thanks @marandaneto! - Apply tracing headers to matching XMLHttpRequest requests
(2026-05-21)
#3646 4f87827 Thanks @marandaneto! - Avoid throwing or initializing PostHogProvider when no API key or client is provided
(2026-05-21)
#3645 280832b Thanks @TueHaulund! - Capture <link rel="stylesheet"> URLs from link.sheet.href and try link.sheet directly for inlining, so recordings survive SPA history.pushState navigations between routes of different path depths (where link.href re-resolves against a new baseURI but link.sheet.href preserves the URL the browser actually fetched).

Ships the fix landed in #3635, which only bumped the internal @posthog/rrweb-snapshot package — that package is bundled into posthog-js at build time but is not published to npm on its own, so a posthog-js bump is needed to actually deliver the change. (2026-05-21)
Updated dependencies []:
- @posthog/types@1.374.4
- @posthog/core@1.29.7

`v1.374.3`

Compare Source

1.374.3

Patch Changes

#3607 557b893 Thanks @eli-r-ph! - Enable $web_vitals reporting when cookieless mode is enabled
(2026-05-20)
Updated dependencies [557b893, a880dbc]:
- @posthog/types@1.374.3
- @posthog/core@1.29.6

`v1.374.2`

Compare Source

1.374.2

Patch Changes

#3550 df91995 Thanks @TueHaulund! - Preserve session-recording remote config across posthog.reset().

posthog.reset() was clearing the entire persistence store, which wiped
$session_recording_remote_config along with user state. On the next session
rotation triggered by the reset, start('session_id_changed') would early-return
because the remote config was missing — leaving rrweb torn down and the new
session opening with no Meta + FullSnapshot until the next periodic 5-minute
checkout.

This affected any flow where an app calls posthog.reset() mid-session
(e.g. on sign-out / sign-in) and was particularly visible on Flutter Web
recordings that depend on a fresh FullSnapshot to anchor the CanvasKit DOM. (2026-05-18)
Updated dependencies []:
- @posthog/types@1.374.2
- @posthog/core@1.29.5

`v1.374.1`

Compare Source

1.374.1

Patch Changes

#3627 07a0f5f Thanks @marandaneto! - Respect transport overrides passed to posthog.capture.
(2026-05-18)
Updated dependencies []:
- @posthog/types@1.374.1
- @posthog/core@1.29.4

`v1.374.0`

Compare Source

1.374.0

Minor Changes

#3620 594ea11 Thanks @pauldambra! - Dead clicks: add a .ph-no-deadclick CSS class (and capture_dead_clicks.css_selector_ignorelist config option) to exclude specific elements from dead-click detection without affecting autocapture, session replay, or heatmaps. Mirrors the existing .ph-no-rageclick pattern.
(2026-05-18)

Patch Changes

#3621 3c0a09f Thanks @pauldambra! - Dead clicks: a click on an <a> (or any element inside an <a>, including across shadow DOM) is no longer flagged as a dead click — the browser navigates / downloads / opens a new window and we can't observe that. Reuses autocapture's existing DOM walker for the ancestor walk. Direct clicks on <button>, <input>, <select>, <textarea>, <label>, and <form> (previously all skipped) are now eligible for dead-click detection: if their JS handler ran, the existing mutation / scroll / selection observers see the effect; if it didn't, dead-click correctly surfaces the bug. A broken <button> with no handler, or an <svg> icon inside one, will now flag — which is exactly the dead-click case we want to catch.
(2026-05-18)
Updated dependencies [594ea11]:
- @posthog/types@1.374.0
- @posthog/core@1.29.3

`v1.373.5`

Compare Source

1.373.5

Patch Changes

#3613 221973e Thanks @lucasheriques! - Surveys: submit open text questions with Cmd/Ctrl+Enter. The textarea still inserts a newline on plain Enter (native behaviour), matching the convention used by Slack, GitHub, Discord, and ChatGPT for multi-line inputs. Single-line "Other:" inputs continue to submit on plain Enter as before.
(2026-05-15)
Updated dependencies []:
- @posthog/types@1.373.5
- @posthog/core@1.29.2

`v1.373.4`

Compare Source

1.373.4

Patch Changes

#3602 4b895bf Thanks @marandaneto! - Validate gzip request bodies at the browser send boundary and fall back to JSON if the outgoing body is not gzip data.
(2026-05-12)
Updated dependencies [4b895bf]:
- @posthog/core@1.29.1
- @posthog/types@1.373.4

`v1.373.3`

Compare Source

1.373.3

Patch Changes

Updated dependencies [ad60818]:
- @posthog/core@1.29.0
- @posthog/types@1.373.3

`v1.373.2`

Compare Source

1.373.2

Patch Changes

#3568 223d925 Thanks @marandaneto! - Validate native gzip output before sending requests and fall back when CompressionStream returns malformed data.
(2026-05-11)
Updated dependencies [223d925]:
- @posthog/core@1.28.7
- @posthog/types@1.373.2

`v1.373.1`

Compare Source

1.373.1

Patch Changes

#3566 7d027bc Thanks @dustinbyrne! - Prevent browser log capture from throwing when console arguments contain unreadable properties.
(2026-05-11)
Updated dependencies []:
- @posthog/types@1.373.1
- @posthog/core@1.28.6

`v1.373.0`

Compare Source

1.373.0

Minor Changes

#3547 4c0c7d9 Thanks @williamchong! - capture() now accepts an optional uuid on CaptureOptions.
(2026-05-11)

Patch Changes

#3561 3511848 Thanks @marandaneto! - Handle invalid persisted session replay config JSON gracefully
(2026-05-11)
#3559 0a835fa Thanks @marandaneto! - Skip remote config background refreshes when no document is available.
(2026-05-11)
Updated dependencies [4c0c7d9, 0a835fa]:
- @posthog/types@1.373.0
- @posthog/core@1.28.5

`v1.372.10`

Compare Source

1.372.10

Patch Changes

#3544 d120042 Thanks @ksvat! - fix: stop session recording before destroying sessionManager in opt_out_capturing() with cookieless_mode: "on_reject". Previously, queued/throttled rrweb events (e.g. mousemove) could fire after the sessionManager was set to undefined and throw [SessionRecording] must be started with a valid sessionManager. Also adds a defensive early-return in onRRwebEmit so any remaining late events bail out instead of throwing.
(2026-05-07)
#3542 94a5ba0 Thanks @TueHaulund! - Preserve <style> textContent when the browser's CSSOM serialization would
emit empty longhands from var() inside a shorthand. When a stylesheet has
e.g. padding: var(--p); padding-bottom: var(--pb);, browsers store the
shorthand's longhands with empty token lists per the CSS Custom Properties
spec, and CSSStyleRule.cssText re-emits them as padding-top: ; padding-right: ; padding-left: ;. The previous behavior replaced the
<style> text with that corrupted output, silently dropping layout rules
on replay. We now detect the empty-longhand pattern and keep the original
textContent in that case. Affects users of any CSS-in-JS framework that
combines var() with shorthands (Chakra UI v3, Panda CSS, Emotion, etc.).
Same class of bug as rrweb-io/rrweb#1667. (2026-05-07)
Updated dependencies []:
- @posthog/types@1.372.10
- @posthog/core@1.28.4

`v1.372.9`

Compare Source

1.372.9

Patch Changes

#3537 026e09d Thanks @TueHaulund! - Pull in the canvas-manager fix from @posthog/rrweb 0.0.61: skip canvas
snapshots while the WebGL context is lost so transparent bitmaps don't
poison the worker's fingerprint dedup map and silently kill canvas
recording for the rest of the session. Also wraps getCanvas() in
try/catch so DOM/shadow-root traversal errors can't cancel the rAF
loop. See PR #3527 for context. (2026-05-05)
Updated dependencies []:
- @posthog/types@1.372.9
- @posthog/core@1.28.3

`v1.372.8`

Compare Source

1.372.8

Patch Changes

#3515 255b273 Thanks @marandaneto! - Gate survey translation logs behind SDK debug logging to avoid production console spam.
(2026-05-04)
Updated dependencies [220cd61, 255b273]:
- @posthog/core@1.28.2
- @posthog/types@1.372.8

`v1.372.7`

Compare Source

1.372.7

Patch Changes

Updated dependencies [8aee3d5]:
- @posthog/core@1.28.1
- @posthog/types@1.372.7

`v1.372.6`

Compare Source

1.372.6

Patch Changes

#3492 cf56753 Thanks @lucasheriques! - Add translated survey rendering support in React Native and share survey translation logic through @posthog/core.
(2026-05-01)
Updated dependencies [cf56753, 04db756]:
- @posthog/core@1.28.0
- @posthog/types@1.372.6

`v1.372.5`

Compare Source

1.372.5

Patch Changes

#3448 c726aae Thanks @posthog! - fix(exceptions): avoid cross-origin property access when calling the previous window.onunhandledrejection handler
(2026-04-29)
Updated dependencies []:
- @posthog/types@1.372.5
- @posthog/core@1.27.9

`v1.372.4`

Compare Source

1.372.4

Patch Changes

#3495 5a6b2a5 Thanks @posthog! - Fix copy autocapture when copying or cutting text from Shadow DOM or document fragment contexts.
(2026-04-29)
Updated dependencies []:
- @posthog/types@1.372.4
- @posthog/core@1.27.8

`v1.372.3`

Compare Source

1.372.3

Patch Changes

#3488 5b8efc3 Thanks @lucasheriques! - Add browser survey translation rendering and language tracking.
(2026-04-27)
Updated dependencies []:
- @posthog/types@1.372.3
- @posthog/core@1.27.7

`v1.372.2`

Compare Source

1.372.2

Patch Changes

#3484 cba2570 Thanks @veryayskiy! - Fix autofocus
(2026-04-27)
Updated dependencies []:
- @posthog/types@1.372.2
- @posthog/core@1.27.6

`v1.372.1`

Compare Source

1.372.1

Patch Changes

#3464 70508df Thanks @dustinbyrne! - Avoid using Blob.stream() for native async gzip compression to prevent Safari NotReadableError stream failures.
(2026-04-24)
Updated dependencies [70508df]:
- @posthog/core@1.27.5
- @posthog/types@1.372.1

`v1.372.0`

Compare Source

1.372.0

Minor Changes

#3470 eaa1322 Thanks @veryayskiy! - You cannot write to a resolve ticket. Start a new one.
(2026-04-24)

Patch Changes

Updated dependencies []:
- @posthog/types@1.372.0
- @posthog/core@1.27.4

`v1.371.4`

Compare Source

1.371.4

Patch Changes

#3469 3c4fc1e Thanks @fasyy612! - bump rrweb to 0.0.60
(2026-04-24)
Updated dependencies []:
- @posthog/types@1.371.4
- @posthog/core@1.27.3

`v1.371.3`

Compare Source

1.371.3

Patch Changes

#3445 61cf83e Thanks @dustinbyrne! - Fix session recording in the full no-external browser bundles
(2026-04-24)
Updated dependencies [daf028d]:
- @posthog/core@1.27.2
- @posthog/types@1.371.3

`v1.371.2`

Compare Source

1.371.2

Patch Changes

#3453 96f19b7 Thanks @turnipdabeets! - Lift OTLP log serialization helpers from posthog-js into @posthog/core so the
upcoming React Native logs feature consumes the same builders. Browser gains
two fixes as a side effect: NaN and ±Infinity attribute values no longer get
silently dropped during JSON encoding, and the scope.version OTLP field is
now populated with the SDK version (changes the server's instrumentation_scope
column from "posthog-js@" to "posthog-js@"). (2026-04-23)
Updated dependencies [96f19b7]:
- @posthog/types@1.371.2
- @posthog/core@1.27.1

`v1.371.1`

Compare Source

1.371.1

Patch Changes

#3425 2da17e8 Thanks @marandaneto! - Classify SDK-owned persistence keys with an explicit event exposure policy so new internal persistence state must be intentionally marked as event-visible, hidden, or derived.
(2026-04-23)
Updated dependencies []:
- @posthog/types@1.371.1

`v1.371.0`

Compare Source

1.371.0

Patch Changes

#3432 1a8b727 Thanks @richardsolomou! - refactor: rename __add_tracing_headers to addTracingHeaders. The __ prefix signalled an internal/experimental option, but the config is a public API (documented for linking LLM traces to session replays). __add_tracing_headers continues to work as a deprecated alias on the browser SDK.

Also exposes patchFetchForTracingHeaders from @posthog/core so non-browser SDKs can reuse the implementation. (2026-04-23)
Updated dependencies [1a8b727]:
- @posthog/core@1.27.0
- @posthog/types@1.371.0

`v1.370.1`

Compare Source

1.370.1

Patch Changes

#3442 6f19ce8 Thanks @marandaneto! - fix(surveys): guard survey seen localStorage access
(2026-04-22)
Updated dependencies []:
- @posthog/types@1.370.1

`v1.370.0`

Compare Source

1.370.0

Minor Changes

#3389 922a1c1 Thanks @hpouillot! - Add exception steps to error tracking (aka breadcrumbs)
(2026-04-22)

Patch Changes

Updated dependencies [922a1c1]:
- @posthog/types@1.370.0
- @posthog/core@1.26.0

`v1.369.5`

Compare Source

1.369.5

Patch Changes

Updated dependencies [1a0b58d]:
- @posthog/core@1.25.3
- @posthog/types@1.369.5

`v1.369.4`

Compare Source

1.369.4

Patch Changes

#3362 d61bce1 Thanks @sampennington! - fix(cookieless): start in cookieless mode when opt_out_capturing_by_default is set
(2026-04-21)
Updated dependencies []:
- @posthog/types@1.369.4

`v1.369.3`

Compare Source

1.369.3

Patch Changes

#3419 ea08727 Thanks @haacked! - Reinstate $feature_flag_payloads and $surveys_activated in captured event properties.
(2026-04-18)
#3416 3d8b2e2 Thanks @feliperalmeida! - Updated dependencies: - protobufjs@7.5.5
(2026-04-18)
Updated dependencies []:
- @posthog/types@1.369.3

`v1.369.2`

Compare Source

1.369.2

Patch Changes

#3386 4a65604 Thanks @dustinbyrne! - Add a preview flag for versioned browser lazy bundle asset paths.
(2026-04-16)
Updated dependencies [4a65604]:
- @posthog/types@1.369.2

`v1.369.1`

Compare Source

1.369.1

Patch Changes

#3393 85ae4d9 Thanks @haacked! - Exclude active feature flag payloads from event properties
(2026-04-16)
#3392 00cd1ce Thanks @haacked! - Fix unnecessary persisted config and activation properties (including product tours, surveys, and session recording config) added to captured events
(2026-04-16)
Updated dependencies []:
- @posthog/types@1.369.1

`v1.369.0`

Compare Source

1.369.0

Minor Changes

#3342 eea5260 Thanks @ksvat! - Account for property filters on events in recording triggers for v2 triggers
(2026-04-14)
#3281 b1fd228 Thanks @ksvat! - Add session replay trigger groups handling (V2)
(2026-04-14)

Patch Changes

Updated dependencies []:
- @posthog/types@1.369.0

`v1.368.2`

Compare Source

1.368.2

Patch Changes

#3378 f1bea33 Thanks @marandaneto! - Disable native gzip compression after a NotReadableError in the browser SDK
(2026-04-14)
Updated dependencies []:
- @posthog/types@1.368.2

`v1.368.1`

Compare Source

1.368.1

Patch Changes

#3379 d7c71b1 Thanks @dmarticus! - Fix bootstrapped feature flags being overwritten by partial /flags response when advanced_only_evaluate_survey_feature_flags is enabled
(2026-04-14)
Updated dependencies []:
- @posthog/types@1.368.1

`v1.368.0`

Compare Source

1.368.0

Minor Changes

#3345 3fcf5c4 Thanks @jonmcwest! - Add posthog.captureLog() API for sending structured log entries to PostHog logs
(2026-04-13)

Patch Changes

#3373 f5fe0a8 Thanks @ksvat! - bump rrweb version
(2026-04-13)
Updated dependencies [3fcf5c4]:
- @posthog/types@1.368.0

`v1.367.0`

Compare Source

1.367.0

Minor Changes

#3242 353be9a Thanks @dustinbyrne! - feat: Add support for pre-loaded remote-config
(2026-04-09)

Patch Changes

Updated dependencies []:
- @posthog/types@1.367.0

`v1.366.2`

Compare Source

1.366.2

Patch Changes

#3364 575e354 Thanks @lucasheriques! - Add a hover state to numeric survey rating options so they provide clearer pointer feedback before selection.
(2026-04-09)
Updated dependencies []:
- @posthog/types@1.366.2

`v1.366.1`

Compare Source

1.366.1

Patch Changes

#3360 802bf39 Thanks @jabahamondes! - Re-evaluate consent persistent store when config changes to support cross-subdomain consent sharing
(2026-04-09)
Updated dependencies []:
- @posthog/types@1.366.1

`v1.366.0`

Compare Source

1.366.0

Minor Changes

#3305 b599672 Thanks @veryayskiy! - Add customer side identification
(2026-04-09)

Patch Changes

Updated dependencies []:
- @posthog/types@1.366.0

`v1.365.5`

Compare Source

1.365.5

Patch Changes

Updated dependencies [c735b08]:
- @posthog/core@1.25.2
- @posthog/types@1.365.5

`v1.365.4`

Compare Source

1.365.4

Patch Changes

#3353 3939856 Thanks @lucasheriques! - Expose the current question index on .survey-box via a data-question-index attribute. This gives consumers rendering surveys via the API a reliable way to know which question is currently displayed without parsing input ids or class names — works for every question type, including link questions which render no input or rating element.
(2026-04-08)
Updated dependencies []:
- @posthog/types@1.365.4

`v1.365.3`

Compare Source

1.365.3

Patch Changes

#3357 dbdddca Thanks @pauldambra! - Bump @posthog/rrweb packages to 0.0.56, which includes:
- PostHog/posthog-rrweb#157: fix: clear mutation buffer on iframe pagehide to prevent recording corruption
- PostHog/posthog-rrweb#158: fix: skip unchanged setAttribute calls to prevent replay flicker
- PostHog/posthog-rrweb#159: fix: prevent iframe leak in untainted prototype and avoid unnecessary iframe creation
- PostHog/posthog-rrweb#163: fix: handle SecurityError in IframeManager destroy and removeIframeById
- PostHog/posthog-rrweb#166: fix: remove postcss from @posthog/rrweb-record bundle (420KB → 170KB) (2026-04-08)
Updated dependencies []:
- @posthog/types@1.365.3

`v1.365.2`

Compare Source

1.365.2

Patch Changes

#3323 c387f6d Thanks @pauldambra! - perf(replay): reduce memory and CPU cost of event compression by caching gzipped empty arrays and eliminating redundant JSON.stringify for size estimation
(2026-04-08)
Updated dependencies [c387f6d]:
- @posthog/types@1.365.2

`v1.365.1`

Compare Source

1.365.1

Patch Changes

Updated dependencies [57ee5b2]:
- @posthog/core@1.25.1
- @posthog/types@1.365.1

`v1.365.0`

Compare Source

1.365.0

Minor Changes

#3302 fc5589f Thanks @dmarticus! - preserve $set_once semantics in local flag evaluation cache
(2026-04-07)

Patch Changes

Updated dependencies [fc5589f]:
- @posthog/core@1.25.0
- @posthog/types@1.365.0

`v1.364.7`

Compare Source

1.364.7

Patch Changes

#3319 b25b689 Thanks @dustinbyrne! - fix: send $groupidentify for new groups even when no properties are provided
(2026-04-03)
Updated dependencies []:
- @posthog/types@1.364.7

react/react (react)

`v19.2.8`: 19.2.8 (July 21st, 2026)

Compare Source

React Server Components

Performance improvements when decoding
(#37087 by @eps1lon)

`v19.2.7`

Compare Source

React Server Components

Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (@unstubbable #36566)

`v19.2.6`

Compare Source

React Server Components

Type hardening and performance improvements (@eps1lon, @unstubbable #36425)

`v19.2.5`

Compare Source

React Server Components

Add more cycle protections (@eps1lon, @unstubbable #36236)

omgovich/react-colorful (react-colorful)

`v5.8.0`

Compare Source

Shadow DOM support: the picker now injects its styles into the closest ShadowRoot when rendered inside one (via #232)

`v5.7.0`

Compare Source

Add onChangeEnd callback that fires when the user finishes changing a color (on mouse up, touch end, or arrow key up). Useful for undo/redo, saving to a database, or other expensive operations (via #230)

`v5.6.2`

Compare Source

Fix React 19 TypeScript compatibility (via #229)

dcastil/tailwind-merge (tailwind-merge)

`v3.6.0`

Compare Source

New Features

Add support for Tailwind CSS v4.3 by @dcastil in #677
- Add postfixLookupClassGroups option to config to support Tailwind utilities where a slash is part of the full class name, like named container queries
Add support for readonly array values by @unional in #652

Documentation

Fix broken links in README by @maurer2 in #662

Other

Harden internal CI pipeline security by omitting git checkout by @dcastil, suggested by @kyletaylored in 6b2499c

Full Changelog: https://github.com/dcastil/tailwind-merge/compare/v3.5.0...v3.6.0

Thanks to @brandonmcconnell, @manavm1990, @langy, @roboflow, @syntaxfm, @getsentry, @codecov, a private sponsor, @block, @openclaw, @sourcegraph, @mike-healy and more via @thnxdev for sponsoring tailwind-merge! ❤️

`v3.5.0`

Compare Source

New Features

Add support for Tailwind CSS v4.2 by @dcastil in #651

Full Changelog: https://github.com/dcastil/tailwind-merge/compare/v3.4.1...v3.5.0

Thanks to @brandonmcconnell, @manavm1990, @langy, @roboflow, @syntaxfm, @getsentry, @codecov, a private sponsor, @block, @openclaw, @sourcegraph and more via @thnxdev for sponsoring tailwind-merge! ❤️

`v3.4.1`

Compare Source

Bug Fixes

Prevent arbitrary font-family and font-weight from merging by @roneymoon in #635

Full Changelog: https://github.com/dcastil/tailwind-merge/compare/v3.4.0...v3.4.1

privatenumber/tsx (tsx)

`v4.23.1`

Compare Source

Bug Fixes

support tsImport after global preload (8d4ffc2)
watch: avoid clearing piped output (95d0672)
watch: treat script and dependency paths literally (79fddde)

Performance Improvements

index transform cache lazily (e818ad6)
load esbuild lazily in CLI (d067938)
map Node TypeScript formats directly (cdcc623)
use sync module hooks on Node v22.22.3+ (f8992f1)

This release is also available on:

npm package (@latest dist-tag)

`v4.23.0`

Compare Source

Bug Fixes

avoid redundant filesystem probes during module resolution (257bbbb), closes privatenumber/tsx#809

Features

add multi-scenario startup benchmark suite (c178197), closes privatenumber/tsx#809 #809 hi#signal privatenumber/tsx#145 #809

This release is also available on:

npm package (@latest dist-tag)

`v4.22.5`

Compare Source

Bug Fixes

isolate hook state per async module.register() registration (a305f36)

This release is also available on:

npm package (@latest dist-tag)

`v4.22.4`

Compare Source

Bug Fixes

resolve CommonJS directory requires inside dependencies (#803) (1ce8463)

This release is also available on:

npm package (@latest dist-tag)

`v4.22.3`

Compare Source

Bug Fixes

decode typed loader source (dce02fc)
preserve entrypoint with TypeScript preload hooks (68f72f3)

This release is also available on:

npm package (@latest dist-tag)

`v4.22.2`

Compare Source

Bug Fixes

preserve CJS JSON require in ESM hooks (35b700b)
preserve named exports from CommonJS TypeScript (11de737)
support module.exports require(esm) interop (cf8f199)

This release is also available on:

npm package (@latest dist-tag)

`v4.22.1`

Compare Source

Bug Fixes

resolve tsconfig path aliases containing a colon (#780) (6979f28)

This release is also available on:

npm package (@latest dist-tag)

`v4.22.0`

Compare Source

Features

upgrade esbuild to 0.28 (#789) (b29f6ee)

This release is also available on:

npm package (@latest dist-tag)

`v4.21.1`

Compare Source

Bug Fixes

support Node 20.11/21.2 import.meta paths (acf3d8f)
support Node.js 24.15.0 (c1d2d45)
support Node.js 26.1.0 and 25.9.0 (1d7e528)

This release is also available on:

npm package (@latest dist-tag)

microsoft/TypeScript (typescript)

`v6.0.3`: TypeScript 6.0.3

Compare Source

For release notes, check out the release announcement blog post.

Downloads are available on:

vitest-dev/vitest (vitest)

`v4.1.10`

Compare Source

🐞 Bug Fixes

browser: Check fs access in builtin commands [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in #10680 (5c18d)
vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4] - by @SveLil and @hi-ogawa in #10661 (bae52)

View changes on GitHub

`v4.1.9`

Compare Source

🐞 Bug Fixes

Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in #10546 (a5180)
browser:
- Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in #10555 (7fb29)
- Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in #10497 and #10556 (fbc62)
mocker:
- Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in #10548 (2c955)
pool:
- Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in #10543 and #10564 (934b0)

View changes on GitHub

`v4.1.8`

Compare Source

🐞 Bug Fixes

browser:
- Disable client cdp API when allowWrite/allowExec: false [backport to v4] - by @hi-ogawa and Codex in #10450 (e4067)
- Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4] - by @toxik and @Zelys-DFKH in #10474 (675b4)

View changes on GitHub

`v4.1.7`

Compare Source

🐞 Bug Fixes

runner: Limit concurrency per task branch in addition to per leaf callbacks (backport) - by @hi-ogawa in #10384 (4f0f2)

View changes on GitHub

`v4.1.6`

Compare Source

🐞 Bug Fixes

browser: Provide project reference in ToMatchScreenshotResolvePath - by @macarie and @sheremet-va in #10138 (31882)
Global sequence.concurrent: true with top-level test(..., { concurrent: false }) + depreacte sequential test API and options - by @hi-ogawa, Codex and @sheremet-va in #10196 (2847d)
browser: Simplify orchestrator otel carrier - by @hi-ogawa in #10285 (18af9)

🏎 Performance

Stringify diff objects only once - by @sheremet-va in #10276 (9f7b1)

View changes on GitHub

`v4.1.5`

Compare Source

🚀 Experimental Features

coverage: Istanbul to support instrumenter option - by @BartWaardenburg and @AriPerkkio in #10119 (0e0ff)

🐞 Bug Fixes

--project negation excludes browser instances - by @felamaslen in #10131 (9423d)
Project color label on html reporter - by @hi-ogawa in #10142 (596f7)
Fix vi.defineHelper called as object method - by @hi-ogawa in #10163 (122c2)
Alias agent reporter to minimal - by @sheremet-va in #10157 (663b9)
Respect diff config options in soft assertions - by @Copilot, sheremet-va and @sheremet-va in #8696 (9787d)
Respect diff config options in soft assertions " - by @sheremet-va in #8696 (7dc6d)
ast-collect: Recognize _vi_import prefix in static test discovery - by @Yejneshwar in #10129 (32546)
coverage: Descriptive error message when reports directory is removed during test run - by @DaveT1991 and @AriPerkkio in #10117 (14133)
snapshot: Increase default snapshot max output length - by @hi-ogawa and Codex in #10150 (21e66)
ui: Fix jsx/tsx syntax highlight - by @hi-ogawa in #10152 (f1b1f)
web-worker: Support MessagePort objects referenced inside postMessage data - by @whitphx and Claude Opus 4.6 (1M context) in #9927 and #10124 (7ad7d)
api: Make test-specification options writable - by @sheremet-va in #10154 (6abd5)

View changes on GitHub

`v4.1.4`

Compare Source

🚀 Experimental Features

coverage:
- Default to text reporter skipFull if agent detected - by @hi-ogawa in #10018 (53757)
experimental:
- Expose assertion as a public field - by @sheremet-va in #10095 (a120e)
- Support aria snapshot - by @hi-ogawa, Claude Opus 4.6 (1M context), @AriPerkkio, Codex and @sheremet-va in #9668 (d4fbb)
reporter:
- Add filterMeta option to json reporter - by @nami8824 and @sheremet-va in #10078 (b77de)

🐞 Bug Fixes

Use "black" foreground for labeled terminal message to ensure contrast - by @hi-ogawa in #10076 (203f0)
Make expect(..., message) consistent as error message prefix - by @hi-ogawa and Codex in #10068 (a1b5f)
Do not hoist imports whose names match class properties . - by @SunsetFi in #10093 and #10094 (0fc4b)
browser: Spread user server options into browser Vite server in project - by @GoldStrikeArch in #10049 (65c9d)

View changes on GitHub

`v4.1.3`

Compare Source

🚀 Experimental Features

Add experimental.preParse flag - by @sheremet-va in #10070 (78273)
Support browser.locators.exact option - by @sheremet-va in #10013 (48799)
Add TestAttachment.bodyEncoding - by @hi-ogawa in #9969 (89ca0)
Support custom snapshot matcher - by @hi-ogawa, Claude Sonnet 4.6 and Codex in #9973 (59b0e)

🐞 Bug Fixes

Advance fake timers with expect.poll interval - by @hi-ogawa and Claude Sonnet 4.6 in #10022 (3f5bf)
Add @vitest/coverage-v8 and @vitest/coverage-istanbul as optional dependency - by @alan-agius4 in #10025 (146d4)
Fix defineHelper for webkit async stack trace + update playwright 1.59.0 - by @hi-ogawa in #10036 (5a5fa)
Fix suite hook throwing errors for unused auto test-scoped fixture - by @hi-ogawa and Claude Sonnet 4.6 in #10035 (39865)
expect:
- Remove JestExtendError.context from verbose error reporting - by @hi-ogawa in #9983 (66751)
- Don't leak "runner" types - by @sheremet-va in #10004 (ec204)
snapshot:
- Fix flagging obsolete snapshots for snapshot properties mismatch - by @hi-ogawa and Claude Sonnet 4.6 in #9986 (6b869)
- Export custom snapshot matcher helper from vitest - by @hi-ogawa and Codex in #10042 (691d3)
ui:
- Don't leak vite types - by @sheremet-va in #10005 (fdff1)
vm:
- Fix external module resolve error with deps optimizer query - by @hi-ogawa and Claude Sonnet 4.6 in #10024 (9dbf4)

View changes on GitHub

colinhacks/zod (zod)

`v4.4.3`

Compare Source

Commits:

4c2fa95 docs: use Zernio primary wordmark for gold sponsor logo
2aeec83 docs: prune lapsed gold sponsors and rebalance logo sizing
7391be8 docs: prune lapsed silver/bronze sponsors and add active ones
2c70332 docs: normalize bronze sponsor logos to github avatar pattern
9195250 docs: remove Mintlify from bronze sponsors (churned)
b8dffe9 docs: remove Numeric and Speakeasy (2+ missed monthly cycles)
1cab693 fix(v4): restore catch handling for absent object keys (#5937) (#5939)
c2be4f8 fix(v4): generalize optin/fallback to transform; restore preprocess on absent keys (#5941)
f3c9ec0 4.4.3
1fb56a5 docs: document release procedure in AGENTS.md

`v4.4.2`

Compare Source

Commits:

0c62df0 Clean up docs navigation and stale labels (#5901)
20cc794 chore: add security policy and refresh tooling deps
6fbe07b fix(docs): heading anchor links now include the hash so it doesnt scoll all the way up, follows navbar logic (#5791)
4bbed1b Tighten discriminated union option typing
bbac3e5 Update PR guidance for agents
cf0dc94 Merge remote-tracking branch 'origin/main' into fix-discriminated-union-key-constraint
292c894 docs: add Zernio gold sponsor
1fc9f31 docs: document codec inversion
1373c85 docs: remove AI disclosure guidance
e20d02b chore: ignore triage notes
e58ea4d docs: test Zod Mini tab code heights
905761a docs: document preprocess input type narrowing
bf64bac chore: tighten test guidance in AGENTS.md
8ec4e73 chore: update play.ts scratch
02c2baf Make z.preprocess defer optionality to inner schema (#5929)
88015df fix(docs): drop deprecated baseUrl from tsconfig
c59d447 4.4.2

`v4.4.1`

Compare Source

Commits:

481f7be ci: gate release publishing on full test workflow
95ccab4 test(v3): restore optional undefined expectations
cede2c6 fix(v4): reject tuple holes before required defaults (#5900)
edd0bf0 release: 4.4.1
180d83d docs: remove Jazz featured sponsor

`v4.4.0`

Compare Source

4.4.0

This is a minor release with a wide set of correctness and soundness fixes. Some fixes intentionally make Zod stricter, so code that depended on previously accepted invalid or ambiguous inputs may need small updates.

Potentially breaking bug fixes

Tuple defaults now materialize output values correctly

Fixed in #5661. Tuple parsing now more accurately reflects defaults, optional tails, explicit undefined, and under-filled inputs. The headline behavior is that defaults in tuple positions now properly appear in parsed output.

const schema = z.tuple([
  z.string(),
  z.string().default("fallback"),
]);

schema.parse(["a"]);
// ["a", "fallback"]

Trailing optional elements that are absent still stay absent; they are not filled with undefined.

const schema = z.tuple([
  z.string(),
  z.string().optional(),
]);

schema.parse(["a"]);
// ["a"]

But explicit undefined values supplied by the caller are preserved.

schema.parse(["a", undefined]);
// ["a", undefined]

When optional elements appear before later defaults, the parsed tuple is now dense so array operations behave predictably.

const schema = z.tuple([
  z.string(),
  z.string().optional(),
  z.string().default("fallback"),
]);

schema.parse(["a"]);
// ["a", undefined, "fallback"]

Tuple length errors are also more consistent now. Since z.function() arguments are tuple-shaped, function input errors may look different.

Required object properties with `z.undefined()`

Fixed in #5661, with follow-up coverage in 57d80a82. A property whose schema is z.undefined() is now treated as required. The key must be present, but its value may be undefined.

const schema = z.object({
  value: z.undefined(),
});

schema.safeParse({}).success;
// false

schema.safeParse({ value: undefined }).success;
// true

Use .optional() when the key itself may be absent.

const schema = z.object({
  value: z.undefined().optional(),
});

schema.safeParse({}).success;
// true

This also affects related .catch(), .partial(), .default(), and .prefault() combinations that previously relied on missing z.undefined() keys being treated as optional.

Safer `.merge()` behavior with refinements

Fixed in #5856. The .merge() method now throws when the receiver has refinements, rather than silently producing ambiguous refinement behavior. Refinements from the second schema are preserved.

const a = z.object({ a: z.string() }).refine((val) => val.a.length > 0);
const b = z.object({ b: z.string() });

a.merge(b);
// throws

Prefer .extend() or .safeExtend() for object composition. The .merge() method is still supported for compatibility, but it is discouraged for new code because its semantics around overlapping keys and refinements are easier to misread.

JSON Schema `$defs` entries no longer include redundant `id`

Fixed in #5759. JSON Schema conversion through z.toJSONSchema() now strips redundant id fields from $defs entries. This is required for correctness in older JSON Schema dialects from before $id was introduced: in those dialects, id changes the resolution scope, so leaving it inside an extracted definition can make references resolve incorrectly. The removed value was redundant because the schema had already been extracted into $defs, so the definition key itself is the identifier. This may affect consumers that were reading those internal id fields directly.

Other JSON Schema fixes in this release:

Draft-04/OpenAPI 3.0 min/max intersections: #5700
Recursive lazy schemas with .describe(): #5797
Falsy prefault values emitted as defaults: #5893
CUID pattern output tightened: #5880

String validators are stricter

Base64 validation now rejects whitespace instead of allowing atob()-style whitespace stripping. Fixed in #5888.

z.base64().safeParse("Zm9v").success;
// true

z.base64().safeParse("Zm 9v").success;
// false

Other string validator changes:

CUID validation through z.cuid() has been tightened, and CUID v1 is now deprecated. Fixed in #5880.
HTTP URL validation through z.httpUrl() now rejects malformed HTTP(S) URLs with a missing slash after the protocol. The underlying URL constructor normalizes inputs like https:/example.com, but Zod now rejects them instead of accepting the repaired URL. Fixed in #5672, related to #5284.

z.httpUrl().safeParse("https://example.com").success;
// true

z.httpUrl().safeParse("https:/example.com").success;
// false

z.httpUrl().safeParse("http:/www.apple.com").success;
// false

Union paths are fixed in formatted errors

Two union-related error fixes landed:

Nested union paths are now preserved correctly in the output of z.treeifyError() and z.formatError(). Fixed in #5708 and 60ff3987.
Invalid discriminated union errors now include discriminator options and improved messages. Fixed in #5723. This may affect users snapshotting ZodError output.

Other fixes

Record key transforms now run

Fixed in #5891. Record schemas now run transforms on record keys.

const schema = z.record(
  z.string().transform((key) => key.toUpperCase()),
  z.number()
);

schema.parse({ foo: 1 });
// { FOO: 1 }

Related record fixes:

Key refinement failures now surface as structured invalid_key issues. Fixed in #5719.
Non-enumerable properties are skipped more consistently. Fixed in #5719.
The v3-style single-argument z.record(valueType) form works again. Fixed in 0e960108.

Metadata and input handling in `fromJSONSchema()`

Schema generation from JSON Schema now applies metadata more consistently across enum, const, not, anyOf, and multi-type schemas. Fixed in #5758. It also rejects or normalizes more non-JSON-like inputs, including cyclic objects and BigInt. Fixed in 87cf0f93.

Codecs

Codec changes:

Encoding through z.discriminatedUnion().encode() now works when the discriminator uses a codec. Fixed in #5769.
Codec inversion was added in #5770.

const stringToNumber = z.codec(
  z.string(),
  z.number(),
  {
    decode: Number,
    encode: String,
  }
);

const numberToString = z.invertCodec(stringToNumber);

Transform context

Transform callbacks now support ctx.addIssue(). Fixed in #5699.

Conditional `.superRefine()` with `when`

The when option was added for .superRefine(). Added in #5741, with related abort behavior fixed in #5681.

Defaults for `Map` and `Set`

Defaults for Map and Set are now cloned instead of shared across parses. Fixed in #5855.

const schema = z.map(z.string(), z.number()).default(new Map());

const a = schema.parse(undefined);
const b = schema.parse(undefined);

a === b;
// false

Empty unions

Empty z.union([]), z.xor([]), and discriminated unions no longer crash at construction time. They construct and fail at parse time. Fixed in #5869.

Floating-point multiples

Number multipleOf() / step() validation is more accurate for decimal and exponent edge cases. Fixed in #5687 and #5793.

Global config and `jitless`

Configuration fixes:

Global configuration is now shared through globalThis, improving behavior across mixed CJS/ESM module instances. Fixed in #5889.
Jitless mode now avoids eval probing when set before first access. Fixed in #5864.

Prototype pollution hardening

Object catchall paths now skip __proto__ keys. Fixed in #5898.

Performance improvements

Reduced memory usage from lazy-bound methods

Fixed in #5897. Classic builder methods are now lazy-bound through a shared internal prototype instead of eagerly attached per schema instance. This significantly reduces per-schema method allocation overhead, especially in codebases that construct many schemas. Detached methods continue to work:

const schema = z.string();
const optional = schema.optional;

optional.call(schema);
// still works

Improved tree-shaking

Implemented in 195e8696 and #5689. Top-level factory calls are annotated as pure, and generated stub package manifests now include sideEffects: false. This gives bundlers more room to remove unused Zod code.

This is intended as the conclusive fix for a long-standing class of tree-shaking and bundle-size issues, especially in Next.js and Turbopack projects. The most visible symptom was that unused validators and locales could survive bundling even when importing from zod/mini or from a narrow subpath.

Related reports include:

Next.js and Turbopack tree-shaking reports: #4433, #5641, #5095, #4810
Locale and zod/mini bundle-size reports: #5561, #5665, #4369, #4572
Broader v4 bundle-size reports: #2596, #4637, #4798, #5206

{
  "sideEffects": false
}

Locales

Added or updated locale support:

Croatian: #5610
Greek: #5840
Romanian: #5657
Uzbek map support: #5599
Georgian translation fix: #5655
French issue origin translations: #5845
Italian validation message updates: #5852

Locale message text changed in some cases, which may affect snapshots.

Closed issues

The following issues were closed by PRs included in this release:

Closed #5466 via #5632: preserve context immutability in parse functions.
Closed #5617 via #5655: correct Georgian translation for string.
Closed #5619 via #5657: add Romanian locale.
Closed #5229 via #5661: align object and tuple optionality handling.
Closed #5680 via #5681: respect abort: true in .refine() checks with when.
Closed #5678 via #5699: add missing addIssue to transform context.
Closed #5717 via #5718: avoid delete in finalizeIssue.
Closed #5714 via #5719: skip non-enumerable properties in record validation.
Closed #5670 via #5723: add discriminator options to invalid discriminator errors.
Closed #5743 via #5744: increase timeout for the datetime ReDoS checker test.
Closed #5732 via #5758: apply description and default metadata in fromJSONSchema().
Closed #5731 via #5759: strip redundant id from $defs entries in JSON Schema output.
Closed #5605 via #5763: update z.custom() docs for v4 compatibility.
Closed #5593 via #5769: support discriminatedUnion().encode() with codec discriminators.
Closed #5625 via #5770: add codec inversion.
Closed #5778 via #5779: add custom docs 404 page.
Closed #5792 via #5793: correct floating-point multipleOf() validation.
Closed #5777 via #5797: resolve recursive lazy JSON Schema stack overflow.
Closed #5805 via #5812: fix self-referencing schema docs.
Closed #5826 via #5855: clone Map and Set defaults.
Closed #5842 via #5856: align .merge() refinement semantics with .extend().
Closed #4461 and #5414 via #5864: honor jitless config in the eval probe.
Closed #5868 via #5869: handle empty z.union([]) and z.xor([]).
Closed #5296 via #5891: apply key schema transforms in z.record().
Closed #5824 via #5893: emit falsy prefault values in JSON Schema output.

Commits

Commit 44f6a03e fix(locales): correct Georgian translation for 'string' to 'ველი' (#5655) by @tushargr0ver
Commit 7b43bc64 docs(ecosystem): add Hono Takibi (#5651) by @nakita628
Commit 119376b9 feat: add map support to Uzbek locale (#5599) by @uchkunr
Commit 8fbf701e test: add edge case tests for boundary values (#5601) by @uchkunr
Commit f1f93c2b Fix order of brand method examples in api.mdx (#5604) by @onurtemiz
Commit 10105ee4 docs: Fix typos in json-schema documentation (#5608) by @SaKaNa-Y
Commit 2d367139 feat: add hr translation (#5610) by @vuki656
Commit 54902cb7 chore: update pullfrog.yml workflow
Commit 89ba70f2 chore: add sideEffects false to stub package.json for tree-shaking (#5689) by @jesse-holden
Commit eaa3c2c3 Update positive checks to use alias .gt(0) in the docs (#5671) by @Fredkiss3
Commit 65f1f404 fix typo (#5676) by @Nikita0x
Commit 5b574501 fix: respect abort: true in .refine() for checks with when function (#5681)
Commit 539de140 docs: fix README links for async refinements/transforms (#5682) by @pavan-sh
Commit 46cd10e7 docs: fix README anchor links for async APIs (#5683) by @pavan-sh
Commit 55747b3c Remove deprecated downlevelIteration option (#5684) by @RyanCavanaugh
Commit 3a818de1 fix(v4): handle multi-digit exponents in floatSafeRemainder (#5687) by @shakecodeslikecray
Commit 3cd45ebc fix(v4): add strict validation to httpUrl() (#5672) by @LuckySilver0021
Commit 7d98c909 add Sanity as silver sponsor and Mintlify as bronze sponsor
Commit c7805073 move Sanity and Mintlify to top of sponsor lists
Commit bee2dc8d docs: move z.iso.time() from format to pattern section (#5696)
Commit 2f8414bc fix: add missing addIssue to transform context (#5699) by @F-A-N-D-E
Commit d3c0ec87 docs: add note about removed .errors alias in v4 changelog (#5705) by @togami2864
Commit fa338a3b fix(v4): JSON schema min/max intersection for draft-04 and openapi-3.0 (#5700) by @ebroder
Commit 3473b288 chore: bump zshy to ^0.7.1
Commit cc8f9b7c docs: improve README wording and fix typos (#5736) by @vedanshshetti
Commit f5336717 feat: add json-up to ecosystem (#5740) by @mrspence
Commit 60ff3987 fix(v4): preserve parent path when treeifying nested union/key/element issues
Commit 08b14b51 perf: avoid delete in finalizeIssue to keep V8 fast mode (#5718)
Commit 9cf868d2 fix(v4): treeify error nested union bug (#5708) by @dstashevskyi
Commit 28f39a6d Add JSONType export (#5709) by @RobinVdBroeck
Commit 65fab33e feat: allow when parameter in .superRefine() (#5741) by @vilvai
Commit 7f87df1e refactor(v4): remove unnecessary type assertions (#5720) by @chisaki66
Commit 518f15dd Preprocess is not deprecated (#5721) by @mxdvl
Commit 2e5b23dc fix: add options to invalid discriminator errors (#5723) by @Danielchinasa
Commit 7f789def fix: skip non-enumerable properties in record validation (#5719) by @veeceey
Commit ee15fa19 docs: add AGENTS notes for JSDoc, PR comments, and PR worktree workflow
Commit f52b4d28 Revert "docs: improve README wording and fix typos (#5736)"
Commit ddb41391 test: increase timeout for redos checker in datetime.test.ts (#5744) by @rishadaufa
Commit bc07e459 docs: fix doc (#5745) by @xgaia
Commit e06af5de Update Hey API description (#5748) by @mrlubos
Commit 28c156e2 fix: apply description and default metadata to enum, const, and not schemas in fromJSONSchema (#5758) by @mibragimov
Commit f457edf1 Fix grammar in CONTRIBUTING.md (#5765) by @siekmang
Commit 411f6c64 fix(v4): resolve stack overflow in toJSONSchema for recursive lazy with describe (#5797) by @Hassad674
Commit 45dd421e docs: add tone guidelines for issue and PR comments to AGENTS.md
Commit ddd20a30 test: align optional property assertions with actual inferred types
Commit a1cf8a93 docs: update z.custom example for v4 compatibility (#5763) by @andrewdamelio
Commit b6a3b336 fix: strip redundant id from $defs entries in toJSONSchema (#5759) by @mibragimov
Commit c7a8ccc0 fix: discriminatedUnion encode() with codec discriminator (#5769) by @mahmoodhamdi
Commit 87cf0f93 fix(fromJSONSchema): normalize input via JSON round-trip
Commit 7163e6f2 feat: add .invert() method to ZodCodec (#5770) by @mahmoodhamdi
Commit b59b9b13 fix: replace .default with .prefault (#5776) by @alanskovrlj
Commit 93bba686 docs: add Zod AOT to ecosystem page (#5806) by @wakita181009
Commit 2564caa4 fix(docs): add custom 404 page with proper theme support (#5779) by @WolfieLeader
Commit 5b7ed214 fix: correct multipleOf float validation using tolerance-based comparison (#5793) by @cyphercodes
Commit cc9139d2 docs: fix self-referencing schema in refine when() example (#5812) by @claygeo
Commit 0e960108 fix(v4): support v3-style single-arg z.record(valueType)
Commit 41b25af9 docs(agents): refine PR comment tone guidance
Commit 4c03c20d Update Italian locale error messages for validation (#5852) by @pastorello
Commit 37ac1ba0 fix(fr): translate issue.origin in too_big/too_small errors (#5845) by @Ouaziz-chedli
Commit 345be203 docs: add validex to ecosystem (#5848) by @chiptoma
Commit 3c1f32bd feat(locales/en): handle instanceof and add comprehensive locale tests
Commit 888e52bb feat(locales): add Greek (el) locale (#5840) by @saileshbro
Commit bf6d99ed Revert "feat(locales/en): handle instanceof and add comprehensive locale tests"
Commit e8196a8d fix(resolution): align expected fr message with translated locale
Commit b6b12882 correct logic for validating length (#5843) by @nameearly
Commit 34f60159 fix(v4): clone Map and Set in shallowClone to prevent shared state across .default() parses (#5855) by @artur-seppa
Commit 91a7d0d1 fix(v4): reject whitespace in z.base64() to close atob bypass
Commit 23edf484 Revert "fix(v4): reject whitespace in z.base64() to close atob bypass"
Commit 15cafa13 fix(v4): throw on .merge() receiver with refinements; preserve refinements from second schema (#5856) by @solssak
Commit 584b1089 fix(v4): reject whitespace in z.base64() to close atob bypass (#5888) by @colinhacks
Commit b9b62c65 fix(core): honour jitless config in allowsEval probe (#5864) by @dokson
Commit fffe99bd fix(v4): construct empty unions instead of crashing (#5869) by @tjenkinson
Commit 285bde7f feat(core): share globalConfig across module systems via globalThis (#5889) by @colinhacks
Commit 195e8696 perf(v4): mark top-level factory calls as /*@__PURE__*/ for tree-shaking
Commit 61d7bedb fix(v4): apply key schema transforms in z.record() (#5891) by @colinhacks
Commit 45acd2ad ci(release): switch to npm trusted publishing via OIDC (#5890) by @colinhacks
Commit 476ae243 Tighten cuid() regex and deprecate CUID v1 (#5880) by @colinhacks
Commit 6217527e docs(agents): document push-to-main footgun and version-bump rule (#5883) by @colinhacks
Commit 757f0b0f fix(v4): apply util.Writeable in strictObject/looseObject for shape display parity (#5882) by @colinhacks
Commit fa4a3740 fix(v4): apply util.Writeable in mini object constructors and extend/safeExtend/partial/required (#5895) by @colinhacks
Commit ebc8287c fix(v4): emit falsy prefault values in toJSONSchema (#5893) by @mixelburg
Commit 8fcb71a5 perf(v4): lazy-bind builder methods to shared internal prototype (#5897) by @colinhacks
Commit 76e8f706 fix(v4): skip __proto__ key in object catchall (#5898) by @colinhacks
Commit f0b0608e ecosystem: eslint-plugin-zod-x is eslint-plugin-zod now (#5637) by @marcalexiei
Commit 0b5c3bc2 docs: fix refinements examples in api.mdx (#5649) by @playoffthecuff
Commit 327e152e docs(agents): refine PR comment tone guidance further
Commit 57d80a82 test(v4): pin object/tuple key optionality through optout propagation
Commit f19860f1 fix: preserve context immutability in parse functions (#5632) by @bgk614
Commit ec979ad7 feat: add Romanian (ro) locale (#5657) by @tushargr0ver
Commit b6066b3e fix(v4): align object and tuple optionality handling (#5661) by @Cyjin-jani
Commit ad0b8271 ci: update release workflow for trusted publishing
Commit 6db607be fix(release): keep JSR manifest publishable
Commit f778e02a build: bump zshy for JSR wildcard exports

Configuration

📅 Schedule: (in timezone Europe/Berlin)

Branch creation
- "before 6am on monday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@biomejs/biome](https://biomejs.dev) ([source](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome)) | [`2.4.10` → `2.5.5`](https://renovatebot.com/diffs/npm/@biomejs%2fbiome/2.4.10/2.5.5) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@biomejs%2fbiome/2.5.5?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@biomejs%2fbiome/2.4.10/2.5.5?slim=true) | | [@clerk/ui](https://github.com/clerk/javascript) ([source](https://github.com/clerk/javascript/tree/HEAD/packages/ui)) | [`1.3.0` → `1.25.7`](https://renovatebot.com/diffs/npm/@clerk%2fui/1.3.0/1.25.7) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@clerk%2fui/1.25.7?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@clerk%2fui/1.3.0/1.25.7?slim=true) | | [@hono/zod-validator](https://github.com/honojs/middleware) ([source](https://github.com/honojs/middleware/tree/HEAD/packages/zod-validator)) | [`^0.7.6` → `^0.9.0`](https://renovatebot.com/diffs/npm/@hono%2fzod-validator/0.7.6/0.9.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@hono%2fzod-validator/0.9.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@hono%2fzod-validator/0.7.6/0.9.0?slim=true) | | [@scalar/nextjs-api-reference](https://github.com/scalar/scalar) ([source](https://github.com/scalar/scalar/tree/HEAD/integrations/nextjs)) | [`^0.9.18` → `^0.11.0`](https://renovatebot.com/diffs/npm/@scalar%2fnextjs-api-reference/0.9.26/0.11.11) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@scalar%2fnextjs-api-reference/0.11.11?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@scalar%2fnextjs-api-reference/0.9.26/0.11.11?slim=true) | | [@tailwindcss/postcss](https://tailwindcss.com) ([source](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss)) | [`4.1.18` → `4.3.3`](https://renovatebot.com/diffs/npm/@tailwindcss%2fpostcss/4.1.18/4.3.3) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@tailwindcss%2fpostcss/4.3.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@tailwindcss%2fpostcss/4.1.18/4.3.3?slim=true) | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node) ([source](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)) | [`25.2.0` → `25.9.5`](https://renovatebot.com/diffs/npm/@types%2fnode/25.2.0/25.9.5) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@types%2fnode/25.9.5?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@types%2fnode/25.2.0/25.9.5?slim=true) | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node) ([source](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)) | [`22.19.10` → `22.20.1`](https://renovatebot.com/diffs/npm/@types%2fnode/22.19.10/22.20.1) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@types%2fnode/22.20.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@types%2fnode/22.19.10/22.20.1?slim=true) | | [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/react) ([source](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react)) | [`19.2.14` → `19.2.17`](https://renovatebot.com/diffs/npm/@types%2freact/19.2.14/19.2.17) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@types%2freact/19.2.17?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@types%2freact/19.2.14/19.2.17?slim=true) | | [autoprefixer](https://github.com/postcss/autoprefixer) | [`10.4.24` → `10.5.4`](https://renovatebot.com/diffs/npm/autoprefixer/10.4.24/10.5.4) | ![age](https://developer.mend.io/api/mc/badges/age/npm/autoprefixer/10.5.4?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/autoprefixer/10.4.24/10.5.4?slim=true) | | [binpackingjs](https://github.com/olragon/binpackingjs) | [`3.0.2` → `3.1.0`](https://renovatebot.com/diffs/npm/binpackingjs/3.0.2/3.1.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/binpackingjs/3.1.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/binpackingjs/3.0.2/3.1.0?slim=true) | | [concurrently](https://github.com/open-cli-tools/concurrently) | [`9.2.1` → `9.2.4`](https://renovatebot.com/diffs/npm/concurrently/9.2.1/9.2.4) | ![age](https://developer.mend.io/api/mc/badges/age/npm/concurrently/9.2.4?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/concurrently/9.2.1/9.2.4?slim=true) | | [convex](https://convex.dev) ([source](https://github.com/get-convex/convex-backend/tree/HEAD/npm-packages/convex)) | [`1.39.1` → `1.42.3`](https://renovatebot.com/diffs/npm/convex/1.39.1/1.42.3) | ![age](https://developer.mend.io/api/mc/badges/age/npm/convex/1.42.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/convex/1.39.1/1.42.3?slim=true) | | [discord.js](https://discord.js.org) ([source](https://github.com/discordjs/discord.js/tree/HEAD/packages/discord.js)) | [`14.25.1` → `14.27.0`](https://renovatebot.com/diffs/npm/discord.js/14.25.1/14.27.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/discord.js/14.27.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/discord.js/14.25.1/14.27.0?slim=true) | | [fuse.js](http://fusejs.io) ([source](https://github.com/krisk/Fuse)) | [`7.1.0` → `7.5.0`](https://renovatebot.com/diffs/npm/fuse.js/7.1.0/7.5.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/fuse.js/7.5.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/fuse.js/7.1.0/7.5.0?slim=true) | | [jimp](https://github.com/jimp-dev/jimp) | [`1.6.0` → `1.6.1`](https://renovatebot.com/diffs/npm/jimp/1.6.0/1.6.1) | ![age](https://developer.mend.io/api/mc/badges/age/npm/jimp/1.6.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/jimp/1.6.0/1.6.1?slim=true) | | [lucide-react](https://lucide.dev) ([source](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react)) | [`^0.563.0` → `^0.577.0`](https://renovatebot.com/diffs/npm/lucide-react/0.563.0/0.577.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/lucide-react/0.577.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/lucide-react/0.563.0/0.577.0?slim=true) | | [motion](https://github.com/motiondivision/motion) | [`12.38.0` → `12.42.2`](https://renovatebot.com/diffs/npm/motion/12.38.0/12.42.2) | ![age](https://developer.mend.io/api/mc/badges/age/npm/motion/12.42.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/motion/12.38.0/12.42.2?slim=true) | | [pixelmatch](https://github.com/mapbox/pixelmatch) | [`7.1.0` → `7.2.0`](https://renovatebot.com/diffs/npm/pixelmatch/7.1.0/7.2.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/pixelmatch/7.2.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/pixelmatch/7.1.0/7.2.0?slim=true) | | [posthog-js](https://posthog.com/docs/libraries/js) ([source](https://github.com/PostHog/posthog-js)) | [`1.364.6` → `1.407.0`](https://renovatebot.com/diffs/npm/posthog-js/1.364.6/1.407.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/posthog-js/1.407.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/posthog-js/1.364.6/1.407.0?slim=true) | | [react](https://react.dev/) ([source](https://github.com/react/react/tree/HEAD/packages/react)) | [`19.2.4` → `19.2.8`](https://renovatebot.com/diffs/npm/react/19.2.4/19.2.8) | ![age](https://developer.mend.io/api/mc/badges/age/npm/react/19.2.8?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/react/19.2.4/19.2.8?slim=true) | | [react-colorful](https://omgovich.github.io/react-colorful) ([source](https://github.com/omgovich/react-colorful)) | [`5.6.1` → `5.8.0`](https://renovatebot.com/diffs/npm/react-colorful/5.6.1/5.8.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/react-colorful/5.8.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/react-colorful/5.6.1/5.8.0?slim=true) | | [react-dom](https://react.dev/) ([source](https://github.com/react/react/tree/HEAD/packages/react-dom)) | [`19.2.4` → `19.2.8`](https://renovatebot.com/diffs/npm/react-dom/19.2.4/19.2.8) | ![age](https://developer.mend.io/api/mc/badges/age/npm/react-dom/19.2.8?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/react-dom/19.2.4/19.2.8?slim=true) | | [tailwind-merge](https://github.com/dcastil/tailwind-merge) | [`3.4.0` → `3.6.0`](https://renovatebot.com/diffs/npm/tailwind-merge/3.4.0/3.6.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/tailwind-merge/3.6.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/tailwind-merge/3.4.0/3.6.0?slim=true) | | [tailwindcss](https://tailwindcss.com) ([source](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss)) | [`4.1.18` → `4.3.3`](https://renovatebot.com/diffs/npm/tailwindcss/4.1.18/4.3.3) | ![age](https://developer.mend.io/api/mc/badges/age/npm/tailwindcss/4.3.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/tailwindcss/4.1.18/4.3.3?slim=true) | | [tsx](https://tsx.hirok.io) ([source](https://github.com/privatenumber/tsx)) | [`4.21.0` → `4.23.1`](https://renovatebot.com/diffs/npm/tsx/4.21.0/4.23.1) | ![age](https://developer.mend.io/api/mc/badges/age/npm/tsx/4.23.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/tsx/4.21.0/4.23.1?slim=true) | | [typescript](https://www.typescriptlang.org/) ([source](https://github.com/microsoft/TypeScript)) | [`6.0.2` → `6.0.3`](https://renovatebot.com/diffs/npm/typescript/6.0.2/6.0.3) | ![age](https://developer.mend.io/api/mc/badges/age/npm/typescript/6.0.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/typescript/6.0.2/6.0.3?slim=true) | | [vitest](https://vitest.dev) ([source](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest)) | [`4.1.2` → `4.1.10`](https://renovatebot.com/diffs/npm/vitest/4.1.2/4.1.10) | ![age](https://developer.mend.io/api/mc/badges/age/npm/vitest/4.1.10?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vitest/4.1.2/4.1.10?slim=true) | | [zod](https://zod.dev) ([source](https://github.com/colinhacks/zod)) | [`4.3.6` → `4.4.3`](https://renovatebot.com/diffs/npm/zod/4.3.6/4.4.3) | ![age](https://developer.mend.io/api/mc/badges/age/npm/zod/4.4.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/zod/4.3.6/4.4.3?slim=true) | --- ### Release Notes <details> <summary>biomejs/biome (@biomejs/biome)</summary> ### [`v2.5.5`](https://github.com/biomejs/biome/blob/HEAD/packages/@biomejs/biome/CHANGELOG.md#255) [Compare Source](https://github.com/biomejs/biome/compare/@biomejs/biome@2.5.4...@biomejs/biome@2.5.5) ##### Patch Changes - [#10972](https://github.com/biomejs/biome/pull/10972) [`ab8c21b`](https://github.com/biomejs/biome/commit/ab8c21b35e81708276e4283a4a0ff86ea815e345) Thanks [@ematipico](https://github.com/ematipico)! - Fixed [`useExhaustiveSwitchCases`](https://biomejs.dev/linter/rules/use-exhaustive-switch-cases/) for unions of bigint literals. The rule now reports missing bigint cases and compares bigint literals by value, including binary, octal, hexadecimal, and separator-containing spellings. For example, this switch now reports the missing `2n` case: ```ts declare const value: 1n | 2n; switch (value) { case 1n: break; } ``` - [#10972](https://github.com/biomejs/biome/pull/10972) [`ab8c21b`](https://github.com/biomejs/biome/commit/ab8c21b35e81708276e4283a4a0ff86ea815e345) Thanks [@ematipico](https://github.com/ematipico)! - Fixed false positives in [`noBaseToString`](https://biomejs.dev/linter/rules/no-base-to-string/) and [`useNullishCoalescing`](https://biomejs.dev/linter/rules/use-nullish-coalescing/) when member, stringification, or nullish inference cannot complete. These rules now suppress diagnostics instead of reporting from partial type information. For example, neither expression is reported when a recursive type cannot be fully resolved: ```ts type Recursive = Recursive; declare const value: Recursive; String(value); value || "fallback"; ``` - [#10977](https://github.com/biomejs/biome/pull/10977) [`0bf7486`](https://github.com/biomejs/biome/commit/0bf748653e488d0b959d39847641438cdb28188b) Thanks [@ematipico](https://github.com/ematipico)! - Fixed [#10922](https://github.com/biomejs/biome/issues/10922): the action [`useSortedAttributes`](https://biomejs.dev/assist/actions/use-sorted-attributes/) no longer triggers for HTML instructions. - [#10957](https://github.com/biomejs/biome/pull/10957) [`cf263c4`](https://github.com/biomejs/biome/commit/cf263c4700e9f24115e541d1f142934a9b2d878f) Thanks [@dyc3](https://github.com/dyc3)! - Fixed [`noThenProperty`](https://biomejs.dev/linter/rules/no-then-property/) failing to detect `Object.fromEntries`, `Object.defineProperty`, and `Reflect.defineProperty` calls with comments between their tokens. - [#10983](https://github.com/biomejs/biome/pull/10983) [`edc0ed7`](https://github.com/biomejs/biome/commit/edc0ed738ab8da3d512d527196684bd668090854) Thanks [@ayaangazali](https://github.com/ayaangazali)! - Fixed [#10980](https://github.com/biomejs/biome/issues/10980): [`useAriaPropsSupportedByRole`](https://biomejs.dev/linter/rules/use-aria-props-supported-by-role/) no longer reports false positives when the attribute that determines an element's implicit ARIA role is written as a shorthand attribute, such as `<a {href} aria-label="...">` in Astro and Svelte files. Shorthand attributes are now taken into account when computing the implicit role, so the anchor above correctly resolves to the `link` role instead of `generic`. - [#10889](https://github.com/biomejs/biome/pull/10889) [`89526e3`](https://github.com/biomejs/biome/commit/89526e3858c437408ec9ff192c35a866ad991d1b) Thanks [@denbezrukov](https://github.com/denbezrukov)! - Fixed CSS formatter casing for syntax-owned names while preserving author-defined names, including scoped keyframes and container scroll-state queries. ```diff - A:HOVER { COLOR: INITIAL; } + A:hover { color: initial; } - @KEYFRAMES :GLOBAL KeepFrames { FROM { COLOR: RED; } } + @keyframes :GLOBAL KeepFrames { from { color: RED; } } - @CONTAINER scroll-state((SCROLLED: TOP) AND (STUCK)) { A:HOVER { COLOR: RED; } } + @container scroll-state((SCROLLED: TOP) AND (STUCK)) { A:hover { color: RED; } } ``` - [#10964](https://github.com/biomejs/biome/pull/10964) [`794ccd0`](https://github.com/biomejs/biome/commit/794ccd0528345c4eaa87af1d86f02475277a0a22) Thanks [@denbezrukov](https://github.com/denbezrukov)! - Fixed CSS formatting for comments between declaration values and `!important`. ```diff -a { color: /* before */ /* after */ red !important; } +a { color: /* before */ red /* after */ !important; } ``` - [#10993](https://github.com/biomejs/biome/pull/10993) [`b7a9694`](https://github.com/biomejs/biome/commit/b7a969425d4292fc7c50440da7aea41ce5c9a9c2) Thanks [@denbezrukov](https://github.com/denbezrukov)! - Fixed the CSS formatter to preserve comments on the correct side of selector combinators and before declaration blocks. ```diff -.before > /* comment */ .after {} +.before /* comment */ > .after {} ``` It now also keeps selectors with escaped newlines in attribute values inline when they fit. ```diff -div - span[foo="bar\ +div span[foo="bar\ value"] {} ``` - [#10978](https://github.com/biomejs/biome/pull/10978) [`8ebafe1`](https://github.com/biomejs/biome/commit/8ebafe1c7489f1f7af379b8e52b8ad063c82d28a) Thanks [@ematipico](https://github.com/ematipico)! - Fixed [#10870](https://github.com/biomejs/biome/issues/10870): [`noUnresolvedImports`](https://biomejs.dev/linter/rules/no-unresolved-imports/) no longer reports false positives such as `import type { NextRequest } from "next/server"`. - [#10901](https://github.com/biomejs/biome/pull/10901) [`68c10e6`](https://github.com/biomejs/biome/commit/68c10e672fc886b31423b18be01e873d3bf77f43) Thanks [@Socialpranker](https://github.com/Socialpranker)! - Fixed [#10622](https://github.com/biomejs/biome/issues/10622): the HTML/Vue parser no longer panics on the argument-less `v-bind` shorthand (`:="props"`). This syntax is valid Vue and equivalent to `v-bind="props"`, so the parser now accepts it (along with the longhand `v-bind:="props"`) instead of crashing while building a diagnostic for a missing argument. - [#10936](https://github.com/biomejs/biome/pull/10936) [`7df46f5`](https://github.com/biomejs/biome/commit/7df46f5be0880a02cb37453f01b83c1ba59b1e44) Thanks [@ematipico](https://github.com/ematipico)! - Improved generic tuple inference for [`useIncludes`](https://biomejs.dev/linter/rules/use-includes/). The rule now recognizes specialised tuple element types returned through generic aliases. - [#10941](https://github.com/biomejs/biome/pull/10941) [`f787725`](https://github.com/biomejs/biome/commit/f7877258271e20523d5c673e62912fce1d85cd56) Thanks [@siketyan](https://github.com/siketyan)! - Fixed [`#10855`](https://github.com/biomejs/biome/issues/10855): Biome now supports parsing and formatting CSS custom media queries declared with [`@custom-media`](https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/At-rules/@custom-media). - [#10969](https://github.com/biomejs/biome/pull/10969) [`72d309b`](https://github.com/biomejs/biome/commit/72d309b655cee70473e20b061f5a45112139688c) Thanks [@ematipico](https://github.com/ematipico)! - Fixed an issue where Biome logs became too verbose, dumping information not relevant to user's operations. - [`e62f6b6`](https://github.com/biomejs/biome/commit/e62f6b61461227bbfd57fdf1b50b2dc8c01ea5a0) Thanks [@ematipico](https://github.com/ematipico)! - Fixed [#10963](https://github.com/biomejs/biome/issues/10963): Biome no longer panics when a type-aware rule such as [`noFloatingPromises`](https://biomejs.dev/linter/rules/no-floating-promises/) checks a call to a function with multiple call signatures imported from another module. - [#10931](https://github.com/biomejs/biome/pull/10931) [`899c60d`](https://github.com/biomejs/biome/commit/899c60d506115b3f62030236cbd0901bf294e6ab) Thanks [@ematipico](https://github.com/ematipico)! - Fixed `check --write` command. Now the command reports code frame of the formatted code, if the formatter is enabled. - [#10904](https://github.com/biomejs/biome/pull/10904) [`ceee4f4`](https://github.com/biomejs/biome/commit/ceee4f43dabf88d86b87c9a4ce6051b6738869c2) Thanks [@qzwxsaedc](https://github.com/qzwxsaedc)! - Fixed [#10892](https://github.com/biomejs/biome/issues/10892): [`noUnnecessaryConditions`](https://biomejs.dev/linter/rules/no-unnecessary-conditions/) no longer reports a false positive when checking a member of a discriminated union that is accessed through a default type-only namespace import. The following code is no longer flagged: ```ts import type Types from "./types"; declare function parse(): Types.Result<string>; const result = parse(); if (!result.success) { } ``` - [#10962](https://github.com/biomejs/biome/pull/10962) [`f0a67f2`](https://github.com/biomejs/biome/commit/f0a67f2e56c0785595c5cf14a93dba5bb32acf2d) Thanks [@ematipico](https://github.com/ematipico)! - Biome no longer removes embedded styles and scripts in HTML files. - [#11000](https://github.com/biomejs/biome/pull/11000) [`5039a1e`](https://github.com/biomejs/biome/commit/5039a1ee35771d0193de65a6326781313ab77afb) Thanks [@ematipico](https://github.com/ematipico)! - Fixed a bug where closing one editor stopped a shared Biome daemon used by other editors. LSP proxy processes now exit when either the editor or daemon disconnects. - [#10957](https://github.com/biomejs/biome/pull/10957) [`cf263c4`](https://github.com/biomejs/biome/commit/cf263c4700e9f24115e541d1f142934a9b2d878f) Thanks [@dyc3](https://github.com/dyc3)! - Improved the performance of the [`noThenProperty`](https://biomejs.dev/linter/rules/no-then-property/) lint rule by about 50%. - [#10992](https://github.com/biomejs/biome/pull/10992) [`4bf9b21`](https://github.com/biomejs/biome/commit/4bf9b21319df240e2c5ef2e5a9cb2e9582a0e1d1) Thanks [@ematipico](https://github.com/ematipico)! - Fixed [`noMisusedPromises`](https://biomejs.dev/linter/rules/no-misused-promises/): The rule now reports Promise-returning callbacks where a synchronous callback is expected when calls use tuple spreads or tuple rest parameters, including generic and deeply nested tuples, and when constructor signatures come from interface or object types. Recursive or excessively nested tuple spreads use a conservative fallback so analysis terminates. For example, the following callback is now reported. ```ts declare function consume(...args: [number, () => void]): void; const prefix: [number] = [1]; consume(...prefix, async () => {}); ``` - [#10915](https://github.com/biomejs/biome/pull/10915) [`b3b12b3`](https://github.com/biomejs/biome/commit/b3b12b3fe390feabbd9ba097922d6c7e56823406) Thanks [@Functionhx](https://github.com/Functionhx)! - Added the rule [`noNegationInEqualityCheck`](https://biomejs.dev/linter/rules/no-negation-in-equality-check/). The rule flags negated expressions on the left side of strict equality checks like `!foo === bar` — due to operator precedence this evaluates as `(!foo) === bar` which is almost always a mistake for `foo !== bar`. The rule provides an unsafe fix that flips the operator. ```js // Invalid !foo === bar; !foo !== bar; // Valid foo !== bar; foo === bar; ``` - [#10970](https://github.com/biomejs/biome/pull/10970) [`bd1038b`](https://github.com/biomejs/biome/commit/bd1038be1ad110aae60bcdbe9a154c6a2fc85c14) Thanks [@ematipico](https://github.com/ematipico)! - Improved overload selection for [`noMisusedPromises`](https://biomejs.dev/linter/rules/no-misused-promises/). Biome now handles overloaded calls, overloaded constructors, rest parameters, union arguments, and generic constraints without selecting an incompatible signature. For example, `noMisusedPromises` now reports the async callback passed to the synchronous overload: ```ts declare function consume(kind: "async", callback: () => Promise<void>): void; declare function consume(kind: "sync", callback: () => void): void; consume("sync", async () => {}); ``` - [#10933](https://github.com/biomejs/biome/pull/10933) [`48a4abb`](https://github.com/biomejs/biome/commit/48a4abb99d41b1241b2a5812a12247b671d0dfed) Thanks [@ematipico](https://github.com/ematipico)! - Fixed [`useArrayFind`](https://biomejs.dev/linter/rules/use-array-find/) to recognize bigint zero indexes. - [#10931](https://github.com/biomejs/biome/pull/10931) [`899c60d`](https://github.com/biomejs/biome/commit/899c60d506115b3f62030236cbd0901bf294e6ab) Thanks [@ematipico](https://github.com/ematipico)! - Fixed an orchestration issue that could lead to deadlocks when type-aware rules are enabled. - [#10969](https://github.com/biomejs/biome/pull/10969) [`72d309b`](https://github.com/biomejs/biome/commit/72d309b655cee70473e20b061f5a45112139688c) Thanks [@ematipico](https://github.com/ematipico)! - Hardened the Biome Language Server by improving its synchronisation logic. - [#10972](https://github.com/biomejs/biome/pull/10972) [`ab8c21b`](https://github.com/biomejs/biome/commit/ab8c21b35e81708276e4283a4a0ff86ea815e345) Thanks [@ematipico](https://github.com/ematipico)! - Fixed false positives in [`noMisusedPromises`](https://biomejs.dev/linter/rules/no-misused-promises/) and [`useAwaitThenable`](https://biomejs.dev/linter/rules/use-await-thenable/) when Promise or thenable inference cannot complete. These rules now suppress diagnostics instead of treating incomplete type information as a definite result. For example, `useAwaitThenable` no longer reports `await value` when the value's thenability is unknown: ```ts declare const value: unknown; async function consume() { await value; } ``` ### [`v2.5.4`](https://github.com/biomejs/biome/blob/HEAD/packages/@biomejs/biome/CHANGELOG.md#254) [Compare Source](https://github.com/biomejs/biome/compare/@biomejs/biome@2.5.3...@biomejs/biome@2.5.4) ##### Patch Changes - [#10665](https://github.com/biomejs/biome/pull/10665) [`55ff995`](https://github.com/biomejs/biome/commit/55ff995098148446b7e7fdfc19053902bb987122) Thanks [@dyc3](https://github.com/dyc3)! - Improved the performance of the HTML parser slightly in our synthetic benchmarks. - [#10894](https://github.com/biomejs/biome/pull/10894) [`f4fb10e`](https://github.com/biomejs/biome/commit/f4fb10e176e537e8ce2cac0c3fd4c38a77f91886) Thanks [@ematipico](https://github.com/ematipico)! - Fixed [#6392](https://github.com/biomejs/biome/issues/6392): On-type formatting no longer moves comments before an `if` statement into its body. - [#10939](https://github.com/biomejs/biome/pull/10939) [`f2799db`](https://github.com/biomejs/biome/commit/f2799db38e3d8a644207d9b8f957abea6cb3d9fa) Thanks [@Netail](https://github.com/Netail)! - Fixed [#10930](https://github.com/biomejs/biome/issues/10930): [`noLabelWithoutControl`](https://biomejs.dev/linter/rules/no-label-without-control/) now correctly detects text interpolation in Astro, Svelte & Vue as valid accessible content. - [#10945](https://github.com/biomejs/biome/pull/10945) [`ae15d98`](https://github.com/biomejs/biome/commit/ae15d98bbf2222fbb34e3e31832cba9676a6d01c) Thanks [@Netail](https://github.com/Netail)! - Fixed [#10942](https://github.com/biomejs/biome/issues/10942): Svelte directives don't throw an accidental debug log anymore. - [#10842](https://github.com/biomejs/biome/pull/10842) [`5e1abfe`](https://github.com/biomejs/biome/commit/5e1abfee59155b5fdca8813314371ed54c06acfb) Thanks [@JamBalaya56562](https://github.com/JamBalaya56562)! - Fixed [#9196](https://github.com/biomejs/biome/issues/9196): `biome check --write --unsafe` no longer hangs forever when applying the [`noCommentText`](https://biomejs.dev/linter/rules/no-comment-text/) code fix. The rule's fix now wraps the comment in a real JSX expression container (`{/* comment */}`) instead of re-inserting the braces as plain JSX text, so the fixed code is no longer reported again by the same rule. - [#10891](https://github.com/biomejs/biome/pull/10891) [`ecca79e`](https://github.com/biomejs/biome/commit/ecca79e8ff10f40aa676212c0db0a970c6091615) Thanks [@ematipico](https://github.com/ematipico)! - Fixed [`#10885`](https://github.com/biomejs/biome/issues/10885): prevented a module-inference regression introduced by a housekeeping change. - [#10886](https://github.com/biomejs/biome/pull/10886) [`60c8043`](https://github.com/biomejs/biome/commit/60c8043527f7ccc7b505471e1042f2a4324e4d31) Thanks [@dyc3](https://github.com/dyc3)! - Fixed [#10727](https://github.com/biomejs/biome/issues/10727): Biome now breaks the arguments of curried `test.each`, `it.each`, `describe.each`, and `test.for` calls when they exceed the configured line width. ```diff - test.each([[1, 2]])("a description that is long enough to push the hugged opening line beyond the print width", (a, b) => { - expect(a).toBe(b); - }); + test.each([[1, 2]])( + "a description that is long enough to push the hugged opening line beyond the print width", + (a, b) => { + expect(a).toBe(b); + }, + ); ``` - [#10895](https://github.com/biomejs/biome/pull/10895) [`01a85f0`](https://github.com/biomejs/biome/commit/01a85f04b09f0af05b16a15c137421e312ceada5) Thanks [@ematipico](https://github.com/ematipico)! - Biome will now remove stale Unix daemon sockets from older Biome versions when starting a newer daemon. ### [`v2.5.3`](https://github.com/biomejs/biome/blob/HEAD/packages/@biomejs/biome/CHANGELOG.md#253) [Compare Source](https://github.com/biomejs/biome/compare/@biomejs/biome@2.5.2...@biomejs/biome@2.5.3) ##### Patch Changes - [#10815](https://github.com/biomejs/biome/pull/10815) [`86613d5`](https://github.com/biomejs/biome/commit/86613d5b01eb965b460ccefbf27f168d87774aaf) Thanks [@WaterWhisperer](https://github.com/WaterWhisperer)! - Fixed a parser panic reported in [#10708](https://github.com/biomejs/biome/issues/10708): Biome now recovers when unsupported CSS Modules `@value` rules or scoped `@keyframes` names end at EOF. - [#10534](https://github.com/biomejs/biome/pull/10534) [`da9b403`](https://github.com/biomejs/biome/commit/da9b403b6bbacc8d75d56e327a46f4ed0285913e) Thanks [@Mokto](https://github.com/Mokto)! - Fixed [`noUnusedVariables`](https://biomejs.dev/linter/rules/no-unused-variables/) false positives in Svelte files: Svelte store subscriptions (`$store` references in templates now keep the underlying `store` binding from being flagged), and `$bindable()` props that are only written to in the script block (write-only is intentional for bindable props) are no longer reported as unused. - [#10827](https://github.com/biomejs/biome/pull/10827) [`098ba41`](https://github.com/biomejs/biome/commit/098ba41c99e6efaac8eb182eec258a567bb00123) Thanks [@Aqu1bp](https://github.com/Aqu1bp)! - Fixed [#10698](https://github.com/biomejs/biome/issues/10698): The [`noUnsafeOptionalChaining`](https://biomejs.dev/linter/rules/no-unsafe-optional-chaining/) rule now reports unsafe optional chains wrapped in TypeScript `as`, `satisfies`, type assertion, and instantiation expressions, such as `new (value?.constructor as Constructor)()`. - [#10773](https://github.com/biomejs/biome/pull/10773) [`3c6513d`](https://github.com/biomejs/biome/commit/3c6513d4e9a82a195785144caa9d96093c3861ff) Thanks [@otkrickey](https://github.com/otkrickey)! - Fixed [#10772](https://github.com/biomejs/biome/issues/10772): [`useVueValidVOn`](https://biomejs.dev/linter/rules/use-vue-valid-v-on/) no longer reports a missing handler for v-on directives using a verb modifier (`.stop` / `.prevent`) without an expression, e.g. `<div @click.stop></div>`. The rule also accepts the arg-less object syntax `<div v-on="$listeners"></div>` instead of reporting a missing event name. - [#10721](https://github.com/biomejs/biome/pull/10721) [`d83c66b`](https://github.com/biomejs/biome/commit/d83c66b39a820703d94100f8a6502cc6dbad26a1) Thanks [@minseong0324](https://github.com/minseong0324)! - Improved type-aware lint rule inference for built-in globals and indexed function calls. Biome now resolves `Error(...)`, `new Error(...)`, optional `Error#stack`, and calls through indexed function values such as `handlers[0]()` more accurately. - [#10865](https://github.com/biomejs/biome/pull/10865) [`6450276`](https://github.com/biomejs/biome/commit/6450276764ee4794a0fcb46c139f95b68d892427) Thanks [@ematipico](https://github.com/ematipico)! - Fixed [#10845](https://github.com/biomejs/biome/issues/10845). Biome Language Server no longer goes in deadlock when the scanner is enabled. - [#10853](https://github.com/biomejs/biome/pull/10853) [`93d8e53`](https://github.com/biomejs/biome/commit/93d8e5352454bccfbd179db03b3155776599c52c) Thanks [@Netail](https://github.com/Netail)! - Fixed [#10840](https://github.com/biomejs/biome/issues/10840): Astro shorthand attribute syntax is now correctly being parsed from embedded nodes. - [#10820](https://github.com/biomejs/biome/pull/10820) [`bba3092`](https://github.com/biomejs/biome/commit/bba30920715920142e933939f6270feedca933a5) Thanks [@JamBalaya56562](https://github.com/JamBalaya56562)! - Fixed [#10619](https://github.com/biomejs/biome/issues/10619): [`noProcessEnv`](https://biomejs.dev/linter/rules/no-process-env/) now also reports computed (bracket) member access. Previously only dot access was checked, so `process["env"]` and `env["NODE_ENV"]` (where `env` is imported from `node:process`) were missed. Both static and computed accesses are now reported. - [#10835](https://github.com/biomejs/biome/pull/10835) [`3447b2f`](https://github.com/biomejs/biome/commit/3447b2f5a3c430efc8e917514260af5341c5509d) Thanks [@dyc3](https://github.com/dyc3)! - Fixed [#10824](https://github.com/biomejs/biome/issues/10824): [`useDomQuerySelector`](https://biomejs.dev/linter/rules/use-dom-query-selector/) now supports an `ignore` option for receiver identifiers that should not be reported. - [#10875](https://github.com/biomejs/biome/pull/10875) [`b12e486`](https://github.com/biomejs/biome/commit/b12e486d0f0b80d02d2208e239190f8756d39d48) Thanks [@dyc3](https://github.com/dyc3)! - Fixed [#10795](https://github.com/biomejs/biome/issues/10795): `--profile-rules` now reports timings for each plugin separately as `plugin/<pluginName>`, matching the naming used by plugin suppressions, instead of aggregating all plugins under a single `plugin/plugin` entry. - [#10877](https://github.com/biomejs/biome/pull/10877) [`d6bc447`](https://github.com/biomejs/biome/commit/d6bc4473a210758ee49f6cad41bc69587a7cf125) Thanks [@ematipico](https://github.com/ematipico)! - Fixed [biome-zed#164](https://github.com/biomejs/biome-zed/issues/164): Biome no longer inserts stray whitespace when format-on-type runs after closing delimiters such as `)`, `]`, and `}`. - [#10867](https://github.com/biomejs/biome/pull/10867) [`a21463e`](https://github.com/biomejs/biome/commit/a21463e5f616a2db5035b470cd206ac9da4d9423) Thanks [@dyc3](https://github.com/dyc3)! - Fixed [#10864](https://github.com/biomejs/biome/issues/10864): Biome no longer crashes when checking or linting HTML files with unquoted attribute values such as `<textarea rows=4></textarea>`. ### [`v2.5.2`](https://github.com/biomejs/biome/blob/HEAD/packages/@biomejs/biome/CHANGELOG.md#252) [Compare Source](https://github.com/biomejs/biome/compare/@biomejs/biome@2.5.1...@biomejs/biome@2.5.2) ##### Patch Changes - [#10595](https://github.com/biomejs/biome/pull/10595) [`f458028`](https://github.com/biomejs/biome/commit/f4580289094a8fe5c85252adc3399c060bab811e) Thanks [@pkallos](https://github.com/pkallos)! - Added the option `ignoreBooleanCoercion` to [useNullishCoalescing](https://biomejs.dev/linter/rules/use-nullish-coalescing/). When enabled, Biome ignores `||` and `||=` used inside a `Boolean()` call, where coalescing on falsy values is intentional. - [#10798](https://github.com/biomejs/biome/pull/10798) [`4a32b63`](https://github.com/biomejs/biome/commit/4a32b63eb41f144dc8faf6b5cdb05e1de5dbcb63) Thanks [@pkallos](https://github.com/pkallos)! - Added the option `ignorePrimitives` to [useNullishCoalescing](https://biomejs.dev/linter/rules/use-nullish-coalescing/). When enabled, Biome ignores `||`, `||=`, and ternary expressions whose non-nullish operands are all primitives the option opts out of. Use `true` to ignore all primitives, or an object selecting `string`, `number`, `boolean`, or `bigint`. - [#10545](https://github.com/biomejs/biome/pull/10545) [`f3d4c00`](https://github.com/biomejs/biome/commit/f3d4c0082676c5188e9a6aa516318c7e3d59bda6) Thanks [@Mokto](https://github.com/Mokto)! - Added the new nursery rule [`noSvelteUnnecessaryStateWrap`](https://biomejs.dev/linter/rules/no-svelte-unnecessary-state-wrap/), which reports unnecessary `$state()` wrapping of classes from `svelte/reactivity` that are already reactive. ```svelte <script> import { SvelteMap } from "svelte/reactivity"; const map = $state(new SvelteMap()); // redundant </script> ``` - [#10752](https://github.com/biomejs/biome/pull/10752) [`f62fb8b`](https://github.com/biomejs/biome/commit/f62fb8b53092fe85e16f9d4ea0e584fee7031ab5) Thanks [@ematipico](https://github.com/ematipico)! - Fixed [#10739](https://github.com/biomejs/biome/issues/10739). Now the rule [`useValidAutocomplete`](https://biomejs.dev/linter/rules/use-valid-autocomplete/) correctly flags the `autoComplete` attribute. - [#10796](https://github.com/biomejs/biome/pull/10796) [`f1b3ab2`](https://github.com/biomejs/biome/commit/f1b3ab2c09522a52c93f669ce679675237b96813) Thanks [@ematipico](https://github.com/ematipico)! - Fixed [#10768](https://github.com/biomejs/biome/issues/10768). Improved the performance of the Biome Language Server by cancelling certain in-flight operations when there are fast updates. - [#10719](https://github.com/biomejs/biome/pull/10719) [`aa649b5`](https://github.com/biomejs/biome/commit/aa649b586a2221bf058af7ce80af6faa11faf846) Thanks [@minseong0324](https://github.com/minseong0324)! - Fixed [`noMisleadingReturnType`](https://biomejs.dev/linter/rules/no-misleading-return-type/) false positive on returns that use a widening type assertion: `"a" as string` is no longer reported as misleading. The rule now also reports a literal-pinning assertion such as `false as false`, matching the existing `as const` behavior. ```ts // No longer flagged (returns are `string`): function getValue(b: boolean): string { if (b) return "a" as string; return "b" as string; } // Now also reported, like `as const` (returns `false`): function isReady(): boolean { return false as false; } ``` - [#10678](https://github.com/biomejs/biome/pull/10678) [`8f073a7`](https://github.com/biomejs/biome/commit/8f073a7cd72b4cf46c2ebf2bc08f4068fc4b5e34) Thanks [@PranavAchar01](https://github.com/PranavAchar01)! - Fixed [#7718](https://github.com/biomejs/biome/issues/7718): Biome now correctly parses CSS nesting selectors when `&` appears as a trailing sub-selector after a type selector, e.g. `h1& { color: red; }`. - [#10756](https://github.com/biomejs/biome/pull/10756) [`5ec965a`](https://github.com/biomejs/biome/commit/5ec965a2620dec7cb40aa4946ba1d41408b11fd9) Thanks [@denbezrukov](https://github.com/denbezrukov)! - Fixed CSS formatter output for selector lists with `allowWrongLineComments` and `//` comments after a selector comma. Biome now keeps the selector before the line comment inline instead of breaking it across descendant combinators. ```diff -.powerPathNavigator - .helm - button.pressedButton, // pressed +.powerPathNavigator .helm button.pressedButton, // pressed .powerPathNavigator .helm button:active:not(.disabledButton) { } ``` - [#10757](https://github.com/biomejs/biome/pull/10757) [`6232fcd`](https://github.com/biomejs/biome/commit/6232fcdef77471e6a6a74bcc33ff7b2b2a9f85a2) Thanks [@PranavAchar01](https://github.com/PranavAchar01)! - Fixed [#8269](https://github.com/biomejs/biome/issues/8269): the CSS parser now accepts Tailwind `@variant` and `@utility` names that start with a digit, such as the `2xl` breakpoint. ```css @utility container { @variant 2xl { max-width: 1400px; } } ``` - [#10777](https://github.com/biomejs/biome/pull/10777) [`575ced6`](https://github.com/biomejs/biome/commit/575ced6fd7fe3597fdec36e572763e4a5d590244) Thanks [@WaterWhisperer](https://github.com/WaterWhisperer)! - Fixed an issue reported in [#10708](https://github.com/biomejs/biome/issues/10708): the GitLab reporter now handles `--verbose` diagnostics filtering correctly. - [#10281](https://github.com/biomejs/biome/pull/10281) [`0efe244`](https://github.com/biomejs/biome/commit/0efe2442e9b81d83f7332fd792ad6096678f8b2c) Thanks [@Zelys-DFKH](https://github.com/Zelys-DFKH)! - Fixed a bug where GritQL patterns rejected positional (unkeyed) arguments. - [#10758](https://github.com/biomejs/biome/pull/10758) [`e36fd8a`](https://github.com/biomejs/biome/commit/e36fd8a9f1314744276df515a1137f21802d3aa5) Thanks [@henrybrewer00-dotcom](https://github.com/henrybrewer00-dotcom)! - Fixed [#10697](https://github.com/biomejs/biome/issues/10697): The formatter no longer removes the parentheses around an `await` or `yield` expression used as the target of a TypeScript instantiation expression. For example, `(await makeFactory)<Value>` is no longer reformatted to `await makeFactory<Value>`, which would change the meaning of the code. - [#10586](https://github.com/biomejs/biome/pull/10586) [`3617094`](https://github.com/biomejs/biome/commit/3617094f00e90f7167ff20baf3c12b5014188b35) Thanks [@IxxyDev](https://github.com/IxxyDev)! - Fixed [#9568](https://github.com/biomejs/biome/issues/9568): [`noFloatingPromises`](https://biomejs.dev/linter/rules/no-floating-promises/) no longer reports a false positive when calling an overloaded function and the selected overload does not return a promise. ```ts function bestEffort(cb: () => Promise<number>): Promise<number>; function bestEffort(cb: () => number): number; function bestEffort( cb: () => number | Promise<number>, ): Promise<number> | number { return cb() as Promise<number> | number; } // This resolves to the second overload, which returns `number`, so it is no // longer flagged as a floating promise. bestEffort(() => 42); ``` - [#10766](https://github.com/biomejs/biome/pull/10766) [`7aff4c1`](https://github.com/biomejs/biome/commit/7aff4c11900579a62dc27ef4e02a4c4760fbbff4) Thanks [@JamBalaya56562](https://github.com/JamBalaya56562)! - Fixed [#2862](https://github.com/biomejs/biome/issues/2862): [`noInteractiveElementToNoninteractiveRole`](https://biomejs.dev/linter/rules/no-interactive-element-to-noninteractive-role/) no longer reports custom elements (a tag name containing a dash, e.g. `<my-button role="img" />`). Per the [W3C HTML-ARIA specification](https://www.w3.org/TR/html-aria/#el-autonomous-custom-element), a custom element may be given any role or none. - [#10680](https://github.com/biomejs/biome/pull/10680) [`771daa4`](https://github.com/biomejs/biome/commit/771daa4f7d229a8754f47923f03b899dc0fc5630) Thanks [@WaterWhisperer](https://github.com/WaterWhisperer)! - Fixed [#10635](https://github.com/biomejs/biome/issues/10635): Biome now recognizes chained table tests such as `test.concurrent.each()` and `it.concurrent.each()` as test calls, fixing `noMisplacedAssertion` false positives and improving formatting for those test declarations. - [#10759](https://github.com/biomejs/biome/pull/10759) [`34570b5`](https://github.com/biomejs/biome/commit/34570b5b793c44e978b12589dafcfda22dba7df1) Thanks [@henrybrewer00-dotcom](https://github.com/henrybrewer00-dotcom)! - Fixed [#10636](https://github.com/biomejs/biome/issues/10636): [noStaticElementInteractions](https://biomejs.dev/linter/rules/no-static-element-interactions/) no longer reports a false positive for event handlers on Svelte special elements such as `<svelte:window>`, `<svelte:document>`, and `<svelte:body>`. These are not real DOM elements, so they are now ignored by the rule. - [#10741](https://github.com/biomejs/biome/pull/10741) [`bd2364e`](https://github.com/biomejs/biome/commit/bd2364e3d077e3a77addcab6dbe127db38654e4a) Thanks [@JamBalaya56562](https://github.com/JamBalaya56562)! - Fixed [#6686](https://github.com/biomejs/biome/issues/6686): the `rage` command now respects the `--config-path` option and the `BIOME_CONFIG_PATH` environment variable when loading the Biome configuration. Previously it always used the default configuration resolution and reported the configuration as `Not set` when no `biome.json` existed in the working directory. - [#10763](https://github.com/biomejs/biome/pull/10763) [`2c3e82d`](https://github.com/biomejs/biome/commit/2c3e82d0235ad2f8331744aefc708d1b71f7177c) Thanks [@Aqu1bp](https://github.com/Aqu1bp)! - Fixed [#10742](https://github.com/biomejs/biome/issues/10742): [`noSolidDestructuredProps`](https://biomejs.dev/linter/rules/no-solid-destructured-props) now reports destructured props in Solid function components and JSX children. - [#10606](https://github.com/biomejs/biome/pull/10606) [`a4cc4ab`](https://github.com/biomejs/biome/commit/a4cc4ab0b01a8ef1731d37cb44bccc5522876f2e) Thanks [@Mokto](https://github.com/Mokto)! - Fixed false positives in `noUnusedImports`, `noUnusedVariables`, and `useImportType` for Svelte components that use both a `<script module>` and a `<script>` block. The two blocks compile to a single module and share a top-level scope, so a binding (import, function, or variable) declared in one block and used only in the other is no longer reported as unused. - [#10767](https://github.com/biomejs/biome/pull/10767) [`36d5aa7`](https://github.com/biomejs/biome/commit/36d5aa77d751bf33485cd2c92d89e4c5764e1e50) Thanks [@otkrickey](https://github.com/otkrickey)! - Fixed [#10754](https://github.com/biomejs/biome/issues/10754): [`useVueValidVBind`](https://biomejs.dev/linter/rules/use-vue-valid-v-bind/) no longer reports the Vue 3.4+ same-name shorthand as missing a value. `:foo` and `v-bind:foo` are now accepted as equivalent to `:foo="foo"`, while `v-bind`, `v-bind:[dynamicArg]`, and `:[dynamicArg]` without a value continue to be reported. - [#10775](https://github.com/biomejs/biome/pull/10775) [`a918af0`](https://github.com/biomejs/biome/commit/a918af0ba827a7fd60a12c96b58daebc8af61db2) Thanks [@WaterWhisperer](https://github.com/WaterWhisperer)! - Fixed an issue reported in [#10708](https://github.com/biomejs/biome/issues/10708): `biome rage` didn't detect running Biome daemon pipes on Windows. - [#10730](https://github.com/biomejs/biome/pull/10730) [`5a2e65b`](https://github.com/biomejs/biome/commit/5a2e65b9929ef0f2294c20e028fd396d760d2b26) Thanks [@dinocosta](https://github.com/dinocosta)! - Fixed an issue where Biome was resolving [the well-known Zed settings file](https://biomejs.dev/guides/configure-biome/#well-known-files) from the wrong location on macOS and Windows. - [#10807](https://github.com/biomejs/biome/pull/10807) [`d97fffe`](https://github.com/biomejs/biome/commit/d97fffe0aba04cddec66943d6bff3e99d440b451) Thanks [@ematipico](https://github.com/ematipico)! - Fixed an issue where `.scss` files were incorrectly analyzed when running `biome check`. - [#10672](https://github.com/biomejs/biome/pull/10672) [`53c6efc`](https://github.com/biomejs/biome/commit/53c6efcd3e5e2769bf8edbe14b8c06ee9fda52d2) Thanks [@ematipico](https://github.com/ematipico)! - Fixed a bug where Biome incorrectly formatted snippets that have parsing errors. - [#10719](https://github.com/biomejs/biome/pull/10719) [`aa649b5`](https://github.com/biomejs/biome/commit/aa649b586a2221bf058af7ce80af6faa11faf846) Thanks [@minseong0324](https://github.com/minseong0324)! - Fixed [`useAwaitThenable`](https://biomejs.dev/linter/rules/use-await-thenable/) false positive when awaiting a custom thenable that is not the global `Promise`. A value with a callable `then` member is now recognized as awaitable. ```ts interface Thenable<T> { then(onfulfilled: (value: T) => void): void; } declare const t: Thenable<number>; async function f() { await t; } ``` - [#10734](https://github.com/biomejs/biome/pull/10734) [`4396496`](https://github.com/biomejs/biome/commit/43964961c88ca0f93ee83d10621844fa2dc7515c) Thanks [@BangDori](https://github.com/BangDori)! - Fixed [#10708](https://github.com/biomejs/biome/issues/10708): `biome migrate` now preserves trivia when migrating the deprecated `recommended` option to `preset`. - [#10683](https://github.com/biomejs/biome/pull/10683) [`ae31a00`](https://github.com/biomejs/biome/commit/ae31a004a20ed33d6aa35d5ec8bb4c433273a517) Thanks [@Netail](https://github.com/Netail)! - Fixed [#10657](https://github.com/biomejs/biome/issues/10657) [#10671](https://github.com/biomejs/biome/issues/10671) [#10661](https://github.com/biomejs/biome/issues/10661) [#10637](https://github.com/biomejs/biome/issues/10637) [#10718](https://github.com/biomejs/biome/issues/10718): HTML rules now correctly handle dynamic attributes. - [#10746](https://github.com/biomejs/biome/pull/10746) [`54e8239`](https://github.com/biomejs/biome/commit/54e8239bba3f598d7923ac1e446d658714ea7832) Thanks [@ematipico](https://github.com/ematipico)! - Fixed an issue where [`noUndeclaredClasses`](https://biomejs.dev/linter/rules/no-undeclared-classes) didn't correctly detect styles defined inside the Astro directive `is:global`. - [#10770](https://github.com/biomejs/biome/pull/10770) [`dd1429c`](https://github.com/biomejs/biome/commit/dd1429c604f58b89524a3f5329e2920d198e8d9f) Thanks [@ematipico](https://github.com/ematipico)! - Improved the Biome Language Server DX by orchestrating certain operations, so that they won't block the editor during typing. This improvement is more visible in large documents. - [#10473](https://github.com/biomejs/biome/pull/10473) [`d9b5133`](https://github.com/biomejs/biome/commit/d9b5133de7e211b22f4531fe220070690a18c8d1) Thanks [@Mokto](https://github.com/Mokto)! - Improved [`noUnusedImports`](https://biomejs.dev/linter/rules/no-unused-imports/), [`noUnusedVariables`](https://biomejs.dev/linter/rules/no-unused-variables/), [`noUnusedFunctionParameters`](https://biomejs.dev/linter/rules/no-unused-function-parameters/), and [`useImportType`](https://biomejs.dev/linter/rules/use-import-type/) for Svelte, Vue, and Astro files (with `html.experimentalFullSupportEnabled`). Bindings used only in the template — including component tags, attribute interpolations, directives, `bind:` shorthand, and snippet parameters — are no longer reported as unused, while genuinely unused ones still are. - [#10796](https://github.com/biomejs/biome/pull/10796) [`f1b3ab2`](https://github.com/biomejs/biome/commit/f1b3ab2c09522a52c93f669ce679675237b96813) Thanks [@ematipico](https://github.com/ematipico)! - Fixed an issue where the Biome Language Server didn't enable project or type-aware lint rules, even when they were explicitly enabled. - [#10746](https://github.com/biomejs/biome/pull/10746) [`54e8239`](https://github.com/biomejs/biome/commit/54e8239bba3f598d7923ac1e446d658714ea7832) Thanks [@ematipico](https://github.com/ematipico)! - Fixed an issue where [`noUndeclaredClasses`](https://biomejs.dev/linter/rules/no-undeclared-classes) didn't detect styles declared inside HTML documents. - [#10774](https://github.com/biomejs/biome/pull/10774) [`bde945b`](https://github.com/biomejs/biome/commit/bde945bee29cb566086828ad788153d9111a125a) Thanks [@pattrickrice](https://github.com/pattrickrice)! - Fixed [#10268](https://github.com/biomejs/biome/issues/10268) where a race condition resulted in internal errors such as: `The file biome.json does not exist in the workspace`. ### [`v2.5.1`](https://github.com/biomejs/biome/blob/HEAD/packages/@biomejs/biome/CHANGELOG.md#251) [Compare Source](https://github.com/biomejs/biome/compare/@biomejs/biome@2.5.0...@biomejs/biome@2.5.1) ##### Patch Changes - [#10722](https://github.com/biomejs/biome/pull/10722) [`f8a303d`](https://github.com/biomejs/biome/commit/f8a303d08b6b22f56edb8ff5e7caa665532d613a) Thanks [@denbezrukov](https://github.com/denbezrukov)! - Fixed CSS formatter output for comments between import media queries. ```diff -@import url("print.css") print, -/* comment */ -screen; +@import url("print.css") print, /* comment */ screen; ``` - [#10738](https://github.com/biomejs/biome/pull/10738) [`9fdc560`](https://github.com/biomejs/biome/commit/9fdc5600997ef59ca7ed55ac212473de9bdb0b2a) Thanks [@JamBalaya56562](https://github.com/JamBalaya56562)! - Fixed [#9899](https://github.com/biomejs/biome/issues/9899): the `json` and `json-pretty` reporters now escape backslashes in a diagnostic's `location.path`. Previously, paths containing backslashes (such as Windows-style paths) were emitted unescaped, producing invalid JSON. ```diff - "path": "src\account\setup-passkey.tsx", + "path": "src\\account\\setup-passkey.tsx", ``` - [#10626](https://github.com/biomejs/biome/pull/10626) [`5f837df`](https://github.com/biomejs/biome/commit/5f837df033afc34d43b398aeddc06c1d4fa491d9) Thanks [@tom-groves](https://github.com/tom-groves)! - Fixed [#10625](https://github.com/biomejs/biome/issues/10625): `biome migrate` no longer emits an invalid trailing comma when a renamed rule (such as `noConsoleLog` → `noConsole`) is the last member of its rule group. Previously this produced malformed output that aborted the migration of a strict-JSON `biome.json` with a parsing error. - [#10535](https://github.com/biomejs/biome/pull/10535) [`c245f9d`](https://github.com/biomejs/biome/commit/c245f9d9e239471d5437cd08f9cfa4601a85abd5) Thanks [@Mokto](https://github.com/Mokto)! - Fixed a false positive in [`noUnusedVariables`](https://biomejs.dev/linter/rules/no-unused-variables/) for Svelte files where variables referenced inside `{@html expr}` blocks were incorrectly reported as unused. - [#10668](https://github.com/biomejs/biome/pull/10668) [`a0f197e`](https://github.com/biomejs/biome/commit/a0f197eb1a6974539927f105ff1dde1f51d07d74) Thanks [@Netail](https://github.com/Netail)! - The `biome init` command has been updated to include a more up-to-date URL to [the first-party extensions page](https://biomejs.dev/editors/first-party-extensions/). - [#10667](https://github.com/biomejs/biome/pull/10667) [`d8c3e87`](https://github.com/biomejs/biome/commit/d8c3e878d53515c02bd6c5cb899b2eaec046c542) Thanks [@Netail](https://github.com/Netail)! - Fixed [#10664](https://github.com/biomejs/biome/issues/10664): [useErrorCause](https://biomejs.dev/linter/rules/use-error-cause/) now correctly detects a shorthand property. - [#10696](https://github.com/biomejs/biome/pull/10696) [`ef2373f`](https://github.com/biomejs/biome/commit/ef2373f29be15673705884d345c9af189e30b581) Thanks [@ematipico](https://github.com/ematipico)! - Fixed [#9566](https://github.com/biomejs/biome/issues/9566). Improved how the Biome Language Server loads multiple configuration files inside a workspace. - [#10705](https://github.com/biomejs/biome/pull/10705) [`4ccb410`](https://github.com/biomejs/biome/commit/4ccb410dc00a6fb243934dad2e8681a9d5d9529e) Thanks [@ematipico](https://github.com/ematipico)! - Fixed [#10652](https://github.com/biomejs/biome/issues/10652). Biome plugins are now properly filtered when using `--only` and `--skip` flags. - [#10669](https://github.com/biomejs/biome/pull/10669) [`aa0a6eb`](https://github.com/biomejs/biome/commit/aa0a6eb8007493961cd578f04201248c15fd809a) Thanks [@Netail](https://github.com/Netail)! - Fixed [#10651](https://github.com/biomejs/biome/issues/10651): [useInlineScriptId](https://biomejs.dev/linter/rules/use-inline-script-id/) now correctly trims trivia to detect if an id attribute has been set. - [#10689](https://github.com/biomejs/biome/pull/10689) [`844b1be`](https://github.com/biomejs/biome/commit/844b1be60ded28bf4c650d85806919ceb57bc402) Thanks [@ematipico](https://github.com/ematipico)! - Fixed [#10658](https://github.com/biomejs/biome/issues/10658). The issue was caused by the "Go-to definition" editor feature, which was enabled by default. The feature is now **disabled by default**. To work, the feature triggers the scanner to build the module graph. This caused memory leak issues in cases where Biome starts in the home directory to modify files. If you relied on this new feature, you must now turn on using the \[editor settings] of the extension e.g. [Zed](https://biomejs.dev/reference/zed/#goto_definition) and [VSCode](https://biomejs.dev/reference/vscode/#biomegotodefinition). - [#10695](https://github.com/biomejs/biome/pull/10695) [`043fbb5`](https://github.com/biomejs/biome/commit/043fbb514f1b96c5b723cd86c8db4b9bc9f03631) Thanks [@ematipico](https://github.com/ematipico)! - Fixed [#10674](https://github.com/biomejs/biome/issues/10674). Biome now throws an error when the field `level` is missing from a rule option. - [#10712](https://github.com/biomejs/biome/pull/10712) [`5941df2`](https://github.com/biomejs/biome/commit/5941df2a0d6904e487e73d4dc7231dcaf7b3a2f0) Thanks [@Conaclos](https://github.com/Conaclos)! - Improved the diagnostic and the documentation of [`useFlatMap`](https://biomejs.dev/linter/rules/use-flat-map/). - [#10615](https://github.com/biomejs/biome/pull/10615) [`23814f1`](https://github.com/biomejs/biome/commit/23814f1ad8430df906a39323ee31d27d7b9ca17b) Thanks [@qwertycxz](https://github.com/qwertycxz)! - Improved the DX the JSON schema when it's used by certain code editors like VSCode. - [#10688](https://github.com/biomejs/biome/pull/10688) [`ec69489`](https://github.com/biomejs/biome/commit/ec694896a0c75176aca040392e3309df1b2e963d) Thanks [@ematipico](https://github.com/ematipico)! - Fixed a bug where the Biome Daemon did not correctly shut down when the editor was closed during an in-progress operation, especially while scanning. - [#10701](https://github.com/biomejs/biome/pull/10701) [`6c2e0d7`](https://github.com/biomejs/biome/commit/6c2e0d7bba1cbc457a42adf6c982a773bc7e4605) Thanks [@ematipico](https://github.com/ematipico)! - Fixed [#10694](https://github.com/biomejs/biome/issues/10694). The Biome Language Server no longer prints an error when the user hovers a variable imported from node\_modules. - [#10681](https://github.com/biomejs/biome/pull/10681) [`888515b`](https://github.com/biomejs/biome/commit/888515b088cde688a95680362a619221c023f9d0) Thanks [@Conaclos](https://github.com/Conaclos)! - Fixed [`useExportType`](https://biomejs.dev/linter/rules/use-export-type/) that reported useless details in some diagnostics. - [#10220](https://github.com/biomejs/biome/pull/10220) [`3694a13`](https://github.com/biomejs/biome/commit/3694a135a9976915889988c36d9eb40d679f06e6) Thanks [@theBGuy](https://github.com/theBGuy)! - Fixed [`useAnchorContent`](https://biomejs.dev/linter/rules/use-anchor-content/) false positive for `<a>` elements used as render prop values (e.g. `render={<a href="..." />}`), a pattern where the receiving component renders its children inside the anchor element. - [#10702](https://github.com/biomejs/biome/pull/10702) [`98823fb`](https://github.com/biomejs/biome/commit/98823fb2e70095b09e1ca4bb9733850bbe8ff33f) Thanks [@ematipico](https://github.com/ematipico)! - Fixed [#10612](https://github.com/biomejs/biome/issues/10612). The Biome parser now correctly parses processing instructions. The following SVG doesn't throw errors anymore: ```svg <?xml version="1.0" encoding="UTF-8" ?> <svg></svg> ``` ### [`v2.5.0`](https://github.com/biomejs/biome/blob/HEAD/packages/@biomejs/biome/CHANGELOG.md#250) [Compare Source](https://github.com/biomejs/biome/compare/@biomejs/biome@2.4.16...@biomejs/biome@2.5.0) ##### Minor Changes - [#9539](https://github.com/biomejs/biome/pull/9539) [`f0615fd`](https://github.com/biomejs/biome/commit/f0615fdae80fa7257fc1d0448d2027cb1acff46e) Thanks [@ematipico](https://github.com/ematipico)! - Added a new reporter called `concise`. When `--reporter=concise` is passed the commands `format`, `lint`, `check` and `ci`, the diagnostics are printed in a compact manner: ``` ! index.ts:2:10: lint/correctness/noUnusedImports: Several of these imports are unused. ! main.ts:9:7: lint/correctness/noUnusedVariables: This variable f is unused. × index.ts:8:5: lint/suspicious/noImplicitAnyLet: This variable implicitly has the any type. × main.ts:2:10: lint/suspicious/noRedeclare: Shouldn't redeclare 'z'. Consider to delete it or rename it. ``` - [#9495](https://github.com/biomejs/biome/pull/9495) [`2056b23`](https://github.com/biomejs/biome/commit/2056b23812a17f9c9a9015e5b725faecb04647b5) Thanks [@aviraldua93](https://github.com/aviraldua93)! - Added the [`useKeyWithClickEvents`](https://biomejs.dev/linter/rules/use-key-with-click-events/) a11y lint rule for HTML files (`.html`, `.vue`, `.svelte`, `.astro`). This is a port of the existing JSX rule. The rule enforces that elements with an `onclick` handler also have at least one keyboard event handler (`onkeydown`, `onkeyup`, or `onkeypress`) to ensure keyboard accessibility. Inherently keyboard-accessible elements (`<a>`, `<button>`, `<input>`, `<select>`, `<textarea>`, `<option>`) are excluded, as are elements hidden from assistive technologies (`aria-hidden`) or with `role="presentation"` / `role="none"`. ```html  <div onclick="handleClick()">Click me</div>  <div onclick="handleClick()" onkeydown="handleKeyDown()">Click me</div>  <button onclick="handleClick()">Submit</button> ``` - [#9152](https://github.com/biomejs/biome/pull/9152) [`9ec8500`](https://github.com/biomejs/biome/commit/9ec8500dabc7305cbe04ecf27a84a1450f012c0b) Thanks [@ematipico](https://github.com/ematipico)! - Added new nursery lint rule [`noUndeclaredClasses`](https://biomejs.dev/linter/rules/no-undeclared-classes/) for HTML, JSX, and SFC files (Vue, Astro, Svelte). The rule detects CSS class names used in `class="..."` (or `className`) attributes that are not defined in any `<style>` block or linked stylesheet reachable from the file. ```html  <html> <head> <style> .button { color: blue; } </style> </head> <body> <div class="button typo"></div> </body> </html> ``` - [#9152](https://github.com/biomejs/biome/pull/9152) [`9ec8500`](https://github.com/biomejs/biome/commit/9ec8500dabc7305cbe04ecf27a84a1450f012c0b) Thanks [@ematipico](https://github.com/ematipico)! - Added new nursery lint rule [`noUnusedClasses`](https://biomejs.dev/linter/rules/no-unused-classes/) for CSS. The rule detects CSS class selectors that are never referenced in any HTML or JSX file that imports the stylesheet. This is a project-domain rule that requires the module graph. ```css /* styles.css — .ghost is never used in any importing file */ .button { color: blue; } .ghost { color: red; } ``` ```jsx /* App.jsx */ import "./styles.css"; export default () => <div className="button" />; ``` - [#9546](https://github.com/biomejs/biome/pull/9546) [`6567efa`](https://github.com/biomejs/biome/commit/6567efa51ba074436b017e49b1d2d369e7252e74) Thanks [@nhedger](https://github.com/nhedger)! - Added a `biome upgrade` command for standalone installations. It upgrades Homebrew installs with `brew upgrade biome`, updates manually installed binaries from the latest GitHub release, and tells npm users to upgrade with their package manager instead. - [#9716](https://github.com/biomejs/biome/pull/9716) [`701767a`](https://github.com/biomejs/biome/commit/701767a3c4de8bce032933588ef2b6e5e252919f) Thanks [@faizkhairi](https://github.com/faizkhairi)! - Added the HTML version of the [`useHeadingContent`](https://biomejs.dev/linter/rules/use-heading-content/) rule. The rule now enforces that heading elements (`h1`-`h6`) have content accessible to screen readers in HTML, Vue, Svelte, and Astro files. ```html  <h1></h1>  <h1 aria-hidden="true">invisible content</h1>  <h1>heading</h1>  <h1 aria-label="Screen reader content"></h1> ``` - [#9582](https://github.com/biomejs/biome/pull/9582) [`f437ef8`](https://github.com/biomejs/biome/commit/f437ef8b6b0eb8f909d523950cf2c543042083d5) Thanks [@rahuld109](https://github.com/rahuld109)! - Added the HTML version of the [`useKeyWithMouseEvents`](https://biomejs.dev/linter/rules/use-key-with-mouse-events/) rule. The rule now enforces that `onmouseover` is accompanied by `onfocus` and `onmouseout` is accompanied by `onblur` in HTML, Vue, Svelte, and Astro files. ```html  <div onmouseover="handleMouseOver()"></div>  <div onmouseover="handleMouseOver()" onfocus="handleFocus()"></div> ``` - [#9275](https://github.com/biomejs/biome/pull/9275) [`1fdbcee`](https://github.com/biomejs/biome/commit/1fdbceea62d373f24da9c1e5cc0cdd169b573e84) Thanks [@ff1451](https://github.com/ff1451)! - Added the new assist action [`useSortedTypeFields`](https://biomejs.dev/assist/actions/use-sorted-type-fields/), which sorts the fields of GraphQL object types, interface types and input object types alphabetically, e.g. `name, age, id` becomes `age, id, name`. - [#10561](https://github.com/biomejs/biome/pull/10561) [`78075b7`](https://github.com/biomejs/biome/commit/78075b7c7cb7490c730a96f4ee9776c9e77826e7) Thanks [@Conaclos](https://github.com/Conaclos)! - Added a new `style` option to [useExportType](https://biomejs.dev/linter/rules/use-export-type/), which enforces a style for exporting types. This is the same option as the one provided by `useImportType`. - [#8987](https://github.com/biomejs/biome/pull/8987) [`d16e32b`](https://github.com/biomejs/biome/commit/d16e32b5b971a4ed9cd3bf5098782c8b752af69a) Thanks [@DerTimonius](https://github.com/DerTimonius)! - Ported the [`useValidAnchor`](https://biomejs.dev/linter/rules/use-valid-anchor/) rule to HTML. This rule enforces that all anchors are valid and that they are navigable elements. - [#9533](https://github.com/biomejs/biome/pull/9533) [`4d251d4`](https://github.com/biomejs/biome/commit/4d251d489cfd33a83e42d425476f8d6c66b72d9b) Thanks [@ematipico](https://github.com/ematipico)! - The `init` command now prints the Biome logo. - [#10069](https://github.com/biomejs/biome/pull/10069) [`0eb9310`](https://github.com/biomejs/biome/commit/0eb93109e1f9bfbb20744961681b4f0b9b781ad5) Thanks [@Netail](https://github.com/Netail)! - Added the HTML lint rule [`noStaticElementInteractions`](https://biomejs.dev/linter/rules/no-static-element-interactions/), which enforces that static, visible elements (such as `<div>`) that have click handlers use the valid role attribute. **Invalid**: ```html <div onclick="myFunction()"></div> ``` - [#9134](https://github.com/biomejs/biome/pull/9134) [`2a43488`](https://github.com/biomejs/biome/commit/2a434882746d31e1bd3c8e0d711372a539ce88f8) Thanks [@ematipico](https://github.com/ematipico)! - Added the assist action [`useSortedPackageJson`](https://biomejs.dev/assist/actions/use-sorted-package-json). This action organizes package.json fields according to the same conventions as the popular [sort-package-json](https://github.com/keithamus/sort-package-json) tool. - [#9309](https://github.com/biomejs/biome/pull/9309) [`7daa18b`](https://github.com/biomejs/biome/commit/7daa18b07f7ab348942f4cb83b475e6a4b3d1125) Thanks [@Bertie690](https://github.com/Bertie690)! - The `allowDoubleNegation` option has been added to [`noImplicitCoercions`](https://biomejs.dev/linter/rules/no-implicit-coercions) to allow ignoring double negations inside code. With the option enabled, the following example is considered valid and is ignored by the rule: ```js const truthy = !!value; ``` - [#9700](https://github.com/biomejs/biome/pull/9700) [`894f3fb`](https://github.com/biomejs/biome/commit/894f3fb4c664b12ff9abd1527b535621fe4e22f6) Thanks [@ematipico](https://github.com/ematipico)! - The Biome Language server now supports the "go-to definition" feature. When the cursor of the mouse is hovering an entity (variable, CSS class, type, etc.), and the command <kbd>CTRL</kbd> + click is triggered, the editor jumps to where this entity is defined, if the language server can find it. Here's what Biome is able to resolve: - Variables and types used in JavaScript modules, defined in the same file or imported from another module. - JSX Components used in JavaScript modules, defined in the same file or imported from another module. - CSS classes used in JSX and HTML-ish files (Vue, Svelte and Astro), and defined in CSS files. - Components used in HTML-ish files and defined in other HTML-ish. - Variables used in HTML-ish files and defined in the same file or imported from another module (JavaScript or HTML-ish). - [#10070](https://github.com/biomejs/biome/pull/10070) [`bae0710`](https://github.com/biomejs/biome/commit/bae071050f5a9c335b4483ee384f21ac1e6f0b4d) Thanks [@Conaclos](https://github.com/Conaclos)! - Added the `:STYLE:` group matcher for [`organizeImports`](https://biomejs.dev/assist/actions/organize-imports/) that matches style imports. For example, the following configuration... ```json { "assist": { "actions": { "source": { "organizeImports": { "level": "on", "options": { "groups": ["**", "!:STYLE:"], "sortBareImports": true } } } } } } ``` ...places style imports last: ```diff - import "./style.css" import A from "./a.js" + import "./style.css" ``` - [#9170](https://github.com/biomejs/biome/pull/9170) [`e3107de`](https://github.com/biomejs/biome/commit/e3107deedcff0f02b61702c6645d89e8d8635b49) Thanks [@mdrobny](https://github.com/mdrobny)! - Added `bundleDependencies` option to [NoUndeclaredDependencies](https://biomejs.dev/linter/rules/no-undeclared-dependencies) rule. This rule now supports imports of packages that are defined only in `bundleDependencies` and `bundledDependencies` arrays. - [#9547](https://github.com/biomejs/biome/pull/9547) [`01f8473`](https://github.com/biomejs/biome/commit/01f847317820f805698e1b8ba9eaa8fa6c26205c) Thanks [@mujpao](https://github.com/mujpao)! - Added new assist rule [`useSortedAttributes`](https://biomejs.dev/assist/actions/use-sorted-attributes/) for HTML, porting the existing JSX rule. This rule enforces sorted HTML attributes. **Invalid** ```html <input type="text" id="name" name="name" /> ``` - [#9366](https://github.com/biomejs/biome/pull/9366) [`2ca1117`](https://github.com/biomejs/biome/commit/2ca1117f1e63f6cd99c0ce8d4b82475625838e2e) Thanks [@dyc3](https://github.com/dyc3)! - Added the `html.parser.vue` configuration option. When enabled, it adds support for the parsing of Vue in `.html` files. Most Vue users don't need to enable this option since Vue files typically use the `.vue` extension, but it can be useful for projects that embed Vue syntax in regular HTML files. - [#9073](https://github.com/biomejs/biome/pull/9073) [`74b20ee`](https://github.com/biomejs/biome/commit/74b20eee556c9acc72ad5ea335b1bf0983d2eb2e) Thanks [@chocky335](https://github.com/chocky335)! - Added support for applying GritQL plugin rewrites as code actions. GritQL plugins that use the rewrite operator (`=>`) now produce fixable diagnostics for JavaScript, CSS, and JSON files. By default, plugin rewrites are treated as unsafe fixes and require `--write --unsafe` to apply. Plugin authors can pass `fix_kind = "safe"` to `register_diagnostic()` to mark a fix as safe, allowing it to be applied with just `--write`. **Example plugin** (`useConsoleInfo.grit`): ```grit language js `console.log($msg)` as $call where { register_diagnostic(span = $call, message = "Use console.info instead of console.log.", severity = "warn", fix_kind = "safe"), $call => `console.info($msg)` } ``` Running `biome check --write` applies safe rewrites. Unsafe rewrites (the default, or `fix_kind = "unsafe"`) still require `--write --unsafe`. - [#9384](https://github.com/biomejs/biome/pull/9384) [`f4c9edc`](https://github.com/biomejs/biome/commit/f4c9edca8f8772a1e65d9e6701fdc3f604a9f3fe) Thanks [@Conaclos](https://github.com/Conaclos)! - Added the `sortBareImports` option to [`organizeImports`](https://biomejs.dev/assist/actions/organize-imports/), which allows bare imports to be sorted within other imports when set to `false`. ```json { "assist": { "actions": { "source": { "organizeImports": { "level": "on", "options": { "sortBareImports": true } } } } } } ``` ```diff - import "b"; import "a"; + import "b"; import { A } from "a"; + import "./file"; import { Local } from "./file"; - import "./file"; ``` - [#8731](https://github.com/biomejs/biome/pull/8731) [`e7872bf`](https://github.com/biomejs/biome/commit/e7872bffba88f60d6c3cb6d0c2dd7a25452a0205) Thanks [@siketyan](https://github.com/siketyan)! - Added the watch mode (`--watch`) to the CLI for `check`/`format`/`lint` commands. By enabling this option, Biome will re-run the check automatically when any file in the workspace has changed after the first run. - [#10106](https://github.com/biomejs/biome/pull/10106) [`9b35f78`](https://github.com/biomejs/biome/commit/9b35f78e183edf44a3d8b7077ebb0c548a7e92f5) Thanks [@ematipico](https://github.com/ematipico)! - Biome can now format and lint `.svg` files. - [#9967](https://github.com/biomejs/biome/pull/9967) [`e9b6c17`](https://github.com/biomejs/biome/commit/e9b6c17cd6f7e870aea68da3b6c6474aa1a9b4f6) Thanks [@dyc3](https://github.com/dyc3)! - Added HTML support for [`noExcessiveLinesPerFile`](https://biomejs.dev/linter/rules/no-excessive-lines-per-file/). Biome now reports HTML files that exceed the configured line limit, including when `skipBlankLines` is enabled. - [#9491](https://github.com/biomejs/biome/pull/9491) [`b3eb63c`](https://github.com/biomejs/biome/commit/b3eb63c7e19e6ebd41e463289de098bb003686e1) Thanks [@IxxyDev](https://github.com/IxxyDev)! - Added the HTML lint rule [`noAriaUnsupportedElements`](https://biomejs.dev/linter/rules/no-aria-unsupported-elements/). This rule enforces that elements that do not support ARIA roles, states, and properties (`meta`, `html`, `script`, `style`) do not have `role` or `aria-*` attributes. ```html  <meta charset="UTF-8" role="meta" /> ``` - [#9306](https://github.com/biomejs/biome/pull/9306) [`afd57a6`](https://github.com/biomejs/biome/commit/afd57a634bdb6b0b161dc8a2522ac460503569b1) Thanks [@viraxslot](https://github.com/viraxslot)! - Added the [`noNoninteractiveTabindex`](https://biomejs.dev/linter/rules/no-noninteractive-tabindex/) lint rule for HTML. This rule enforces that `tabindex` is not used on non-interactive elements, as it can cause usability issues for keyboard users. ```html <div tabindex="0">Invalid: non-interactive element</div> ` ``` - [#9276](https://github.com/biomejs/biome/pull/9276) [`6d041d9`](https://github.com/biomejs/biome/commit/6d041d919e06595553093e084e6aad0d39fb8109) Thanks [@IxxyDev](https://github.com/IxxyDev)! - Added the HTML lint rule [`noRedundantRoles`](https://biomejs.dev/linter/rules/no-redundant-roles/). This rule enforces that explicit `role` attributes are not the same as the implicit/default role of an HTML element. It supports HTML, Vue, Svelte, and Astro files. ```html  <button role="button"></button> ``` - [#9813](https://github.com/biomejs/biome/pull/9813) [`69aadc2`](https://github.com/biomejs/biome/commit/69aadc27741bb8a74c926e14a2a9777064cb1e03) Thanks [@ematipico](https://github.com/ematipico)! - Added a new linter configuration called `preset`. With the new option, users can enable different kinds of rules at once. The following presets are available: - `"recommended"`: it enables all Biome-recommended rules, or recommended rules of a group; - `"all"`: it enables all Biome rules, or enables all rules of a group; - `"none"`: it disables all Biome rules, or disable all rules of a group. You can enable recommended rules: ```json { "linter": { "rules": { "preset": "recommended" } } } ``` You can enable **all rules** at once: ```json5 { linter: { rules: { preset: "all", // enables all rules }, }, } ``` Or enable all rules for a group: ```json5 { linter: { rules: { style: { preset: "all", // enables all rules in the style group }, }, }, } ``` This new option, however, doesn't affect how nursery rules work. Nursery rules must be enabled singularly, due to their nature. This new option is meant to replace `recommended`, so make sure to run the `migrate` command. - [#10022](https://github.com/biomejs/biome/pull/10022) [`3422d71`](https://github.com/biomejs/biome/commit/3422d71bc5e9d7f07fd4e7509566427e1591d760) Thanks [@Netail](https://github.com/Netail)! - Added the HTML lint rule [`noNoninteractiveElementToInteractiveRole`](https://biomejs.dev/linter/rules/no-noninteractive-element-to-interactive-role/), which enforces that interactive ARIA roles are not assigned to non-interactive HTML elements. **Invalid**: ```html <h1 role="checkbox"></h1> ``` - [#8396](https://github.com/biomejs/biome/pull/8396) [`13785fc`](https://github.com/biomejs/biome/commit/13785fc8f4be068eccff84a8ad90ac8530d5c992) Thanks [@apple-yagi](https://github.com/apple-yagi)! - Biome now supports pnpm catalogs (default and named) when resolving dependencies for linting. This behavior is opt-in and requires setting `javascript.resolver.experimentalPnpmCatalogs` to `true`. - [#10028](https://github.com/biomejs/biome/pull/10028) [`1009414`](https://github.com/biomejs/biome/commit/100941409f3ec5e6653e92b2cfbb4100df1becb0) Thanks [@Netail](https://github.com/Netail)! - Added the HTML lint rule [`noInteractiveElementToNoninteractiveRole`](https://biomejs.dev/linter/rules/no-interactive-element-to-noninteractive-role/), which enforces that non-interactive ARIA roles are not assigned to interactive HTML elements. **Invalid**: ```html <input role="img" /> ``` - [#9853](https://github.com/biomejs/biome/pull/9853) [`816302f`](https://github.com/biomejs/biome/commit/816302f8c8c9862585c283fce22ffd1817dedf9f) Thanks [@Netail](https://github.com/Netail)! - Added the new assist action [`useSortedSelectionSet`](https://biomejs.dev/assist/actions/use-sorted-selection-set/), which sorts GraphQL selection sets alphabetically, e.g. `name, age, id` becomes `age, id, name`. **Invalid**: ```graphql query { name age id } ``` - [#10074](https://github.com/biomejs/biome/pull/10074) [`9c7c6eb`](https://github.com/biomejs/biome/commit/9c7c6eb99f6880aa87ae0e7aff357e978361c4a3) Thanks [@georgephillips](https://github.com/georgephillips)! - Added a `kind` field to the `ImportMatcher` used by the [`organizeImports`](https://biomejs.dev/assist/actions/organize-imports/) assist action. The new field selects imports by their syntactic kind and currently supports `bare` (matching side-effect imports such as `import "polyfill"`) with optional `!` negation (`!bare`). The matcher composes with the existing `type` and `source` fields, so users can express patterns such as "only bare imports that import a CSS file" (`{ "kind": "bare", "source": "**/*.css" }`). For example, with the following configuration: ```json { "assist": { "actions": { "source": { "organizeImports": { "level": "on", "options": { "sortBareImports": true, "groups": [ { "kind": "!bare" }, ":BLANK_LINE:", { "kind": "bare" } ] } } } } } } ``` ...the following code: ```ts import "./register-my-component"; import { render } from "react-dom"; import "./polyfill"; import { Button } from "@/components/Button"; ``` ...is organized as: ```ts import { render } from "react-dom"; import { Button } from "@/components/Button"; import "./polyfill"; import "./register-my-component"; ``` - [#9171](https://github.com/biomejs/biome/pull/9171) [`ce65710`](https://github.com/biomejs/biome/commit/ce65710f591eb2676df6833e9cd00e310981692b) Thanks [@chocky335](https://github.com/chocky335)! - Added `includes` option for plugin file scoping. Plugins can now be configured with glob patterns to restrict which files they run on. Use negated globs for exclusions. ```json { "plugins": [ "global-plugin.grit", { "path": "scoped-plugin.grit", "includes": ["src/**/*.ts", "!**/*.test.ts"] } ] } ``` - [#9617](https://github.com/biomejs/biome/pull/9617) [`dcb99ef`](https://github.com/biomejs/biome/commit/dcb99ef0305d8431af40b526c449316bb8a70efa) Thanks [@faizkhairi](https://github.com/faizkhairi)! - Ported [`useAriaActivedescendantWithTabindex`](https://biomejs.dev/linter/rules/use-aria-activedescendant-with-tabindex/) a11y rule to HTML. - [#9496](https://github.com/biomejs/biome/pull/9496) [`1dfb829`](https://github.com/biomejs/biome/commit/1dfb8291a0a2340e7c9220f9126317a7490ec466) Thanks [@aviraldua93](https://github.com/aviraldua93)! - Added HTML support for the [`noAriaHiddenOnFocusable`](https://biomejs.dev/linter/rules/no-aria-hidden-on-focusable/) accessibility lint rule, which enforces that `aria-hidden="true"` is not set on focusable elements. Focusable elements include native interactive elements (`<button>`, `<input>`, `<select>`, `<textarea>`), elements with `href` (`<a>`, `<area>`), elements with `tabindex >= 0`, and editing hosts (`contenteditable`). Includes an unsafe fix to remove the `aria-hidden` attribute. ```html  <button aria-hidden="true">Submit</button>  <div aria-hidden="true">decorative content</div> ``` - [#9792](https://github.com/biomejs/biome/pull/9792) [`f516854`](https://github.com/biomejs/biome/commit/f51685404f015a5c6f0fc87b9070ac5d9f0a7b6b) Thanks [@Maximiliano-Zeballos](https://github.com/Maximiliano-Zeballos)! - Added the [`useSemanticElements`](https://biomejs.dev/linter/rules/use-semantic-elements/) lint rule for HTML. The rule now detects the use of `role` attributes in HTML elements and suggests using semantic elements instead. For example, the following code is now flagged: ```html <div role="navigation"></div> ``` The rule suggests using `<nav>` instead. - [#9761](https://github.com/biomejs/biome/pull/9761) [`cbbb7d5`](https://github.com/biomejs/biome/commit/cbbb7d5bf21d8fb6db275da7adcc03c034538635) Thanks [@Maximiliano-Zeballos](https://github.com/Maximiliano-Zeballos)! - Ported the [`useValidAriaProps`](https://biomejs.dev/linter/rules/use-valid-aria-props/) lint rule to HTML. This rule checks that all `aria-*` attributes used in HTML elements are valid ARIA attributes as defined by the WAI-ARIA specification. - [#9928](https://github.com/biomejs/biome/pull/9928) [`aa82576`](https://github.com/biomejs/biome/commit/aa82576ff66e03924e07729051ac9bfc59cd5aa1) Thanks [@aviraldua93](https://github.com/aviraldua93)! - Ported [`useValidAriaValues`](https://biomejs.dev/linter/rules/use-valid-aria-values/) to HTML. Biome now validates static `aria-*` attribute values in HTML elements against WAI-ARIA types, catching invalid values such as `aria-hidden="yes"`. - [#10562](https://github.com/biomejs/biome/pull/10562) [`6642895`](https://github.com/biomejs/biome/commit/66428957e6ca393a802f365b8e643438f19a3039) Thanks [@ematipico](https://github.com/ematipico)! - Promoted 73 nursery rules to stable groups. Four rules were renamed as part of the promotion: - `noFloatingClasses` is now [`noUnusedInstantiation`](https://biomejs.dev/linter/rules/no-unused-instantiation/), because the rule checks any discarded `new` expression, not only classes. - `noMultiStr` is now [`noMultilineString`](https://biomejs.dev/linter/rules/no-multiline-string/). - `useFind` is now [`useArrayFind`](https://biomejs.dev/linter/rules/use-array-find/). - `useSpread` is now [`useSpreadOverApply`](https://biomejs.dev/linter/rules/use-spread-over-apply/), because the rule enforces spread call arguments over `Function.apply()`, not array or object spread. ##### Correctness Promoted the following rules to the `correctness` group: - [`noBeforeInteractiveScriptOutsideDocument`](https://biomejs.dev/linter/rules/no-before-interactive-script-outside-document/) - [`noUnusedInstantiation`](https://biomejs.dev/linter/rules/no-unused-instantiation/) - [`useInlineScriptId`](https://biomejs.dev/linter/rules/use-inline-script-id/) (recommended, Next.js domain) - [`noVueVIfWithVFor`](https://biomejs.dev/linter/rules/no-vue-v-if-with-v-for/) (recommended, Vue domain) - [`useVueValidVBind`](https://biomejs.dev/linter/rules/use-vue-valid-v-bind/) (recommended, Vue domain) - [`useVueValidVElse`](https://biomejs.dev/linter/rules/use-vue-valid-v-else/) (recommended, Vue domain) - [`useVueValidVElseIf`](https://biomejs.dev/linter/rules/use-vue-valid-v-else-if/) (recommended, Vue domain) - [`useVueValidVHtml`](https://biomejs.dev/linter/rules/use-vue-valid-v-html/) (recommended, Vue domain) - [`useVueValidVIf`](https://biomejs.dev/linter/rules/use-vue-valid-v-if/) (recommended, Vue domain) - [`useVueValidVOn`](https://biomejs.dev/linter/rules/use-vue-valid-v-on/) (recommended, Vue domain) - [`useVueValidVText`](https://biomejs.dev/linter/rules/use-vue-valid-v-text/) (recommended, Vue domain) - [`useVueValidTemplateRoot`](https://biomejs.dev/linter/rules/use-vue-valid-template-root/) (recommended, Vue domain) - [`useVueValidVCloak`](https://biomejs.dev/linter/rules/use-vue-valid-v-cloak/) (recommended, Vue domain) - [`useVueValidVOnce`](https://biomejs.dev/linter/rules/use-vue-valid-v-once/) (recommended, Vue domain) - [`useVueValidVPre`](https://biomejs.dev/linter/rules/use-vue-valid-v-pre/) (recommended, Vue domain) - [`useVueVForKey`](https://biomejs.dev/linter/rules/use-vue-v-for-key/) (recommended, Vue domain) - [`noDuplicateAttributes`](https://biomejs.dev/linter/rules/no-duplicate-attributes/) (recommended) - [`noDuplicateArgumentNames`](https://biomejs.dev/linter/rules/no-duplicate-argument-names/) (recommended) - [`noDuplicateInputFieldNames`](https://biomejs.dev/linter/rules/no-duplicate-input-field-names/) (recommended) - [`noDuplicateVariableNames`](https://biomejs.dev/linter/rules/no-duplicate-variable-names/) (recommended) - [`noDuplicateEnumValueNames`](https://biomejs.dev/linter/rules/no-duplicate-enum-value-names/) (recommended) - [`useLoneAnonymousOperation`](https://biomejs.dev/linter/rules/use-lone-anonymous-operation/) (recommended) ##### Suspicious Promoted the following rules to the `suspicious` group: - [`noShadow`](https://biomejs.dev/linter/rules/no-shadow/) - [`noUnnecessaryConditions`](https://biomejs.dev/linter/rules/no-unnecessary-conditions/) - [`noParametersOnlyUsedInRecursion`](https://biomejs.dev/linter/rules/no-parameters-only-used-in-recursion/) - [`noUnknownAttribute`](https://biomejs.dev/linter/rules/no-unknown-attribute/) - [`useArraySortCompare`](https://biomejs.dev/linter/rules/use-array-sort-compare/) - [`noForIn`](https://biomejs.dev/linter/rules/no-for-in/) - [`noDuplicatedSpreadProps`](https://biomejs.dev/linter/rules/no-duplicated-spread-props/) - [`noEqualsToNull`](https://biomejs.dev/linter/rules/no-equals-to-null/) - [`noProto`](https://biomejs.dev/linter/rules/no-proto/) (recommended) - [`noUndeclaredEnvVars`](https://biomejs.dev/linter/rules/no-undeclared-env-vars/) (recommended, Turborepo domain) - [`noReturnAssign`](https://biomejs.dev/linter/rules/no-return-assign/) (default severity: `error`) - [`noDuplicateEnumValues`](https://biomejs.dev/linter/rules/no-duplicate-enum-values/) (recommended) - [`noVueArrowFuncInWatch`](https://biomejs.dev/linter/rules/no-vue-arrow-func-in-watch/) (recommended, Vue domain) - [`noNestedPromises`](https://biomejs.dev/linter/rules/no-nested-promises/) - [`noLeakedRender`](https://biomejs.dev/linter/rules/no-leaked-render/) - [`noDeprecatedMediaType`](https://biomejs.dev/linter/rules/no-deprecated-media-type/) (recommended) - [`noDuplicateGraphqlOperationName`](https://biomejs.dev/linter/rules/no-duplicate-graphql-operation-name/) - [`useRequiredScripts`](https://biomejs.dev/linter/rules/use-required-scripts/) ##### Style Promoted the following rules to the `style` group: - [`useVueMultiWordComponentNames`](https://biomejs.dev/linter/rules/use-vue-multi-word-component-names/) (recommended, Vue domain) - [`useVueDefineMacrosOrder`](https://biomejs.dev/linter/rules/use-vue-define-macros-order/) - [`noIncrementDecrement`](https://biomejs.dev/linter/rules/no-increment-decrement/) - [`noContinue`](https://biomejs.dev/linter/rules/no-continue/) - [`useSpreadOverApply`](https://biomejs.dev/linter/rules/use-spread-over-apply/) - [`noTernary`](https://biomejs.dev/linter/rules/no-ternary/) - [`noMultilineString`](https://biomejs.dev/linter/rules/no-multiline-string/) - [`noMultiAssign`](https://biomejs.dev/linter/rules/no-multi-assign/) - [`noExcessiveClassesPerFile`](https://biomejs.dev/linter/rules/no-excessive-classes-per-file/) - [`noExcessiveLinesPerFile`](https://biomejs.dev/linter/rules/no-excessive-lines-per-file/) - [`noVueOptionsApi`](https://biomejs.dev/linter/rules/no-vue-options-api/) - [`useErrorCause`](https://biomejs.dev/linter/rules/use-error-cause/) - [`useConsistentEnumValueType`](https://biomejs.dev/linter/rules/use-consistent-enum-value-type/) - [`useConsistentMethodSignatures`](https://biomejs.dev/linter/rules/use-consistent-method-signatures/) - [`useGlobalThis`](https://biomejs.dev/linter/rules/use-global-this/) (default severity: `warn`) - [`useDestructuring`](https://biomejs.dev/linter/rules/use-destructuring/) - [`useVueHyphenatedAttributes`](https://biomejs.dev/linter/rules/use-vue-hyphenated-attributes/) (recommended, Vue domain) - [`useVueConsistentVBindStyle`](https://biomejs.dev/linter/rules/use-vue-consistent-v-bind-style/) (recommended, Vue domain) - [`useVueConsistentVOnStyle`](https://biomejs.dev/linter/rules/use-vue-consistent-v-on-style/) (recommended, Vue domain) - [`noHexColors`](https://biomejs.dev/linter/rules/no-hex-colors/) - [`useConsistentGraphqlDescriptions`](https://biomejs.dev/linter/rules/use-consistent-graphql-descriptions/) - [`noRootType`](https://biomejs.dev/linter/rules/no-root-type/) - [`useLoneExecutableDefinition`](https://biomejs.dev/linter/rules/use-lone-executable-definition/) - [`useInputName`](https://biomejs.dev/linter/rules/use-input-name/) ##### Complexity Promoted the following rules to the `complexity` group: - [`useArrayFind`](https://biomejs.dev/linter/rules/use-array-find/) - [`noRedundantDefaultExport`](https://biomejs.dev/linter/rules/no-redundant-default-export/) (default severity: `warn`) - [`noUselessReturn`](https://biomejs.dev/linter/rules/no-useless-return/) - [`noDivRegex`](https://biomejs.dev/linter/rules/no-div-regex/) ##### Performance Promoted the following rules to the `performance` group: - [`noSyncScripts`](https://biomejs.dev/linter/rules/no-sync-scripts/) - [`noJsxPropsBind`](https://biomejs.dev/linter/rules/no-jsx-props-bind/) - [`useVueVapor`](https://biomejs.dev/linter/rules/use-vue-vapor/) ##### Security Promoted the following rules to the `security` group: - [`noScriptUrl`](https://biomejs.dev/linter/rules/no-script-url/) (recommended) ##### A11y Promoted the following rules to the `a11y` group: - [`noAmbiguousAnchorText`](https://biomejs.dev/linter/rules/no-ambiguous-anchor-text/) (recommended) - [#10121](https://github.com/biomejs/biome/pull/10121) [`450f8e1`](https://github.com/biomejs/biome/commit/450f8e1c0a46e8c867a63a0842deaa50dee95176) Thanks [@jongwan56](https://github.com/jongwan56)! - Biome now applies Git's local exclude file when VCS ignore files are enabled. Files listed in `.git/info/exclude` are skipped the same way as files listed in `.gitignore`, including in linked worktrees. - [#9397](https://github.com/biomejs/biome/pull/9397) [`d5913c9`](https://github.com/biomejs/biome/commit/d5913c9d57b771b0b1c0097f8014017878cc14c2) Thanks [@mvarendorff](https://github.com/mvarendorff)! - Added `ignore` option to the [noUnusedVariables](https://biomejs.dev/linter/rules/no-unused-variables/) rule. The option allows excluding identifiers by providing a list of ignored names. It also allows excluding kinds of identifiers from this rule entirely, which may be useful when loading classes dynamically. For example, unused classes as well as all unused variables, functions, etc. called "unused" may be ignored entirely with the following configuration: ```json { "ignore": { "*": ["unused"], "class": ["*"] } } ``` - [#10089](https://github.com/biomejs/biome/pull/10089) [`71a21f0`](https://github.com/biomejs/biome/commit/71a21f0ab4fd32739331d3b3068c6c1ae6392290) Thanks [@Netail](https://github.com/Netail)! - Added the lint rule [`noLabelWithoutControl`](https://biomejs.dev/linter/rules/no-label-without-control/) to HTML, which enforces that a label element or component has a text label and an associated input. ```html <label></label> ``` - [#10015](https://github.com/biomejs/biome/pull/10015) [`1828261`](https://github.com/biomejs/biome/commit/182826178de9c1b23bad2e997c3567a9d5176ba2) Thanks [@Netail](https://github.com/Netail)! - Added the HTML lint rule [`useAriaPropsSupportedByRole`](https://biomejs.dev/linter/rules/use-aria-props-supported-by-role/), which enforces that ARIA properties are valid for the roles that are supported by the element. ```html <a href="#" aria-checked></a> ``` - [#10234](https://github.com/biomejs/biome/pull/10234) [`1a51569`](https://github.com/biomejs/biome/commit/1a51569229936b9ad1191d081ed6742e8342badd) Thanks [@ematipico](https://github.com/ematipico)! - Added the `delimiterSpacing` formatter option. This option inserts spaces inside delimiters (after the opening delimiter and before the closing delimiter) when the content fits on a single line. Empty delimiters are not affected, and no space is added before the opening delimiter. The specific delimiters affected depend on the language. It can be configured globally via `formatter.delimiterSpacing` or per-language via `javascript.formatter.delimiterSpacing`, `json.formatter.delimiterSpacing`, and `css.formatter.delimiterSpacing`. Defaults to `false`. ```diff - callFn(foo) + callFn( foo ) ``` ```diff - const arr = [1, 2, 3]; + const arr = [ 1, 2, 3 ]; ``` ##### JavaScript When enabled, Biome inserts spaces inside parentheses (e.g., `foo( a, b )`), square brackets (e.g., `[ a, b ]`), template literal interpolations (e.g., `${ expr }`), and the logical NOT operator (e.g., `! x`, but in chains only after the last one: `!! x`). Only applies when the content fits on a single line. Empty delimiters and the space before the opening delimiter are not affected. ```diff - if (condition) {} + if ( condition ) {} ``` ```diff - `Hello ${name}!` + `Hello ${ name }!` ``` ##### JSX When enabled, Biome inserts spaces inside JSX expression braces (e.g., `attr={ value }`) and spread attributes (e.g., `{ ...props }`). Only applies when the content fits on a single line. Empty delimiters are not affected. ```diff - <Foo bar={value} /> + <Foo bar={ value } /> ``` ##### TypeScript When enabled, Biome inserts spaces inside TypeScript angle brackets (e.g., `foo< T >()`), indexed access types (e.g., `T[ K ]`), mapped types, tuple types, type parameters, and index signatures. Only applies when the content fits on a single line. Empty delimiters are not affected. ```diff - type Result = Map<string, number>; + type Result = Map< string, number >; ``` ##### JSON When enabled, Biome inserts spaces inside square brackets when the content fits on a single line. Empty brackets are not affected. ```diff - [1, 2, 3] + [ 1, 2, 3 ] ``` ##### CSS When enabled, Biome inserts spaces inside parentheses and square brackets when the content fits on a single line. Empty delimiters are not affected. ```diff - rgba(0, 0, 0, 1) + rgba( 0, 0, 0, 1 ) ``` ```diff - [data-attr] + [ data-attr ] ``` - [#10461](https://github.com/biomejs/biome/pull/10461) [`6bac1c3`](https://github.com/biomejs/biome/commit/6bac1c3457d396215e4daed5fc59eaf23b42f4eb) Thanks [@TXWSLYF](https://github.com/TXWSLYF)! - Implements [#9445](https://github.com/biomejs/biome/issues/9445). Added the `allowImplicit` option to [`useIterableCallbackReturn`](https://biomejs.dev/linter/rules/use-iterable-callback-return/). When enabled, callbacks can use `return;` to implicitly return `undefined`, matching ESLint's `array-callback-return` rule. - [#9571](https://github.com/biomejs/biome/pull/9571) [`5a8eb75`](https://github.com/biomejs/biome/commit/5a8eb755fe07b38760d2b72ec46e24cd108f6619) Thanks [@dyc3](https://github.com/dyc3)! - Added configurable options to the [`useNumericSeparators`](https://biomejs.dev/linter/rules/use-numeric-separators/) rule. Users can now customize the minimum number of digits required before adding separators and the group length for each type of numeric literal (`binary`, `octal`, `decimal`, `hexadecimal`). ```json { "linter": { "rules": { "style": { "useNumericSeparators": { "level": "error", "options": { "decimal": { "minimumDigits": 7, "groupLength": 3 }, "hexadecimal": { "minimumDigits": 4, "groupLength": 2 } } } } } } } ``` - [#10067](https://github.com/biomejs/biome/pull/10067) [`6064312`](https://github.com/biomejs/biome/commit/60643120b5593104b311e184cf9581b9c7c2254d) Thanks [@Netail](https://github.com/Netail)! - Added the lint rule [`useFocusableInteractive`](https://biomejs.dev/linter/rules/use-focusable-interactive/) to HTML, which enforces elements with an interactive role and interaction handler to be focusable. **Invalid**: ```html <div role="button"></div> ``` - [#10026](https://github.com/biomejs/biome/pull/10026) [`fb42ac4`](https://github.com/biomejs/biome/commit/fb42ac42079ec7b8e699a507bce332f4446ac7f2) Thanks [@Netail](https://github.com/Netail)! - Added the HTML lint rule [`noNoninteractiveElementInteractions`](https://biomejs.dev/linter/rules/no-noninteractive-element-interactions/), which disallows use event handlers on non-interactive elements. **Invalid**: ```html <div onclick="myFunction()">button</div> ``` - [#10000](https://github.com/biomejs/biome/pull/10000) [`2093e3e`](https://github.com/biomejs/biome/commit/2093e3ee2a615abecae159d35a5a17fe0df5f506) Thanks [@Netail](https://github.com/Netail)! - Added the new assist action [`useSortedEnumMembers`](https://biomejs.dev/assist/actions/use-sorted-enum-members/), which sorts TypeScript & GraphQL enum members. **Invalid**: ```graphql enum Role { SUPER_ADMIN ADMIN USER GOD } ``` - [#10013](https://github.com/biomejs/biome/pull/10013) [`ad01d3d`](https://github.com/biomejs/biome/commit/ad01d3d882276b070433822f01cdf6afed63ca4e) Thanks [@Netail](https://github.com/Netail)! - Added the HTML lint rule [`useValidAutocomplete`](https://biomejs.dev/linter/rules/use-valid-autocomplete/), which enforces using valid values for the `autocomplete` attribute on `input` elements. ```html <input autocomplete="incorrect" /> ``` ##### Patch Changes - [#10498](https://github.com/biomejs/biome/pull/10498) [`995c1ff`](https://github.com/biomejs/biome/commit/995c1ffeca039787c93370fed8b970a057e9c073) Thanks [@citadelgrad](https://github.com/citadelgrad)! - Added the nursery rule [`useReactFunctionComponentDefinition`](https://biomejs.dev/linter/rules/use-react-function-component-definition), which enforces a consistent function type for named React function components. For example, the following snippet triggers the rule by default. ```jsx const MyComponent = (props) => { return <div>{props.name}</div>; }; ``` - [#9974](https://github.com/biomejs/biome/pull/9974) [`ff635a9`](https://github.com/biomejs/biome/commit/ff635a90da3567a9006ae947b6c5983d87dfbb9f) Thanks [@pkallos](https://github.com/pkallos)! - Added `ignoreMixedLogicalExpressions` to [useNullishCoalescing](https://biomejs.dev/linter/rules/use-nullish-coalescing/), partially addressing [#9232](https://github.com/biomejs/biome/issues/9232). When enabled, Biome ignores `||` and `||=` mixed with `&&` in the same expression tree. - [#10503](https://github.com/biomejs/biome/pull/10503) [`c656679`](https://github.com/biomejs/biome/commit/c656679d1f9e725a42e5d60fb3b9e76bb03d7f88) Thanks [@Mokto](https://github.com/Mokto)! - Added the new nursery rule `useSvelteRequireEachKey`, a Svelte lint rule that reports `{#each}` blocks with item bindings that are missing a key. - [#10516](https://github.com/biomejs/biome/pull/10516) [`0f29b83`](https://github.com/biomejs/biome/commit/0f29b8361ba3cd11bdbfb91f8ff722184cfadf08) Thanks [@Dotify71](https://github.com/Dotify71)! - Added [`useIncludes`](https://biomejs.dev/linter/rules/use-includes/) to the nursery group. This rule flags comparisons of `String.prototype.indexOf()` or `Array.prototype.indexOf()` against `-1` and suggests replacing them with the clearer `includes()` / `!includes()` form. - [#10487](https://github.com/biomejs/biome/pull/10487) [`0c03ee3`](https://github.com/biomejs/biome/commit/0c03ee3deee068220175c3599e6bc3c4ed8ad247) Thanks [@Mokto](https://github.com/Mokto)! - Fixed a Svelte parser error that incorrectly required a binding variable after `{:then}` and `{:catch}`. Biome now correctly accepts `{:then}` and `{:catch}` without a binding, as well as the `{#await expr then}` and `{#await expr catch}` shorthand forms. - [#10566](https://github.com/biomejs/biome/pull/10566) [`a4a294c`](https://github.com/biomejs/biome/commit/a4a294c3c1128fc5b38634262d499d3d2601bf3b) Thanks [@dyc3](https://github.com/dyc3)! - Fixed [`useVueHyphenatedAttributes`](https://biomejs.dev/linter/rules/use-vue-hyphenated-attributes/): The rule now only reports diagnostics in Vue files and ignores SVG elements. - [#10565](https://github.com/biomejs/biome/pull/10565) [`72ccf3b`](https://github.com/biomejs/biome/commit/72ccf3b042c4258f9871ff5b99d87f879cecccde) Thanks [@dyc3](https://github.com/dyc3)! - Fixed [`useVueConsistentVBindStyle`](https://biomejs.dev/linter/rules/use-vue-consistent-v-bind-style/): The rule no longer reports argument-less `v-bind` directives because they cannot be converted to shorthand syntax. - [#10591](https://github.com/biomejs/biome/pull/10591) [`6e8557b`](https://github.com/biomejs/biome/commit/6e8557b1b8e49ce2383f6089a46624eb030178ad) Thanks [@xsourabhsharma](https://github.com/xsourabhsharma)! - Fixed [#10563](https://github.com/biomejs/biome/issues/10563): Biome now parses comma-separated CSS Modules `composes` values, such as `composes: classA from "./a.css", classB from "./b.css";`. - [#10603](https://github.com/biomejs/biome/pull/10603) [`174b21b`](https://github.com/biomejs/biome/commit/174b21b52993fc3e0237ceefe97c0d71c9b5264e) Thanks [@denbezrukov](https://github.com/denbezrukov)! - Fixed CSS formatting for `grid-template-areas` declarations with comments before multiline values. Biome now keeps grid area rows aligned instead of adding an extra declaration-boundary indent. ```diff .grid { grid-template-areas: /* row */ - "header header" - "footer footer"; + "header header" + "footer footer"; } ``` - [#10542](https://github.com/biomejs/biome/pull/10542) [`c3f07f7`](https://github.com/biomejs/biome/commit/c3f07f773edeb7f098c778392c5e2d6bb92b78fb) Thanks [@dyc3](https://github.com/dyc3)! - Fixed [#10513](https://github.com/biomejs/biome/issues/10513): Biome no longer rejects literal `\u` sequences in quoted HTML attribute values. - [#10108](https://github.com/biomejs/biome/pull/10108) [`24e51d6`](https://github.com/biomejs/biome/commit/24e51d6edebaee0ffb938bc20633d9c3403110c9) Thanks [@IxxyDev](https://github.com/IxxyDev)! - Fixed [#6611](https://github.com/biomejs/biome/issues/6611): [`noUnnecessaryConditions`](https://biomejs.dev/linter/rules/no-unnecessary-conditions/) now uses type information to detect more redundant conditions, including `?.`, `??`, `||`, `&&`, comparisons against `null`/`undefined` on non-nullish operands, and `case` clauses that can never match the `switch` value. - [#10568](https://github.com/biomejs/biome/pull/10568) [`eb1ed0e`](https://github.com/biomejs/biome/commit/eb1ed0e90395a07e64ee763fe15ae00fb77682e0) Thanks [@harsha-cpp](https://github.com/harsha-cpp)! - Fixed [#10564](https://github.com/biomejs/biome/issues/10564): `useAriaPropsForRole` no longer reports false positives for Vue v-bind shorthand bindings (`:aria-checked`, `:aria-level`, etc.). - [#10570](https://github.com/biomejs/biome/pull/10570) [`2ceb4fe`](https://github.com/biomejs/biome/commit/2ceb4fe437b77b08a60ad48efde2a6c311b7d2e3) Thanks [@Conaclos](https://github.com/Conaclos)! - Improved [`noTsIgnore`](https://biomejs.dev/linter/rules/no-ts-ignore/). The rule now reports more precisely the range of the `@ts-ignore` comment. - [#10520](https://github.com/biomejs/biome/pull/10520) [`b55d10f`](https://github.com/biomejs/biome/commit/b55d10f5e8f3099b3f246911ca19cc79758d55e0) Thanks [@dyc3](https://github.com/dyc3)! - Fixed [#10519](https://github.com/biomejs/biome/issues/10519): Vue `v-on` event handlers with multiple inline statements are now parsed consistently with Vue. - [#10204](https://github.com/biomejs/biome/pull/10204) [`ebbf0bd`](https://github.com/biomejs/biome/commit/ebbf0bd382059936ac00de29fc58931728f854d9) Thanks [@ematipico](https://github.com/ematipico)! - Improved the performance of the Biome linter. The improvements are more visible in bigger projects that have more than \~1k files. Early tests showed that in a code base with \~2k files, Biome took less than 26% of time to finish the command. - [#10546](https://github.com/biomejs/biome/pull/10546) [`e39bb2c`](https://github.com/biomejs/biome/commit/e39bb2c23063ad0384a12e01d666909fd6b26735) Thanks [@tim-we](https://github.com/tim-we)! - Fixed [`#10536`](https://github.com/biomejs/biome/issues/10536): [noUnknownFunction](https://biomejs.dev/linter/rules/no-unknown-function/) no longer flagged CSS `contrast-color()` as unknown. `contrast-color()` is Baseline 2026. - [#8012](https://github.com/biomejs/biome/pull/8012) [`2be0264`](https://github.com/biomejs/biome/commit/2be02648a090153a93cf71fb63ef68feefd495c2) Thanks [@denbezrukov](https://github.com/denbezrukov)! - Improved the performance of the formatter in some cases. The formatter is now up to \~20% faster at formatting files. - [#10467](https://github.com/biomejs/biome/pull/10467) [`9a5855e`](https://github.com/biomejs/biome/commit/9a5855e4191c98149f8278289569b2272b992684) Thanks [@Netail](https://github.com/Netail)! - Added a new nursery rule [`noRestrictedDependencies`](https://biomejs.dev/linter/rules/no-restricted-dependencies/), which flags imports and `package.json` dependency entries that have better alternatives in e18e's module replacement data. For example, the package `globby` is reported because there's a better alternative: ```js import glob from "globby"; ``` ```json { "dependencies": { "globby": "x.x.x" } } ``` - [#10470](https://github.com/biomejs/biome/pull/10470) [`84b43c5`](https://github.com/biomejs/biome/commit/84b43c5969569cb3eea3d51ea6c602276723306b) Thanks [@ShaharAviram1](https://github.com/ShaharAviram1)! - Fixed [#10447](https://github.com/biomejs/biome/issues/10447): now the rule [`noProcessEnv`](https://biomejs.dev/linter/rules/no-process-env) detects the use of `env` when it's imported from `process` and `node:process`. - [#10556](https://github.com/biomejs/biome/pull/10556) [`7ff6b16`](https://github.com/biomejs/biome/commit/7ff6b165f2f62a0836446dee889d9868f12fb06e) Thanks [@ematipico](https://github.com/ematipico)! - Fixed [#10492](https://github.com/biomejs/biome/issues/10492): Biome no longer crashes with a stack overflow on certain code when a type-aware rule such as [`noFloatingPromises`](https://biomejs.dev/linter/rules/no-floating-promises/), [`noMisusedPromises`](https://biomejs.dev/linter/rules/no-misused-promises/), or [`noUnnecessaryConditions`](https://biomejs.dev/linter/rules/no-unnecessary-conditions/) is enabled. For example, the following code used to crash Biome: ```js function f(visitor) { let ctrl = visitor(); for (const x of [0]) ctrl = ctrl(); } ``` - [#10532](https://github.com/biomejs/biome/pull/10532) [`1da3c75`](https://github.com/biomejs/biome/commit/1da3c7573cdb1d097fc1773fee686140d95f3f35) Thanks [@denbezrukov](https://github.com/denbezrukov)! - CSS declarations with comments before `:` or after `!important` now preserve spaces before `:` and `;`. ```diff .selector { - padding/* name */: 1px; - color: red !important /* note */; + padding/* name */ : 1px; + color: red !important /* note */ ; } ``` - [#10491](https://github.com/biomejs/biome/pull/10491) [`a1b5834`](https://github.com/biomejs/biome/commit/a1b5834d4968fd518cc4adfa0e8b4b65b2232637) Thanks [@Mokto](https://github.com/Mokto)! - Fixed the Svelte parser rejecting `{#each}` blocks where the binding uses object destructuring with property renaming, e.g. `{#each items as { id, component: Filter }}`. Biome now correctly parses and formats these rename bindings. - [#10490](https://github.com/biomejs/biome/pull/10490) [`99bc7df`](https://github.com/biomejs/biome/commit/99bc7df1d1cbb599e9713da56c29763cd04bb53c) Thanks [@Mokto](https://github.com/Mokto)! - Fixed the CSS parser rejecting comma-separated selector lists inside `:global()` and `:local()` pseudo-class functions. Biome now correctly parses `:global(.foo, .bar)`. - [#10543](https://github.com/biomejs/biome/pull/10543) [`c394fae`](https://github.com/biomejs/biome/commit/c394faeaa27f9f7db8ba075afc6657c0245d8276) Thanks [@mangod12](https://github.com/mangod12)! - Fixed [#10477](https://github.com/biomejs/biome/issues/10477): The RDJSON reporter now emits code replacement text for fix suggestions instead of the human-readable fix description. - [#10530](https://github.com/biomejs/biome/pull/10530) [`e8e1e6a`](https://github.com/biomejs/biome/commit/e8e1e6aa1b39d1e19d33c12d4b56d6d3fd01a7ce) Thanks [@Conaclos](https://github.com/Conaclos)! - Fixed [#10493](https://github.com/biomejs/biome/issues/10493): [`useImportType`](https://biomejs.dev/linter/rules/use-import-type/) now correctly separates types from a default named import when all imports are types and the `style` option is set to `separatedType`. - [#10555](https://github.com/biomejs/biome/pull/10555) [`263c7cc`](https://github.com/biomejs/biome/commit/263c7ccd12cd8c0d4527fdf4797c652a223df012) Thanks [@Mokto](https://github.com/Mokto)! - Improved Svelte lint rule accuracy for quoted attribute values containing `{expression}` interpolations. - [`noRedundantAlt`](https://biomejs.dev/linter/rules/no-redundant-alt/) no longer emits false positives when the alt text contains an interpolation, e.g. `alt="image of {person}"`. - [`useButtonType`](https://biomejs.dev/linter/rules/use-button-type/) no longer emits false positives for dynamic button types written as `type="{dynamicType}"`. - [`noScriptUrl`](https://biomejs.dev/linter/rules/no-script-url/) no longer emits false positives for dynamic hrefs such as `href="{url}"`. - [#10489](https://github.com/biomejs/biome/pull/10489) [`96ef9a4`](https://github.com/biomejs/biome/commit/96ef9a4c2647a71d917485f6791e151cf8b88c96) Thanks [@Mokto](https://github.com/Mokto)! - Fixed Svelte `{#each}` parser incorrectly rejecting TypeScript `as const` type assertions in the iterable expression. Biome now correctly parses `{#each arr as const as item}`. - [#10539](https://github.com/biomejs/biome/pull/10539) [`935c59a`](https://github.com/biomejs/biome/commit/935c59a6657022c37c9b9933c66cc29c236e5aff) Thanks [@dyc3](https://github.com/dyc3)! - Improved how diagnostics print long lines of code, for example minified files where the entire source code is printed in one line. ### [`v2.4.16`](https://github.com/biomejs/biome/blob/HEAD/packages/@biomejs/biome/CHANGELOG.md#2416) [Compare Source](https://github.com/biomejs/biome/compare/@biomejs/biome@2.4.15...@biomejs/biome@2.4.16) ##### Patch Changes - [#10329](https://github.com/biomejs/biome/pull/10329) [`ef764d5`](https://github.com/biomejs/biome/commit/ef764d51b9f5be18ec5a4f9b4dce732512e5d805) Thanks [@Conaclos](https://github.com/Conaclos)! - Fixed an issue where diagnostics showed an incorrect location in Astro files. - [#10363](https://github.com/biomejs/biome/pull/10363) [`50aa415`](https://github.com/biomejs/biome/commit/50aa4157599a1ac5c77c13bce81f5c87240beff0) Thanks [@dyc3](https://github.com/dyc3)! - Fixed HTML formatting for a case where comments could cause the formatter to split up a closing tag, which would cause the resulting HTML to be syntactically invalid. Input: ```html <span ><span>a</span ><span>b</span ></span> ``` Output: ```diff <span > <span>a</span ><span>b</span><span>a</span><span>b</span></span > ``` - [#10465](https://github.com/biomejs/biome/pull/10465) [`0c718da`](https://github.com/biomejs/biome/commit/0c718da81770f47d65845bc1a006f99512d9359b) Thanks [@dfedoryshchev](https://github.com/dfedoryshchev)! - Fixed diagnostics emitted by the `noUntrustedLicenses` rule. - [#10358](https://github.com/biomejs/biome/pull/10358) [`05c2617`](https://github.com/biomejs/biome/commit/05c26176573534a0abfa92d454d244f9569bc77d) Thanks [@dyc3](https://github.com/dyc3)! - Fixed [#10356](https://github.com/biomejs/biome/issues/10356): `biome rage --linter` now displays rules enabled through linter domains in the enabled rules list. - [#10300](https://github.com/biomejs/biome/pull/10300) [`950247c`](https://github.com/biomejs/biome/commit/950247c389e693c16b47d61d8ef0f1b85d1a1b02) Thanks [@dyc3](https://github.com/dyc3)! - Fixed [#10265](https://github.com/biomejs/biome/issues/10265): Svelte function bindings such as `bind:value={get, set}` are now parsed more precisely, so [`noCommaOperator`](https://biomejs.dev/linter/rules/no-comma-operator/) won't emit false positives for that syntax anymore. - [#9786](https://github.com/biomejs/biome/pull/9786) [`e71f584`](https://github.com/biomejs/biome/commit/e71f58490f3121432d1bc24ae5330ecf96391a40) Thanks [@MeGaNeKoS](https://github.com/MeGaNeKoS)! - Fixed [#8480](https://github.com/biomejs/biome/issues/8480): [`useDestructuring`](https://biomejs.dev/linter/rules/use-destructuring/) now provides `variableDeclarator` and `assignmentExpression` options to control which contexts enforce destructuring, matching ESLint's `prefer-destructuring` configuration. Both default to `{array: true, object: true}`. The diagnostic for object destructuring in assignment expressions now instructs users to wrap the assignment in parentheses. - [#10425](https://github.com/biomejs/biome/pull/10425) [`1948b72`](https://github.com/biomejs/biome/commit/1948b7242e092ed0cfcf501ef6f119202b8ea93b) Thanks [@sjh9714](https://github.com/sjh9714)! - Fixed [#10244](https://github.com/biomejs/biome/issues/10244): The `useOptionalChain` rule now detects negated guard inequality chains like `!foo || foo.bar !== "x"`. - [#10442](https://github.com/biomejs/biome/pull/10442) [`001f94f`](https://github.com/biomejs/biome/commit/001f94f696d9baca3c231d39895a01d4dd528d52) Thanks [@ematipico](https://github.com/ematipico)! - Fixed [#10411](https://github.com/biomejs/biome/issues/10411): [`noMisusedPromises`](https://biomejs.dev/linter/rules/no-misused-promises/) no longer causes a stack overflow when a nested function returns an object with shorthand properties that shadow destructured variables from an outer scope. - [#10318](https://github.com/biomejs/biome/pull/10318) [`9b1577f`](https://github.com/biomejs/biome/commit/9b1577fa400279d9b0222cbc920cfa9ddcf1c9d6) Thanks [@dyc3](https://github.com/dyc3)! - Added support for `formatter.trailingCommas` in overrides. This option was previously available in the top-level formatter configuration but missing from formatter overrides. - [#10319](https://github.com/biomejs/biome/pull/10319) [`2e37709`](https://github.com/biomejs/biome/commit/2e3770923f9fb4e33606113e726014f7b63730d0) Thanks [@dyc3](https://github.com/dyc3)! - Fixed Vue and Svelte formatting for standalone interpolations in inline elements. Biome now preserves existing newlines in cases like: ```diff - <span> {{ value }} </span> + <span> + {{ value }} + </span> ``` - [#10365](https://github.com/biomejs/biome/pull/10365) [`0a58eb0`](https://github.com/biomejs/biome/commit/0a58eb0982460b757a26f94d958a7e40c0686227) Thanks [@Netail](https://github.com/Netail)! - Fixed [#10361](https://github.com/biomejs/biome/issues/10361): [`noUnusedFunctionParameters`](https://biomejs.dev/linter/rules/no-unused-function-parameters/) now mentions the parameter name in the diagnostic. - [#10439](https://github.com/biomejs/biome/pull/10439) [`df6b867`](https://github.com/biomejs/biome/commit/df6b867bb6fd210cc75ac03d832e7281eced5b61) Thanks [@denbezrukov](https://github.com/denbezrukov)! - Fixed CSS and SCSS formatting for comments around declaration colons so comments between property names, colons, and values stay at the same boundary as Prettier. ```diff .selector { - color: /* red, */ - blue; + color: /* red, */ blue; } ``` - [#10344](https://github.com/biomejs/biome/pull/10344) [`b30208c`](https://github.com/biomejs/biome/commit/b30208c06365907d6fb376f030bc75bbf5e3dea9) Thanks [@siketyan](https://github.com/siketyan)! - Fixed [`#10123`](https://github.com/biomejs/biome/issues/10123): Corrected the [`noReactNativeDeepImports`](https://biomejs.dev/linter/rules/no-react-native-deep-imports/) source rule to point to the proper upstream rule, so users can migrate from the original rule correctly. - [#10328](https://github.com/biomejs/biome/pull/10328) [`b59133f`](https://github.com/biomejs/biome/commit/b59133fd2a8afa33564914df531f7f752b48ecee) Thanks [@dyc3](https://github.com/dyc3)! - Fixed [#10309](https://github.com/biomejs/biome/issues/10309): Biome no longer adds newlines to Astro frontmatter when linter or assist `--write` mode is enabled. ### [`v2.4.15`](https://github.com/biomejs/biome/blob/HEAD/packages/@biomejs/biome/CHANGELOG.md#2415) [Compare Source](https://github.com/biomejs/biome/compare/@biomejs/biome@2.4.14...@biomejs/biome@2.4.15) ##### Patch Changes - [#9394](https://github.com/biomejs/biome/pull/9394) [`ba3480e`](https://github.com/biomejs/biome/commit/ba3480e62da6ac7f0f9d99126f1459a72306368b) Thanks [@dyc3](https://github.com/dyc3)! - Added the nursery rule [`useTestHooksInOrder`](https://biomejs.dev/linter/rules/use-test-hooks-in-order) in the `test` domain. The rule enforces that Jest/Vitest lifecycle hooks (`beforeAll`, `beforeEach`, `afterEach`, `afterAll`) are declared in the order they execute, making test setup and teardown easier to reason about. - [#10254](https://github.com/biomejs/biome/pull/10254) [`e0a54cc`](https://github.com/biomejs/biome/commit/e0a54ccc0a0c892fff2270ae772bcecf0d34e79a) Thanks [@dyc3](https://github.com/dyc3)! - Added a new nursery rule [`useVueNextTickPromise`](https://biomejs.dev/linter/rules/use-vue-next-tick-promise/), which enforces Promise syntax when using Vue `nextTick`. For example, the following snippet triggers the rule: ```js import { nextTick } from "vue"; nextTick(() => { updateDom(); }); ``` - [#10219](https://github.com/biomejs/biome/pull/10219) [`64aee45`](https://github.com/biomejs/biome/commit/64aee454ac2db2ade31089c1438dd761c94a8d57) Thanks [@dyc3](https://github.com/dyc3)! - Added a new nursery rule [`noVueVOnNumberValues`](https://biomejs.dev/linter/rules/no-vue-v-on-number-values/), that disallows deprecated number modifiers on Vue `v-on` directives. For example, the following snippet triggers the rule: ```vue <input @keyup.13="submit" /> ``` - [#10195](https://github.com/biomejs/biome/pull/10195) [`7b8d4e1`](https://github.com/biomejs/biome/commit/7b8d4e161a225f14bc9e070e04cc8572ee988bb2) Thanks [@dyc3](https://github.com/dyc3)! - Added the new nursery rule [`useVueValidVFor`](https://biomejs.dev/linter/rules/use-vue-valid-v-for/), which validates Vue `v-for` directives and reports invalid aliases, missing component keys, and keys that do not use iteration variables. - [#10238](https://github.com/biomejs/biome/pull/10238) [`1110256`](https://github.com/biomejs/biome/commit/1110256c6d60500ebc05b9d2738fe77345c7ffd6) Thanks [@dyc3](https://github.com/dyc3)! - Added the recommended nursery rule [`noVueImportCompilerMacros`](https://biomejs.dev/linter/rules/no-vue-import-compiler-macros/), which disallows importing Vue compiler macros such as `defineProps` from `vue` because they are automatically available. - [#10201](https://github.com/biomejs/biome/pull/10201) [`1a08f89`](https://github.com/biomejs/biome/commit/1a08f89df55eafe1d8463696d1be53f8dea90a80) Thanks [@realknove](https://github.com/realknove)! - Fixed [#10193](https://github.com/biomejs/biome/issues/10193): `style/useReadonlyClassProperties` no longer reports class properties as readonly-able when they are assigned inside arrow callbacks nested in class property initializers. - [#9574](https://github.com/biomejs/biome/pull/9574) [`3bd2b6a`](https://github.com/biomejs/biome/commit/3bd2b6adf0be44eda922ad7610781dd2e387bdb6) Thanks [@Conaclos](https://github.com/Conaclos)! - Fixed [#9530](https://github.com/biomejs/biome/issues/9530). The diagnostics of [`organizeImports`](https://biomejs.dev/assist/actions/organize-imports/) are now more detailed and more precise. They are also better at localizing where the issue is. - [#10205](https://github.com/biomejs/biome/pull/10205) [`a704a6c`](https://github.com/biomejs/biome/commit/a704a6c40392e71aad5127ab35c771486116937e) Thanks [@Conaclos](https://github.com/Conaclos)! - Fixed [#10185](https://github.com/biomejs/biome/issues/10185). [\`organizeImports](https://biomejs.dev/assist/actions/organize-imports/) now errors when it encounters an unknown predefined group. The following configuration is now reported as invalid because `:INEXISTENT:` is an unknown predefined group. ```json { "assist": { "actions": { "source": { "organizeImports": { "options": { "groups": [":INEXISTENT:"] } } } } } } ``` - [#10052](https://github.com/biomejs/biome/pull/10052) [`b565bed`](https://github.com/biomejs/biome/commit/b565bedf53bd241bfef57883439d6a60a19b43c5) Thanks [@minseong0324](https://github.com/minseong0324)! - Improved [`noMisleadingReturnType`](https://biomejs.dev/linter/rules/no-misleading-return-type/): it now flags union annotations whose extra variants are never returned, and suggests the narrower type (e.g. `string | null` → `string`). These functions are now reported because `null` and `number` are included in the return annotations but never returned: ```ts function getUser(): string | null { return "hello"; } // null is never returned function getCode(): string | number { return "hello"; } // number is never returned ``` - [#10213](https://github.com/biomejs/biome/pull/10213) [`ac30057`](https://github.com/biomejs/biome/commit/ac30057415302e74003d428e96983433441e84dc) Thanks [@dyc3](https://github.com/dyc3)! - Fixed [#9450](https://github.com/biomejs/biome/issues/9450): HTML and Vue element formatting now preserves child line breaks when an element contains another element child on its own line, instead of collapsing the child element onto the same line. - [#10275](https://github.com/biomejs/biome/pull/10275) [`9ee6c03`](https://github.com/biomejs/biome/commit/9ee6c03203581639b564b6c7f81b3e5a2febea58) Thanks [@solithcy](https://github.com/solithcy)! - Fixed [#10274](https://github.com/biomejs/biome/issues/10274): Svelte templates with missing expressions no longer parsed as `HtmlBogusElement` - [#10143](https://github.com/biomejs/biome/pull/10143) [`56798a7`](https://github.com/biomejs/biome/commit/56798a76b9e7f57caf070acd51734beb61904d9d) Thanks [@minseong0324](https://github.com/minseong0324)! - [`noMisleadingReturnType`](https://biomejs.dev/linter/rules/no-misleading-return-type/) now detects misleading return type annotations when object literal properties are initialized with `as const`. This function is now reported because the return annotation widens a property initialized with `as const`: ```ts function f(): { value: string } { return { value: "text" as const }; } ``` - [#10143](https://github.com/biomejs/biome/pull/10143) [`56798a7`](https://github.com/biomejs/biome/commit/56798a76b9e7f57caf070acd51734beb61904d9d) Thanks [@minseong0324](https://github.com/minseong0324)! - [`noUselessTypeConversion`](https://biomejs.dev/linter/rules/no-useless-type-conversion/) now detects redundant conversions on object literal properties initialized with `as const`. This conversion is now reported because `message.value` is inferred as a string literal: ```ts const message = { value: "text" as const }; String(message.value); ``` - [#9807](https://github.com/biomejs/biome/pull/9807) [`0ae5840`](https://github.com/biomejs/biome/commit/0ae58406b4752f296adfccf94b1d2a042c4cddc7) Thanks [@dyc3](https://github.com/dyc3)! - Added the new nursery rule [`useThisInClassMethods`](https://biomejs.dev/linter/rules/use-this-in-class-methods/), based on ESLint's `class-methods-use-this`. The rule now reports instance methods, getters, setters, and function-valued instance fields that do not use `this`, and `biome migrate eslint` preserves the supported `ignoreMethods`, `ignoreOverrideMethods`, and `ignoreClassesWithImplements` options. **Invalid**: ```js class Foo { bar() { // does not use `this`, invalid console.log("Hello Biome"); } } ``` - [#10258](https://github.com/biomejs/biome/pull/10258) [`e7b18f7`](https://github.com/biomejs/biome/commit/e7b18f759d82291a3f280ea616b3028fa716cba5) Thanks [@ematipico](https://github.com/ematipico)! - Improved linter performance by narrowing the query nodes for several lint rules, reducing how often they are evaluated. - [#10273](https://github.com/biomejs/biome/pull/10273) [`04e22a1`](https://github.com/biomejs/biome/commit/04e22a10e7446178a80cf3c0c614dc512d894e9d) Thanks [@dyc3](https://github.com/dyc3)! - Fixed [#10271](https://github.com/biomejs/biome/issues/10271): The HTML parser now correctly parses `of` as text content when in text contexts. - [#9838](https://github.com/biomejs/biome/pull/9838) [`83f7385`](https://github.com/biomejs/biome/commit/83f7385f14d68704510ea4c028cfa20317698fc0) Thanks [@dyc3](https://github.com/dyc3)! - Added the nursery rule [`noBaseToString`](https://biomejs.dev/linter/rules/no-base-to-string/), which reports stringification sites that fall back to Object's default `"[object Object]"` formatting. The rule also supports the `ignoredTypeNames` option. - [#10143](https://github.com/biomejs/biome/pull/10143) [`56798a7`](https://github.com/biomejs/biome/commit/56798a76b9e7f57caf070acd51734beb61904d9d) Thanks [@minseong0324](https://github.com/minseong0324)! - [`useExhaustiveSwitchCases`](https://biomejs.dev/linter/rules/use-exhaustive-switch-cases/) now checks switch statements over object literal properties initialized with `as const`. This switch is now reported because `status.kind` is inferred as the string literal `"ready"` but no case handles it: ```ts const status = { kind: "ready" as const }; switch (status.kind) { } ``` - [#10143](https://github.com/biomejs/biome/pull/10143) [`56798a7`](https://github.com/biomejs/biome/commit/56798a76b9e7f57caf070acd51734beb61904d9d) Thanks [@minseong0324](https://github.com/minseong0324)! - [`useStringStartsEndsWith`](https://biomejs.dev/linter/rules/use-string-starts-ends-with/) now detects string index comparisons on object literal properties initialized with `as const`. This comparison is now reported because `message.value` is inferred as a string literal: ```ts const message = { value: "hello" as const }; message.value[0] === "h"; ``` ### [`v2.4.14`](https://github.com/biomejs/biome/blob/HEAD/packages/@biomejs/biome/CHANGELOG.md#2414) [Compare Source](https://github.com/biomejs/biome/compare/@biomejs/biome@2.4.13...@biomejs/biome@2.4.14) ##### Patch Changes - [#9393](https://github.com/biomejs/biome/pull/9393) [`491b171`](https://github.com/biomejs/biome/commit/491b171e245aa1ad1063662d4408692b4fc11eae) Thanks [@dyc3](https://github.com/dyc3)! - Added the nursery rule [`useTestHooksOnTop`](https://biomejs.dev/linter/rules/use-test-hooks-on-top) in the `test` domain. The rule flags lifecycle hooks (`beforeEach`, `beforeAll`, `afterEach`, `afterAll`) that appear after test cases in the same block, enforcing that hooks are defined before any test case. - [#10157](https://github.com/biomejs/biome/pull/10157) [`eefc5ab`](https://github.com/biomejs/biome/commit/eefc5ab81709e78068774b0f5bc56af448a733d1) Thanks [@dyc3](https://github.com/dyc3)! - Fixed [#7882](https://github.com/biomejs/biome/issues/7882): The HTML parser will now emit better diagnostics when it encounters a void element with a closing tag, such as `<br></br>`. Previously, the parser would emit multiple diagnostics with conflicting advice. Now it emits a single diagnostic that clearly states that void elements should not have closing tags. - [#10054](https://github.com/biomejs/biome/pull/10054) [`0e9f569`](https://github.com/biomejs/biome/commit/0e9f5696b1f2dec6e0d1f81b39192bdb07ab0c1a) Thanks [@minseong0324](https://github.com/minseong0324)! - [`noMisleadingReturnType`](https://biomejs.dev/linter/rules/no-misleading-return-type/) no longer misses widening from concrete object types, class instances, object literals, tuples, functions, and regular expressions to `: object`. A function annotated `: object` returning an object literal: ```ts function f(): object { return { retry: true }; } ``` - [#10116](https://github.com/biomejs/biome/pull/10116) [`53269eb`](https://github.com/biomejs/biome/commit/53269ebe0a2f718213483444696b88c7e8d0e7c4) Thanks [@jiwon79](https://github.com/jiwon79)! - Fixed [#6201](https://github.com/biomejs/biome/issues/6201): [`noUselessEscapeInRegex`](https://biomejs.dev/linter/rules/no-useless-escape-in-regex/) no longer flags an escaped backslash followed by `-` as a useless escape. Patterns like `/[\\-]/` are now considered valid because the second `\` is the escaped backslash, not an unnecessary escape of the trailing dash. - [#10092](https://github.com/biomejs/biome/pull/10092) [`33d8543`](https://github.com/biomejs/biome/commit/33d8543da451e272000b84a8e29114d72923cdc1) Thanks [@Conaclos](https://github.com/Conaclos)! - Fixed [#9097](https://github.com/biomejs/biome/issues/9097): [`organizeImports`](https://biomejs.dev/assist/actions/organize-imports/) no longer adds a blank line between a never-matched group and a matched group. Given the following `organizeImports` options: ```json { "groups": [":NODE:", ":BLANK_LINE:", ":PACKAGE:", ":BLANK_LINE:", ":PATH:"] } ``` The following code... ```js // Comment import "package"; import "./file.js"; ``` ...was organized as: ```diff + // Comment import "package"; + import "./file.js"; ``` A blank line was added even though the group ':NODE:' doesn't match any imports here. `:BLANK_LINE:` between never-matched groups and matched groups are now ignored. The code is now organized as: ```diff // Comment import "package"; + import "./file.js"; ``` - [#10138](https://github.com/biomejs/biome/pull/10138) [`a10b6c1`](https://github.com/biomejs/biome/commit/a10b6c119d1f3862da918ce7617ee365bb534c6e) Thanks [@dyc3](https://github.com/dyc3)! - Fixed Vue `v-for` handling for [`noUndeclaredVariables`](https://biomejs.dev/linter/rules/no-undeclared-variables/) and [`noUnusedVariables`](https://biomejs.dev/linter/rules/no-unused-variables/). Biome now recognizes variables declared by `v-for` directives and references to iterated values in Vue templates. - [#10115](https://github.com/biomejs/biome/pull/10115) [`d428d76`](https://github.com/biomejs/biome/commit/d428d76ba8be7131090c199cefa36613a332e75b) Thanks [@minseong0324](https://github.com/minseong0324)! - [`noMisleadingReturnType`](https://biomejs.dev/linter/rules/no-misleading-return-type/) no longer reports false positives when a union return type's `boolean` variant is covered by both `true` and `false` returns. - [#9922](https://github.com/biomejs/biome/pull/9922) [`7acf1e0`](https://github.com/biomejs/biome/commit/7acf1e0890d1e52b1cfa940554f6ebbd1bae20b3) Thanks [@dyc3](https://github.com/dyc3)! - Added the new nursery rule [`noReactStringRefs`](https://biomejs.dev/linter/rules/no-react-string-refs/), which disallows legacy React string refs such as `ref="hello"` and `this.refs.hello`. Biome also reports template-literal refs such as ``ref={`hello`}``, so React code can consistently migrate to callback refs, `createRef()`, or `useRef()`. - [#10010](https://github.com/biomejs/biome/pull/10010) [`f3e76ab`](https://github.com/biomejs/biome/commit/f3e76ab7befecca7cdc7a04edac1350de31029de) Thanks [@dyc3](https://github.com/dyc3)! - Fixed a bug in the LSP file watcher registration so Biome now watches `.biome.json` and `.biome.jsonc` configuration files and reloads workspace settings when they change. - [#10176](https://github.com/biomejs/biome/pull/10176) [`8a40ef8`](https://github.com/biomejs/biome/commit/8a40ef835db83277a15b4f0455b5b9b69c719ad3) Thanks [@dyc3](https://github.com/dyc3)! - Fixed [#10011](https://github.com/biomejs/biome/issues/10011): The [`noThisInStatic`](https://biomejs.dev/linter/rules/no-this-in-static/) rule no longer reports `this` when it is used as the constructor target in `new this(...)`, which is required for inherited static factory methods. - [#10163](https://github.com/biomejs/biome/pull/10163) [`6867e96`](https://github.com/biomejs/biome/commit/6867e96dacf0b96dfbefd51f95a29136d90b7bb4) Thanks [@jiwon79](https://github.com/jiwon79)! - Fixed [#9884](https://github.com/biomejs/biome/issues/9884): The [`useSortedAttributes`](https://biomejs.dev/assist/actions/use-sorted-attributes/) auto-fix no longer corrupts source code when both an outer JSX element and a nested JSX-valued attribute have unsorted attributes in the same pass. Multiple unsorted groups separated by spread or shorthand attributes within the same JSX element are now reported as a single diagnostic. - [#10079](https://github.com/biomejs/biome/pull/10079) [`d29dd19`](https://github.com/biomejs/biome/commit/d29dd1916bdfa4a13dba95cad57f61c65cb5739c) Thanks [@Damix48](https://github.com/Damix48)! - Fixed false positive in `noAssignInExpressions` for Svelte `{@const}` blocks. Assignments in `{@const name = value}` are now correctly recognized as declarations rather than accidental assignments in expressions. - [#10080](https://github.com/biomejs/biome/pull/10080) [`5d8fdac`](https://github.com/biomejs/biome/commit/5d8fdac6d26987904130c2ef0db797c295922f08) Thanks [@Damix48](https://github.com/Damix48)! - Fixed parsing of closing parentheses in Svelte `{#each}` block key expressions. Biome now correctly parses method calls and other parenthesised expressions used as keys. For example, the following snippets are now parsed correctly: ```svelte {#each numbers as number, index (number.toString())} <p>{number}</p> {/each} {#each numbers as number (key(number))} <p>{number}</p> {/each} ``` - [#10140](https://github.com/biomejs/biome/pull/10140) [`e7024b9`](https://github.com/biomejs/biome/commit/e7024b92638090a9b8ccd064e0662f7994164621) Thanks [@solithcy](https://github.com/solithcy)! - Fixed [#10135](https://github.com/biomejs/biome/issues/10135): Biome no longer crashes on missing Svelte template expressions. The following code snippet longer panics: ```svelte {#if } <p>^ this would previously crash</p> {/if} {@const } <p> ^ this would also crash</p> ``` - [#10111](https://github.com/biomejs/biome/pull/10111) [`7818009`](https://github.com/biomejs/biome/commit/7818009e23e12758d00665be6faf8471ca0b0027) Thanks [@jiwon79](https://github.com/jiwon79)! - Fixed [#9997](https://github.com/biomejs/biome/issues/9997): [`noDuplicateSelectors`](https://biomejs.dev/linter/rules/no-duplicate-selectors/) no longer reports false positives for selectors inside `@scope` queries. Biome now treats `@scope` as a separate at-rule context, like `@media`, `@supports`, `@container`, and `@starting-style`. The following snippet is no longer flagged as a duplicate: ```css .Example { padding: 0; } @scope (.theme-dark) { .Example { color: white; } } ``` - [#9926](https://github.com/biomejs/biome/pull/9926) [`d62b331`](https://github.com/biomejs/biome/commit/d62b331726c1b730ca2d1c38325ce6196beee7a4) Thanks [@dyc3](https://github.com/dyc3)! - Added the nursery lint rule [`useMathMinMax`](https://biomejs.dev/linter/rules/use-math-min-max/), which prefers `Math.min()` and `Math.max()` over equivalent ternary comparisons. For example, this code: ```js const min = a < b ? a : b; ``` is much more readable when rewritten as: ```js const min = Math.min(a, b); ``` - [#10115](https://github.com/biomejs/biome/pull/10115) [`d428d76`](https://github.com/biomejs/biome/commit/d428d76ba8be7131090c199cefa36613a332e75b) Thanks [@minseong0324](https://github.com/minseong0324)! - [`useExhaustiveSwitchCases`](https://biomejs.dev/linter/rules/use-exhaustive-switch-cases/) now flags missing `true`/`false` cases for `boolean` discriminants, including when `boolean` is a union variant. - [#10125](https://github.com/biomejs/biome/pull/10125) [`a55a0b6`](https://github.com/biomejs/biome/commit/a55a0b6fe03f772316b76937b1292096cdc8a661) Thanks [@bmish](https://github.com/bmish)! - Fixed a resolver bug where packages that define a typed entry point through `package.json`'s `main` field but omit `types` were ignored during type-aware resolution. Type-aware rules such as [`noFloatingPromises`](https://biomejs.dev/linter/rules/no-floating-promises/) can now inspect imports from those packages. - [#10117](https://github.com/biomejs/biome/pull/10117) [`895e809`](https://github.com/biomejs/biome/commit/895e809dc799cd6aa70032fbb56dfe0f9c0f6f39) Thanks [@denizdogan](https://github.com/denizdogan)! - Added support for the `corner-shape` family of CSS properties and the `superellipse()`/`squircle()` value functions, so [`noUnknownProperty`](https://biomejs.dev/linter/rules/no-unknown-property/) and [`noUnknownFunction`](https://biomejs.dev/linter/rules/no-unknown-function/) no longer flag them as unknown. New known properties: `corner-shape`, `corner-block-end-shape`, `corner-block-start-shape`, `corner-bottom-left-shape`, `corner-bottom-right-shape`, `corner-bottom-shape`, `corner-end-end-shape`, `corner-end-start-shape`, `corner-inline-end-shape`, `corner-inline-start-shape`, `corner-left-shape`, `corner-right-shape`, `corner-start-end-shape`, `corner-start-start-shape`, `corner-top-left-shape`, `corner-top-right-shape`, `corner-top-shape`. New known value functions: `superellipse()`, `squircle()`. - [#8620](https://github.com/biomejs/biome/pull/8620) [`8df8f73`](https://github.com/biomejs/biome/commit/8df8f73ca1c18a688f64f304f0b9089797258a1e) Thanks [@dyc3](https://github.com/dyc3)! - Fixed [#8062](https://github.com/biomejs/biome/issues/8062): Added support for parsing Vue `v-for` directives more accurately. - [#10191](https://github.com/biomejs/biome/pull/10191) [`aa055cd`](https://github.com/biomejs/biome/commit/aa055cd74f82fac691dfa2f65dbfd255213cb884) Thanks [@guney](https://github.com/guney)! - Now the rule [`noStaticElementInteractions`](https://biomejs.dev/linter/rules/no-static-element-interactions/) doesn't trigger custom elements. - [#9757](https://github.com/biomejs/biome/pull/9757) [`2c62594`](https://github.com/biomejs/biome/commit/2c62594b84ae62fd5fa130adff917a1bcd8dfddd) Thanks [@dyc3](https://github.com/dyc3)! - Fixed [#9099](https://github.com/biomejs/biome/issues/9099): the HTML formatter collapsing non-text children (inline elements, Svelte expressions, comments) onto a single line when the source had them on separate lines. Biome now preserves the user's intended line breaks for exclusively non-text children. For example, the following Svelte snippet is now preserved instead of being collapsed to `<div>{name}</div>`: ```svelte <div> {name} </div> ``` Similarly, HTML elements like `<span>` inside a `<div>` are now preserved when written on their own line: ```html <div> <span>text</span> </div> ``` - [#10105](https://github.com/biomejs/biome/pull/10105) [`e7c1a6d`](https://github.com/biomejs/biome/commit/e7c1a6d5319908cf613f7fa80667e6981435508d) Thanks [@jiwon79](https://github.com/jiwon79)! - Fixed [#10039](https://github.com/biomejs/biome/issues/10039): [`useReadonlyClassProperties`](https://biomejs.dev/linter/rules/use-readonly-class-properties/) now detects unreassigned private members in class expressions and export default classes, not only in class declarations. The following patterns are now correctly flagged: ```ts const AnonClass = class { #prop = 123; constructor() { console.log(this.#prop); } }; export default class { #prop = 123; constructor() { console.log(this.#prop); } } ``` - [#10141](https://github.com/biomejs/biome/pull/10141) [`46a77d0`](https://github.com/biomejs/biome/commit/46a77d0a35e8dbbcefeca264e8630af83b21f1d9) Thanks [@minseong0324](https://github.com/minseong0324)! - Improved [`noUnnecessaryConditions`](https://biomejs.dev/linter/rules/no-unnecessary-conditions/) to detect conditions that are always truthy because they check built-in global class instances such as `Date`, `Map`, `Set`, `WeakMap`, and `Error`. - [#10178](https://github.com/biomejs/biome/pull/10178) [`7b05a89`](https://github.com/biomejs/biome/commit/7b05a893df8c9c950871b83ff1b3ae28113e8b15) Thanks [@dyc3](https://github.com/dyc3)! - Fixed [#10177](https://github.com/biomejs/biome/issues/10177): The HTML parser no longer reports lowercase `html` or `doctype` text as invalid after void elements such as `<br>`. - [#10155](https://github.com/biomejs/biome/pull/10155) [`0d4595d`](https://github.com/biomejs/biome/commit/0d4595dae68b034bd6de3bdfd15437a34fa53cb2) Thanks [@jiwon79](https://github.com/jiwon79)! - Fixed [#10045](https://github.com/biomejs/biome/issues/10045): the CSS formatter no longer compounds indentation inside nested functional pseudo-classes such as `:not(:where(...))`, `:is(:where(...))`, and similar combinations. The same fix also removes one level of unnecessary indentation that was added inside any pseudo-class function whose argument list wrapped onto multiple lines, including `:nth-child(... of ...)`, `::part(...)`, and `:active-view-transition-type(...)`. The following snippet is now correctly formatted, matching Prettier. ```css input:not( :where( [type="submit"], [type="checkbox"], [type="radio"], [type="button"], [type="reset"] ) ) { inline-size: 100%; } ``` - [#10112](https://github.com/biomejs/biome/pull/10112) [`6f0251e`](https://github.com/biomejs/biome/commit/6f0251ea12cddb6edcbf512e5608a7b502762423) Thanks [@dyc3](https://github.com/dyc3)! - Fixed [#10110](https://github.com/biomejs/biome/issues/10110): Biome's parser now accepts surrogate code points in JavaScript string `\u{...}` escapes. - [#10141](https://github.com/biomejs/biome/pull/10141) [`46a77d0`](https://github.com/biomejs/biome/commit/46a77d0a35e8dbbcefeca264e8630af83b21f1d9) Thanks [@minseong0324](https://github.com/minseong0324)! - Improved [`noMisleadingReturnType`](https://biomejs.dev/linter/rules/no-misleading-return-type/) to detect `object` return annotations that hide built-in global class instances such as `Date`, `Map`, `Set`, `WeakMap`, and `Error`. - [#10083](https://github.com/biomejs/biome/pull/10083) [`4a664c1`](https://github.com/biomejs/biome/commit/4a664c1c9ebee339ee4a8b971b0a345aa4dbbe70) Thanks [@ematipico](https://github.com/ematipico)! - Added two new options to [`noShadow`](https://biomejs.dev/linter/rules/no-shadow/), both defaulting to `true` to match typescript-eslint's behavior. Fixed [#9482](https://github.com/biomejs/biome/issues/9482): Added `ignoreFunctionTypeParameterNameValueShadow` option. When enabled, parameter names inside function type annotations (e.g. `(options: unknown) => void`) are not flagged as shadowing outer variables. Fixed [#7812](https://github.com/biomejs/biome/issues/7812): Added `ignoreTypeValueShadow` option. When enabled, a value binding that shares its name with a type-only declaration (type alias or interface) is not flagged, since types and values occupy separate namespaces in TypeScript. - [#9286](https://github.com/biomejs/biome/pull/9286) [`52695cf`](https://github.com/biomejs/biome/commit/52695cf52b3ff42ddfcaef040cfaa00e9a93a4b7) Thanks [@Hugo-Polloli](https://github.com/Hugo-Polloli)! - Fixed [#6316](https://github.com/biomejs/biome/issues/6316): Biome now resolves Svelte `$store` references to the underlying `store` binding in semantic analysis, preventing false `noUndeclaredVariables` diagnostics when the store is declared. - [#10188](https://github.com/biomejs/biome/pull/10188) [`ae659dd`](https://github.com/biomejs/biome/commit/ae659ddbd317753c4feb5e4d223b9159d272d01b) Thanks [@dyc3](https://github.com/dyc3)! - Added a new nursery rule [`noExcessiveNestedCallbacks`](https://biomejs.dev/linter/rules/no-excessive-nested-callbacks/), which disallows callbacks nested deeper than the configured maximum. - [#9757](https://github.com/biomejs/biome/pull/9757) [`2c62594`](https://github.com/biomejs/biome/commit/2c62594b84ae62fd5fa130adff917a1bcd8dfddd) Thanks [@dyc3](https://github.com/dyc3)! - Fixed [#9450](https://github.com/biomejs/biome/issues/9450): the HTML formatter now correctly preserves multiline formatting for nested `<template>` elements (e.g. `<template #body>`) when the source has children on separate lines. Previously, the children were collapsed onto a single line. ```diff <template> <UModal> - <template #body> <p>content</p> </template> + <template #body> + <p>content</p> + </template> </UModal> </template> ``` - [#10118](https://github.com/biomejs/biome/pull/10118) [`c6edcb4`](https://github.com/biomejs/biome/commit/c6edcb493d42f05179167a8ff3be4549908e9d0b) Thanks [@Netail](https://github.com/Netail)! - Fixed [#10024](https://github.com/biomejs/biome/issues/10024): `biome migrate eslint` correctly migrates `eslint` rules that belong to multiple Biome rules. ### [`v2.4.13`](https://github.com/biomejs/biome/blob/HEAD/packages/@biomejs/biome/CHANGELOG.md#2413) [Compare Source](https://github.com/biomejs/biome/compare/@biomejs/biome@2.4.12...@biomejs/biome@2.4.13) ##### Patch Changes - [#9969](https://github.com/biomejs/biome/pull/9969) [`c5eb92b`](https://github.com/biomejs/biome/commit/c5eb92ba288ba13698b37e43617eed5339ad7007) Thanks [@officialasishkumar](https://github.com/officialasishkumar)! - Added the nursery rule [`noUnnecessaryTemplateExpression`](https://biomejs.dev/linter/rules/no-unnecessary-template-expression/), which disallows template literals that only contain string literal expressions. These can be replaced with a simpler string literal. For example, the following code triggers the rule: ```js const a = `${"hello"}`; // can be 'hello' const b = `${"prefix"}_suffix`; // can be 'prefix_suffix' const c = `${"a"}${"b"}`; // can be 'ab' ``` - [#10037](https://github.com/biomejs/biome/pull/10037) [`f785e8c`](https://github.com/biomejs/biome/commit/f785e8c604879dd3dd17b53aae0e2feef4026c82) Thanks [@minseong0324](https://github.com/minseong0324)! - Fixed [#9810](https://github.com/biomejs/biome/issues/9810): [`noMisleadingReturnType`](https://biomejs.dev/linter/rules/no-misleading-return-type/) no longer reports false positives on a getter with a matching setter in the same namespace. ```ts class Store { get status(): string { if (Math.random() > 0.5) return "loading"; return "idle"; } set status(v: string) {} } ``` - [#10084](https://github.com/biomejs/biome/pull/10084) [`5e2f90c`](https://github.com/biomejs/biome/commit/5e2f90c045b4bd7006c96a9df123303d6c24e1d8) Thanks [@jiwon79](https://github.com/jiwon79)! - Fixed [#10034](https://github.com/biomejs/biome/issues/10034): [`noUselessEscapeInRegex`](https://biomejs.dev/linter/rules/no-useless-escape-in-regex/) no longer flags escapes of `ClassSetReservedPunctuator` characters (`&`, `!`, `#`, `%`, `,`, `:`, `;`, `<`, `=`, `>`, `@`, `` ` ``, `~`) inside `v`-flag character classes as useless. These characters are reserved as individual code points in `v`-mode, so the escape is required. The following pattern is now considered valid: ```js /[a-z\&]/v; ``` - [#10063](https://github.com/biomejs/biome/pull/10063) [`c9ffa16`](https://github.com/biomejs/biome/commit/c9ffa16491c9f8c003eb945796911564fc981b71) Thanks [@Netail](https://github.com/Netail)! - Added extra rule sources from ESLint CSS. `biome migrate eslint` should do a bit better detecting rules in your eslint configurations. - [#10035](https://github.com/biomejs/biome/pull/10035) [`946b50e`](https://github.com/biomejs/biome/commit/946b50e173e8c89a2d2b303cb159a05cbd068767) Thanks [@Netail](https://github.com/Netail)! - Fixed [#10032](https://github.com/biomejs/biome/issues/10032): [useIframeSandbox](https://biomejs.dev/linter/rules/use-iframe-sandbox/) now flags if there's no initializer value. - [#9865](https://github.com/biomejs/biome/pull/9865) [`68fb8d4`](https://github.com/biomejs/biome/commit/68fb8d468c01732c4283a336eca42223983df09b) Thanks [@dyc3](https://github.com/dyc3)! - Added the new nursery rule [`useDomNodeTextContent`](https://biomejs.dev/linter/rules/use-dom-node-text-content/), which prefers `textContent` over `innerText` for DOM node text access and destructuring. For example, the following snippet triggers the rule: ```js const foo = node.innerText; ``` - [#10023](https://github.com/biomejs/biome/pull/10023) [`bd1e74f`](https://github.com/biomejs/biome/commit/bd1e74fd80b0cadafd091513950275e0ff75d80f) Thanks [@ematipico](https://github.com/ematipico)! - Added a new nursery rule [`noReactNativeDeepImports`](https://biomejs.dev/linter/rules/no-react-native-deep-imports/) that disallows deep imports from the `react-native` package. Internal paths like `react-native/Libraries/...` are not part of the public API and may change between versions. For example, the following code triggers the rule: ```js import View from "react-native/Libraries/Components/View/View"; ``` - [#9885](https://github.com/biomejs/biome/pull/9885) [`3dce737`](https://github.com/biomejs/biome/commit/3dce737e5050cfda7d2b9be8f809aee417f01196) Thanks [@dyc3](https://github.com/dyc3)! - Added a new nursery rule [`useDomQuerySelector`](https://biomejs.dev/linter/rules/use-dom-query-selector/) that prefers `querySelector()` and `querySelectorAll()` over older DOM query methods such as `getElementById()` and `getElementsByClassName()`. - [#9995](https://github.com/biomejs/biome/pull/9995) [`4da9caf`](https://github.com/biomejs/biome/commit/4da9caf8281473177fac3332610c710b31e89546) Thanks [@siketyan](https://github.com/siketyan)! - Fixed [#9994](https://github.com/biomejs/biome/issues/9994): Biome now parses nested CSS rules correctly when declarations follow them inside embedded snippets. - [#10009](https://github.com/biomejs/biome/pull/10009) [`b41cc5a`](https://github.com/biomejs/biome/commit/b41cc5a58c74fd6b237352c1772e64e74fcc7546) Thanks [@Jayllyz](https://github.com/Jayllyz)! - Fixed [#10004](https://github.com/biomejs/biome/issues/10004): [`noComponentHookFactories`](https://biomejs.dev/linter/rules/no-component-hook-factories/) no longer reports false positives for object methods and class methods. - [#9988](https://github.com/biomejs/biome/pull/9988) [`eabf54a`](https://github.com/biomejs/biome/commit/eabf54ad03c6c1d63753a641c8ad1ef385e42d2b) Thanks [@Netail](https://github.com/Netail)! - Tweaked the diagnostics range for [useAltText](https://biomejs.dev/linter/rules/use-alt-text), [useButtonType](https://biomejs.dev/linter/rules/use-button-type), [useHtmlLang](https://biomejs.dev/linter/rules/use-html-lang), [useIframeTitle](https://biomejs.dev/linter/rules/use-iframe-title), [useValidAriaRole](https://biomejs.dev/linter/rules/use-valid-aria-role) & [useIfameSandbox](https://biomejs.dev/linter/rules/use-iframe-sandbox) to report on the opening tag instead of the full tag. - [#10043](https://github.com/biomejs/biome/pull/10043) [`fc65902`](https://github.com/biomejs/biome/commit/fc65902f17cd548ae38ff916462291b51a32e356) Thanks [@mujpao](https://github.com/mujpao)! - Fixed [#10003](https://github.com/biomejs/biome/issues/10003): Biome no longer panics when parsing Svelte files containing `{#}`. - [#9815](https://github.com/biomejs/biome/pull/9815) [`5cc83b1`](https://github.com/biomejs/biome/commit/5cc83b177830bc21dc4d6e18343f58eca4ee0de6) Thanks [@dyc3](https://github.com/dyc3)! - Added the new nursery rule [`noLoopFunc`](https://biomejs.dev/linter/rules/no-loop-func/). When enabled, it warns when a function declared inside a loop captures outer variables that can change across iterations. - [#9702](https://github.com/biomejs/biome/pull/9702) [`ef470ba`](https://github.com/biomejs/biome/commit/ef470ba2db119aa52c24f918bcef451cf2770ccb) Thanks [@ryan-m-walker](https://github.com/ryan-m-walker)! - Added the nursery rule [`useRegexpTest`](https://biomejs.dev/linter/rules/use-regexp-test/) that enforces `RegExp.prototype.test()` over `String.prototype.match()` and `RegExp.prototype.exec()` in boolean contexts. `test()` returns a boolean directly, avoiding unnecessary computation of match results. **Invalid** ```js if ("hello world".match(/hello/)) { } ``` **Valid** ```js if (/hello/.test("hello world")) { } ``` - [#9743](https://github.com/biomejs/biome/pull/9743) [`245307d`](https://github.com/biomejs/biome/commit/245307dc4ee7af87f62873162107b608084d40f3) Thanks [@leetdavid](https://github.com/leetdavid)! - Fixed [#2245](https://github.com/biomejs/biome/issues/2245): Svelte `<script>` tag language detection when the `generics` attribute contains `>` characters (e.g., `<script lang="ts" generics="T extends Record<string, unknown>">`). Biome now correctly recognizes TypeScript in such script blocks. - [#10046](https://github.com/biomejs/biome/pull/10046) [`0707de7`](https://github.com/biomejs/biome/commit/0707de7d72f0c5e14f4d5c91524ad2a9d1f50b34) Thanks [@Conaclos](https://github.com/Conaclos)! - Fixed [#10038](https://github.com/biomejs/biome/issues/10038): [`organizeImports`](https://biomejs.dev/assist/actions/organize-imports/) now sorts imports in TypeScript modules and declaration files. ```diff declare module "mymodule" { - import type { B } from "b"; import type { A } from "a"; + import type { B } from "b"; } ``` - [#10012](https://github.com/biomejs/biome/pull/10012) [`94ccca9`](https://github.com/biomejs/biome/commit/94ccca96800e73732b3f26d7eb21a5e3e025e51e) Thanks [@ematipico](https://github.com/ematipico)! - Added the nursery rule [`noReactNativeLiteralColors`](https://biomejs.dev/linter/rules/no-react-native-literal-colors/), which disallows color literals inside React Native styles. The rule belongs to the `reactNative` domain. It reports properties whose name contains `color` and whose value is a string literal when they appear inside a `StyleSheet.create(...)` call or inside a JSX attribute whose name contains `style`. ```jsx // Invalid const Hello = () => <Text style={{ backgroundColor: "#FFFFFF" }}>hi</Text>; const styles = StyleSheet.create({ text: { color: "red" }, }); ``` ```jsx // Valid const red = "#f00"; const styles = StyleSheet.create({ text: { color: red }, }); ``` - [#10005](https://github.com/biomejs/biome/pull/10005) [`131019e`](https://github.com/biomejs/biome/commit/131019e161b69fd755742ba509b1c51fcb2af183) Thanks [@ematipico](https://github.com/ematipico)! - Added the nursery rule [`noReactNativeRawText`](https://biomejs.dev/linter/rules/no-react-native-raw-text/), which disallows raw text outside of `<Text>` components in React Native. The rule belongs to the new `reactNative` domain. ```jsx // Invalid <View>some text</View> <View>{'some text'}</View> ``` ```jsx // Valid <View> <Text>some text</Text> </View> ``` Additional components can be allowlisted through the `skip` option: ```json { "options": { "skip": ["Title"] } } ``` - [#9911](https://github.com/biomejs/biome/pull/9911) [`1603f78`](https://github.com/biomejs/biome/commit/1603f7893c9e249439fc3c22c02ec1a363cc54b9) Thanks [@Netail](https://github.com/Netail)! - Added the nursery rule [`noJsxLeakedDollar`](https://biomejs.dev/linter/rules/no-jsx-leaked-dollar), which flags text nodes with a trailing `$` if the next sibling node is a JSX expression. This could be an unintentional mistake, resulting in a '$' being rendered as text in the output. **Invalid**: ```jsx function MyComponent({ user }) { return <div>Hello ${user.name}</div>; } ``` - [#9999](https://github.com/biomejs/biome/pull/9999) [`f42405f`](https://github.com/biomejs/biome/commit/f42405fca77302bbbca573474c59ae49f027f75d) Thanks [@minseong0324](https://github.com/minseong0324)! - Fixed `noMisleadingReturnType` incorrectly flagging functions with reassigned `let` variables. - [#10075](https://github.com/biomejs/biome/pull/10075) [`295f97f`](https://github.com/biomejs/biome/commit/295f97fd538779eb9cc35b5bf54d37a90e0b5e9b) Thanks [@ematipico](https://github.com/ematipico)! - Fixed [`#9983`](https://github.com/biomejs/biome/issues/9983): Biome now parses functions declared inside Svelte `#snippet` blocks without throwing errors. - [#10006](https://github.com/biomejs/biome/pull/10006) [`cf4c1c9`](https://github.com/biomejs/biome/commit/cf4c1c943a53612648d052d843aaf977652c79d6) Thanks [@minseong0324](https://github.com/minseong0324)! - Fixed [#9810](https://github.com/biomejs/biome/issues/9810): `noMisleadingReturnType` incorrectly flagging nested object literals with widened properties. - [#10033](https://github.com/biomejs/biome/pull/10033) [`11ddc05`](https://github.com/biomejs/biome/commit/11ddc05713a1cb85b6748c865ee9dda91235a5d1) Thanks [@ematipico](https://github.com/ematipico)! - Added the nursery rule [`useReactNativePlatformComponents`](https://biomejs.dev/linter/rules/use-react-native-platform-components/) that ensures platform-specific React Native components (e.g. `ProgressBarAndroid`, `ActivityIndicatorIOS`) are only imported in files with a matching platform suffix. It also reports when Android and iOS components are mixed in the same file. The following code triggers the rule when the file does not have an `.android.js` suffix: ```js // file.js import { ProgressBarAndroid } from "react-native"; ``` ### [`v2.4.12`](https://github.com/biomejs/biome/blob/HEAD/packages/@biomejs/biome/CHANGELOG.md#2412) [Compare Source](https://github.com/biomejs/biome/compare/@biomejs/biome@2.4.11...@biomejs/biome@2.4.12) ##### Patch Changes - [#9376](https://github.com/biomejs/biome/pull/9376) [`9701a33`](https://github.com/biomejs/biome/commit/9701a336af701c36d0fe4892f53de049f63f46f4) Thanks [@dyc3](https://github.com/dyc3)! - Added the [`nursery/noIdenticalTestTitle`](https://biomejs.dev/linter/rules/no-identical-test-title) lint rule. This rule disallows using the same title for two `describe` blocks or two test cases at the same nesting level. ```js describe("foo", () => {}); describe("foo", () => { // invalid: same title as previous describe block test("baz", () => {}); test("baz", () => {}); // invalid: same title as previous test case }); ``` - [#9889](https://github.com/biomejs/biome/pull/9889) [`7ae83f2`](https://github.com/biomejs/biome/commit/7ae83f2f60dc83eae6ef72e4cb1d6f06f3a882de) Thanks [@dyc3](https://github.com/dyc3)! - Improved the diagnostics for [`useForOf`](https://biomejs.dev/linter/rules/use-for-of/) to better explain the problem, why it matters, and how to fix it. - [#9916](https://github.com/biomejs/biome/pull/9916) [`27dd7b1`](https://github.com/biomejs/biome/commit/27dd7b156b3bf9c461051b9997b277e1fee6fcb2) Thanks [@Jayllyz](https://github.com/Jayllyz)! - Added a new nursery rule [`noComponentHookFactories`](https://biomejs.dev/linter/rules/no-component-hook-factories/), that disallows defining React components or custom hooks inside other functions. For example, the following snippets trigger the rule: ```jsx function createComponent(label) { function MyComponent() { return <div>{label}</div>; } return MyComponent; } ``` ```jsx function Parent() { function Child() { return <div />; } return <Child />; } ``` - [#9980](https://github.com/biomejs/biome/pull/9980) [`098f1ff`](https://github.com/biomejs/biome/commit/098f1fff71e2500da57200a28870f6d6e3d4201d) Thanks [@ematipico](https://github.com/ematipico)! - Fixed [#9941](https://github.com/biomejs/biome/issues/9941): Biome now emits a `warning` diagnostic when a file exceed the `files.maxSize` limit. - [#9942](https://github.com/biomejs/biome/pull/9942) [`9956f1d`](https://github.com/biomejs/biome/commit/9956f1d1b53168f8b33792c004f741368c883ff7) Thanks [@dyc3](https://github.com/dyc3)! - Fixed [#9918](https://github.com/biomejs/biome/issues/9918): [`useConsistentTestIt`](https://biomejs.dev/linter/rules/use-consistent-test-it/) no longer panics when applying fixes to chained calls such as `test.for([])("x", () => {});`. - [#9891](https://github.com/biomejs/biome/pull/9891) [`4d9ac51`](https://github.com/biomejs/biome/commit/4d9ac51352482d72d3438f2d514dbeef0edc63e0) Thanks [@dyc3](https://github.com/dyc3)! - Improved the `noGlobalObjectCalls` diagnostic to better explain why calling global objects like `Math` or `JSON` is invalid and how to fix it. - [#9902](https://github.com/biomejs/biome/pull/9902) [`3f4d103`](https://github.com/biomejs/biome/commit/3f4d1033f7f672be2adba11bb8b7de5d8d3532fc) Thanks [@ematipico](https://github.com/ematipico)! - Fixed [#9901](https://github.com/biomejs/biome/issues/9901): the command `lint --write` is now idempotent when it's run against HTML-ish files that contains scripts and styles. - [#9891](https://github.com/biomejs/biome/pull/9891) [`4d9ac51`](https://github.com/biomejs/biome/commit/4d9ac51352482d72d3438f2d514dbeef0edc63e0) Thanks [@dyc3](https://github.com/dyc3)! - Improved the `noMultiStr` diagnostic to explain why escaped multiline strings are discouraged and what to use instead. - [#9966](https://github.com/biomejs/biome/pull/9966) [`322675e`](https://github.com/biomejs/biome/commit/322675ed97b10b088f6af3ad7843326d2888e9d8) Thanks [@siketyan](https://github.com/siketyan)! - Fixed [#9113](https://github.com/biomejs/biome/issues/9113): Biome now parses and formats `@media` and other conditional blocks correctly inside embedded CSS snippets. - [#9835](https://github.com/biomejs/biome/pull/9835) [`f8d49d9`](https://github.com/biomejs/biome/commit/f8d49d9ea27ffcfefc993449f56dd2b6572a77d6) Thanks [@bmish](https://github.com/bmish)! - The [`noFloatingPromises`](https://biomejs.dev/linter/rules/no-floating-promises/) rule now detects floating promises through cross-module generic wrapper functions. Previously, patterns like `export const fn = trace(asyncFn)` — where `trace` preserves the function signature via a generic `<F>(fn: F): F` — were invisible to the rule when the wrapper was defined in a different file. - [#9981](https://github.com/biomejs/biome/pull/9981) [`02bd8dd`](https://github.com/biomejs/biome/commit/02bd8dd97163281b78b840d7ae79361e26637de9) Thanks [@siketyan](https://github.com/siketyan)! - Fixed [#9975](https://github.com/biomejs/biome/issues/9975): Biome now parses nested CSS selectors correctly inside embedded snippets without requiring an explicit `&`. - [#9949](https://github.com/biomejs/biome/pull/9949) [`e0ba71d`](https://github.com/biomejs/biome/commit/e0ba71d9dceec6db371c79833855e0ca4ce44a61) Thanks [@Netail](https://github.com/Netail)! - Added the nursery rule [`useIframeSandbox`](https://biomejs.dev/linter/rules/use-iframe-sandbox), which enforces the `sandbox` attribute for `iframe` tags. **Invalid**: ```html <iframe></iframe> ``` - [#9913](https://github.com/biomejs/biome/pull/9913) [`d417803`](https://github.com/biomejs/biome/commit/d417803eb451f3423deb8f3bf6925d76629d271f) Thanks [@Netail](https://github.com/Netail)! - Added the nursery rule [`noJsxNamespace`](https://biomejs.dev/linter/rules/no-jsx-namespace), which disallows JSX namespace syntax. **Invalid**: ```jsx <ns:testcomponent /> ``` - [#9892](https://github.com/biomejs/biome/pull/9892) [`e75d70e`](https://github.com/biomejs/biome/commit/e75d70ef48297604b9371db5c281f6ef6a8d2a38) Thanks [@dyc3](https://github.com/dyc3)! - Improved the `noSelfCompare` diagnostic to better explain why comparing a value to itself is suspicious and what to use for NaN checks. - [#9861](https://github.com/biomejs/biome/pull/9861) [`2cff700`](https://github.com/biomejs/biome/commit/2cff7004182d21fb2f39b218f9fecf351210f938) Thanks [@dyc3](https://github.com/dyc3)! - Added the new nursery rule [`useVarsOnTop`](https://biomejs.dev/linter/rules/use-vars-on-top/), which requires `var` declarations to appear at the top of their containing scope. For example, the following code now triggers the rule: ```js function f() { doSomething(); var value = 1; } ``` - [#9892](https://github.com/biomejs/biome/pull/9892) [`e75d70e`](https://github.com/biomejs/biome/commit/e75d70ef48297604b9371db5c281f6ef6a8d2a38) Thanks [@dyc3](https://github.com/dyc3)! - Improved the `noThenProperty` diagnostic to better explain why exposing `then` can create thenable behavior and how to avoid it. - [#9892](https://github.com/biomejs/biome/pull/9892) [`e75d70e`](https://github.com/biomejs/biome/commit/e75d70ef48297604b9371db5c281f6ef6a8d2a38) Thanks [@dyc3](https://github.com/dyc3)! - Improved the `noShorthandPropertyOverrides` diagnostic to explain why later shorthand declarations can unintentionally overwrite earlier longhand properties. - [#9978](https://github.com/biomejs/biome/pull/9978) [`4847715`](https://github.com/biomejs/biome/commit/484771541c1a27747012f6f27809a30b0e0eec08) Thanks [@mdevils](https://github.com/mdevils)! - Fixed [#9744](https://github.com/biomejs/biome/issues/9744): [`useExhaustiveDependencies`](https://biomejs.dev/linter/rules/use-exhaustive-dependencies/) no longer reports false positives for variables obtained via object destructuring with computed keys, e.g. `const { [KEY]: key1 } = props`. - [#9892](https://github.com/biomejs/biome/pull/9892) [`e75d70e`](https://github.com/biomejs/biome/commit/e75d70ef48297604b9371db5c281f6ef6a8d2a38) Thanks [@dyc3](https://github.com/dyc3)! - Improved the `noRootType` diagnostic to better explain that the reported root type is disallowed by project configuration and how to proceed. - [#9927](https://github.com/biomejs/biome/pull/9927) [`7974ab7`](https://github.com/biomejs/biome/commit/7974ab71d298b04f12c7536e1f4e0b14a9f0a74a) Thanks [@dyc3](https://github.com/dyc3)! - Added eslint-plugin-unicorn's `no-nested-ternary` as a rule source for [`noNestedTernary`](https://biomejs.dev/linter/rules/no-nested-ternary/) - [#9873](https://github.com/biomejs/biome/pull/9873) [`19ff706`](https://github.com/biomejs/biome/commit/19ff70667001258104645abdc6015958bc8826ec) Thanks [@minseong0324](https://github.com/minseong0324)! - [`noMisleadingReturnType`](https://biomejs.dev/linter/rules/no-misleading-return-type/) now checks class methods, object methods, and getters in addition to functions. - [#9888](https://github.com/biomejs/biome/pull/9888) [`362b638`](https://github.com/biomejs/biome/commit/362b638b99d09c09456943668c7627a81c40b644) Thanks [@dyc3](https://github.com/dyc3)! - Updated metadata for `biome migrate eslint` to better reflect which ESLint rules are redundant versus unsupported versus unimplemented. - [#9892](https://github.com/biomejs/biome/pull/9892) [`e75d70e`](https://github.com/biomejs/biome/commit/e75d70ef48297604b9371db5c281f6ef6a8d2a38) Thanks [@dyc3](https://github.com/dyc3)! - Improved the `noAutofocus` diagnostic to better explain why autofocus harms accessibility outside allowed modal contexts. - [#9982](https://github.com/biomejs/biome/pull/9982) [`d6bdf4a`](https://github.com/biomejs/biome/commit/d6bdf4a91df0cf638946009d97d7555b11f2fd8c) Thanks [@dyc3](https://github.com/dyc3)! - Improved performance of [noMagicNumbers](https://biomejs.dev/linter/rules/no-magic-numbers/). Biome now maps ESLint `no-magic-numbers` sources more accurately during `biome migrate eslint`. - [#9889](https://github.com/biomejs/biome/pull/9889) [`7ae83f2`](https://github.com/biomejs/biome/commit/7ae83f2f60dc83eae6ef72e4cb1d6f06f3a882de) Thanks [@dyc3](https://github.com/dyc3)! - Improved the diagnostics for [`noConstantCondition`](https://biomejs.dev/linter/rules/no-constant-condition/) to better explain the problem, why it matters, and how to fix it. - [#9866](https://github.com/biomejs/biome/pull/9866) [`40bd180`](https://github.com/biomejs/biome/commit/40bd18090895046c34105c4d5671f7c27461e18a) Thanks [@dyc3](https://github.com/dyc3)! - Added a new nursery rule [`noExcessiveSelectorClasses`](https://biomejs.dev/linter/rules/no-excessive-selector-classes/), which limits how many class selectors can appear in a single CSS selector. - [#9796](https://github.com/biomejs/biome/pull/9796) [`f1c1363`](https://github.com/biomejs/biome/commit/f1c136340f46e5c749337a4600a560c11612d789) Thanks [@dyc3](https://github.com/dyc3)! - Added a new nursery rule [`useStringStartsEndsWith`](https://biomejs.dev/linter/rules/use-string-starts-ends-with/), which prefers `startsWith()` and `endsWith()` over verbose string prefix and suffix checks. The rule uses type information, so it only reports on strings and skips array lookups such as `items[0] === "a"`. - [#9942](https://github.com/biomejs/biome/pull/9942) [`9956f1d`](https://github.com/biomejs/biome/commit/9956f1d1b53168f8b33792c004f741368c883ff7) Thanks [@dyc3](https://github.com/dyc3)! - Fixed the safe fix for [`noSkippedTests`](https://biomejs.dev/linter/rules/no-skipped-tests/) so it no longer panics when rewriting skipped test function names such as `xit()`, `xtest()`, and `xdescribe()`. - [#9874](https://github.com/biomejs/biome/pull/9874) [`9e570d1`](https://github.com/biomejs/biome/commit/9e570d1b431d3326f6b6e9062dd8fdcf28bf0d84) Thanks [@minseong0324](https://github.com/minseong0324)! - Type-aware lint rules now resolve members through `Pick<T, K>` and `Omit<T, K>` utility types. - [#9909](https://github.com/biomejs/biome/pull/9909) [`0d0e611`](https://github.com/biomejs/biome/commit/0d0e6118ff1ffb93d0c5d59c10abf57cecf46ccd) Thanks [@Netail](https://github.com/Netail)! - Added the nursery rule [`useReactAsyncServerFunction`](https://biomejs.dev/linter/rules/use-react-async-server-function), which requires React server actions to be async. **Invalid:** ```js function serverFunction() { "use server"; // ... } ``` - [#9925](https://github.com/biomejs/biome/pull/9925) [`29accb3`](https://github.com/biomejs/biome/commit/29accb3e455c7d833e3fd179c3a5400eb972b339) Thanks [@ematipico](https://github.com/ematipico)! - Fixed [#9910](https://github.com/biomejs/biome/issues/9910): added support for parsing member expressions in Svelte directive properties. Biome now correctly parses directives like `in:renderer.in|global`, `use:obj.action`, and deeply nested forms like `in:a.b.c|global`. - [#9904](https://github.com/biomejs/biome/pull/9904) [`e7775a5`](https://github.com/biomejs/biome/commit/e7775a5c7f26bc808302e6646a1ffd702ec59fce) Thanks [@ematipico](https://github.com/ematipico)! - Fixed [#9626](https://github.com/biomejs/biome/issues/9626): [`noUnresolvedImports`](https://biomejs.dev/linter/rules/no-unresolved-imports/) no longer reports false positives for named imports from packages that have a corresponding `@types/*` package installed. For example, `import { useState } from "react"` with `@types/react` installed is now correctly recognised. - [#9942](https://github.com/biomejs/biome/pull/9942) [`9956f1d`](https://github.com/biomejs/biome/commit/9956f1d1b53168f8b33792c004f741368c883ff7) Thanks [@dyc3](https://github.com/dyc3)! - Fixed the safe fix for [`noFocusedTests`](https://biomejs.dev/linter/rules/no-focused-tests/) so it no longer panics when rewriting focused test function names such as `fit()` and `fdescribe()`. - [#9577](https://github.com/biomejs/biome/pull/9577) [`c499f46`](https://github.com/biomejs/biome/commit/c499f4609912b76fb5a7071a9e9c6a35bb26827a) Thanks [@tt-a1i](https://github.com/tt-a1i)! - Added the nursery rule [`useReduceTypeParameter`](https://biomejs.dev/linter/rules/use-reduce-type-parameter/). It flags type assertions on the initial value passed to `Array#reduce` and `Array#reduceRight` and recommends using a type parameter instead. ```ts // before: type assertion on initial value arr.reduce((sum, num) => sum + num, [] as number[]); // after: type parameter on the call arr.reduce<number[]>((sum, num) => sum + num, []); ``` - [#9895](https://github.com/biomejs/biome/pull/9895) [`1c8e1ef`](https://github.com/biomejs/biome/commit/1c8e1ef86882faabe4a461d29ab8643c18bfa83f) Thanks [@Netail](https://github.com/Netail)! - Added extra rule sources from react-xyz. `biome migrate eslint` should do a bit better detecting rules in your eslint configurations. - [#9891](https://github.com/biomejs/biome/pull/9891) [`4d9ac51`](https://github.com/biomejs/biome/commit/4d9ac51352482d72d3438f2d514dbeef0edc63e0) Thanks [@dyc3](https://github.com/dyc3)! - Improved the `noInvalidUseBeforeDeclaration` diagnostic to better explain why using a declaration too early is problematic and how to fix it. - [#9889](https://github.com/biomejs/biome/pull/9889) [`7ae83f2`](https://github.com/biomejs/biome/commit/7ae83f2f60dc83eae6ef72e4cb1d6f06f3a882de) Thanks [@dyc3](https://github.com/dyc3)! - Improved the diagnostics for [`noRedeclare`](https://biomejs.dev/linter/rules/no-redeclare/) to better explain the problem, why it matters, and how to fix it. - [#9875](https://github.com/biomejs/biome/pull/9875) [`a951586`](https://github.com/biomejs/biome/commit/a951586fa9cfc0a1826b1c695f12b5cfdd921245) Thanks [@minseong0324](https://github.com/minseong0324)! - Type-aware lint rules now resolve members through `Partial<T>`, `Required<T>`, and `Readonly<T>` utility types, preserving optional, readonly, and nullable member flags. ### [`v2.4.11`](https://github.com/biomejs/biome/blob/HEAD/packages/@biomejs/biome/CHANGELOG.md#2411) [Compare Source](https://github.com/biomejs/biome/compare/@biomejs/biome@2.4.10...@biomejs/biome@2.4.11) ##### Patch Changes - [#9350](https://github.com/biomejs/biome/pull/9350) [`4af4a3a`](https://github.com/biomejs/biome/commit/4af4a3a9ca31a598e9836997b7811992eae53387) Thanks [@dyc3](https://github.com/dyc3)! - Added the new nursery rule [useConsistentTestIt](https://biomejs.dev/linter/rules/use-consistent-test-it/) in the `test` domain. The rule enforces consistent use of either `it` or `test` for test functions in Jest/Vitest suites, with separate control for top-level tests and tests inside `describe` blocks. Invalid: ```js test("should fly", () => {}); // Top-level test using 'test' flagged, convert to 'it' describe("pig", () => { test("should fly", () => {}); // Test inside 'describe' using 'test' flagged, convert to 'it' }); ``` - [#9429](https://github.com/biomejs/biome/pull/9429) [`a2f3f7e`](https://github.com/biomejs/biome/commit/a2f3f7eb3a134ccc6851ed0eec19d1ff1636ec72) Thanks [@ematipico](https://github.com/ematipico)! - Added the new nursery lint rule [`useExplicitReturnType`](https://biomejs.dev/linter/rules/use-explicit-return-type). It reports TypeScript functions and methods that omit an explicit return type. ```ts function toString(x: any) { // rule triggered, it doesn't declare a return type return x.toString(); } ``` - [#9828](https://github.com/biomejs/biome/pull/9828) [`9e40844`](https://github.com/biomejs/biome/commit/9e40844261cf7b8c573e340e11e3297ef08bcd60) Thanks [@ematipico](https://github.com/ematipico)! - Fixed [#9484](https://github.com/biomejs/biome/issues/9484): the formatter no longer panics when formatting files that contain `graphql` tagged template literals combined with parenthesized expressions. - [#9886](https://github.com/biomejs/biome/pull/9886) [`e7c681e`](https://github.com/biomejs/biome/commit/e7c681ecbb6aed471c914167f5d067d327792f44) Thanks [@ematipico](https://github.com/ematipico)! - Fixed an issue where, occasionally, some bindings and references were not properly tracked, causing false positives from [`noUnusedVariables`](https://biomejs.dev/linter/rules/no-unused-variables/) and [`noUndeclaredVariables`](https://biomejs.dev/linter/rules/no-undeclared-variables/) in Svelte, Vue, and Astro files. - [#9760](https://github.com/biomejs/biome/pull/9760) [`5b16d18`](https://github.com/biomejs/biome/commit/5b16d187ba63800f4b6ea5057d551ae3f2fbc68c) Thanks [@myx0m0p](https://github.com/myx0m0p)! - Fixed [#4093](https://github.com/biomejs/biome/issues/4093): the [`noDelete`](https://biomejs.dev/linter/rules/no-delete/) rule no longer triggers for `delete process.env.FOO`, since `delete` is the documented way to remove environment variables in Node.js. - [#9799](https://github.com/biomejs/biome/pull/9799) [`2af8efd`](https://github.com/biomejs/biome/commit/2af8efd348cfa992bc7d35683de55bb8cc583260) Thanks [@minseong0324](https://github.com/minseong0324)! - Added the rule [`noMisleadingReturnType`](https://biomejs.dev/linter/rules/no-misleading-return-type/). The rule detects when a function's return type annotation is wider than what the implementation actually returns. ```ts // Flagged: `: string` is wider than `"loading" | "idle"` function getStatus(b: boolean): string { if (b) return "loading"; return "idle"; } ``` - [#9880](https://github.com/biomejs/biome/pull/9880) [`7f67749`](https://github.com/biomejs/biome/commit/7f67749e77af6e5af3dfc72a02bb99718695612e) Thanks [@dyc3](https://github.com/dyc3)! - Improved the diagnostics for [`useFind`](https://biomejs.dev/linter/rules/use-find/) to better explain the problem, why it matters, and how to fix it. - [#9755](https://github.com/biomejs/biome/pull/9755) [`bff7bdb`](https://github.com/biomejs/biome/commit/bff7bdb1355cdf7d219a288e31c5c5a0357e3aad) Thanks [@ematipico](https://github.com/ematipico)! - Improved performance of fix-all operations (`--write`). Biome is now smarter when it runs lint rules and assist actions. First, it runs only rules that have code fixes, and then runs the rest of the rules. - [#8651](https://github.com/biomejs/biome/pull/8651) [`aafca2d`](https://github.com/biomejs/biome/commit/aafca2d086eb24226a9cf1a69179561f70d02773) Thanks [@siketyan](https://github.com/siketyan)! - Add a new lint rule `useDisposables` for JavaScript, which detects disposable objects assigned to variables without `using` or `await using` syntax. Disposable objects that implement the `Disposable` or `AsyncDisposable` interface are intended to be disposed of after use. Not disposing them can lead to resource or memory leaks, depending on the implementation. **Invalid:** ```js function createDisposable(): Disposable { return { [Symbol.dispose]() { // do something }, }; } const disposable = createDisposable(); ``` **Valid:** ```js function createDisposable(): Disposable { return { [Symbol.dispose]() { // do something }, }; } using disposable = createDisposable(); ``` - [#9788](https://github.com/biomejs/biome/pull/9788) [`53b8e57`](https://github.com/biomejs/biome/commit/53b8e5768e33b87298f8e0e4c896957dee6f2eb6) Thanks [@MeGaNeKoS](https://github.com/MeGaNeKoS)! - Fixed [#7760](https://github.com/biomejs/biome/issues/7760): Added support for CSS scroll-driven animation `timeline-range-name` keyframe selectors (`cover`, `contain`, `entry`, `exit`, `entry-crossing`, `exit-crossing`). Biome no longer reports parse errors on keyframes like `entry 0% { ... }` or `exit 100% { ... }`. - [#9728](https://github.com/biomejs/biome/pull/9728) [`5085424`](https://github.com/biomejs/biome/commit/5085424db427c7874eef7ca732f237febb49fdb1) Thanks [@mkosei](https://github.com/mkosei)! - Fixed [#9696](https://github.com/biomejs/biome/issues/9696): Astro frontmatter now correctly parses regular expression literals like `/\d{4}/`. - [#9261](https://github.com/biomejs/biome/pull/9261) [`16b6c49`](https://github.com/biomejs/biome/commit/16b6c4951793c820d109a9b502e1812fcbfca764) Thanks [@ematipico](https://github.com/ematipico)! - Fixed [#8409](https://github.com/biomejs/biome/issues/8409): CSS formatter now correctly places comments after the colon in property declarations. Previously, comments that appeared after the colon in CSS property values were incorrectly moved before the property name: ```diff [lang]:lang(ja) { - /* system-ui,*/ font-family: + font-family: /* system-ui,*/ Hiragino Sans, sans-serif; } ``` - [#9441](https://github.com/biomejs/biome/pull/9441) [`957ea4c`](https://github.com/biomejs/biome/commit/957ea4c8ebe75083ba68a98f70616c88368883c5) Thanks [@soconnor-seeq](https://github.com/soconnor-seeq)! - Fixed [#1630](https://github.com/biomejs/biome/issues/1630): LSP project selection now prefers the most specific project root in nested workspaces. - [#9878](https://github.com/biomejs/biome/pull/9878) [`de6210f`](https://github.com/biomejs/biome/commit/de6210f80fa6d1dc0ca3edd395e9d8e571766bb8) Thanks [@ematipico](https://github.com/ematipico)! - Fixed [#9118](https://github.com/biomejs/biome/issues/9118): [`noUnusedImports`](https://biomejs.dev/linter/rules/no-unused-imports/) no longer reports false positives for default imports used inside Svelte, Vue and Astro components. - [#9879](https://github.com/biomejs/biome/pull/9879) [`ce7e2b7`](https://github.com/biomejs/biome/commit/ce7e2b762bc82319c39027d15e84a26f8708fc92) Thanks [@dyc3](https://github.com/dyc3)! - Fixed a parser diagnostic's message when vue syntax is disabled so that it no longer references the non-existant `html.parser.vue` option. This option will become available in 2.5. - [#9880](https://github.com/biomejs/biome/pull/9880) [`7f67749`](https://github.com/biomejs/biome/commit/7f67749e77af6e5af3dfc72a02bb99718695612e) Thanks [@dyc3](https://github.com/dyc3)! - Improved the diagnostics for [`useRegexpExec`](https://biomejs.dev/linter/rules/use-regexp-exec/) to better explain the problem, why it matters, and how to fix it. - [#9846](https://github.com/biomejs/biome/pull/9846) [`b7134d9`](https://github.com/biomejs/biome/commit/b7134d92413991c4394574353b76b1891160bc38) Thanks [@ematipico](https://github.com/ematipico)! - Fixed [#9140](https://github.com/biomejs/biome/issues/9140): Biome now parses Astro's attribute shorthand inside `.astro` files. The following snippet no longer reports a parse error: ```astro --- const items = ['a', 'b']; --- <ul> {items.map((item) => <li {item}>row</li>)} </ul> ``` - [#9790](https://github.com/biomejs/biome/pull/9790) [`67df09d`](https://github.com/biomejs/biome/commit/67df09d524fe49d3bb08dc45b7dfb99771e25bdd) Thanks [@dyc3](https://github.com/dyc3)! - Fixed [#9781](https://github.com/biomejs/biome/issues/9781): Trailing comments after a top-level `biome-ignore-all format` suppression are now preserved instead of being dropped. This applies to JavaScript, CSS, HTML, JSONC, GraphQL, and Grit files. - [#9745](https://github.com/biomejs/biome/pull/9745) [`d87073e`](https://github.com/biomejs/biome/commit/d87073ef5586f0cf7eb74fd0d7390a3444c591ff) Thanks [@ematipico](https://github.com/ematipico)! - Fixed [#9741](https://github.com/biomejs/biome/issues/9741): the LSP server now correctly returns the [`organizeImports`](https://biomejs.dev/assist/actions/organize-imports/) code action when the client requests it via `source.organizeImports.biome` in the `only` filter. Previously, editors with `codeAction/resolve` support (e.g. Zed) received an empty response because the action was serialized with the wrong kind (`source.biome.organizeImports` instead of `source.organizeImports.biome`). - [#9880](https://github.com/biomejs/biome/pull/9880) [`7f67749`](https://github.com/biomejs/biome/commit/7f67749e77af6e5af3dfc72a02bb99718695612e) Thanks [@dyc3](https://github.com/dyc3)! - Improved the diagnostics for [`useArraySome`](https://biomejs.dev/linter/rules/use-array-some/) to better explain the problem, why it matters, and how to fix it. - [#9795](https://github.com/biomejs/biome/pull/9795) [`1d09f0f`](https://github.com/biomejs/biome/commit/1d09f0fae1d0270ad603e7b494d8dffb979125aa) Thanks [@dyc3](https://github.com/dyc3)! - Relaxed [`useExplicitType`](https://biomejs.dev/linter/rules/use-explicit-type/) for trivially inferrable types. Type annotations can now be omitted when types are trivially inferrable from: - Binary expressions (`const sum = 1 + 1`) - Comparison expressions (`const isEqual = 'a' === 'b'`, `const isTest = process.env.NODE_ENV === 'test'`) - Logical expressions (`const and = true && false`) - Class instantiation (`const date = new Date()`) - Array literals (`const arr = [1, 2, 3]`) - Conditional expressions (`const val = true ? 'yes' : 'no'`) - Function calls (`const num = Math.random()`) - Parameter defaults - any expression is now allowed (`const fn = (max = MAX_ATTEMPTS) => ...`) Comparison expressions always return `boolean`, so any operands are now allowed (including property access like `process.env.NODE_ENV`). Parameters with default values no longer require type annotations, as TypeScript can infer the type from the default value (even when referencing variables). Also removed the redundant `any` type validation from this rule. The `any` type is now only validated by the dedicated `noExplicitAny` rule, following the Single Responsibility Principle. - [#9809](https://github.com/biomejs/biome/pull/9809) [`e8cad58`](https://github.com/biomejs/biome/commit/e8cad58a1baf8f8c935e8547da88905cfbfb05be) Thanks [@Netail](https://github.com/Netail)! - Added the new nursery rule [`useQwikLoaderLocation`](https://biomejs.dev/linter/rules/use-qwik-loader-location/), which enforces that Qwik loader functions are declared in the correct location. - [#9877](https://github.com/biomejs/biome/pull/9877) [`fc9d715`](https://github.com/biomejs/biome/commit/fc9d715a904d382fcd7fb932a05896cfbafaaa44) Thanks [@ematipico](https://github.com/ematipico)! - Fixed [#9136](https://github.com/biomejs/biome/issues/9136) and [#9653](https://github.com/biomejs/biome/issues/9653): [`noUndeclaredVariables`](https://biomejs.dev/linter/rules/no-undeclared-variables/) and [`noUnusedVariables`](https://biomejs.dev/linter/rules/no-unused-variables/) no longer report false positives on several Svelte template constructs that declare or reference bindings in the host grammar: - `{#snippet name(params)}` — the snippet name and its parameters (including object, array, rest, and nested destructuring) are now tracked. - `{@render name(args)}` — the snippet name used at the render site is now resolved against the snippet declaration. - `{#each items as item, index (key)}` — the `item` binding (plain identifier or destructured), the optional `index`, and the optional `key` expression are now tracked. - `{@const name = value}` — the declared name is now tracked as a binding and the initializer is analyzed for undeclared references. - `{@debug a, b, c}` — each debugged identifier is now analyzed and reported if undeclared. - Shorthand attributes `<img {src} />` — the curly-shorthand attribute is now analyzed as an expression, so undeclared references inside it are reported. For example, the following template no longer triggers either rule: ```svelte <script> let items = []; let total = 0; </script> {#snippet figure(image)} <figure> <img src={image.src} alt={image.caption} /> <figcaption>{image.caption}</figcaption> </figure> {/snippet} {#each items as item} {@const price = item.price} {@render figure(item)} <span>{price}</span> {/each} {@debug items, total} ``` - [#9869](https://github.com/biomejs/biome/pull/9869) [`78bce77`](https://github.com/biomejs/biome/commit/78bce773a2d8776991c93a239d462fd42bf24cc4) Thanks [@Netail](https://github.com/Netail)! - Updated [`noDuplicateFieldDefinitionNames`](https://biomejs.dev/linter/rules/no-duplicate-field-definition-names/) to also flag duplicate fields within type extensions, interface extensions & input extensions. - [#9739](https://github.com/biomejs/biome/pull/9739) [`0bc2198`](https://github.com/biomejs/biome/commit/0bc2198735230c3bad14a831652543bd304fa0d6) Thanks [@dyc3](https://github.com/dyc3)! - Fixed Grit queries that use native Biome AST node names with the native field names that are in our `.ungram` grammar files. Queries such as `JsConditionalExpression(consequent = $cons, alternate = $alt)` now compile successfully in `biome search` and grit plugins. - [#9811](https://github.com/biomejs/biome/pull/9811) [`2dddca3`](https://github.com/biomejs/biome/commit/2dddca3f09bda92f7f43bbaf482796f5aec7a970) Thanks [@dyc3](https://github.com/dyc3)! - Updated `noImpliedEval` to flag `new Function()` usages, as its a form of indirect `eval`, and to include `no-new-func` as a rule source. - [#9870](https://github.com/biomejs/biome/pull/9870) [`ccf9770`](https://github.com/biomejs/biome/commit/ccf9770b37cf2d04205a5914db72c86137bca50f) Thanks [@Netail](https://github.com/Netail)! - Marked eslint-qwik-plugin's `unused-server` as redundant since it was covered by `noUnusedVariables`. - [#9701](https://github.com/biomejs/biome/pull/9701) [`1417c3b`](https://github.com/biomejs/biome/commit/1417c3b4ece262b1500b12c9f1da1429e4d53fc4) Thanks [@dyc3](https://github.com/dyc3)! - Added the new nursery rule [`noUselessTypeConversion`](https://biomejs.dev/linter/rules/no-useless-type-conversion/), which reports redundant primitive conversion patterns such as `String(value)` when `value` is already a string. - [#9248](https://github.com/biomejs/biome/pull/9248) [`49f00a3`](https://github.com/biomejs/biome/commit/49f00a38d64af131178ba4e096155d22055aa1c4) Thanks [@pkallos](https://github.com/pkallos)! - `useNullishCoalescing` now also detects ternary expressions that check for `null` or `undefined` and suggests rewriting them with `??`. A new `ignoreTernaryTests` option allows disabling this behavior. - [#9863](https://github.com/biomejs/biome/pull/9863) [`6a44619`](https://github.com/biomejs/biome/commit/6a4461915f1f5f161795081706b84cc8992b12dd) Thanks [@ematipico](https://github.com/ematipico)! - Fixed [#9690](https://github.com/biomejs/biome/issues/9690): `biome check --write` is now idempotent on HTML files that contain embedded `<style>` or `<script>` blocks. Previously, each run reported "Fixed 1 file" even when the file content did not actually change, because the embedded language formatter's output was not re-indented to match the surrounding HTML block. </details> <details> <summary>clerk/javascript (@clerk/ui)</summary> ### [`v1.25.7`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#1257) [Compare Source](https://github.com/clerk/javascript/compare/@clerk/ui@1.25.6...@clerk/ui@1.25.7) ##### Patch Changes - Ensure the keyless prompt renders above application content by setting an explicit `z-index`. ([#9211](https://github.com/clerk/javascript/pull/9211)) by [@alexcarpenter](https://github.com/alexcarpenter) - The OAuth consent screen now shows a recognizable brand mark for well-known OAuth clients (Claude, ChatGPT) when the requesting application has not uploaded its own logo. ([#9158](https://github.com/clerk/javascript/pull/9158)) by [@alexcarpenter](https://github.com/alexcarpenter) ### [`v1.25.6`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#1256) [Compare Source](https://github.com/clerk/javascript/compare/@clerk/ui@1.25.5...@clerk/ui@1.25.6) ##### Patch Changes - Add an experimental `oidcSelfServe` option to enable the self-serve OIDC configuration flow in `<ConfigureSSO />`. ([#9198](https://github.com/clerk/javascript/pull/9198)) by [@NicolasLopes7](https://github.com/NicolasLopes7) - Updated dependencies \[[`858a689`](https://github.com/clerk/javascript/commit/858a6896736cd2a82e6a2f10c3cd84435fa2b0de), [`c904fb4`](https://github.com/clerk/javascript/commit/c904fb4d0ea6a6fa10c1961b56420d6f99f5188e)]: - [@clerk/shared](https://github.com/clerk/shared)@4.25.6 - [@clerk/localizations](https://github.com/clerk/localizations)@4.13.6 ### [`v1.25.5`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#1255) [Compare Source](https://github.com/clerk/javascript/compare/@clerk/ui@1.25.4...@clerk/ui@1.25.5) ##### Patch Changes - Fix pressing `Escape` while a `Select` is open inside a `Drawer` (for example the payment method picker in Checkout) dismissing the entire Drawer. `Escape` now closes only the open `Select` and leaves the Drawer open. The `Select` now wires up its floating interaction props so it handles `Escape` itself, and the `Drawer` roots a floating tree so nested floating elements are recognized as its children. ([#9176](https://github.com/clerk/javascript/pull/9176)) by [@alexcarpenter](https://github.com/alexcarpenter) - Improve `Select` keyboard and screen reader support by routing navigation through floating-ui's interaction hooks. Pressing `ArrowUp`/`ArrowDown` on a focused, closed `Select` now opens the listbox, and the active option is announced via `aria-activedescendant`. The searchable variant (for example the `PhoneInput` country picker) now exposes a proper combobox: its input is marked `role="combobox"` with `aria-controls`, `aria-autocomplete="list"`, and `aria-activedescendant`, while the plain variant keeps its listbox semantics. ([#9179](https://github.com/clerk/javascript/pull/9179)) by [@alexcarpenter](https://github.com/alexcarpenter) - Updated dependencies \[[`bcbdda6`](https://github.com/clerk/javascript/commit/bcbdda6d7d6c6e12cf33febe17fd148c69788716)]: - [@clerk/shared](https://github.com/clerk/shared)@4.25.5 - [@clerk/localizations](https://github.com/clerk/localizations)@4.13.5 ### [`v1.25.4`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#1254) [Compare Source](https://github.com/clerk/javascript/compare/@clerk/ui@1.25.3...@clerk/ui@1.25.4) ##### Patch Changes - Reduce layout shift while loading the organization and billing UI. The domain list, billing subscription section, and payment methods now reserve their loaded height while data is fetched, and the subscription section shows a loading indicator instead of rendering nothing. ([#9169](https://github.com/clerk/javascript/pull/9169)) by [@alexcarpenter](https://github.com/alexcarpenter) - Improve phone input country selector and menu item styling, refining hover and focus states, spacing, and scroll padding. ([#9161](https://github.com/clerk/javascript/pull/9161)) by [@alexcarpenter](https://github.com/alexcarpenter) - Fix table row hover styling so the rounded bottom corners are only applied to the last row, matching the table's border radius. Previously any hovered row showed a stray corner radius. ([#9170](https://github.com/clerk/javascript/pull/9170)) by [@alexcarpenter](https://github.com/alexcarpenter) - Headings now use `text-wrap: balance` and body text uses `text-wrap: pretty` to reduce widows and orphans when text wraps across lines. This is a progressive enhancement that falls back to normal wrapping in browsers without support. ([#9157](https://github.com/clerk/javascript/pull/9157)) by [@alexcarpenter](https://github.com/alexcarpenter) - Updated dependencies \[[`e162b71`](https://github.com/clerk/javascript/commit/e162b7144e4b84dc8e69ca415a5da98df876cba0)]: - [@clerk/shared](https://github.com/clerk/shared)@4.25.4 - [@clerk/localizations](https://github.com/clerk/localizations)@4.13.4 ### [`v1.25.3`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#1253) [Compare Source](https://github.com/clerk/javascript/compare/@clerk/ui@1.25.2...@clerk/ui@1.25.3) ##### Patch Changes - Fix small actions button border radius to ensure consistency. ([#9146](https://github.com/clerk/javascript/pull/9146)) by [@alexcarpenter](https://github.com/alexcarpenter) - Reduce the organization avatar's border radius in the `OrganizationSwitcher` trigger so it stays proportional at the smaller trigger size. ([#9148](https://github.com/clerk/javascript/pull/9148)) by [@alexcarpenter](https://github.com/alexcarpenter) - Set `box-sizing: border-box` on the spinner so its border no longer changes the rendered size and causes a layout shift. ([#9147](https://github.com/clerk/javascript/pull/9147)) by [@alexcarpenter](https://github.com/alexcarpenter) - Updated dependencies \[[`d8fc1d7`](https://github.com/clerk/javascript/commit/d8fc1d7df68305db28c224b4ce0aa429d0b30a8e), [`1d0e78c`](https://github.com/clerk/javascript/commit/1d0e78cd26ac3598b11631a91192dba0f1155afc)]: - [@clerk/shared](https://github.com/clerk/shared)@4.25.3 - [@clerk/localizations](https://github.com/clerk/localizations)@4.13.3 ### [`v1.25.2`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#1252) ##### Patch Changes - Add a clear button to search inputs for quickly resetting the current query. It appears in the `<APIKeys />` search and the `<OrganizationProfile />` members search. ([#9098](https://github.com/clerk/javascript/pull/9098)) by [@alexcarpenter](https://github.com/alexcarpenter) Search inputs now expose a shared `searchInput` appearance element (layered alongside any existing component-specific element), and the clear button is themeable via the new shared `searchInputClearButton` element. The clear button's label can be customized with the new shared `searchInput.action__clear` localization key. - Fix org invitation and request action descriptions alignment. ([#9118](https://github.com/clerk/javascript/pull/9118)) by [@alexcarpenter](https://github.com/alexcarpenter) - Polish the `<OrganizationSwitcher />`: ([#9112](https://github.com/clerk/javascript/pull/9112)) by [@maxyinger](https://github.com/maxyinger) - Decode avatar images synchronously so a freshly mounted avatar (e.g. when the popover opens) paints on its first frame instead of briefly flashing the avatar background. - Highlight the trigger while its popover is open. - Align the "Create organization" action's height with the other rows for a consistent list. - Increase the default height of buttons and inputs by 2px for larger, easier-to-tap touch targets, especially on mobile. ([#9061](https://github.com/clerk/javascript/pull/9061)) by [@alexcarpenter](https://github.com/alexcarpenter) - Updated dependencies \[[`8dbf343`](https://github.com/clerk/javascript/commit/8dbf343f9d327bae9f950718645ef71d6272c797)]: - [@clerk/localizations](https://github.com/clerk/localizations)@4.13.2 - [@clerk/shared](https://github.com/clerk/shared)@4.25.2 ### [`v1.25.1`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#1251) ##### Patch Changes - Updated dependencies \[[`62f6702`](https://github.com/clerk/javascript/commit/62f6702dda69acf5570fd61dfa01ca8cd0dd2c77)]: - [@clerk/shared](https://github.com/clerk/shared)@4.25.1 - [@clerk/localizations](https://github.com/clerk/localizations)@4.13.1 ### [`v1.25.0`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#1250) [Compare Source](https://github.com/clerk/javascript/compare/@clerk/ui@1.24.2...@clerk/ui@1.25.0) ##### Minor Changes - Add support for Clerk Protect mid-flow SDK challenges (`protect_check`) on both sign-up and sign-in. ([#8329](https://github.com/clerk/javascript/pull/8329)) by [@zourzouvillys](https://github.com/zourzouvillys) When the Protect antifraud service issues a challenge, responses now carry a `protectCheck` field with `{ status, token, sdkUrl, expiresAt?, uiHints? }`. Clients resolve the gate by loading the SDK at `sdkUrl`, executing the challenge, and submitting the resulting proof token via `signUp.submitProtectCheck({ proofToken })` or `signIn.submitProtectCheck({ proofToken })`. The response may carry a chained challenge, which the SDK resolves iteratively. Sign-in adds a new `'needs_protect_check'` value to the `SignInStatus` union. **Upgrading this package is type-only and does not change runtime behavior**: the server returns the new status (and the `protectCheck` field) only for instances where Protect mid-flow challenges have been explicitly enabled — the feature is off by default and is not enabled for existing instances by upgrading. The server additionally only emits the new status value to SDK versions that understand it, so older clients never receive an unknown status. If an exhaustive `switch` on `signIn.status` flags the new value after upgrading, handle it by running the challenge described by `protectCheck` and submitting the proof via `submitProtectCheck()`. Clients should treat the `protectCheck` field as the authoritative gate signal and fall back to the status value for defense in depth. The pre-built `<SignIn />` and `<SignUp />` components handle the gate automatically by routing to a new `protect-check` route that runs the challenge SDK and resumes the flow on completion. ##### Patch Changes - Fix the payment method form getting stuck in a loading state after a failed card setup. Non-validation errors such as 3DS authentication failures are now displayed. ([#9080](https://github.com/clerk/javascript/pull/9080)) by [@aeliox](https://github.com/aeliox) - Fix the organization profile modal close button overlapping the SSO configuration wizard's step header. ([#9089](https://github.com/clerk/javascript/pull/9089)) by [@iagodahlem](https://github.com/iagodahlem) - Enlarge the show/hide password toggle button's hit area with added padding and rounded corners, making it easier to tap and giving it a clearer hover/focus target. ([#9096](https://github.com/clerk/javascript/pull/9096)) by [@alexcarpenter](https://github.com/alexcarpenter) - Polish the Protect check card: the loading spinner now hides while a challenge widget (e.g. Turnstile) is visible instead of spinning alongside it, only appears after a short delay so near-instant checks never flash it, and the card no longer reserves empty space above the spinner before a widget has rendered. ([#9099](https://github.com/clerk/javascript/pull/9099)) by [@mwickett](https://github.com/mwickett) - Fix standalone `<SignUp />` Protect checks so the verification card stays mounted while a solved challenge routes to the next step, while stale direct visits to the protect-check route return to the start of the sign-up flow. ([#9082](https://github.com/clerk/javascript/pull/9082)) by [@mwickett](https://github.com/mwickett) - Fix tooltips rendering behind modals (for example on the organization profile Security page). Tooltips now layer above modal content, and pressing Escape or clicking outside while a tooltip is open inside a modal closes only the tooltip instead of also dismissing the modal. ([#9093](https://github.com/clerk/javascript/pull/9093)) by [@alexcarpenter](https://github.com/alexcarpenter) - Updated dependencies \[[`6f97ef5`](https://github.com/clerk/javascript/commit/6f97ef59429a88af14534df895e52893b4f160a6), [`bab1f29`](https://github.com/clerk/javascript/commit/bab1f2978d6fed5aab62721b85a7066cd771d5c9), [`f2d9e4b`](https://github.com/clerk/javascript/commit/f2d9e4b9eeac4cb9a2b1c9d4278ff11cf49555b1)]: - [@clerk/shared](https://github.com/clerk/shared)@4.25.0 - [@clerk/localizations](https://github.com/clerk/localizations)@4.13.0 ### [`v1.24.2`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#1242) [Compare Source](https://github.com/clerk/javascript/compare/@clerk/ui@1.24.1...@clerk/ui@1.24.2) ##### Patch Changes - Fix the checked checkbox appearing as a blank filled box in dark themes. The checkmark now uses the `colorPrimaryForeground` theme color, so it stays legible against the checkbox background across light, dark, and custom themes. ([#9074](https://github.com/clerk/javascript/pull/9074)) by [@alexcarpenter](https://github.com/alexcarpenter) - On the Test step of the self-serve SSO configuration flow, clicking Continue now re-checks for a successful test run before blocking, so a successful run completed in a separate browser tab is recognized without first clicking Refresh logs. ([#9046](https://github.com/clerk/javascript/pull/9046)) by [@iagodahlem](https://github.com/iagodahlem) - Use locale and currency aware formatting for negative money amounts ([#9064](https://github.com/clerk/javascript/pull/9064)) by [@dstaley](https://github.com/dstaley) - Fix icon-only social buttons rendering taller than the ones with text. They now size to the same height as the text (block) buttons across all appearance spacing and font-size settings, keeping every social button in a row consistent. ([#9058](https://github.com/clerk/javascript/pull/9058)) by [@alexcarpenter](https://github.com/alexcarpenter) - Stop `truncateWithEndVisible` from splitting characters outside the BMP (such as CJK Extension B kanji and emoji) into a broken replacement character when truncating to a very small width. The short-width fallback now slices by code point, matching the main truncation path. ([#9047](https://github.com/clerk/javascript/pull/9047)) by [@alexcarpenter](https://github.com/alexcarpenter) - Updated dependencies \[[`1efc7e5`](https://github.com/clerk/javascript/commit/1efc7e55c568e87b7e47c2d3f235ea4d822242d9), [`5028b54`](https://github.com/clerk/javascript/commit/5028b540c945571db396f8c32a7a6b0c48a31071), [`2e1fec7`](https://github.com/clerk/javascript/commit/2e1fec7c85d7f5d95aa42f8e1f1066be399b88db)]: - [@clerk/shared](https://github.com/clerk/shared)@4.24.0 - [@clerk/localizations](https://github.com/clerk/localizations)@4.12.1 ### [`v1.24.1`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#1241) [Compare Source](https://github.com/clerk/javascript/compare/@clerk/ui@1.24.0...@clerk/ui@1.24.1) ##### Patch Changes - Add an accessible name to the API Keys search input so screen readers announce it correctly. ([#9055](https://github.com/clerk/javascript/pull/9055)) by [@wobsoriano](https://github.com/wobsoriano) ### [`v1.24.0`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#1240) [Compare Source](https://github.com/clerk/javascript/compare/@clerk/ui@1.23.1...@clerk/ui@1.24.0) ##### Minor Changes - Add account credits section and credit history page to the billing tab for payers with an existing credit balance. ([#8977](https://github.com/clerk/javascript/pull/8977)) by [@l-armstrong](https://github.com/l-armstrong) ##### Patch Changes - Fix `<UserButton />` session actions alignment. ([#9034](https://github.com/clerk/javascript/pull/9034)) by [@andrewtam](https://github.com/andrewtam) - Updated dependencies \[[`4306146`](https://github.com/clerk/javascript/commit/430614605666c4ad387c3f945700c08df1e774c0), [`533f0b1`](https://github.com/clerk/javascript/commit/533f0b17e48bc326310df80a9d4a53234548b915)]: - [@clerk/localizations](https://github.com/clerk/localizations)@4.12.0 - [@clerk/shared](https://github.com/clerk/shared)@4.23.0 ### [`v1.23.1`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#1231) [Compare Source](https://github.com/clerk/javascript/compare/@clerk/ui@1.23.0...@clerk/ui@1.23.1) ##### Patch Changes - UserProfile should show attributes enabled for sign in ([#8042](https://github.com/clerk/javascript/pull/8042)) by [@dmoerner](https://github.com/dmoerner) - Fix missing redirect URL protocol validation for Clerk UI browser navigations, including the multi-session add-account flow. ([#8961](https://github.com/clerk/javascript/pull/8961)) by [@jacekradko](https://github.com/jacekradko) Internal browser navigations now consistently honor configured redirect protocols and fail closed across mixed ClerkJS/UI bundle versions. - Updated dependencies \[[`cb76aa2`](https://github.com/clerk/javascript/commit/cb76aa25b80124a86d8d2384f3fb370eb6917f6d)]: - [@clerk/shared](https://github.com/clerk/shared)@4.22.1 - [@clerk/localizations](https://github.com/clerk/localizations)@4.11.1 ### [`v1.23.0`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#1230) ##### Minor Changes - Handle expired organization domains on self-serve SSO flow, allowing to trigger a new verification ([#9000](https://github.com/clerk/javascript/pull/9000)) by [@LauraBeatris](https://github.com/LauraBeatris) - Add drag-to-upload support in AvatarUploader ([#8348](https://github.com/clerk/javascript/pull/8348)) by [@alexcarpenter](https://github.com/alexcarpenter) ##### Patch Changes - Fix the self-serve SSO configuration wizard losing your place when organization data refetches mid-flow. After submitting a Configure step (for example saving an identity provider's metadata), a background refetch on the OrganizationProfile Security page could unmount the open ConfigureSSO wizard and re-render it on an earlier step. The wizard now stays on its current step while data loads in the background. ([#8999](https://github.com/clerk/javascript/pull/8999)) by [@iagodahlem](https://github.com/iagodahlem) - Fix focus ring visibility on `Tab` elements for keyboard navigation. ([#8998](https://github.com/clerk/javascript/pull/8998)) by [@alexcarpenter](https://github.com/alexcarpenter) - Updated dependencies \[[`19ce04a`](https://github.com/clerk/javascript/commit/19ce04aab6387c430dc41e51c6130a88cc543cc8), [`3e036f4`](https://github.com/clerk/javascript/commit/3e036f425da47d781a45a0805ec8b0fcc6f38eff)]: - [@clerk/localizations](https://github.com/clerk/localizations)@4.11.0 - [@clerk/shared](https://github.com/clerk/shared)@4.22.0 ### [`v1.22.0`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#1220) ##### Minor Changes - Monetary amounts are now formatted using your application's locale. For example, with the locale set to `fr-FR`, a USD 1000 amount now renders as `1 000,00 $US`; previously, it rendered as `$1,000.00` regardless of your application's configured locale. ([#8918](https://github.com/clerk/javascript/pull/8918)) by [@dstaley](https://github.com/dstaley) ##### Patch Changes - Fix the `<ConfigureSSO />` wizard header on small screens: the back link now stacks above the step indicators and the step separators are hidden, so the steps no longer wrap onto a second line. ([#8984](https://github.com/clerk/javascript/pull/8984)) by [@iagodahlem](https://github.com/iagodahlem) - Updated dependencies \[[`fd7b824`](https://github.com/clerk/javascript/commit/fd7b8247c8bc0d9c14bd470df8d5f6cf707eab59), [`af0eb3f`](https://github.com/clerk/javascript/commit/af0eb3f02cd1a3eca2c7dbc4df4d226f8d844213), [`8024cac`](https://github.com/clerk/javascript/commit/8024cac2fb34e46adc4f043f9fa32d5e3886cee9)]: - [@clerk/localizations](https://github.com/clerk/localizations)@4.10.0 ### [`v1.21.0`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#1210) [Compare Source](https://github.com/clerk/javascript/compare/@clerk/ui@1.20.0...@clerk/ui@1.21.0) ##### Minor Changes - Migrate from `:focus` to `:focus-visible` so focus rings only appear during keyboard navigation ([#8595](https://github.com/clerk/javascript/pull/8595)) by [@alexcarpenter](https://github.com/alexcarpenter) - Improve UserButton and OrganizationSwitcher accessibility. The trigger button now announces itself as a dialog trigger (`aria-haspopup="dialog"`) and the popover uses `role="dialog"` instead of `role="menu"`. UserButton and OrganizationSwitcher popovers now receive focus when opened, and actions are logically grouped with labelled `role="group"` elements for screen readers. ([#8325](https://github.com/clerk/javascript/pull/8325)) by [@alexcarpenter](https://github.com/alexcarpenter) ##### Patch Changes - Condense the OrganizationProfile Security page SSO overview to a single summary row (one-line description, domains as chips, status badge, actions under the overflow menu) and remove the now-unused ssoSection provider/sign-on URL/issuer/descriptionLine2 localization keys. ([#8915](https://github.com/clerk/javascript/pull/8915)) by [@iagodahlem](https://github.com/iagodahlem) - Updates development mode indicator styling. ([#8917](https://github.com/clerk/javascript/pull/8917)) by [@alexcarpenter](https://github.com/alexcarpenter) - Add a generic `FLOW_STEP_MOUNTED` telemetry event (`eventFlowStepMounted`) for measuring multi-step flow funnels, and wire it into the self-serve SSO flow ([#8951](https://github.com/clerk/javascript/pull/8951)) by [@LauraBeatris](https://github.com/LauraBeatris) - Add localization support for OAuth access denied errors. ([#8786](https://github.com/clerk/javascript/pull/8786)) by [@wobsoriano](https://github.com/wobsoriano) - Allow changing enterprise connection provider between self-serve SSO steps ([#8881](https://github.com/clerk/javascript/pull/8881)) by [@LauraBeatris](https://github.com/LauraBeatris) - The Security tab in `<OrganizationProfile />` is now hidden for members who lack the manage enterprise connections permission (`org:sys_entconns:manage`), instead of rendering a permission-denied state. This matches how the Members, Billing, and API keys tabs are gated. ([#8971](https://github.com/clerk/javascript/pull/8971)) by [@iagodahlem](https://github.com/iagodahlem) - Self-serve SSO: fix the configuration wizard rendering a blank step when a connection is reset from the first configuration step. Resetting now returns to the provider selection step. ([#8970](https://github.com/clerk/javascript/pull/8970)) by [@iagodahlem](https://github.com/iagodahlem) - Self-serve SSO: restore keyboard-accessible provider selection, mark configuration wizard steps complete based on connection state rather than position, and fix the organization Security page loading state. ([#8940](https://github.com/clerk/javascript/pull/8940)) by [@iagodahlem](https://github.com/iagodahlem) - Updated dependencies \[[`c38d853`](https://github.com/clerk/javascript/commit/c38d8534b916936acbe4131fac58c8743e684eab), [`7e3174a`](https://github.com/clerk/javascript/commit/7e3174a4f861ad89667c3d0c63b6f2d0c001bcb6), [`97039bb`](https://github.com/clerk/javascript/commit/97039bb871a33ccc2c9e46f011e4cbbc1459fb1e), [`f43071d`](https://github.com/clerk/javascript/commit/f43071d8d98194c22e34d1d72ed8d0cf0b6b0f0e), [`0e0ff11`](https://github.com/clerk/javascript/commit/0e0ff110fdab5f0ffb0a8896c1f864605c1f809d), [`0039618`](https://github.com/clerk/javascript/commit/003961810786af49daba5a3e82e34378d52b885c), [`a536a0d`](https://github.com/clerk/javascript/commit/a536a0d5b31a5fcba31813ed34f9494a4ec4851b)]: - [@clerk/localizations](https://github.com/clerk/localizations)@4.9.3 - [@clerk/shared](https://github.com/clerk/shared)@4.21.0 ### [`v1.20.0`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#1200) [Compare Source](https://github.com/clerk/javascript/compare/@clerk/ui@1.19.0...@clerk/ui@1.20.0) ##### Minor Changes - Introduces organization membership feature. ([#8933](https://github.com/clerk/javascript/pull/8933)) by [@NicolasLopes7](https://github.com/NicolasLopes7) Organizations can enforce exclusive membership, limiting users to a single organization. During the `choose-organization` session task, members of such an organization are automatically activated instead of seeing the picker. `Organization.exclusiveMembership` is now exposed on the Organization resource. ##### Patch Changes - Updated dependencies \[[`01789b4`](https://github.com/clerk/javascript/commit/01789b4e8d3a280940b7ebcb223a33c6ecfd209a)]: - [@clerk/shared](https://github.com/clerk/shared)@4.20.0 - [@clerk/localizations](https://github.com/clerk/localizations)@4.9.2 ### [`v1.19.0`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#1190) ##### Minor Changes - When an interactive bot-protection challenge appears during sign-in or sign-up, the card now brings the challenge to the foreground — hiding the other fields and buttons until it's solved — so it's clear the "Verify you are human" check must be completed. Invisible challenges are unaffected. ([#8907](https://github.com/clerk/javascript/pull/8907)) by [@alexcarpenter](https://github.com/alexcarpenter) ### [`v1.18.1`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#1181) ##### Patch Changes - Improve the accessible label for identity edit buttons in verification flows. ([#8902](https://github.com/clerk/javascript/pull/8902)) by [@austincalvelage](https://github.com/austincalvelage) - Remove hidden password input from accessibility tree when hidden ([#8899](https://github.com/clerk/javascript/pull/8899)) by [@alexcarpenter](https://github.com/alexcarpenter) - Add support for the `inert` attribute usage under React 19. Inert content is now correctly non-interactive on both React 18 and 19. ([#8820](https://github.com/clerk/javascript/pull/8820)) by [@alexcarpenter](https://github.com/alexcarpenter) - Fix checkbox default styles when using the simple theme. ([#8922](https://github.com/clerk/javascript/pull/8922)) by [@alexcarpenter](https://github.com/alexcarpenter) - Improve Menu keyboard navigation and accessibility. Menus now support `Enter`/`Space` to open from the trigger, `ArrowDown`/`ArrowUp`/`Home`/`End` to move focus, `Escape` to close and return focus to the trigger, and skip disabled items during arrow-key navigation. Menus no longer mark the rest of the page as `aria-hidden` while open, so assistive technologies can still reach surrounding content. ([#8333](https://github.com/clerk/javascript/pull/8333)) by [@alexcarpenter](https://github.com/alexcarpenter) - The SSO setup flow now ends on an explicit Activate step: after configuring and testing a connection you confirm activation with an Activate SSO action (or skip and activate later) instead of a static confirmation summary. ([#8882](https://github.com/clerk/javascript/pull/8882)) by [@iagodahlem](https://github.com/iagodahlem) - Fix the X (formerly Twitter) provider logo being nearly invisible in dark mode by recoloring it to match the foreground color, consistent with other monochrome provider icons. ([#8912](https://github.com/clerk/javascript/pull/8912)) by [@jordan-bott](https://github.com/jordan-bott) - Updated dependencies \[[`c84f8df`](https://github.com/clerk/javascript/commit/c84f8df4222c212ecce6ae5ff8c47958b5b5d972), [`53e7b11`](https://github.com/clerk/javascript/commit/53e7b11058096d5ce15da53af12fe7236e88db2c), [`e51e22a`](https://github.com/clerk/javascript/commit/e51e22a2aec03293e8ccf5a5372cd9906aeccbb7)]: - [@clerk/localizations](https://github.com/clerk/localizations)@4.9.1 - [@clerk/shared](https://github.com/clerk/shared)@4.19.1 ### [`v1.18.0`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#1180) ##### Minor Changes - Introduce organization domains with TXT verification on self-serve SSO flow ([#8788](https://github.com/clerk/javascript/pull/8788)) by [@LauraBeatris](https://github.com/LauraBeatris) - Improve `OrganizationProfile` UI: ([#8898](https://github.com/clerk/javascript/pull/8898)) by [@LauraBeatris](https://github.com/LauraBeatris) - Hide the `Verified domains` section when there are no domains and the user lacks permission to add them - Rename the `Organization profile` section to `Profile` for consistency with `UserProfile` - Align the enterprise accounts section with the account data ##### Patch Changes - When inviting organization members requires purchasing additional seats, invitations are now sent automatically after checkout completes successfully. ([#8869](https://github.com/clerk/javascript/pull/8869)) by [@dstaley](https://github.com/dstaley) - Add confirmation dialog for organization domain deletion as part of self-serve SSO ([#8866](https://github.com/clerk/javascript/pull/8866)) by [@LauraBeatris](https://github.com/LauraBeatris) - The Security page's SSO wizard now has a back-to-Security control, and Start/Edit open the wizard at the first step (Continue resumes where you left off). ([#8864](https://github.com/clerk/javascript/pull/8864)) by [@iagodahlem](https://github.com/iagodahlem) - Updated dependencies \[[`d5968d0`](https://github.com/clerk/javascript/commit/d5968d026d6b2a1b399b6967fd8727613a5bc3cd), [`431e16c`](https://github.com/clerk/javascript/commit/431e16c69a2745779af217747c13a7f922e250fa), [`ffbc650`](https://github.com/clerk/javascript/commit/ffbc650ebbcee48171c95aa5d2b497273b0276b0)]: - [@clerk/localizations](https://github.com/clerk/localizations)@4.9.0 - [@clerk/shared](https://github.com/clerk/shared)@4.19.0 ### [`v1.17.0`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#1170) [Compare Source](https://github.com/clerk/javascript/compare/@clerk/ui@1.16.1...@clerk/ui@1.17.0) ##### Minor Changes - Add internal OAuth transport support for native desktop SDK wrappers to run Clerk's prebuilt OAuth flows through a system browser. ([#8831](https://github.com/clerk/javascript/pull/8831)) by [@wobsoriano](https://github.com/wobsoriano) ##### Patch Changes - Add an overview to the organization profile Security page. The page now lands on a summary of the SSO connection — a status badge (Unconfigured, In Progress, Active, Inactive), the configuration details framed in a card (provider, domain, sign-on URL, issuer, certificate), and an actions menu with Edit, Activate / Deactivate, and Remove — and switches into the existing configuration flow on Start, Continue, or Edit. ([#8813](https://github.com/clerk/javascript/pull/8813)) by [@iagodahlem](https://github.com/iagodahlem) - Rename the `<OrganizationProfile />` SSO page to "Security". The navbar entry is now labeled "Security" with a shield icon, its route path changed from `organization-self-serve-sso` to `organization-security`, and a new `organizationProfile.navbar.security` localization key replaces `organizationProfile.navbar.selfServeSSO`. ([#8796](https://github.com/clerk/javascript/pull/8796)) by [@iagodahlem](https://github.com/iagodahlem) - Upgrade build tooling to Rspack 2 (No user-facing API changes). ([#8382](https://github.com/clerk/javascript/pull/8382)) by [@jacekradko](https://github.com/jacekradko) - Updated dependencies \[[`f4167ec`](https://github.com/clerk/javascript/commit/f4167eccb19e0de98340d48e221b950e3dad189e), [`17e4164`](https://github.com/clerk/javascript/commit/17e416471a5409e5a4c02f4f94f687c428c071de), [`ed2cf75`](https://github.com/clerk/javascript/commit/ed2cf75ce713703d8e2c258fc3ca0cf43dc964dc), [`67c04a4`](https://github.com/clerk/javascript/commit/67c04a43db64b70819d68333f99e3483523d1d47), [`51c8fdc`](https://github.com/clerk/javascript/commit/51c8fdcb7160457e44cfe7cc86524f7d728a030a), [`c2ba971`](https://github.com/clerk/javascript/commit/c2ba971aad55df570507b7b117786ab048415ad3), [`8744728`](https://github.com/clerk/javascript/commit/8744728e6610b2229f56dd3b31975c3f57395f02), [`d9b5c7d`](https://github.com/clerk/javascript/commit/d9b5c7d79fe641d08f45f0df7d4f5146b6b2c3ab)]: - [@clerk/shared](https://github.com/clerk/shared)@4.18.0 - [@clerk/localizations](https://github.com/clerk/localizations)@4.8.2 ### [`v1.16.1`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#1161) [Compare Source](https://github.com/clerk/javascript/compare/@clerk/ui@1.16.0...@clerk/ui@1.16.1) ##### Patch Changes - Fix checkout button label showing "Start free trial" when adding seats during a free trial period ([#8829](https://github.com/clerk/javascript/pull/8829)) by [@mauricioabreu](https://github.com/mauricioabreu) - Migrate the build pipeline to tsdown and TypeScript 6.0. This is an internal tooling change with no intended changes to the public API or runtime behavior. ([#8177](https://github.com/clerk/javascript/pull/8177)) by [@dstaley](https://github.com/dstaley) - Updated dependencies \[[`f046c49`](https://github.com/clerk/javascript/commit/f046c491d99c880b61e335645ad3ced4fee602d8), [`b5fa9f6`](https://github.com/clerk/javascript/commit/b5fa9f6ab2f01f1bbf6de52e16b4c9d9516f966c), [`3d5b2fe`](https://github.com/clerk/javascript/commit/3d5b2fe959171770bb7e8493d8a204317b7101a7)]: - [@clerk/localizations](https://github.com/clerk/localizations)@4.8.1 - [@clerk/shared](https://github.com/clerk/shared)@4.17.1 ### [`v1.16.0`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#1160) [Compare Source](https://github.com/clerk/javascript/compare/@clerk/ui@1.15.1...@clerk/ui@1.16.0) ##### Minor Changes - Add support for Clerk Billing plans with per-seat costs. ([#8629](https://github.com/clerk/javascript/pull/8629)) by [@dstaley](https://github.com/dstaley) - New invite-to-checkout flow when inviting members while on a plan that uses per-seat costs. - New localization values to support UI additions. - Support for the `orgId` and `minSeats` parameters to `getPlans()`. - Support for the `seatsQuantity` and `priceId` parameters to checkout creation. - New `totals` field on payments. - New `availablePrices` field on plans. - New `nextPayment` field on subscription items. - New `discounts` field on checkouts. - Additional fields on `nextPayment` for more granularity. ##### Patch Changes - Display the scope description for `user:org:read` organization access in the OAuth Consent dialog so users understand organization membership information is being shared with the OAuth client. ([#8798](https://github.com/clerk/javascript/pull/8798)) by [@jfoshee](https://github.com/jfoshee) - Fix alignment of the domain section subtitle in the organization profile to match the button above it. ([#8795](https://github.com/clerk/javascript/pull/8795)) by [@alexcarpenter](https://github.com/alexcarpenter) - Updated dependencies \[[`a5c7bc7`](https://github.com/clerk/javascript/commit/a5c7bc74dabfa78d4748516ccc252f68cae82264)]: - [@clerk/localizations](https://github.com/clerk/localizations)@4.8.0 - [@clerk/shared](https://github.com/clerk/shared)@4.17.0 ### [`v1.15.1`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#1151) [Compare Source](https://github.com/clerk/javascript/compare/@clerk/ui@1.15.0...@clerk/ui@1.15.1) ##### Patch Changes - Fix Chrome-specific scroll jump when toggling the billing period switch on the pricing table. ([#8742](https://github.com/clerk/javascript/pull/8742)) by [@alexcarpenter](https://github.com/alexcarpenter) - Fix a circular import in the styled-system that could crash module initialization under bundler configurations with tree-shaking disabled. ([#8754](https://github.com/clerk/javascript/pull/8754)) by [@jacekradko](https://github.com/jacekradko) - Internal refactor for self-serve SSO wizard navigation to leverage a guard-based state machine. ([#8715](https://github.com/clerk/javascript/pull/8715)) by [@iagodahlem](https://github.com/iagodahlem) It makes the step navigation more predictable: the step you land on (including after a reload) and which steps you can move to are derived from the connection's state, the connection reset flow lands you on the right step. - Correctly display OAuth consent redirect domains for known multi-label public suffixes. ([#8700](https://github.com/clerk/javascript/pull/8700)) by [@wobsoriano](https://github.com/wobsoriano) - Fix modal backdrop appearing light in dark mode ([#8743](https://github.com/clerk/javascript/pull/8743)) by [@alexcarpenter](https://github.com/alexcarpenter) - Add a "Forgot password?" action on the sign-in start page when the password field is shown. This improves the account recovery UX when strict user enumeration protection is enabled. ([#8733](https://github.com/clerk/javascript/pull/8733)) by [@Ephem](https://github.com/Ephem) - Add and improve JSDoc comments across public types and methods to support generated reference documentation for the `/objects` docs section. Exports a few previously-internal types (`OnEventListener`, `OffEventListener`, `ClerkOptionsNavigation`) so they can be referenced from the generated docs. ([#8276](https://github.com/clerk/javascript/pull/8276)) by [@alexisintech](https://github.com/alexisintech) - Updated dependencies \[[`2d6670c`](https://github.com/clerk/javascript/commit/2d6670c6c05c59901709283921b5d65c43f3a676), [`af706e3`](https://github.com/clerk/javascript/commit/af706e35420a16c028fd34b70dd50d663d42e006), [`032632c`](https://github.com/clerk/javascript/commit/032632c6982297e53e28559b59b4a435de4c9adc), [`0fece6f`](https://github.com/clerk/javascript/commit/0fece6ff5d2b1babb59a285dbce9d46723e33d73), [`b295af3`](https://github.com/clerk/javascript/commit/b295af3d5bb12e09a502cae4a935d2e7f5d35d5c), [`8e1bd48`](https://github.com/clerk/javascript/commit/8e1bd48a91dc07751493f41416d2a68b89e114cc), [`90bc732`](https://github.com/clerk/javascript/commit/90bc732143e907051f2cefab8a31283e3d985126)]: - [@clerk/shared](https://github.com/clerk/shared)@4.16.0 - [@clerk/localizations](https://github.com/clerk/localizations)@4.7.2 ### [`v1.15.0`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#1150) [Compare Source](https://github.com/clerk/javascript/compare/@clerk/ui@1.14.0...@clerk/ui@1.15.0) ##### Minor Changes - Internal `<ConfigureSSO />` refactor to call new org-scoped enterprise connections FAPI endpoints, replacing the `/me/` deprecated scope. ([#8671](https://github.com/clerk/javascript/pull/8671)) by [@iagodahlem](https://github.com/iagodahlem) ##### Patch Changes - Add support for Google Workspace SAML provider to self-serve SSO ([#8690](https://github.com/clerk/javascript/pull/8690)) by [@LauraBeatris](https://github.com/LauraBeatris) - Layer architecture for configure steps per IdP and protocol on `<ConfigureSSO />` ([#8651](https://github.com/clerk/javascript/pull/8651)) by [@LauraBeatris](https://github.com/LauraBeatris) - Reworks the `<ConfigureSSO />` confirmation step and adds a dedicated reset connection dialog: ([#8706](https://github.com/clerk/javascript/pull/8706)) by [@iagodahlem](https://github.com/iagodahlem) - Introduces `<ResetConnectionDialog />` — a modal-based, type-to-confirm dialog scoped to the wizard container that replaces the inline reset confirmation card. Wraps the destructive delete behind `useReverification`, clears the local provider selection, and rewinds the wizard to provider selection on success. - Restyles the confirmation step body: unified status header with an inline `Active` / `Inactive` badge, grouped Enable SSO and Domain rows, two-column configuration details rendered through `ProfileSection.ItemList`, outlined `Configure again`, destructive `Reset connection`, and an inactive-state banner inside the step footer. - `Step.Header` now accepts a `badge` prop so a step can render an inline status pill next to its title without crowding the right-aligned children slot. - `OrganizationProfile` forwards the shared content ref to `<ConfigureSSO />` so the new dialog portals into the wizard chrome when the component is embedded inside the organization profile. - "Fix rendering issue for free trial badge." ([#8712](https://github.com/clerk/javascript/pull/8712)) by [@l-armstrong](https://github.com/l-armstrong) - Fix the legal consent checkbox growing in size when its label wraps to a second line while using the `simple` theme. The checkbox is now aligned to the start of the row so it no longer stretches to match the label height. ([#8705](https://github.com/clerk/javascript/pull/8705)) by [@dmoerner](https://github.com/dmoerner) - Avoid sending duplicate verification codes when persisted email or phone code verifications are already pending. ([#8548](https://github.com/clerk/javascript/pull/8548)) by [@jacekradko](https://github.com/jacekradko) - Adds a wizard-wide reset connection entry on the `<ConfigureSSO />` step footers: ([#8711](https://github.com/clerk/javascript/pull/8711)) by [@iagodahlem](https://github.com/iagodahlem) - New `Step.Footer.Reset` compound part that renders a destructive ghost button on the leading edge of the footer and opens the existing `ResetConnectionDialog`. The slot owns its own open state and gates itself on the current enterprise connection, so it stays hidden on the provider selection step. - Wires the reset entry into the Verify Domain, Configure (Okta and Custom SAML), and Test steps so the reset action is reachable from anywhere in the wizard. The confirmation step keeps its in-body destructive button. - Exposes a `configureSSOFooterResetButton` element descriptor so the new button surface can be themed via appearance customizations. - Fix stepper chevron wrapping in `<ConfigureSSO />` ([#8693](https://github.com/clerk/javascript/pull/8693)) by [@alexcarpenter](https://github.com/alexcarpenter) - Add support for Microsoft Entra SAML provider to self-serve SSO ([#8695](https://github.com/clerk/javascript/pull/8695)) by [@LauraBeatris](https://github.com/LauraBeatris) - Add mobile support for `<ConfigureSSO />` navbar to display application name, logo and organization name ([#8675](https://github.com/clerk/javascript/pull/8675)) by [@LauraBeatris](https://github.com/LauraBeatris) - Scope the `UserProfile` active-devices fetch cache by `user.id` so a session switch or sign-out/sign-in on a shared device no longer renders the previous user's device activity (IP, location, browser/device) from the module-scoped cache. ([#8703](https://github.com/clerk/javascript/pull/8703)) by [@dominic-clerk](https://github.com/dominic-clerk) - Updated dependencies \[[`afb75e6`](https://github.com/clerk/javascript/commit/afb75e68efa561ff18f6ae5359df1cf336e861a5), [`c3df67a`](https://github.com/clerk/javascript/commit/c3df67a231adff73fa36563718d9b94e6bb2a540), [`86fd38f`](https://github.com/clerk/javascript/commit/86fd38f4e39ab89b6a9fbb7515a5d9b7b37aa3ab), [`8d6bb56`](https://github.com/clerk/javascript/commit/8d6bb56de25692e0f9c350f16c8f45fbedaad2ac), [`43dfefa`](https://github.com/clerk/javascript/commit/43dfefaabf0bad1a6d92b75b1cb6de1860ea87e4), [`5fc7b21`](https://github.com/clerk/javascript/commit/5fc7b21573cab36b9184dd6277396f7c38b91e1f), [`c2ba134`](https://github.com/clerk/javascript/commit/c2ba1344db5fd50f1d4e04d01d0455f0181c8d96)]: - [@clerk/localizations](https://github.com/clerk/localizations)@4.7.1 - [@clerk/shared](https://github.com/clerk/shared)@4.15.0 ### [`v1.14.0`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#1140) [Compare Source](https://github.com/clerk/javascript/compare/@clerk/ui@1.13.1...@clerk/ui@1.14.0) ##### Minor Changes - Migrate to new icon set to create consistency across components. ([#8319](https://github.com/clerk/javascript/pull/8319)) by [@alexcarpenter](https://github.com/alexcarpenter) - Display "Single Sign-on (SSO)" section in `OrganizationProfile` if self-serve SSO is enabled on the current active organization ([#8600](https://github.com/clerk/javascript/pull/8600)) by [@LauraBeatris](https://github.com/LauraBeatris) ##### Patch Changes - Simplify ActionCard shadow styling. ([#8625](https://github.com/clerk/javascript/pull/8625)) by [@alexcarpenter](https://github.com/alexcarpenter) - Add a visible radio indicator to each provider card on the `<ConfigureSSO />` Select Provider step. ([#8664](https://github.com/clerk/javascript/pull/8664)) by [@iagodahlem](https://github.com/iagodahlem) - Introduce UX improvements for `<ConfigureSSO />` such as: ([#8601](https://github.com/clerk/javascript/pull/8601)) by [@LauraBeatris](https://github.com/LauraBeatris) - Render attribute-mapping and service-provider field labels per IdP nomenclature - Add "Open test URL" button and surface a clear empty state - Expand the appearance descriptor surface across step content so developers can override styling - Updated dependencies \[[`e538525`](https://github.com/clerk/javascript/commit/e538525f2399e94099f0f523169710e4c73d430e), [`79cdd1f`](https://github.com/clerk/javascript/commit/79cdd1f9c9d8aa5d9a98d8d245b5f7f98c0cabb4), [`0937b5d`](https://github.com/clerk/javascript/commit/0937b5dfd8e119a0517576b921d887c924f0b148), [`48e3f64`](https://github.com/clerk/javascript/commit/48e3f647d3c89d99f42763a5ee741b684a176e96), [`4af9389`](https://github.com/clerk/javascript/commit/4af93898e1c3c8d51a9ce4ed590d1d564737718c), [`4d5027b`](https://github.com/clerk/javascript/commit/4d5027b15873dc6637e49f51142be64ef5f8e9bf), [`10d36ab`](https://github.com/clerk/javascript/commit/10d36abfd7e4fe0eed421565093704941a8574b9), [`4e08924`](https://github.com/clerk/javascript/commit/4e089248a3dfdf99fc110c06b699a084d4e8a7ee), [`bcf0e77`](https://github.com/clerk/javascript/commit/bcf0e776231c6ec675d3a3a8bfd122513d3c57ef)]: - [@clerk/localizations](https://github.com/clerk/localizations)@4.7.0 - [@clerk/shared](https://github.com/clerk/shared)@4.14.0 ### [`v1.13.1`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#1131) [Compare Source](https://github.com/clerk/javascript/compare/@clerk/ui@1.13.0...@clerk/ui@1.13.1) ##### Patch Changes - Fix the Manage Subscription button in `<UserProfile />` / `<OrganizationProfile />` and the Cancel / Re-subscribe actions in `<SubscriptionDetails />` so they are shown for paid seat-based plans that have no base fee. A shared `isManageableSubscriptionItem` helper now drives both places, treating "free / unmanageable" as "the instance's default plan" instead of "the plan has no base fee". ([#8375](https://github.com/clerk/javascript/pull/8375)) by [@mauricioabreu](https://github.com/mauricioabreu) - Updated dependencies \[[`a036ce8`](https://github.com/clerk/javascript/commit/a036ce8fef3b3ee2b49fd05d592b083ffc37f463)]: - [@clerk/shared](https://github.com/clerk/shared)@4.13.1 - [@clerk/localizations](https://github.com/clerk/localizations)@4.6.8 ### [`v1.13.0`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#1130) [Compare Source](https://github.com/clerk/javascript/compare/@clerk/ui@1.12.1...@clerk/ui@1.13.0) ##### Minor Changes - Remove `<ConfigureSSO />` from experimental path ([#8588](https://github.com/clerk/javascript/pull/8588)) by [@LauraBeatris](https://github.com/LauraBeatris) - Add `elevation` appearance option with `'raised'` (default) and `'flush'` values. When set to `flush`, card-based components render without border, box-shadow, border-radius, outer padding, and footer background, allowing them to sit flat against their container. Applies to `<SignIn />`, `<SignUp />`, `<Waitlist />`, `<CreateOrganization />`, `<OrganizationList />`, `<OAuthConsent />`, `<UserVerification />`, and session task components. Profile and popover components always render as raised. Modal components always render as raised regardless of this setting. ([#8510](https://github.com/clerk/javascript/pull/8510)) by [@alexcarpenter](https://github.com/alexcarpenter) The `cardBox` element exposes a `data-elevation="flush"` attribute when flush is active, giving className-based themes a hook to neutralize their card chrome via attribute selectors. The `shadcn` theme uses this hook to drop its `shadow-sm border` utilities under flush. ##### Patch Changes - Add `ProfileCard.Page` for `UserProfile` and `OrganizationProfile` pages ([#8602](https://github.com/clerk/javascript/pull/8602)) by [@LauraBeatris](https://github.com/LauraBeatris) - Fix layout shift when Copy test URL button enters loading state in `<ConfigureSSO />` ([#8592](https://github.com/clerk/javascript/pull/8592)) by [@alexcarpenter](https://github.com/alexcarpenter) - Improve ClipboardInput positioning and accessibility by using `readOnly` instead of `isDisabled` ([#8593](https://github.com/clerk/javascript/pull/8593)) by [@alexcarpenter](https://github.com/alexcarpenter) - Updated dependencies \[[`6eaf4d6`](https://github.com/clerk/javascript/commit/6eaf4d66fe0b21fb96a5cd19d61e6c3b2302ff97), [`1aab31e`](https://github.com/clerk/javascript/commit/1aab31e5070b7223402ff71f65a0d829bbc29cfd)]: - [@clerk/shared](https://github.com/clerk/shared)@4.13.0 - [@clerk/localizations](https://github.com/clerk/localizations)@4.6.7 ### [`v1.12.1`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#1121) ##### Patch Changes - Fix attribute statement section in `<ConfigureSSO />` with claim name for Custom SAML provider ([#8586](https://github.com/clerk/javascript/pull/8586)) by [@LauraBeatris](https://github.com/LauraBeatris) - Updated dependencies \[[`95f6c2f`](https://github.com/clerk/javascript/commit/95f6c2f8b7154b11dc64c864dcd994baab637c70)]: - [@clerk/localizations](https://github.com/clerk/localizations)@4.6.6 - [@clerk/shared](https://github.com/clerk/shared)@4.12.2 ### [`v1.12.0`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#1120) ##### Minor Changes - Add `autoFocus` appearance option to disable automatic input focusing ([#8521](https://github.com/clerk/javascript/pull/8521)) by [@alexcarpenter](https://github.com/alexcarpenter) ##### Patch Changes - Improve Floating UI usage: fix `arialLabel` typo in `MenuTrigger`, replace imperative floating ref in `MenuList` with `useMergeRefs`, remove manual position offset in `SelectOptionList`, add `aria-haspopup` to `MenuTrigger`, and add missing ARIA attributes (`aria-expanded`, `aria-haspopup`, `role`, `aria-selected`) to `Select` components. ([#8328](https://github.com/clerk/javascript/pull/8328)) by [@alexcarpenter](https://github.com/alexcarpenter) - Add support for custom SAML provider in `<ConfigureSSO />` ([#8564](https://github.com/clerk/javascript/pull/8564)) by [@LauraBeatris](https://github.com/LauraBeatris) - Update `NavBar` to receive `containerSx` prop ([#8568](https://github.com/clerk/javascript/pull/8568)) by [@LauraBeatris](https://github.com/LauraBeatris) - Updated dependencies \[[`4fc38a0`](https://github.com/clerk/javascript/commit/4fc38a097cb9ed1d37c9c3faa274e5c44e405c68)]: - [@clerk/localizations](https://github.com/clerk/localizations)@4.6.5 - [@clerk/shared](https://github.com/clerk/shared)@4.12.1 ### [`v1.11.0`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#1110) [Compare Source](https://github.com/clerk/javascript/compare/@clerk/ui@1.10.0...@clerk/ui@1.11.0) ##### Minor Changes - Add `highlightedPlan` prop to PricingTable default layout to render a "Popular" badge on the matching plan ([#8554](https://github.com/clerk/javascript/pull/8554)) by [@alexcarpenter](https://github.com/alexcarpenter) - Add support for inline `<bold>` markup in localization values, rendered as `<strong>` elements. Translators can now write `'Agree to <bold>Terms</bold>'` in a single key instead of splitting into prefix/bold/suffix fragments. Token values are substituted only into parsed text leaves, so user-controlled data can never become markup. Also hardens `applyTokensToString` to use `Object.prototype.hasOwnProperty.call` when filtering token names, preventing prototype-chain names like `{{hasOwnProperty}}` from crashing rendering. ([#8539](https://github.com/clerk/javascript/pull/8539)) by [@alexcarpenter](https://github.com/alexcarpenter) ##### Patch Changes - Add a two-mode segmented control to the SAML config submission sub-step in `<__experimental_ConfigureSSO />`. Users pick between **Add via metadata URL** (default) and **Configure manually**. The metadata URL form is unchanged; the manual entry form ships in a follow-up commit. Locale keys added under `configureSSO.configureStep.samlOkta.modes` in `en-US`. ([#8553](https://github.com/clerk/javascript/pull/8553)) by [@iagodahlem](https://github.com/iagodahlem) - Add confirmation step for `<__experimental_ConfigureSSO />` ([#8531](https://github.com/clerk/javascript/pull/8531)) by [@LauraBeatris](https://github.com/LauraBeatris) - Add test step for `<__experimental_ConfigureSSO />` ([#8544](https://github.com/clerk/javascript/pull/8544)) by [@LauraBeatris](https://github.com/LauraBeatris) - Updated dependencies \[[`9fa6642`](https://github.com/clerk/javascript/commit/9fa6642de6a734faf532ca70c411431c5d0d2bbb), [`930047f`](https://github.com/clerk/javascript/commit/930047f3ea9b603a7f254f7764c3dc5e0fa7c769), [`b45777c`](https://github.com/clerk/javascript/commit/b45777c5723b01b8c7ee3d37b712c639067b36ab), [`5a7225e`](https://github.com/clerk/javascript/commit/5a7225ef119edf551e20bdce8af465b42981c8f2)]: - [@clerk/shared](https://github.com/clerk/shared)@4.12.0 - [@clerk/localizations](https://github.com/clerk/localizations)@4.6.4 ### [`v1.10.0`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#1100) [Compare Source](https://github.com/clerk/javascript/compare/@clerk/ui@1.9.1...@clerk/ui@1.10.0) ##### Minor Changes - Add `fontFamilyMono` appearance variable for customizing the monospace font used in Clerk components. Defaults to `ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace` and is exposed as the `--clerk-font-family-mono` CSS variable. ([#8546](https://github.com/clerk/javascript/pull/8546)) by [@alexcarpenter](https://github.com/alexcarpenter) ##### Patch Changes - Implement the Okta SAML metadata URL submission path in the Configure step of `<__experimental_ConfigureSSO />`. Adds a single text input for the IdP metadata URL; Continue posts `{ saml: { idpMetadataUrl } }` via `user.updateEnterpriseConnection` wrapped in `useReverification`, with `useCardState` driving the loading state and `handleError` routing backend errors inline to the field or to the card-level error surface. Locale keys added under `configureSSO.configureStep` in `en-US`. Manual entry, file upload, SP-side copy rows, and the Okta admin-console walkthrough ship in follow-up PRs. ([#8535](https://github.com/clerk/javascript/pull/8535)) by [@iagodahlem](https://github.com/iagodahlem) - Implement the provider selection step of `<__experimental_ConfigureSSO />`. Renders the two SAML provider tiles (Okta Workforce and Custom SAML Provider) with real icons sourced from `img.clerk.com`, tracks the picked provider in local state, and gates `Step.Footer.Continue` on a selection. Includes a warning callout about provider lock-in and a minor `Step.Header` alignment tweak. All user-visible strings are wired through `@clerk/localizations`, with translations for every supported locale. ([#8503](https://github.com/clerk/javascript/pull/8503)) by [@iagodahlem](https://github.com/iagodahlem) Also extends the flow context with `provider` and `setProvider`, adds the `deriveInitialStep` helper, and wires the wizard's `initialStepId` so the configure flow remounts on the right step after a reload. Continue on Select Provider stages the chosen provider and advances to the next step; the enterprise connection is created on Verify Domain once the user's email is verified and primary. - Update `<ConfigureSSO />` in the context of organizations to only allow managing enterprise connections based on system permission ([#8515](https://github.com/clerk/javascript/pull/8515)) by [@LauraBeatris](https://github.com/LauraBeatris) - fix(ui): don't treat numeric usernames as phone numbers ([#8532](https://github.com/clerk/javascript/pull/8532)) by [@thiskevinwang](https://github.com/thiskevinwang) - Fixed custom page icons not rendering in React 19 due to a forwarded ref overwriting the internal node reference. ([#8534](https://github.com/clerk/javascript/pull/8534)) by [@wobsoriano](https://github.com/wobsoriano) - Add verify/add email address step to `<__experimental_ConfigureSSO />` ([#8520](https://github.com/clerk/javascript/pull/8520)) by [@LauraBeatris](https://github.com/LauraBeatris) - Refactor `<__experimental_ConfigureSSO />` into a layered primitive set: a state-driven Wizard, a UI-only Stepper, a `Step` compound, and ProfileCard chrome. No public component API change. Drops the central FooterActionsContext registry — each step now renders its own footer via `Step.Footer.Previous` / `Step.Footer.Continue` purely-presentational compounds. Adds a SelectProviderStep boilerplate filtered out of the breadcrumb. ([#8493](https://github.com/clerk/javascript/pull/8493)) by [@iagodahlem](https://github.com/iagodahlem) - Updated dependencies \[[`1a4d7d1`](https://github.com/clerk/javascript/commit/1a4d7d1c711c25f4f83c0773616b799df2feb010), [`a6916b1`](https://github.com/clerk/javascript/commit/a6916b15658625a0e627c474a62212a65868bfb6), [`1084180`](https://github.com/clerk/javascript/commit/1084180797722ff113df8404a3c967bc6abeb12d), [`39099b6`](https://github.com/clerk/javascript/commit/39099b62308fc9b0ebbb25988c0ae4b655efe744), [`18e0a1a`](https://github.com/clerk/javascript/commit/18e0a1aa48e7f65a6610ec3c6ffe105deb3474b2)]: - [@clerk/localizations](https://github.com/clerk/localizations)@4.6.3 - [@clerk/shared](https://github.com/clerk/shared)@4.11.0 ### [`v1.9.1`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#191) [Compare Source](https://github.com/clerk/javascript/compare/@clerk/ui@1.9.0...@clerk/ui@1.9.1) ##### Patch Changes - Fixed unhandled TypeError when `unsafeMetadata` is passed to `<SignUp />` ([#8500](https://github.com/clerk/javascript/pull/8500)) by [@wobsoriano](https://github.com/wobsoriano) - Updated dependencies \[[`5cda3ee`](https://github.com/clerk/javascript/commit/5cda3ee8451cc9af375895824d24a5c3ed7fbee6)]: - [@clerk/shared](https://github.com/clerk/shared)@4.10.2 - [@clerk/localizations](https://github.com/clerk/localizations)@4.6.2 ### [`v1.9.0`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#190) [Compare Source](https://github.com/clerk/javascript/compare/@clerk/ui@1.8.0...@clerk/ui@1.9.0) ##### Minor Changes - Removed unused internal OAuthConsent prop. ([#8492](https://github.com/clerk/javascript/pull/8492)) by [@wobsoriano](https://github.com/wobsoriano) ##### Patch Changes - Add wizard steps for the `<__experimental_ConfigureSSO />` component ([#8468](https://github.com/clerk/javascript/pull/8468)) by [@LauraBeatris](https://github.com/LauraBeatris) - Remove back button on the sign-in password compromised/pwned error screen. ([#8280](https://github.com/clerk/javascript/pull/8280)) by [@Ephem](https://github.com/Ephem) These errors are not recoverable by re-entering the password, so the back button led to a confusing dead end that would always take you back to the same error. - Updated dependencies \[[`7a5892f`](https://github.com/clerk/javascript/commit/7a5892f9bcaa1a6212e6e6d3741160929ffd027e)]: - [@clerk/shared](https://github.com/clerk/shared)@4.10.1 - [@clerk/localizations](https://github.com/clerk/localizations)@4.6.1 ### [`v1.8.0`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#180) [Compare Source](https://github.com/clerk/javascript/compare/@clerk/ui@1.7.0...@clerk/ui@1.8.0) ##### Minor Changes - Add experimental `<ConfigureSSO />` component. Not ready for usage yet. ([#8427](https://github.com/clerk/javascript/pull/8427)) by [@LauraBeatris](https://github.com/LauraBeatris) ##### Patch Changes - Localize API keys table headers ([#8462](https://github.com/clerk/javascript/pull/8462)) by [@jebibot](https://github.com/jebibot) - Surface initialization errors and stalled mounts in the component renderer. The internal `ensureMounted` pipeline now logs a `[Clerk UI]` error to the console when the lazy module import rejects, and emits a diagnostic warning if the renderer has not mounted within 10 seconds. Makes silent failures (e.g. failed dev-server chunk loads, unresolved lazy-compilation proxies) surface with an actionable message instead of hanging without feedback. ([#8379](https://github.com/clerk/javascript/pull/8379)) by [@jacekradko](https://github.com/jacekradko) - Updated dependencies \[[`9e9230c`](https://github.com/clerk/javascript/commit/9e9230c8c3cbdb1c253ca7cdd24cc8d681b5ee5a), [`68d32df`](https://github.com/clerk/javascript/commit/68d32dfcc453080ef93edf69be8de765a342d88c), [`1c27d4d`](https://github.com/clerk/javascript/commit/1c27d4dd41a27cf41c3823306fe88e026fed08fb), [`1001193`](https://github.com/clerk/javascript/commit/10011936981fc22bf7d3750f1591f0873ea78bcb)]: - [@clerk/localizations](https://github.com/clerk/localizations)@4.6.0 - [@clerk/shared](https://github.com/clerk/shared)@4.10.0 ### [`v1.7.0`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#170) [Compare Source](https://github.com/clerk/javascript/compare/@clerk/ui@1.6.9...@clerk/ui@1.7.0) ##### Minor Changes - Render OAuthConsent organization selector from `user:org:read` scope. ([#8415](https://github.com/clerk/javascript/pull/8415)) by [@wobsoriano](https://github.com/wobsoriano) - Expose `OAuthConsent` as a public component export across React-based SDKs. ([#8381](https://github.com/clerk/javascript/pull/8381)) by [@wobsoriano](https://github.com/wobsoriano) Example: ```tsx import { OAuthConsent } from '@clerk/react'; export default function Page() { return <OAuthConsent />; } ``` ##### Patch Changes - Updated dependencies \[[`785f057`](https://github.com/clerk/javascript/commit/785f057f5cda202c26a9f34bde7c1873a6cbd6ea), [`90beaeb`](https://github.com/clerk/javascript/commit/90beaeb8319d5bccb8fa52343f4b241c6d2d3ebe), [`244920d`](https://github.com/clerk/javascript/commit/244920d1ebb5d420a96bfc2a79d84cccafe9b61c)]: - [@clerk/shared](https://github.com/clerk/shared)@4.9.0 - [@clerk/localizations](https://github.com/clerk/localizations)@4.5.8 ### [`v1.6.9`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#169) [Compare Source](https://github.com/clerk/javascript/compare/@clerk/ui@1.6.8...@clerk/ui@1.6.9) ##### Patch Changes - Updated dependencies \[[`1bfd8ab`](https://github.com/clerk/javascript/commit/1bfd8ab89c62e428038b8c565f118c582ed395ea), [`5eec2fe`](https://github.com/clerk/javascript/commit/5eec2fee4e5b36d0b7dafedc704760e245d3a0e9)]: - [@clerk/shared](https://github.com/clerk/shared)@4.8.7 - [@clerk/localizations](https://github.com/clerk/localizations)@4.5.7 ### [`v1.6.8`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#168) [Compare Source](https://github.com/clerk/javascript/compare/@clerk/ui@1.6.7...@clerk/ui@1.6.8) ##### Patch Changes - Updated dependencies \[[`9b57986`](https://github.com/clerk/javascript/commit/9b5798696eb0c6cc6ab548ade100b504f691895c), [`00f9ff9`](https://github.com/clerk/javascript/commit/00f9ff942f0568f3839a04ff2527339d8fbf3a5d), [`a9f9b29`](https://github.com/clerk/javascript/commit/a9f9b2971a026d04571ceb1865ec8dafedbbe863)]: - [@clerk/shared](https://github.com/clerk/shared)@4.8.6 - [@clerk/localizations](https://github.com/clerk/localizations)@4.5.6 ### [`v1.6.7`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#167) ##### Patch Changes - Updated dependencies \[[`da76490`](https://github.com/clerk/javascript/commit/da7649075e24351737271318e81842b5c298dee1)]: - [@clerk/shared](https://github.com/clerk/shared)@4.8.5 - [@clerk/localizations](https://github.com/clerk/localizations)@4.5.5 ### [`v1.6.6`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#166) ##### Patch Changes - Display web3wallet in UserProfile when added by administrator ([#7981](https://github.com/clerk/javascript/pull/7981)) by [@dmoerner](https://github.com/dmoerner) - Updated dependencies \[[`083c4c5`](https://github.com/clerk/javascript/commit/083c4c50a2d2e1cedc8ffb85d8ba749170ea4f90), [`dcaf694`](https://github.com/clerk/javascript/commit/dcaf694fbc7fd1b80fd10661225aa6d61eb3c2a9), [`4b62ce8`](https://github.com/clerk/javascript/commit/4b62ce86afd56e6aacc5278226a07b093a66b0d3)]: - [@clerk/shared](https://github.com/clerk/shared)@4.8.4 - [@clerk/localizations](https://github.com/clerk/localizations)@4.5.4 ### [`v1.6.5`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#165) ##### Patch Changes - Fixed OAuth `redirect_url` for `openSignIn` modal. ([#8385](https://github.com/clerk/javascript/pull/8385)) by [@wobsoriano](https://github.com/wobsoriano) ### [`v1.6.4`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#164) ##### Patch Changes - Default the organization selection in `<OAuthConsent />` to the user's last active organization, falling back to the first membership when it is not set or no longer available. ([#8362](https://github.com/clerk/javascript/pull/8362)) by [@kylemac](https://github.com/kylemac) - Updated dependencies \[[`d52b311`](https://github.com/clerk/javascript/commit/d52b311f16453e834df5c81594a1bfead30c935f)]: - [@clerk/shared](https://github.com/clerk/shared)@4.8.3 - [@clerk/localizations](https://github.com/clerk/localizations)@4.5.3 ### [`v1.6.3`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#163) [Compare Source](https://github.com/clerk/javascript/compare/@clerk/ui@1.6.2...@clerk/ui@1.6.3) ##### Patch Changes - Fix EnableOrganizationsPrompt in keyless mode: show "Claim your application" CTA instead of broken "Sign in to continue" when organizations are enabled on an unclaimed keyless app with no signed-in user. ([#8341](https://github.com/clerk/javascript/pull/8341)) by [@mwickett](https://github.com/mwickett) - Use `user.organizationMemberships` from the already-loaded user object to populate the org select in the OAuth consent screen, avoiding a redundant memberships fetch. ([#8350](https://github.com/clerk/javascript/pull/8350)) by [@wobsoriano](https://github.com/wobsoriano) - Correctly display IP redirect URIs in OAuth consent. ([#8342](https://github.com/clerk/javascript/pull/8342)) by [@wobsoriano](https://github.com/wobsoriano) - Add scroll-driven fade overlays to `ListGroupContent` in the OAuthConsent component so overflowing scope lists visually indicate more content above and below. ([#8339](https://github.com/clerk/javascript/pull/8339)) by [@alexcarpenter](https://github.com/alexcarpenter) ### [`v1.6.2`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#162) [Compare Source](https://github.com/clerk/javascript/compare/@clerk/ui@1.6.1...@clerk/ui@1.6.2) ##### Patch Changes - Add infinite loading to organization selection in `<OAuthConsent />`. ([#8309](https://github.com/clerk/javascript/pull/8309)) by [@wobsoriano](https://github.com/wobsoriano) - Fix OAuthConsent always redirecting to sign-in by adopting the `AuthenticatedRoutes` pattern used by other full-page components ([#8327](https://github.com/clerk/javascript/pull/8327)) by [@alexcarpenter](https://github.com/alexcarpenter) - Updated dependencies \[[`c7b0f47`](https://github.com/clerk/javascript/commit/c7b0f4789c47d4d7eeed767a06d3b257a24a50dd), [`34762e8`](https://github.com/clerk/javascript/commit/34762e8f2772034e6abb5f4f4daec902f74b30b6)]: - [@clerk/shared](https://github.com/clerk/shared)@4.8.2 - [@clerk/localizations](https://github.com/clerk/localizations)@4.5.2 ### [`v1.6.1`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#161) ##### Patch Changes - Updated dependencies \[[`b0b6675`](https://github.com/clerk/javascript/commit/b0b6675bad09eb3dd5b711ad5b45539162664c7a)]: - [@clerk/shared](https://github.com/clerk/shared)@4.8.1 - [@clerk/localizations](https://github.com/clerk/localizations)@4.5.1 ### [`v1.6.0`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#160) ##### Minor Changes - Introduce internal `<OAuthConsent />` component for rendering a zero-config OAuth consent screen on an OAuth authorize redirect page. ([#8289](https://github.com/clerk/javascript/pull/8289)) by [@wobsoriano](https://github.com/wobsoriano) Usage example: ```tsx import { OAuthConsent } from '@clerk/nextjs'; export default function OAuthConsentPage() { return <OAuthConsent />; } ``` ##### Patch Changes - Updated dependencies \[[`dc2de16`](https://github.com/clerk/javascript/commit/dc2de16480086f376449d452d31ae0d2a319af17)]: - [@clerk/shared](https://github.com/clerk/shared)@4.8.0 - [@clerk/localizations](https://github.com/clerk/localizations)@4.5.0 ### [`v1.5.1`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#151) [Compare Source](https://github.com/clerk/javascript/compare/@clerk/ui@1.5.0...@clerk/ui@1.5.1) ##### Patch Changes - Updated dependencies \[[`3fd586d`](https://github.com/clerk/javascript/commit/3fd586d171e9c281c4b96f620ee9070b47ba00f4), [`f9ff9e9`](https://github.com/clerk/javascript/commit/f9ff9e937d70713abf96fdd92071cd6e84b8eb80)]: - [@clerk/shared](https://github.com/clerk/shared)@4.7.0 - [@clerk/localizations](https://github.com/clerk/localizations)@4.4.1 ### [`v1.5.0`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#150) [Compare Source](https://github.com/clerk/javascript/compare/@clerk/ui@1.4.0...@clerk/ui@1.5.0) ##### Minor Changes - Add support for rendering the Banned badge in the organization members list. ([#8261](https://github.com/clerk/javascript/pull/8261)) by [@dstaley](https://github.com/dstaley) ##### Patch Changes - Updated dependencies \[[`fdac10e`](https://github.com/clerk/javascript/commit/fdac10e96ad60c0176cde4e1e3ddc89e40cd0a15), [`4e3cb0a`](https://github.com/clerk/javascript/commit/4e3cb0abed1f8aa1cba032c15da3a94a49162b0c), [`aa32bbc`](https://github.com/clerk/javascript/commit/aa32bbc94e76ea726056810885208c59269b2d2b)]: - [@clerk/shared](https://github.com/clerk/shared)@4.6.0 - [@clerk/localizations](https://github.com/clerk/localizations)@4.4.0 ### [`v1.4.0`](https://github.com/clerk/javascript/blob/HEAD/packages/ui/CHANGELOG.md#140) [Compare Source](https://github.com/clerk/javascript/compare/@clerk/ui@1.3.0...@clerk/ui@1.4.0) ##### Minor Changes - API keys is now generally available. ([#8059](https://github.com/clerk/javascript/pull/8059)) by [@wobsoriano](https://github.com/wobsoriano) ##### `<APIKeys />` component ```tsx import { APIKeys } from '@clerk/react'; export default function Page() { return <APIKeys />; } ``` ##### `useAPIKeys()` hook ```tsx import { useAPIKeys } from '@clerk/react'; export default function CustomAPIKeys() { const { data, isLoading, page, pageCount, fetchNext, fetchPrevious } = useAPIKeys({ pageSize: 10, initialPage: 1, }); if (isLoading) return <div>Loading...</div>; return ( <ul> {data?.map(key => ( <li key={key.id}>{key.name}</li> ))} </ul> ); } ``` ##### Patch Changes - Adjust padding and display logo on `OrganizationList` header ([#8229](https://github.com/clerk/javascript/pull/8229)) by [@LauraBeatris](https://github.com/LauraBeatris) - Updated dependencies \[[`2c06a5f`](https://github.com/clerk/javascript/commit/2c06a5f1859ce4f1f64111f7c0a61f0093002667)]: - [@clerk/shared](https://github.com/clerk/shared)@4.5.0 - [@clerk/localizations](https://github.com/clerk/localizations)@4.3.2 </details> <details> <summary>honojs/middleware (@hono/zod-validator)</summary> ### [`v0.9.0`](https://github.com/honojs/middleware/blob/HEAD/packages/zod-validator/CHANGELOG.md#090) [Compare Source](https://github.com/honojs/middleware/compare/@hono/zod-validator@0.8.0...@hono/zod-validator@0.9.0) ##### Minor Changes - [#2038](https://github.com/honojs/middleware/pull/2038) [`7bc11dffa7dd5b639c614b12c34bd76722d76354`](https://github.com/honojs/middleware/commit/7bc11dffa7dd5b639c614b12c34bd76722d76354) Thanks [@yusukebe](https://github.com/yusukebe)! - Use `InferInput` from `hono/validator` instead of a local copy to avoid duplication (requires `hono >=4.11.2`) ### [`v0.8.0`](https://github.com/honojs/middleware/blob/HEAD/packages/zod-validator/CHANGELOG.md#080) [Compare Source](https://github.com/honojs/middleware/compare/@hono/zod-validator@0.7.6...@hono/zod-validator@0.8.0) ##### Minor Changes - [#1881](https://github.com/honojs/middleware/pull/1881) [`e90e4fb30877f3e3f4b0588bdb2bbfc337efbf67`](https://github.com/honojs/middleware/commit/e90e4fb30877f3e3f4b0588bdb2bbfc337efbf67) Thanks [@T4ko0522](https://github.com/T4ko0522)! - fix(zod-validator): surface the default `400` failure response so it propagates to the RPC schema (refs [honojs/hono#3746](https://github.com/honojs/hono/issues/3746)). - Widen the no-hook overload return type to `MiddlewareHandler<E, P, V, TypedResponse<ZodValidatorFailureBody<T>, 400, 'json'>>`, so the default `c.json(result, 400)` body reaches `MergeMiddlewareResponse<M_k>` on the Hono side and shows up in `hc<typeof app>` as a typed `400` branch. - Intersect the inferred middleware response with `Response` (`Response & TypedResponse<...>`) in both `ZodValidatorFailureResponse<T>` and `ExtractValidationResponse<VF>` so a `zValidator(...)` middleware remains assignable to a plain `MiddlewareHandler` (avoids a `TS2322` regression caused by bare `TypedResponse`). - Collapse the no-hook overload to also accept `undefined` for the hook parameter together with the `options.validationFunction`, allowing `zValidator(target, schema, undefined, { validationFunction })` to match the typed-failure path. - Bump `peerDependencies.hono` to `>=4.10.0` because this PR now relies on the 4-argument `MiddlewareHandler<E, P, I, R>` signature introduced in Hono v4.10.0; on `hono` <4.10.0, `MiddlewareHandler` only accepts 3 type arguments and consumers would hit `TS2707` even though peer ranges currently allow it. </details> <details> <summary>scalar/scalar (@scalar/nextjs-api-reference)</summary> ### [`v0.11.11`](https://github.com/scalar/scalar/blob/HEAD/integrations/nextjs/CHANGELOG.md#01111) ##### Patch Changes - [#9719](https://github.com/scalar/scalar/pull/9719): docs: update the Scalar platform overview block in the README ### [`v0.11.10`](https://github.com/scalar/scalar/blob/HEAD/integrations/nextjs/CHANGELOG.md#01110) ##### Patch Changes - [#9710](https://github.com/scalar/scalar/pull/9710): Republish so the updated README (with the Scalar platform overview) reaches npm. Also renames the README generator metadata in package.json from `readme` to `scalarReadme`: npm treats a `readme` field as the readme text itself, so affected packages were published with a literal `[object Object]` readme on the registry instead of README.md. ### [`v0.11.9`](https://github.com/scalar/scalar/blob/HEAD/integrations/nextjs/CHANGELOG.md#0119) ### [`v0.11.8`](https://github.com/scalar/scalar/blob/HEAD/integrations/nextjs/CHANGELOG.md#0118) ### [`v0.11.7`](https://github.com/scalar/scalar/blob/HEAD/integrations/nextjs/CHANGELOG.md#0117) ### [`v0.11.6`](https://github.com/scalar/scalar/blob/HEAD/integrations/nextjs/CHANGELOG.md#0116) ### [`v0.11.5`](https://github.com/scalar/scalar/blob/HEAD/integrations/nextjs/CHANGELOG.md#0115) ### [`v0.11.4`](https://github.com/scalar/scalar/blob/HEAD/integrations/nextjs/CHANGELOG.md#0114) ### [`v0.11.3`](https://github.com/scalar/scalar/blob/HEAD/integrations/nextjs/CHANGELOG.md#0113) ### [`v0.11.2`](https://github.com/scalar/scalar/blob/HEAD/integrations/nextjs/CHANGELOG.md#0112) ### [`v0.11.1`](https://github.com/scalar/scalar/blob/HEAD/integrations/nextjs/CHANGELOG.md#01111) ##### Patch Changes - [#9719](https://github.com/scalar/scalar/pull/9719): docs: update the Scalar platform overview block in the README ### [`v0.11.0`](https://github.com/scalar/scalar/blob/HEAD/integrations/nextjs/CHANGELOG.md#0110) ##### Minor Changes - [#9422](https://github.com/scalar/scalar/pull/9422): Add a `nonce` option for Content Security Policy support. When you pass a `nonce`, the rendered HTML stamps it onto the inline `<script>` and the CDN `<script>` tag (and Scalar's own `<style>` tags, plus a matching `<meta property="csp-nonce">`). This lets the API Reference run under a strict `script-src` with no `unsafe-inline` and no `unsafe-eval`. ```ts ApiReference({ url: '/openapi.json', // Match this value in your `script-src` CSP directive. nonce: 'r4nd0m', }) ``` Note: `style-src` still needs `'unsafe-inline'`. The reference renders inline `style="…"` attributes, which a CSP nonce can never authorize (nonces only apply to `<script>`, `<style>` and `<link>` elements), so a nonce-only `style-src` is not possible. The win is a fully strict `script-src`. ### [`v0.10.20`](https://github.com/scalar/scalar/blob/HEAD/integrations/nextjs/CHANGELOG.md#01020) ### [`v0.10.19`](https://github.com/scalar/scalar/blob/HEAD/integrations/nextjs/CHANGELOG.md#01019) ### [`v0.10.18`](https://github.com/scalar/scalar/blob/HEAD/integrations/nextjs/CHANGELOG.md#01018) ### [`v0.10.17`](https://github.com/scalar/scalar/blob/HEAD/integrations/nextjs/CHANGELOG.md#01017) ### [`v0.10.16`](https://github.com/scalar/scalar/blob/HEAD/integrations/nextjs/CHANGELOG.md#01016) ### [`v0.10.14`](https://github.com/scalar/scalar/blob/HEAD/integrations/nextjs/CHANGELOG.md#01014) ### [`v0.10.13`](https://github.com/scalar/scalar/blob/HEAD/integrations/nextjs/CHANGELOG.md#01013) ### [`v0.10.12`](https://github.com/scalar/scalar/blob/HEAD/integrations/nextjs/CHANGELOG.md#01012) ### [`v0.10.11`](https://github.com/scalar/scalar/blob/HEAD/integrations/nextjs/CHANGELOG.md#01011) ### [`v0.10.10`](https://github.com/scalar/scalar/blob/HEAD/integrations/nextjs/CHANGELOG.md#01010) ### [`v0.10.9`](https://github.com/scalar/scalar/blob/HEAD/integrations/nextjs/CHANGELOG.md#0109) ##### Patch Changes - [#8873](https://github.com/scalar/scalar/pull/8873): refactor: migrate integrations to client-side rendering package ### [`v0.10.8`](https://github.com/scalar/scalar/blob/HEAD/integrations/nextjs/CHANGELOG.md#0108) ### [`v0.10.7`](https://github.com/scalar/scalar/blob/HEAD/integrations/nextjs/CHANGELOG.md#0107) ### [`v0.10.6`](https://github.com/scalar/scalar/blob/HEAD/integrations/nextjs/CHANGELOG.md#0106) ### [`v0.10.5`](https://github.com/scalar/scalar/blob/HEAD/integrations/nextjs/CHANGELOG.md#0105) ### [`v0.10.4`](https://github.com/scalar/scalar/blob/HEAD/integrations/nextjs/CHANGELOG.md#0104) ##### Patch Changes - [#8466](https://github.com/scalar/scalar/pull/8466): chore: new build pipeline ### [`v0.10.3`](https://github.com/scalar/scalar/blob/HEAD/integrations/nextjs/CHANGELOG.md#0103) ##### Patch Changes ##### Updated Dependencies - **[@scalar/core](https://github.com/scalar/core)@0.4.3** ### [`v0.10.2`](https://github.com/scalar/scalar/blob/HEAD/integrations/nextjs/CHANGELOG.md#01020) ### [`v0.10.1`](https://github.com/scalar/scalar/blob/HEAD/integrations/nextjs/CHANGELOG.md#01019) ### [`v0.10.0`](https://github.com/scalar/scalar/blob/HEAD/integrations/nextjs/CHANGELOG.md#0100) ##### Minor Changes - [#8322](https://github.com/scalar/scalar/pull/8322): chore: bump required node version to >=22 (LTS) ##### Patch Changes ##### Updated Dependencies - **[@scalar/core](https://github.com/scalar/core)@0.4.0** - [#8322](https://github.com/scalar/scalar/pull/8322): chore: bump required node version to >=22 (LTS) </details> <details> <summary>tailwindlabs/tailwindcss (@tailwindcss/postcss)</summary> ### [`v4.3.3`](https://github.com/tailwindlabs/tailwindcss/blob/HEAD/CHANGELOG.md#433---2026-07-16) [Compare Source](https://github.com/tailwindlabs/tailwindcss/compare/v4.3.2...v4.3.3) ##### Fixed - Support `--watch --poll[=ms]` in `@tailwindcss/cli` when filesystem events are unreliable or unavailable ([#20297](https://github.com/tailwindlabs/tailwindcss/pull/20297)) - Canonicalization: match arbitrary hex colors against theme colors case-insensitively (e.g. `bg-[#fff]` and `bg-[#FFF]` → `bg-white`) ([#20298](https://github.com/tailwindlabs/tailwindcss/pull/20298)) - Prevent Preflight from overriding Firefox's native `iframe:focus-visible` outline styles ([#20292](https://github.com/tailwindlabs/tailwindcss/pull/20292)) - Ensure `theme('colors.foo')` in JS plugins resolves correctly when both `--color-foo` and `--color-foo-bar` exist ([#20299](https://github.com/tailwindlabs/tailwindcss/pull/20299)) - Ensure fractional opacity modifiers work with named shadow sizes like `shadow-sm/12.5`, `text-shadow-sm/12.5`, `drop-shadow-sm/12.5`, and `inset-shadow-sm/12.5` ([#20302](https://github.com/tailwindlabs/tailwindcss/pull/20302)) - Parse selectors like `[data-foo]div` as two selectors instead of one ([#20303](https://github.com/tailwindlabs/tailwindcss/pull/20303)) - Ensure `@tailwindcss/postcss` rebuilds when a preprocessor like Sass changes the input CSS without changing the input file on disk ([#20310](https://github.com/tailwindlabs/tailwindcss/pull/20310)) - Ensure CSS nesting is handled even when Lightning CSS isn't run, such as in `@tailwindcss/browser` and Tailwind Play ([#20124](https://github.com/tailwindlabs/tailwindcss/pull/20124)) - Prevent achromatic theme colors from shifting hue when mixed in polar color spaces like `oklch` ([#20314](https://github.com/tailwindlabs/tailwindcss/pull/20314)) - Ensure `--spacing(0)` is optimized to `0px` instead of `0` so it remains a `<length>` when used in `calc(…)` ([#20319](https://github.com/tailwindlabs/tailwindcss/pull/20319)) - Load `@parcel/watcher` only when needed in `@tailwindcss/cli --watch` mode, so one-off builds and `--watch --poll` work when `@parcel/watcher` can't be loaded ([#20325](https://github.com/tailwindlabs/tailwindcss/pull/20325)) - Use explicit platform fonts instead of `system-ui` and `ui-sans-serif` so CJK text respects the page's `lang` attribute on Windows ([#20318](https://github.com/tailwindlabs/tailwindcss/pull/20318)) - Prevent `@tailwindcss/upgrade` from rewriting ignored files when run from a subdirectory ([#20329](https://github.com/tailwindlabs/tailwindcss/pull/20329)) - Ensure earlier `@source` rules pointing to nested files are scanned when later `@source` rules point to files in parent folders ([#20335](https://github.com/tailwindlabs/tailwindcss/pull/20335)) - Prevent `@tailwindcss/vite` from triggering full page reloads when scanned files are processed by Vite but haven't been loaded as modules yet ([#20336](https://github.com/tailwindlabs/tailwindcss/pull/20336)) ### [`v4.3.2`](https://github.com/tailwindlabs/tailwindcss/blob/HEAD/CHANGELOG.md#432---2026-06-26) [Compare Source](https://github.com/tailwindlabs/tailwindcss/compare/v4.3.1...v4.3.2) ##### Fixed - Support bare spacing values for `auto-rows-*` and `auto-cols-*` utilities (e.g. `auto-rows-12` and `auto-cols-16`) ([#20229](https://github.com/tailwindlabs/tailwindcss/pull/20229)) - Prevent `@tailwindcss/cli` in `--watch` mode from crashing on Windows when `@source` points to a directory that doesn't exist ([#20242](https://github.com/tailwindlabs/tailwindcss/pull/20242)) - Prevent `@tailwindcss/vite` from crashing in Deno v2.8.x when `context.parentURL` is not a valid URL ([#20245](https://github.com/tailwindlabs/tailwindcss/pull/20245)) - Ensure `@tailwindcss/cli` in `--watch` mode rebuilds when the input CSS file changes in an ignored directory ([#20246](https://github.com/tailwindlabs/tailwindcss/pull/20246)) - Allow `@variant` rules used in `addBase(…)` to use custom variants defined later ([#20247](https://github.com/tailwindlabs/tailwindcss/pull/20247)) - Prevent `@tailwindcss/vite` from crashing during HMR when scanned files or directories are deleted ([#20259](https://github.com/tailwindlabs/tailwindcss/pull/20259)) - Generate `font-size` instead of `color` declarations for `text-[--spacing(…)]` ([#20260](https://github.com/tailwindlabs/tailwindcss/pull/20260)) - Prevent `@source` patterns from scanning unrelated sibling files and folders ([#20263](https://github.com/tailwindlabs/tailwindcss/pull/20263)) - Extract class candidates adjacent to Template Toolkit delimiters like `%]…[%` in `.tt`, `.tt2`, and `.tx` files ([#20269](https://github.com/tailwindlabs/tailwindcss/pull/20269)) - Extract class candidates from conditional Maud syntax like `p.text-black[condition]` ([#20269](https://github.com/tailwindlabs/tailwindcss/pull/20269)) - Prevent `@position-try` rules from triggering unknown at-rule warnings when optimizing CSS ([#20277](https://github.com/tailwindlabs/tailwindcss/pull/20277)) - Support class suggestions for named opacity modifiers from `--opacity` theme values ([#20287](https://github.com/tailwindlabs/tailwindcss/pull/20287)) - Prevent type errors in `@tailwindcss/postcss` when used with newer PostCSS patch releases ([#20289](https://github.com/tailwindlabs/tailwindcss/pull/20289)) ### [`v4.3.1`](https://github.com/tailwindlabs/tailwindcss/blob/HEAD/CHANGELOG.md#431---2026-06-12) [Compare Source](https://github.com/tailwindlabs/tailwindcss/compare/v4.3.0...v4.3.1) ##### Added - Add `--silent` option to suppress output in `@tailwindcss/cli` ([#20100](https://github.com/tailwindlabs/tailwindcss/pull/20100)) ##### Fixed - Remove deprecation warnings by using `Module#registerHooks` instead of `Module#register` on Node 26+ ([#20028](https://github.com/tailwindlabs/tailwindcss/pull/20028)) - Canonicalization: don't crash when plugin utilities throw for unsupported values ([#20052](https://github.com/tailwindlabs/tailwindcss/pull/20052)) - Allow `@apply` to be used with CSS mixins ([#19427](https://github.com/tailwindlabs/tailwindcss/pull/19427)) - Ensure `not-*` correctly negates `@container` queries, including `style(…)` queries ([#20059](https://github.com/tailwindlabs/tailwindcss/pull/20059)) - Ensure `drop-shadow-*` color utilities work with custom shadow values containing `calc(…)` ([#20080](https://github.com/tailwindlabs/tailwindcss/pull/20080)) - Fix 'Sourcemap is likely to be incorrect' warnings when using `@tailwindcss/vite` ([#20103](https://github.com/tailwindlabs/tailwindcss/pull/20103)) - Ensure `@tailwindcss/webpack` can be installed in Rspack projects without requiring `webpack` as a peer dependency ([#20027](https://github.com/tailwindlabs/tailwindcss/pull/20027)) - Canonicalization: don't suggest invalid `calc(…)` expressions (e.g. `px-[calc(1rem+0px)]` → `px-[calc(1rem+0)]`) ([#20127](https://github.com/tailwindlabs/tailwindcss/pull/20127)) - Canonicalization: avoid suggesting large spacing-scale values for arbitrary lengths (e.g. `left-[99999px]` → `left-[99999px]`, not `left-24999.75`) ([#20130](https://github.com/tailwindlabs/tailwindcss/pull/20130)) - Ensure `@tailwindcss/cli` in `--watch` mode recovers when a tracked dependency is deleted and restored ([#20137](https://github.com/tailwindlabs/tailwindcss/pull/20137)) - Ensure standalone `@tailwindcss/cli` binaries are ignored when scanning for class candidates ([#20139](https://github.com/tailwindlabs/tailwindcss/pull/20139)) - Ensure class candidates are extracted from Twig `addClass(…)` and `removeClass(…)` calls ([#20198](https://github.com/tailwindlabs/tailwindcss/pull/20198)) - Don't crash in the Ruby or Vue preprocessors when scanning files containing invalid UTF-8 bytes ([#19588](https://github.com/tailwindlabs/tailwindcss/pull/19588)) - Allow `@variant` to be used inside `addBase` ([#19480](https://github.com/tailwindlabs/tailwindcss/pull/19480)) - Ensure `@source` globs with symlinks are preserved ([#20203](https://github.com/tailwindlabs/tailwindcss/pull/20203)) - Ensure later `@source` rules can re-include files excluded by earlier `@source not` rules ([#20203](https://github.com/tailwindlabs/tailwindcss/pull/20203)) - Upgrade: don't migrate empty class rules to invalid `@utility` rules ([#20205](https://github.com/tailwindlabs/tailwindcss/pull/20205)) - Ensure transitions between `inset-shadow-none` and other inset shadows work correctly ([#20208](https://github.com/tailwindlabs/tailwindcss/pull/20208)) - Ensure explicitly referenced `@source` directories are scanned even when ignored by git ([#20214](https://github.com/tailwindlabs/tailwindcss/pull/20214)) - Ensure `@source` globs ending in `**/*` preserve dynamic path segments to avoid scanning too many files ([#20217](https://github.com/tailwindlabs/tailwindcss/pull/20217)) - Canonicalization: don't fold `calc(…)` divisions when the result would require high precision (e.g. `w-[calc(100%/3.5)]` → `w-[calc(100%/3.5)]`, not `w-[28.571428571428573%]`) ([#20221](https://github.com/tailwindlabs/tailwindcss/pull/20221)) - Serve ESM type declarations to ESM importers of `@tailwindcss/postcss` ([#20228](https://github.com/tailwindlabs/tailwindcss/pull/20228)) ##### Changed - Generate `0` instead of `calc(var(--spacing) * 0)` for spacing utilities like `m-0` and `left-0` ([#20196](https://github.com/tailwindlabs/tailwindcss/pull/20196)) - Generate `var(--spacing)` instead of `calc(var(--spacing) * 1)` for spacing utilities like `m-1` and `left-1` ([#20196](https://github.com/tailwindlabs/tailwindcss/pull/20196)) ### [`v4.3.0`](https://github.com/tailwindlabs/tailwindcss/blob/HEAD/CHANGELOG.md#430---2026-05-08) [Compare Source](https://github.com/tailwindlabs/tailwindcss/compare/v4.2.4...v4.3.0) ##### Added - Add `@container-size` utility ([#18901](https://github.com/tailwindlabs/tailwindcss/pull/18901)) - Add `scrollbar-{auto,thin,none}` utilities for `scrollbar-width`, and `scrollbar-thumb-*` / `scrollbar-track-*` color utilities for `scrollbar-color` ([#19981](https://github.com/tailwindlabs/tailwindcss/pull/19981), [#20019](https://github.com/tailwindlabs/tailwindcss/pull/20019)) - Add `scrollbar-gutter-*` utilities ([#20018](https://github.com/tailwindlabs/tailwindcss/pull/20018)) - Add `zoom-*` utilities ([#20020](https://github.com/tailwindlabs/tailwindcss/pull/20020)) - Add `tab-*` utilities ([#20022](https://github.com/tailwindlabs/tailwindcss/pull/20022)) - Allow using `@variant` with stacked variants (e.g. `@variant hover:focus { … }`) ([#19996](https://github.com/tailwindlabs/tailwindcss/pull/19996)) - Allow using `@variant` with compound variants (e.g. `@variant hover, focus { … }`) ([#19996](https://github.com/tailwindlabs/tailwindcss/pull/19996)) - Support `--default(…)` in `--value(…)` and `--modifier(…)` for functional `@utility` definitions ([#19989](https://github.com/tailwindlabs/tailwindcss/pull/19989)) ##### Fixed - Ensure `@plugin` resolves package JavaScript entries instead of browser CSS entries when using `@tailwindcss/vite` ([#19949](https://github.com/tailwindlabs/tailwindcss/pull/19949)) - Fix relative `@import` and `@plugin` paths resolving from the wrong directory when using `@tailwindcss/vite` ([#19965](https://github.com/tailwindlabs/tailwindcss/pull/19965)) - Ensure CSS files containing `@variant` are processed by `@tailwindcss/vite` ([#19966](https://github.com/tailwindlabs/tailwindcss/pull/19966)) - Resolve imports relative to `base` when `result.opts.from` is not provided when using `@tailwindcss/postcss` ([#19980](https://github.com/tailwindlabs/tailwindcss/pull/19980)) - Canonicalization: preserve significant `_` whitespace in arbitrary values ([#19986](https://github.com/tailwindlabs/tailwindcss/pull/19986)) - Canonicalization: add parentheses when removing whitespace from arbitrary values would hurt readability (e.g. `w-[calc(100%---spacing(60))]` → `w-[calc(100%-(--spacing(60)))]`) ([#19986](https://github.com/tailwindlabs/tailwindcss/pull/19986)) - Canonicalization: preserve the original unit in arbitrary values instead of normalizing to base units (e.g. `-mt-[20in]` → `mt-[-20in]`, not `mt-[-1920px]`) ([#19988](https://github.com/tailwindlabs/tailwindcss/pull/19988)) - Canonicalization: migrate arbitrary `:has()` variants from `[&:has(…)]` to `has-[…]` ([#19991](https://github.com/tailwindlabs/tailwindcss/pull/19991)) - Upgrade: don’t migrate inline `style` attributes (e.g. `style="flex-grow: 1"` → `style="flex-grow: 1"`, not `style="grow: 1"`) ([#19918](https://github.com/tailwindlabs/tailwindcss/pull/19918)) - Allow multiple `@utility` definitions with the same name but different value types ([#19777](https://github.com/tailwindlabs/tailwindcss/pull/19777)) - Export missing `PluginWithConfig` type from `tailwindcss/plugin` to fix errors when inferring plugin config types ([#19707](https://github.com/tailwindlabs/tailwindcss/pull/19707)) - Ensure `start` and `end` legacy utilities without values do not generate CSS ([#20003](https://github.com/tailwindlabs/tailwindcss/pull/20003)) - Ensure `--value(…)` is required in functional `@utility` definitions ([#20005](https://github.com/tailwindlabs/tailwindcss/pull/20005)) - Canonicalization: preserve required whitespace around operators in negated arbitrary values (e.g. `-left-[(var(--a)+var(--b))]`) ([#20011](https://github.com/tailwindlabs/tailwindcss/pull/20011)) ### [`v4.2.4`](https://github.com/tailwindlabs/tailwindcss/blob/HEAD/CHANGELOG.md#424---2026-04-21) [Compare Source](https://github.com/tailwindlabs/tailwindcss/compare/v4.2.3...v4.2.4) ##### Fixed - Ensure imports in `@import` and `@plugin` still resolve correctly when using Vite aliases in `@tailwindcss/vite` ([#19947](https://github.com/tailwindlabs/tailwindcss/pull/19947)) ### [`v4.2.3`](https://github.com/tailwindlabs/tailwindcss/blob/HEAD/CHANGELOG.md#423---2026-04-20) [Compare Source](https://github.com/tailwindlabs/tailwindcss/compare/v4.2.2...v4.2.3) ##### Fixed - Canonicalization: improve canonicalization for `tracking-*` utilities by preferring non-negative utilities (e.g. `-tracking-tighter` → `tracking-wider`) ([#19827](https://github.com/tailwindlabs/tailwindcss/pull/19827)) - Fix crash due to invalid characters in candidate (exceeding valid unicode code point range) ([#19829](https://github.com/tailwindlabs/tailwindcss/pull/19829)) - Ensure query params in imports are considered unique resources when using `@tailwindcss/webpack` ([#19723](https://github.com/tailwindlabs/tailwindcss/pull/19723)) - Canonicalization: collapse arbitrary values into shorthand utilities (e.g. `px-[1.2rem] py-[1.2rem]` → `p-[1.2rem]`) ([#19837](https://github.com/tailwindlabs/tailwindcss/pull/19837)) - Canonicalization: collapse `border-{t,b}-*` into `border-y-*`, `border-{l,r}-*` into `border-x-*`, and `border-{t,r,b,l}-*` into `border-*` ([#19842](https://github.com/tailwindlabs/tailwindcss/pull/19842)) - Canonicalization: collapse `scroll-m{t,b}-*` into `scroll-my-*`, `scroll-m{l,r}-*` into `scroll-mx-*`, and `scroll-m{t,r,b,l}-*` into `scroll-m-*` ([#19842](https://github.com/tailwindlabs/tailwindcss/pull/19842)) - Canonicalization: collapse `scroll-p{t,b}-*` into `scroll-py-*`, `scroll-p{l,r}-*` into `scroll-px-*`, and `scroll-p{t,r,b,l}-*` into `scroll-p-*` ([#19842](https://github.com/tailwindlabs/tailwindcss/pull/19842)) - Canonicalization: collapse `overflow-{x,y}-*` into `overflow-*` ([#19842](https://github.com/tailwindlabs/tailwindcss/pull/19842)) - Canonicalization: collapse `overscroll-{x,y}-*` into `overscroll-*` ([#19842](https://github.com/tailwindlabs/tailwindcss/pull/19842)) - Read from `--placeholder-color` instead of `--background-color` for `placeholder-*` utilities ([#19843](https://github.com/tailwindlabs/tailwindcss/pull/19843)) - Upgrade: ensure files are not emptied out when killing the upgrade process while it's running ([#19846](https://github.com/tailwindlabs/tailwindcss/pull/19846)) - Upgrade: use `config.content` when migrating from Tailwind CSS v3 to Tailwind CSS v4 ([#19846](https://github.com/tailwindlabs/tailwindcss/pull/19846)) - Upgrade: never migrate files that are ignored by git ([#19846](https://github.com/tailwindlabs/tailwindcss/pull/19846)) - Add `.env` and `.env.*` to default ignored content files ([#19846](https://github.com/tailwindlabs/tailwindcss/pull/19846)) - Canonicalization: migrate `overflow-ellipsis` into `text-ellipsis` ([#19849](https://github.com/tailwindlabs/tailwindcss/pull/19849)) - Canonicalization: migrate `start-full` → `inset-s-full`, `start-auto` → `inset-s-auto`, `start-px` → `inset-s-px`, and `start-<number>` → `inset-s-<number>` as well as negative versions ([#19849](https://github.com/tailwindlabs/tailwindcss/pull/19849)) - Canonicalization: migrate `end-full` → `inset-e-full`, `end-auto` → `inset-e-auto`, `end-px` → `inset-e-px`, and `end-<number>` → `inset-e-<number>` as well as negative versions ([#19849](https://github.com/tailwindlabs/tailwindcss/pull/19849)) - Canonicalization: move the `-` sign inside the arbitrary value `-left-[9rem]` → `left-[-9rem]` ([#19858](https://github.com/tailwindlabs/tailwindcss/pull/19858)) - Canonicalization: move the `-` sign outside the arbitrary value `ml-[calc(-1*var(--width))]` → `-ml-(--width)` ([#19858](https://github.com/tailwindlabs/tailwindcss/pull/19858)) - Improve performance when scanning JSONL / NDJSON files ([#19862](https://github.com/tailwindlabs/tailwindcss/pull/19862)) - Support `NODE_PATH` environment variable in standalone CLI ([#19617](https://github.com/tailwindlabs/tailwindcss/pull/19617)) ### [`v4.2.2`](https://github.com/tailwindlabs/tailwindcss/blob/HEAD/CHANGELOG.md#422---2026-03-18) [Compare Source](https://github.com/tailwindlabs/tailwindcss/compare/v4.2.1...v4.2.2) ##### Fixed - Don't crash when candidates contain prototype properties like `row-constructor` ([#19725](https://github.com/tailwindlabs/tailwindcss/pull/19725)) - Canonicalize `calc(var(--spacing)*…)` expressions into `--spacing(…)` ([#19769](https://github.com/tailwindlabs/tailwindcss/pull/19769)) - Fix crash in canonicalization step when handling utilities containing `@property` at-rules (e.g. `shadow-sm border`) ([#19727](https://github.com/tailwindlabs/tailwindcss/pull/19727)) - Skip full reload for server only modules scanned by client CSS when using `@tailwindcss/vite` ([#19745](https://github.com/tailwindlabs/tailwindcss/pull/19745)) - Add support for Vite 8 in `@tailwindcss/vite` ([#19790](https://github.com/tailwindlabs/tailwindcss/pull/19790)) - Improve canonicalization for bare values exceeding default spacing scale suggestions (e.g. `w-1234 h-1234` → `size-1234`) ([#19809](https://github.com/tailwindlabs/tailwindcss/pull/19809)) - Fix canonicalization resulting in empty list (e.g. `w-5 h-5 size-5` → `''` instead of `size-5`) ([#19812](https://github.com/tailwindlabs/tailwindcss/pull/19812)) - Resolve tsconfig paths to allow for `@import '@/path/to/file';` when using `@tailwindcss/vite` ([#19803](https://github.com/tailwindlabs/tailwindcss/pull/19803)) ### [`v4.2.1`](https://github.com/tailwindlabs/tailwindcss/blob/HEAD/CHANGELOG.md#421---2026-02-23) [Compare Source](https://github.com/tailwindlabs/tailwindcss/compare/v4.2.0...v4.2.1) ##### Fixed - Allow trailing dash in functional utility names for backwards compatibility ([#19696](https://github.com/tailwindlabs/tailwindcss/pull/19696)) - Properly detect classes containing `.` characters within curly braces in MDX files ([#19711](https://github.com/tailwindlabs/tailwindcss/pull/19711)) ### [`v4.2.0`](https://github.com/tailwindlabs/tailwindcss/blob/HEAD/CHANGELOG.md#420---2026-02-18) [Compare Source](https://github.com/tailwindlabs/tailwindcss/compare/v4.1.18...v4.2.0) ##### Added - Add mauve, olive, mist, and taupe color palettes to the default theme ([#19627](https://github.com/tailwindlabs/tailwindcss/pull/19627)) - Add `@tailwindcss/webpack` package to run Tailwind CSS as a webpack plugin ([#19610](https://github.com/tailwindlabs/tailwindcss/pull/19610)) - Add `pbs-*` and `pbe-*` utilities for `padding-block-start` and `padding-block-end` ([#19601](https://github.com/tailwindlabs/tailwindcss/pull/19601)) - Add `mbs-*` and `mbe-*` utilities for `margin-block-start` and `margin-block-end` ([#19601](https://github.com/tailwindlabs/tailwindcss/pull/19601)) - Add `scroll-pbs-*` and `scroll-pbe-*` utilities for `scroll-padding-block-start` and `scroll-padding-block-end` ([#19601](https://github.com/tailwindlabs/tailwindcss/pull/19601)) - Add `scroll-mbs-*` and `scroll-mbe-*` utilities for `scroll-margin-block-start` and `scroll-margin-block-end` ([#19601](https://github.com/tailwindlabs/tailwindcss/pull/19601)) - Add `border-bs-*` and `border-be-*` utilities for `border-block-start` and `border-block-end` ([#19601](https://github.com/tailwindlabs/tailwindcss/pull/19601)) - Add `inline-*`, `min-inline-*`, `max-inline-*` utilities for `inline-size`, `min-inline-size`, and `max-inline-size` ([#19612](https://github.com/tailwindlabs/tailwindcss/pull/19612)) - Add `block-*`, `min-block-*`, `max-block-*` utilities for `block-size`, `min-block-size`, and `max-block-size` ([#19612](https://github.com/tailwindlabs/tailwindcss/pull/19612)) - Add `inset-s-*`, `inset-e-*`, `inset-bs-*`, `inset-be-*` utilities for `inset-inline-start`, `inset-inline-end`, `inset-block-start`, and `inset-block-end` ([#19613](https://github.com/tailwindlabs/tailwindcss/pull/19613)) - Add `font-features-*` utility for `font-feature-settings` ([#19623](https://github.com/tailwindlabs/tailwindcss/pull/19623)) ##### Fixed - Prevent double `@supports` wrapper for `color-mix` values ([#19450](https://github.com/tailwindlabs/tailwindcss/pull/19450)) - Allow whitespace around `@source inline()` argument ([#19461](https://github.com/tailwindlabs/tailwindcss/pull/19461)) - Emit comment when source maps are saved to files when using `@tailwindcss/cli` ([#19447](https://github.com/tailwindlabs/tailwindcss/pull/19447)) - Detect utilities containing capital letters followed by numbers ([#19465](https://github.com/tailwindlabs/tailwindcss/pull/19465)) - Fix class extraction for Rails' strict locals ([#19525](https://github.com/tailwindlabs/tailwindcss/pull/19525)) - Align `@utility` name validation with Oxide scanner rules ([#19524](https://github.com/tailwindlabs/tailwindcss/pull/19524)) - Fix infinite loop when using `@variant` inside `@custom-variant` ([#19633](https://github.com/tailwindlabs/tailwindcss/pull/19633)) - Allow multiples of `.25` in `aspect-*` fractions (e.g. `aspect-8.5/11`) ([#19688](https://github.com/tailwindlabs/tailwindcss/pull/19688)) - Ensure changes to external files listed via `@source` trigger a full page reload when using `@tailwindcss/vite` ([#19670](https://github.com/tailwindlabs/tailwindcss/pull/19670)) - Improve performance of Oxide scanner in bigger projects by reducing file system walks ([#19632](https://github.com/tailwindlabs/tailwindcss/pull/19632)) - Ensure import aliases in Astro v5 work without crashing when using `@tailwindcss/vite` ([#19677](https://github.com/tailwindlabs/tailwindcss/issues/19677)) - Allow escape characters in `@utility` names to improve support with formatters such as Biome ([#19626](https://github.com/tailwindlabs/tailwindcss/pull/19626)) - Fix incorrect canonicalization results when canonicalizing multiple times ([#19675](https://github.com/tailwindlabs/tailwindcss/pull/19675)) - Add `.jj` to default ignored content directories ([#19687](https://github.com/tailwindlabs/tailwindcss/pull/19687)) ##### Deprecated - Deprecate `start-*` and `end-*` utilities in favor of `inset-s-*` and `inset-e-*` utilities ([#19613](https://github.com/tailwindlabs/tailwindcss/pull/19613)) </details> <details> <summary>postcss/autoprefixer (autoprefixer)</summary> ### [`v10.5.4`](https://github.com/postcss/autoprefixer/blob/HEAD/CHANGELOG.md#1054) [Compare Source](https://github.com/postcss/autoprefixer/compare/10.5.3...10.5.4) - Fixed prefixed rule duplication (by [@xianjianlf2](https://github.com/xianjianlf2)). ### [`v10.5.3`](https://github.com/postcss/autoprefixer/blob/HEAD/CHANGELOG.md#1053) [Compare Source](https://github.com/postcss/autoprefixer/compare/10.5.2...10.5.3) - Fixed brackets and gradient parser ([@alanturing881](https://github.com/alanturing881)). ### [`v10.5.2`](https://github.com/postcss/autoprefixer/blob/HEAD/CHANGELOG.md#1052) [Compare Source](https://github.com/postcss/autoprefixer/compare/10.5.1...10.5.2) - Moved `-webkit-fill-available` before `-moz-available`, so Firefox will use `-webkit-` version which is closer to `stretch`. ### [`v10.5.1`](https://github.com/postcss/autoprefixer/blob/HEAD/CHANGELOG.md#1051) [Compare Source](https://github.com/postcss/autoprefixer/compare/10.5.0...10.5.1) - Fixed `grid-area` span reset for overriding areas (by [@puneetdixit200](https://github.com/puneetdixit200)). ### [`v10.5.0`](https://github.com/postcss/autoprefixer/blob/HEAD/CHANGELOG.md#1050-Each-Endeavouring-All-Achieving) [Compare Source](https://github.com/postcss/autoprefixer/compare/10.4.27...10.5.0) - Added `mask-position-x` and `mask-position-y` support (by [@toporek](https://github.com/toporek)). ### [`v10.4.27`](https://github.com/postcss/autoprefixer/blob/HEAD/CHANGELOG.md#10427) [Compare Source](https://github.com/postcss/autoprefixer/compare/10.4.26...10.4.27) - Removed development key from `package.json`. ### [`v10.4.26`](https://github.com/postcss/autoprefixer/blob/HEAD/CHANGELOG.md#10426) [Compare Source](https://github.com/postcss/autoprefixer/compare/10.4.25...10.4.26) - Reduced package size. ### [`v10.4.25`](https://github.com/postcss/autoprefixer/blob/HEAD/CHANGELOG.md#10425) [Compare Source](https://github.com/postcss/autoprefixer/compare/10.4.24...10.4.25) - Fixed broken gradients on CSS Custom Properties (by [@serger777](https://github.com/serger777)). </details> <details> <summary>olragon/binpackingjs (binpackingjs)</summary> ### [`v3.1.0`](https://github.com/olragon/binpackingjs/blob/HEAD/CHANGELOG.md#310-2026-05-13) [Compare Source](https://github.com/olragon/binpackingjs/compare/51560dcafc27a6f3cc97c4717ccab46eebcde0b0...0a2220f48deb4dd3d9fcc26877d6aa04cf849d6b) ##### Bug Fixes - Fix 2D `pruneFreeList` bug: `i++` moved to outer loop so free rectangles are not skipped during pruning ([#42](https://github.com/olragon/binpackingjs/issues/42), credit to [@traaan](https://github.com/traaan) PR [#27](https://github.com/olragon/binpackingjs/issues/27)) - Fix 3D `scoreRotation` heuristic: use tiling efficiency instead of squared dimension ratios ([#37](https://github.com/olragon/binpackingjs/issues/37)) - Fix broken 2D paper link in README ([#29](https://github.com/olragon/binpackingjs/issues/29)) ##### Other - Add bug reproduction tests for [#42](https://github.com/olragon/binpackingjs/issues/42) and [#37](https://github.com/olragon/binpackingjs/issues/37) - Upgrade all dependencies, fix security vulnerabilities - Upgrade mocha 8 to 11 *** </details> <details> <summary>open-cli-tools/concurrently (concurrently)</summary> ### [`v9.2.4`](https://github.com/open-cli-tools/concurrently/releases/tag/v9.2.4) [Compare Source](https://github.com/open-cli-tools/concurrently/compare/v9.2.3...v9.2.4) - upgrade shell-quote to 1.9.0 - [#597](https://github.com/open-cli-tools/concurrently/issues/597), [#600](https://github.com/open-cli-tools/concurrently/issues/600) **Full Changelog**: <https://github.com/open-cli-tools/concurrently/compare/v9.2.3...v9.2.4> ### [`v9.2.3`](https://github.com/open-cli-tools/concurrently/releases/tag/v9.2.3) [Compare Source](https://github.com/open-cli-tools/concurrently/compare/v9.2.1...v9.2.3) - Address [vulnerability in `shell-quote`](https://app.snyk.io/vuln/SNYK-JS-SHELLQUOTE-16799355) - [#591](https://github.com/open-cli-tools/concurrently/issues/591), [#596](https://github.com/open-cli-tools/concurrently/issues/596) </details> <details> <summary>get-convex/convex-backend (convex)</summary> ### [`v1.42.3`](https://github.com/get-convex/convex-backend/blob/HEAD/npm-packages/convex/CHANGELOG.md#1423) - Fixed a bug where the codegen would not sort module paths in an order consistent with other platforms when running on Windows. This completes a fix that was only partially applied in 1.42.2. ### [`v1.42.2`](https://github.com/get-convex/convex-backend/blob/HEAD/npm-packages/convex/CHANGELOG.md#1422) - Mutations and actions can now read the raw authentication token used in the request by accessing `authToken` in `ctx.meta.getRequestMetadata()`. - Fixed a circular import in `convex/browser` that caused issues when using the `ConvexHttpClient` in some JavaScript environments. - Fixed a bug in `ConvexProviderWithClerk` that caused the Convex client to ignore session changes in some situations. - Fixed a bug where the codegen would not sort module paths in an order consistent with other platforms when running on Windows. - When running `npx convex dev` outside a Convex project, the CLI now returns an error message immediately instead of first asking the user to select a project and then failing later. ### [`v1.42.1`](https://github.com/get-convex/convex-backend/blob/HEAD/npm-packages/convex/CHANGELOG.md#1421) - Fixed an issue where the CLI would be unable to find the `tsgo` binary in newer versions of `@typescript/native-preview`. - Added a new `initialAuthTokenReuse` option to `ConvexReactClient` that prevents extra function calls when users re-authenticate. ### [`v1.42.0`](https://github.com/get-convex/convex-backend/blob/HEAD/npm-packages/convex/CHANGELOG.md#1420) - Added a new `npx convex project create` command that can be used to create new projects programmatically. - Added a new `--names-only` flag to `npx convex env list` (and `npx convex env default list`). This flag shows the names of the env vars that are set, without the values. It can be useful to let AI coding agents know the variables that are set on a deployment, without giving them the actual values. - Added a new `useStaleSnapshot` option to the arguments for `runQuery`. This is an advanced feature that can be used to allow mutations to avoid optimistic concurrency control (OCC) conflicts in some cases where they can commit even though they depend on conflicting reads. This change allows us to improve the performance of some of the official Convex components, including Workpool. - Improved the documentation of `db.*` methods to more clearly explain the difference between the old APIs without table names (e.g. `db.get(userId)`) and the new APIs with table names (e.g. `db.get("users", userId)`). - Fixed an issue where the CLI would not surface permission errors correctly when the user or token doesn’t have permission to do something. - Exposes the current scheduled function's ID as `scheduledFunctionId` in `ctx.meta.getRequestMetadata()`. - `npx convex insights` has a new `--json` flag that makes the command output easier to parse programmatically. - File storage: marked a few TypeScript types in `convex/server` as `@deprecated` (`FileMetadata`, `FileStorageId`, `StorageId`). These types are used only by file storage APIs that were deprecated in `convex@1.6.0`, so we also marked them as `@deprecated` for clarity. - Bumps the `ws` peer dependency to avoid a vulnerable range. ### [`v1.41.0`](https://github.com/get-convex/convex-backend/blob/HEAD/npm-packages/convex/CHANGELOG.md#1410) - It is now possible to set limits on nested queries and mutations with the new `transactionLimits` option in `runQuery`/`runMutation`. - `npx convex ai-files` now installs skills with separate copies of each skill for each coding agent instead of using symlinks. We made this change to avoid known issues with symlinks on Windows. - When using Convex in anonymous mode (without a Convex account), `npx convex dev` now starts a different dashboard server for each deployment. This ensures the dashboard always connects to the right deployment when multiple deployments are running at the same time. ### [`v1.40.0`](https://github.com/get-convex/convex-backend/blob/HEAD/npm-packages/convex/CHANGELOG.md#1400) - You can now create a local deployment in a specific Convex cloud project with `npx convex deployment create team-slug:project-slug:local`. - You can now move a local deployment to another cloud project using `npx convex deployment select team-slug:project-slug:local`. This command warns when it moves the deployment to another project. - The CLI now shows more clearly which deployment is targeted when running commands such as `npx convex dev` and `npx convex deploy`. - Added a new `<AuthRefreshing />` helper component, used to show indicators when function calls are paused because the authentication token is refreshing. - Removed `--local` and `--cloud` flags from `npx convex dev`. The behavior of these flags was misleading when a deployment was already selected. Instead, use `npx convex deployment select local` to use a local deployment, and `npx convex deployment select dev` to use your personal cloud dev deployment. - The CLI now provides guidance when TypeScript type checking is taking too long. - Improved the CLI command documentation to include more details and examples. - `npx convex logs`: `--tail` is now accepted as an alias for the `--history` flag. - When creating a local deployment, the CLI now skips importing the default environment variables from the Convex cloud project if you don’t have permission to view the default environment variables instead of crashing. </details> <details> <summary>discordjs/discord.js (discord.js)</summary> ### [`v14.27.0`](https://github.com/discordjs/discord.js/releases/tag/14.27.0) [Compare Source](https://github.com/discordjs/discord.js/compare/14.26.5...14.27.0) #### Bug Fixes - Update `clientReady` event name references ([#10632](https://github.com/discordjs/discord.js/issues/10632)) ([9592aea](https://github.com/discordjs/discord.js/commit/9592aea673df43561d8f7a23d86a29c9e17610cb)) - **InteractionResponses:** Optional parameter for update() ([#10797](https://github.com/discordjs/discord.js/issues/10797)) ([fbda4fe](https://github.com/discordjs/discord.js/commit/fbda4fe5256802abf3ae4d74e5df8961e7950603)) - **guide:** Miscellaneous fixes ([#11147](https://github.com/discordjs/discord.js/issues/11147)) ([c53c8c2](https://github.com/discordjs/discord.js/commit/c53c8c276e2aa3b93d2b5b945508be575b291c0b)) - **GuildChannel:** Manageable perm check ([#11166](https://github.com/discordjs/discord.js/issues/11166)) ([8b342a1](https://github.com/discordjs/discord.js/commit/8b342a14a3d848ba221aed7ec652caf547a2dd78)) - **StageInstanceManager#create:** Correctly resolve `guildScheduledEvent` ([#11540](https://github.com/discordjs/discord.js/issues/11540)) ([0aabb6c](https://github.com/discordjs/discord.js/commit/0aabb6cde24a10218bd97f452dd9ab112f17c833)) - **RoleManager:** Allow null in RoleColorsResolvable to clear gradient colors ([#11536](https://github.com/discordjs/discord.js/issues/11536)) ([221680d](https://github.com/discordjs/discord.js/commit/221680dbd13f7610dc95d39a4527ec39854330b6)) - **GuildChannel:** Handle empty overwrite must only handle [@everyone](https://github.com/everyone) ([#11221](https://github.com/discordjs/discord.js/issues/11221)) ([1e2fdf4](https://github.com/discordjs/discord.js/commit/1e2fdf4a657afd797d633d30b54fea53892f32d1)) #### Documentation - **Attachment:** `string` property ([d646a13](https://github.com/discordjs/discord.js/commit/d646a13d2c086aada7602c92a1b14d86a733a761)) - Fix close tags ([#10756](https://github.com/discordjs/discord.js/issues/10756)) ([4349e10](https://github.com/discordjs/discord.js/commit/4349e103e25aabc3971a3e6bda3a71301c2d9dd9)) - Replace Discord API with Discord Developers ([#10968](https://github.com/discordjs/discord.js/issues/10968)) ([538457c](https://github.com/discordjs/discord.js/commit/538457c1d74130f987cd805964bb66a6c2ba75c9)) - Clarify wording for maximum values ([#11231](https://github.com/discordjs/discord.js/issues/11231)) ([9ec73fa](https://github.com/discordjs/discord.js/commit/9ec73fa687570cc07673df7b12b6b2218ece911f)) - Fix incorrect casing in the ready event deprecation ([#11574](https://github.com/discordjs/discord.js/issues/11574)) ([0df0628](https://github.com/discordjs/discord.js/commit/0df0628d468df998c775b35e4139800bcf04ce32)) - Fix typos and duplicated words in comments and guide ([#11502](https://github.com/discordjs/discord.js/issues/11502)) ([63cd992](https://github.com/discordjs/discord.js/commit/63cd9926bb048713e5828a986d92ea1976c792ee)) #### Features - Send voice messages ([#11493](https://github.com/discordjs/discord.js/issues/11493)) ([fed811a](https://github.com/discordjs/discord.js/commit/fed811a66905a2548dcaf70010ea1a0fc1661b98)) - **Guild:** Add `maximumStageBitrate` ([#11313](https://github.com/discordjs/discord.js/issues/11313)) ([6d2cd99](https://github.com/discordjs/discord.js/commit/6d2cd9952632edbf9ed80eed8c7d018b59c7dfa3)) - Proper authorizing integration owners structure ([#11366](https://github.com/discordjs/discord.js/issues/11366)) ([b6db455](https://github.com/discordjs/discord.js/commit/b6db455b9963c68864d2f505b728f6d4bac7f888)) - **RoleManager:** Add `fetchMemberCounts` ([#11352](https://github.com/discordjs/discord.js/issues/11352)) ([3b738ee](https://github.com/discordjs/discord.js/commit/3b738eef58bfd2c8d05a025ada89011627102b7a)) - Emit voiceServerUpdate event ([#11414](https://github.com/discordjs/discord.js/issues/11414)) ([74a42bf](https://github.com/discordjs/discord.js/commit/74a42bfd108c4e20cc560d700a28282856bdbd86)) - **GuildMember:** Add collectibles ([#11468](https://github.com/discordjs/discord.js/issues/11468)) ([b0e6aff](https://github.com/discordjs/discord.js/commit/b0e6aff8561d8cc3c1d3726b35b687d147892eda)) - Add shared client theme support ([#11454](https://github.com/discordjs/discord.js/issues/11454)) ([16fd248](https://github.com/discordjs/discord.js/commit/16fd248c64d056cae7a627b0fca910a96183acc5)) - **ClientApplication:** Add fetchActivityInstance method ([#11481](https://github.com/discordjs/discord.js/issues/11481)) ([24a0606](https://github.com/discordjs/discord.js/commit/24a0606a744d0d6dc4d080b400d0d8c9795bf4da)) #### Refactor - Reorder imports ([40b7a60](https://github.com/discordjs/discord.js/commit/40b7a60f26332f26abab3e53e5aa72a2325d6196)) #### Typings - **WebhookMessageCreateOptions:** Omit `sharedClientTheme` ([b816b79](https://github.com/discordjs/discord.js/commit/b816b795fc740a57f51cdcf98dddaf7442b61d5c)) - **Message:** Specify `rawData` arg type ([#11123](https://github.com/discordjs/discord.js/issues/11123)) ([c4531d4](https://github.com/discordjs/discord.js/commit/c4531d45a00dcab94f38adf0ca8273221569ed4b)) - **UserManager:** Fix send() return type to Promise\<Message<false>> ([#11337](https://github.com/discordjs/discord.js/issues/11337)) ([07c4127](https://github.com/discordjs/discord.js/commit/07c412791d3916ce9f62fbd834a2a104453b3cbe)) ### [`v14.26.5`](https://github.com/discordjs/discord.js/releases/tag/14.26.5) [Compare Source](https://github.com/discordjs/discord.js/compare/14.26.4...14.26.5) #### Bug Fixes - Detect spoiler attachments with flag (v14) ([#11561](https://github.com/discordjs/discord.js/issues/11561)) ([ce29ae9](https://github.com/discordjs/discord.js/commit/ce29ae9815efcaf0ecfaad318709aa9bc8e7bd82)) ### [`v14.26.4`](https://github.com/discordjs/discord.js/releases/tag/14.26.4) [Compare Source](https://github.com/discordjs/discord.js/compare/14.26.3...14.26.4) #### Bug Fixes - **MessageCreateAction:** Receive DMs in uncached DMChannels again ([#11495](https://github.com/discordjs/discord.js/issues/11495)) ([b8d8812](https://github.com/discordjs/discord.js/commit/b8d8812a05c14a93cc40b2839e19be38ed928cb7)) ### [`v14.26.3`](https://github.com/discordjs/discord.js/releases/tag/14.26.3) [Compare Source](https://github.com/discordjs/discord.js/compare/14.26.2...14.26.3) #### Bug Fixes - **TeamMember:** Allow a default `permissions` ([dced197](https://github.com/discordjs/discord.js/commit/dced1970ebb481ae7c5cf46ec5fadee4b05215bb)) ### [`v14.26.2`](https://github.com/discordjs/discord.js/releases/tag/14.26.2) [Compare Source](https://github.com/discordjs/discord.js/compare/14.26.1...14.26.2) #### Bug Fixes - **Action:** Don't add recipients to guild channels ([#11479](https://github.com/discordjs/discord.js/issues/11479)) ([b86573d](https://github.com/discordjs/discord.js/commit/b86573db3c13fe0292bdf6756bcd4351f84e2950)) ### [`v14.26.1`](https://github.com/discordjs/discord.js/releases/tag/14.26.1) [Compare Source](https://github.com/discordjs/discord.js/compare/14.26.0...14.26.1) #### Bug Fixes - Only return DMChannel that have the user as known recipient ([#11478](https://github.com/discordjs/discord.js/issues/11478)) ([67566d0](https://github.com/discordjs/discord.js/commit/67566d0b0efd64012088e3357ad9cd6bacc23930)) ### [`v14.26.0`](https://github.com/discordjs/discord.js/releases/tag/14.26.0) [Compare Source](https://github.com/discordjs/discord.js/compare/14.25.1...14.26.0) #### Bug Fixes - Remove manage messages check for pinnable ([#11453](https://github.com/discordjs/discord.js/issues/11453)) ([1a0da18](https://github.com/discordjs/discord.js/commit/1a0da18b3611a31553fd5250b6f882b755d8d003)) - **DJSError:** Differentiate error type ([#11295](https://github.com/discordjs/discord.js/issues/11295)) ([f5b3f84](https://github.com/discordjs/discord.js/commit/f5b3f842e39ec1f211a0017fadb683ae3b372e02)) #### Features - Allow partial DMChannel without client user ([#11462](https://github.com/discordjs/discord.js/issues/11462)) ([45bd430](https://github.com/discordjs/discord.js/commit/45bd430c0d55ddb98380ea320fab9dc56211e07a)) - Modal radio group and checkbox components for v14 ([#11437](https://github.com/discordjs/discord.js/issues/11437)) ([b42e499](https://github.com/discordjs/discord.js/commit/b42e4994109ee83f3e329e810cc8733cf4176dbe)) #### Refactor - **DJSError:** Prefer `this.constructor.name` ([#11294](https://github.com/discordjs/discord.js/issues/11294)) ([e32f0c1](https://github.com/discordjs/discord.js/commit/e32f0c141a4ef17383f7a868e26c26a2878fb4f2)) #### Typings - BroadcastEval overload order ([#11422](https://github.com/discordjs/discord.js/issues/11422)) ([16d70b9](https://github.com/discordjs/discord.js/commit/16d70b9232559f505f4d6c1a5b1122ebbac5e35d)) </details> <details> <summary>krisk/Fuse (fuse.js)</summary> ### [`v7.5.0`](https://github.com/krisk/Fuse/blob/HEAD/CHANGELOG.md#750-2026-07-13) [Compare Source](https://github.com/krisk/Fuse/compare/v7.4.2...v7.5.0) ##### ⚠️ Behavior changes Every change in this release is a bug fix, but each one corrects a **scoring or ranking** bug. Scores and result ordering will shift for some queries. That is why this ships as a minor rather than a patch: the public API is unchanged and upgrading is a drop-in, but the results you get back can differ, and that should not arrive silently in a patch bump. If you assert on exact `score` values or on a specific result order, expect those assertions to need updating. Re-baseline them against 7.5.0 rather than pinning to 7.4.x, since the 7.4.x behavior was wrong in the cases below. - **Field-length normalisation now counts words correctly.** Tabs and newlines were not treated as word separators, so a multi-line or tab-delimited field was scored as though it were one long word, making it look far shorter than it is. Fields containing `\t`, `\n`, or `\r` now score differently ([#830](https://github.com/krisk/Fuse/issues/830)). - **Key weights are now normalised in object and keyless-logical search.** Weights that did not sum to `1` were applied unnormalised, skewing the relative influence of each key. If your `keys` weights do not already sum to `1`, your relative ranking changes ([#833](https://github.com/krisk/Fuse/issues/833)). - **`limit` now returns the correct top-N when scores tie.** A tie at the cutoff boundary could evict a result that should have been kept, so `limit` could return the *wrong* items, not merely the right items in a different order ([#835](https://github.com/krisk/Fuse/issues/835)). - **Bitap respects `minMatchCharLength` in the exact-match shortcut.** Matches shorter than `minMatchCharLength` were still reported via the exact-match fast path, so the `matches` array could contain entries it was configured to exclude ([#831](https://github.com/krisk/Fuse/issues/831)). ##### Bug Fixes - **bitap:** respect minMatchCharLength in exact-match shortcut ([dbb98b6](https://github.com/krisk/Fuse/commit/dbb98b6ace1811ed65e1cac28f3e1501d1de3f34)), closes [#831](https://github.com/krisk/Fuse/issues/831) - **fieldNorm:** count tabs and newlines as word separators ([6fe85b0](https://github.com/krisk/Fuse/commit/6fe85b087c675edc328b73f1d0088da73c09ab5e)), closes [#830](https://github.com/krisk/Fuse/issues/830) - **fieldNorm:** count word-starts instead of space transitions ([2946f97](https://github.com/krisk/Fuse/commit/2946f978881f4bc2f214b6c64fee96450dcceae2)) - **scoring:** normalise key weights in object and keyless-logical search ([e164b61](https://github.com/krisk/Fuse/commit/e164b61d4d324e0207e1f790e55dd13fe59c74ae)), closes [#833](https://github.com/krisk/Fuse/issues/833) - **search:** keep the correct top-N under limit when scores tie ([437f8f3](https://github.com/krisk/Fuse/commit/437f8f32713f6d8647339516dd61b8344847b3ae)), closes [#835](https://github.com/krisk/Fuse/issues/835), thanks [@spokodev](https://github.com/spokodev) for the report and the fix ##### [7.4.2](https://github.com/krisk/Fuse/compare/v7.4.1...v7.4.2) (2026-06-05) ##### Bug Fixes - **types:** emit CommonJS declarations (.d.cts) for node16/nodenext ([#780](https://github.com/krisk/Fuse/issues/780)) ([33f5d29](https://github.com/krisk/Fuse/commit/33f5d290df034e50b0646125264ee4a6229def98)) ##### [7.4.1](https://github.com/krisk/Fuse/compare/v7.4.0...v7.4.1) (2026-06-02) ##### Bug Fixes - **types:** add TypeScript declarations for fuse.js/worker-script ([6ef6c33](https://github.com/krisk/Fuse/commit/6ef6c33101f8f4387d8a1dc7a227e483a179231f)), closes [#828](https://github.com/krisk/Fuse/issues/828) - **types:** ship TypeScript declarations for fuse.js/worker ([572ad1e](https://github.com/krisk/Fuse/commit/572ad1e6fca0bce226afae88b33a6f2d3672f80f)), closes [#828](https://github.com/krisk/Fuse/issues/828) ### [`v7.4.2`](https://github.com/krisk/Fuse/blob/HEAD/CHANGELOG.md#742-2026-06-05) [Compare Source](https://github.com/krisk/Fuse/compare/v7.4.1...v7.4.2) ### [`v7.4.1`](https://github.com/krisk/Fuse/blob/HEAD/CHANGELOG.md#741-2026-06-02) [Compare Source](https://github.com/krisk/Fuse/compare/v7.4.0...v7.4.1) ### [`v7.4.0`](https://github.com/krisk/Fuse/blob/HEAD/CHANGELOG.md#740-2026-05-30) [Compare Source](https://github.com/krisk/Fuse/compare/v7.3.0...v7.4.0) ### [`v7.3.0`](https://github.com/krisk/Fuse/blob/HEAD/CHANGELOG.md#730-2026-04-04) [Compare Source](https://github.com/krisk/Fuse/compare/v7.2.0...v7.3.0) ##### Features - add BigInt support for indexing and search ([0ae662c](https://github.com/krisk/Fuse/commit/0ae662cb825e1c9db7cdaf8331aab992f293b508)), closes [#814](https://github.com/krisk/Fuse/issues/814) - add static Fuse.match() for single string matching ([460eb5b](https://github.com/krisk/Fuse/commit/460eb5be84b56525710602ec44e2af402ca09686)) - add token search — per-term fuzzy matching with IDF scoring ([68c1dcf](https://github.com/krisk/Fuse/commit/68c1dcf981a60ef46387440dc550fc546254bae9)) - getFn null return, escaped pipe in extended search, empty query returns all ([d33b735](https://github.com/krisk/Fuse/commit/d33b735f62ae2f149808a49ff0c185a04bee28d7)), closes [#800](https://github.com/krisk/Fuse/issues/800) [#765](https://github.com/krisk/Fuse/issues/765) [#728](https://github.com/krisk/Fuse/issues/728) - removeAt() now returns the removed item ([8cec7e2](https://github.com/krisk/Fuse/commit/8cec7e2f99a7063e0aa9a04b8cedf0813e169531)), closes [#675](https://github.com/krisk/Fuse/issues/675) - **search:** support keyless string entries in logical queries ([8695556](https://github.com/krisk/Fuse/commit/86955565a106514212639ecfd3ff45d492f4a0a3)), closes [#736](https://github.com/krisk/Fuse/issues/736) ##### Bug Fixes - **index:** coerce non-string array values to strings during indexing ([db0e181](https://github.com/krisk/Fuse/commit/db0e181e5db988d5fad8bee1e281fa20f8a69376)), closes [#738](https://github.com/krisk/Fuse/issues/738) - **index:** strip getFn from keys in toJSON() for safe serialization ([0f2a69b](https://github.com/krisk/Fuse/commit/0f2a69babf8c76faeb366c471e17430f5f6d8595)), closes [#798](https://github.com/krisk/Fuse/issues/798) - **lint:** suppress unused var in toJSON destructure ([d63c0e8](https://github.com/krisk/Fuse/commit/d63c0e8bd82e4c4d4cec5844a800e64d3b056b29)) - merge overlapping match indices in extended search ([06c5e97](https://github.com/krisk/Fuse/commit/06c5e97c1b79f6e29d482a300eea99a9b6fad82f)) - **search:** handle non-decomposable diacritics in stripDiacritics ([5a01f29](https://github.com/krisk/Fuse/commit/5a01f2994ffe48f7e0e4191f4cdeeabe6a3967a5)), closes [home-assistant/frontend#30399](https://github.com/home-assistant/frontend/issues/30399) [#816](https://github.com/krisk/Fuse/issues/816) - **search:** handle quoted tokens with inner spaces and quotes in extended search ([c226523](https://github.com/krisk/Fuse/commit/c22652342b2d15c12f5dc5870e6b4b0eef1d2247)), closes [#810](https://github.com/krisk/Fuse/issues/810) - **search:** inverse patterns now work correctly across multiple keys ([9351882](https://github.com/krisk/Fuse/commit/935188228ed50dc0a555b41eda47447ada59dd6b)), closes [#712](https://github.com/krisk/Fuse/issues/712) ### [`v7.2.0`](https://github.com/krisk/Fuse/blob/HEAD/CHANGELOG.md#720-2026-04-02) [Compare Source](https://github.com/krisk/Fuse/compare/v7.1.0...v7.2.0) ##### Features - add `Fuse.use()` for runtime plugin registration ([8546a9b](https://github.com/krisk/Fuse/commit/8546a9b0)) ##### Performance - inline Bitap score computation to reduce object allocation in hot loops ([8546a9b](https://github.com/krisk/Fuse/commit/8546a9b0)) - batch `removeAll` for O(n) bulk removes instead of O(n\*k) ([8546a9b](https://github.com/krisk/Fuse/commit/8546a9b0)) - heap-based top-k selection when `limit` is set ([8546a9b](https://github.com/krisk/Fuse/commit/8546a9b0)) - cache compiled searcher for repeated queries ([8546a9b](https://github.com/krisk/Fuse/commit/8546a9b0)) ##### Bug Fixes - **search:** deduplicate and merge overlapping match indices ([60c393a](https://github.com/krisk/Fuse/commit/60c393a45f75e63ebbecd5e4913d539c8d4a3752)), closes [#735](https://github.com/krisk/Fuse/issues/735) - **search:** preserve original array indices in nested path traversal ([a1451be](https://github.com/krisk/Fuse/commit/a1451be8ad46d453799b330f6ad00c58996eb9df)), closes [#786](https://github.com/krisk/Fuse/issues/786) - **types:** correct key type in FuseSortFunctionMatch ([fecee16](https://github.com/krisk/Fuse/commit/fecee16f19dd5d8280260854717a9821256f6702)), closes [#811](https://github.com/krisk/Fuse/issues/811) - **types:** correct keys type in parseIndex parameter ([58c7c73](https://github.com/krisk/Fuse/commit/58c7c73bb8c015c46f583c7cdac377839f5c61ce)), closes [#794](https://github.com/krisk/Fuse/issues/794) </details> <details> <summary>jimp-dev/jimp (jimp)</summary> ### [`v1.6.1`](https://github.com/jimp-dev/jimp/releases/tag/v1.6.1) [Compare Source](https://github.com/jimp-dev/jimp/compare/v1.6.0...v1.6.1) :tada: This release contains work from new contributors! :tada: Thanks for all your work! :heart: Denys Kashkovskyi ([@Kashkovsky](https://github.com/Kashkovsky)) :heart: Viki ([@vikiboss](https://github.com/vikiboss)) ##### 🐛 Bug Fix - fix docs imports ([@hipstersmoothie](https://github.com/hipstersmoothie)) - `@jimp/core`, `@jimp/plugin-quantize`, `@jimp/wasm-avif`, `@jimp/wasm-jpeg`, `@jimp/wasm-png`, `@jimp/wasm-webp` - Update file-type from ^16 to ^21.3.3 in [@jimp/core](https://github.com/jimp/core) [#1400](https://github.com/jimp-dev/jimp/pull/1400) ([@Kashkovsky](https://github.com/Kashkovsky) [@hipstersmoothie](https://github.com/hipstersmoothie)) ##### ⚠️ Pushed to `main` - `@jimp/core` - Doc updates (closes [#1342](https://github.com/jimp-dev/jimp/issues/1342)) ([@hipstersmoothie](https://github.com/hipstersmoothie)) ##### 📝 Documentation - docs: correct GitHub repo link [#1340](https://github.com/jimp-dev/jimp/pull/1340) ([@vikiboss](https://github.com/vikiboss)) ##### Authors: 3 - Andrew Lisowski ([@hipstersmoothie](https://github.com/hipstersmoothie)) - Denys Kashkovskyi ([@Kashkovsky](https://github.com/Kashkovsky)) - Viki ([@vikiboss](https://github.com/vikiboss)) </details> <details> <summary>lucide-icons/lucide (lucide-react)</summary> ### [`v0.577.0`](https://github.com/lucide-icons/lucide/releases/tag/0.577.0): Version 0.577.0 [Compare Source](https://github.com/lucide-icons/lucide/compare/0.576.0...0.577.0) #### What's Changed - chore(deps): bump rollup from 4.53.3 to 4.59.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#4106](https://github.com/lucide-icons/lucide/pull/4106) - fix(repo): correctly ignore docs/releaseMetadata via .gitignore by [@bhavberi](https://github.com/bhavberi) in [#4100](https://github.com/lucide-icons/lucide/pull/4100) - feat(icons): added `ellipse` icon by [@KISHORE-KUMAR-S](https://github.com/KISHORE-KUMAR-S) in [#3749](https://github.com/lucide-icons/lucide/pull/3749) #### New Contributors - [@bhavberi](https://github.com/bhavberi) made their first contribution in [#4100](https://github.com/lucide-icons/lucide/pull/4100) - [@KISHORE-KUMAR-S](https://github.com/KISHORE-KUMAR-S) made their first contribution in [#3749](https://github.com/lucide-icons/lucide/pull/3749) **Full Changelog**: <https://github.com/lucide-icons/lucide/compare/0.576.0...0.577.0> ### [`v0.576.0`](https://github.com/lucide-icons/lucide/releases/tag/0.576.0): Version 0.576.0 [Compare Source](https://github.com/lucide-icons/lucide/compare/0.575.0...0.576.0) #### What's Changed - Added zodiac signs by [@karsa-mistmere](https://github.com/karsa-mistmere) in [#712](https://github.com/lucide-icons/lucide/pull/712) - fix(icons): fixes guideline violations in `package-*` icons. by [@karsa-mistmere](https://github.com/karsa-mistmere) in [#4074](https://github.com/lucide-icons/lucide/pull/4074) - fix(icons): changed `receipt` icon by [@karsa-mistmere](https://github.com/karsa-mistmere) in [#4075](https://github.com/lucide-icons/lucide/pull/4075) - fix(icons): updated `cuboid` icon tags and categories by [@karsa-mistmere](https://github.com/karsa-mistmere) in [#4095](https://github.com/lucide-icons/lucide/pull/4095) - fix(icons): changed `cuboid` icon by [@jamiemlaw](https://github.com/jamiemlaw) in [#4098](https://github.com/lucide-icons/lucide/pull/4098) - fix(lucide-font, lucide-static): Fixing stable code points by [@ericfennis](https://github.com/ericfennis) in [#3894](https://github.com/lucide-icons/lucide/pull/3894) - feat(icons): added `fishing-rod` icon by [@7ender](https://github.com/7ender) in [#3839](https://github.com/lucide-icons/lucide/pull/3839) **Full Changelog**: <https://github.com/lucide-icons/lucide/compare/0.575.0...0.576.0> ### [`v0.575.0`](https://github.com/lucide-icons/lucide/releases/tag/0.575.0): Version 0.575.0 [Compare Source](https://github.com/lucide-icons/lucide/compare/0.574.0...0.575.0) #### What's Changed - feat(icons): added `message-square-check` icon by [@karsa-mistmere](https://github.com/karsa-mistmere) in [#4076](https://github.com/lucide-icons/lucide/pull/4076) - fix(lucide): Fix ESM Module output path in build by [@ericfennis](https://github.com/ericfennis) in [#4084](https://github.com/lucide-icons/lucide/pull/4084) - feat(icons): added `metronome` icon by [@edwloef](https://github.com/edwloef) in [#4063](https://github.com/lucide-icons/lucide/pull/4063) - fix(icons): remove execution permission of SVG files by [@duckafire](https://github.com/duckafire) in [#4053](https://github.com/lucide-icons/lucide/pull/4053) - fix(icons): changed `file-pen-line` icon by [@jguddas](https://github.com/jguddas) in [#3970](https://github.com/lucide-icons/lucide/pull/3970) - feat(icons): added `square-arrow-right-exit` and `square-arrow-right-enter` icons by [@EthanHazel](https://github.com/EthanHazel) in [#3958](https://github.com/lucide-icons/lucide/pull/3958) - fix(icons): renamed `flip-*` to `square-centerline-dashed-*` by [@jguddas](https://github.com/jguddas) in [#3945](https://github.com/lucide-icons/lucide/pull/3945) #### New Contributors - [@edwloef](https://github.com/edwloef) made their first contribution in [#4063](https://github.com/lucide-icons/lucide/pull/4063) - [@duckafire](https://github.com/duckafire) made their first contribution in [#4053](https://github.com/lucide-icons/lucide/pull/4053) **Full Changelog**: <https://github.com/lucide-icons/lucide/compare/0.573.0...0.575.0> ### [`v0.574.0`](https://github.com/lucide-icons/lucide/releases/tag/0.574.0): Version 0.574.0 [Compare Source](https://github.com/lucide-icons/lucide/compare/0.573.0...0.574.0) #### What's Changed - fix(icons): changed `rocking-chair` icon by [@jamiemlaw](https://github.com/jamiemlaw) in [#3445](https://github.com/lucide-icons/lucide/pull/3445) - fix(icons): flipped `coins` icon by [@jguddas](https://github.com/jguddas) in [#3158](https://github.com/lucide-icons/lucide/pull/3158) - feat(icons): added `x-line-top` icon by [@jguddas](https://github.com/jguddas) in [#2838](https://github.com/lucide-icons/lucide/pull/2838) - feat(icons): added `mouse-left` icon by [@marvfash](https://github.com/marvfash) in [#2788](https://github.com/lucide-icons/lucide/pull/2788) - feat(icons): added `mouse-right` icon by [@marvfash](https://github.com/marvfash) in [#2787](https://github.com/lucide-icons/lucide/pull/2787) #### New Contributors - [@marvfash](https://github.com/marvfash) made their first contribution in [#2788](https://github.com/lucide-icons/lucide/pull/2788) **Full Changelog**: <https://github.com/lucide-icons/lucide/compare/0.572.0...0.574.0> ### [`v0.573.0`](https://github.com/lucide-icons/lucide/releases/tag/0.573.0): Version 0.573.0 [Compare Source](https://github.com/lucide-icons/lucide/compare/0.572.0...0.573.0) #### What's Changed - fix(icons): changed `rocking-chair` icon by [@jamiemlaw](https://github.com/jamiemlaw) in [#3445](https://github.com/lucide-icons/lucide/pull/3445) - fix(icons): flipped `coins` icon by [@jguddas](https://github.com/jguddas) in [#3158](https://github.com/lucide-icons/lucide/pull/3158) - feat(icons): added `x-line-top` icon by [@jguddas](https://github.com/jguddas) in [#2838](https://github.com/lucide-icons/lucide/pull/2838) - feat(icons): added `mouse-left` icon by [@marvfash](https://github.com/marvfash) in [#2788](https://github.com/lucide-icons/lucide/pull/2788) - feat(icons): added `mouse-right` icon by [@marvfash](https://github.com/marvfash) in [#2787](https://github.com/lucide-icons/lucide/pull/2787) #### New Contributors - [@marvfash](https://github.com/marvfash) made their first contribution in [#2788](https://github.com/lucide-icons/lucide/pull/2788) **Full Changelog**: <https://github.com/lucide-icons/lucide/compare/0.572.0...0.573.0> ### [`v0.572.0`](https://github.com/lucide-icons/lucide/releases/tag/0.572.0): Version 0.572.0 [Compare Source](https://github.com/lucide-icons/lucide/compare/0.571.0...0.572.0) #### What's Changed - feat(icons): added `message-circle-check` icon by [@Shrinks99](https://github.com/Shrinks99) in [#3770](https://github.com/lucide-icons/lucide/pull/3770) #### New Contributors - [@Shrinks99](https://github.com/Shrinks99) made their first contribution in [#3770](https://github.com/lucide-icons/lucide/pull/3770) **Full Changelog**: <https://github.com/lucide-icons/lucide/compare/0.571.0...0.572.0> ### [`v0.571.0`](https://github.com/lucide-icons/lucide/releases/tag/0.571.0): Version 0.571.0 [Compare Source](https://github.com/lucide-icons/lucide/compare/0.570.0...0.571.0) #### What's Changed - fix(icons): rearange `circle`-icons path and circle order by [@adamlindqvist](https://github.com/adamlindqvist) in [#3746](https://github.com/lucide-icons/lucide/pull/3746) - feat(icons): added `shelving-unit` icon by [@karsa-mistmere](https://github.com/karsa-mistmere) in [#3041](https://github.com/lucide-icons/lucide/pull/3041) #### New Contributors - [@adamlindqvist](https://github.com/adamlindqvist) made their first contribution in [#3746](https://github.com/lucide-icons/lucide/pull/3746) **Full Changelog**: <https://github.com/lucide-icons/lucide/compare/0.570.0...0.571.0> ### [`v0.570.0`](https://github.com/lucide-icons/lucide/releases/tag/0.570.0): Version 0.570.0 [Compare Source](https://github.com/lucide-icons/lucide/compare/0.569.0...0.570.0) #### What's Changed - feat(icons): added `towel-rack` icon by [@jguddas](https://github.com/jguddas) in [#3350](https://github.com/lucide-icons/lucide/pull/3350) **Full Changelog**: <https://github.com/lucide-icons/lucide/compare/0.569.0...0.570.0> ### [`v0.569.0`](https://github.com/lucide-icons/lucide/releases/tag/0.569.0): Version 0.569.0 [Compare Source](https://github.com/lucide-icons/lucide/compare/0.568.0...0.569.0) #### What's Changed - fix(icons): changed `clipboard-pen` icon by [@Spleefies](https://github.com/Spleefies) in [#4006](https://github.com/lucide-icons/lucide/pull/4006) - feat(icons): add `mirror-round` and `mirror-rectangular` by [@Muhammad-Aqib-Bashir](https://github.com/Muhammad-Aqib-Bashir) in [#3832](https://github.com/lucide-icons/lucide/pull/3832) **Full Changelog**: <https://github.com/lucide-icons/lucide/compare/0.568.0...0.569.0> ### [`v0.568.0`](https://github.com/lucide-icons/lucide/releases/tag/0.568.0): Version 0.568.0 [Compare Source](https://github.com/lucide-icons/lucide/compare/0.567.0...0.568.0) #### What's Changed - fix(icons): adjusted `clapperboard` so slash is no longer protruding by [@torfmuer](https://github.com/torfmuer) in [#3764](https://github.com/lucide-icons/lucide/pull/3764) - feat(icons): Add `git-merge-conflict` icon by [@timmy471](https://github.com/timmy471) in [#3008](https://github.com/lucide-icons/lucide/pull/3008) #### New Contributors - [@torfmuer](https://github.com/torfmuer) made their first contribution in [#3764](https://github.com/lucide-icons/lucide/pull/3764) - [@timmy471](https://github.com/timmy471) made their first contribution in [#3008](https://github.com/lucide-icons/lucide/pull/3008) **Full Changelog**: <https://github.com/lucide-icons/lucide/compare/0.567.0...0.568.0> ### [`v0.567.0`](https://github.com/lucide-icons/lucide/releases/tag/0.567.0): Version 0.567.0 [Compare Source](https://github.com/lucide-icons/lucide/compare/0.566.0...0.567.0) #### What's Changed - chore(tags): added tags to `info` by [@jamiemlaw](https://github.com/jamiemlaw) in [#4047](https://github.com/lucide-icons/lucide/pull/4047) - fix(icons): changed `gift` icon by [@jguddas](https://github.com/jguddas) in [#3977](https://github.com/lucide-icons/lucide/pull/3977) - feat(icons): added `line-dot-right-horizontal` icon by [@nathan-de-pachtere](https://github.com/nathan-de-pachtere) in [#3742](https://github.com/lucide-icons/lucide/pull/3742) **Full Changelog**: <https://github.com/lucide-icons/lucide/compare/0.566.0...0.567.0> ### [`v0.566.0`](https://github.com/lucide-icons/lucide/releases/tag/0.566.0): Version 0.566.0 [Compare Source](https://github.com/lucide-icons/lucide/compare/0.565.0...0.566.0) #### What's Changed - fix(icons): changed `forklift` icon by [@jguddas](https://github.com/jguddas) in [#4069](https://github.com/lucide-icons/lucide/pull/4069) - fix(icons): changed `rocket` icon by [@jguddas](https://github.com/jguddas) in [#4067](https://github.com/lucide-icons/lucide/pull/4067) - feat(icons): added `globe-off` icon by [@TimNekk](https://github.com/TimNekk) in [#4051](https://github.com/lucide-icons/lucide/pull/4051) #### New Contributors - [@TimNekk](https://github.com/TimNekk) made their first contribution in [#4051](https://github.com/lucide-icons/lucide/pull/4051) **Full Changelog**: <https://github.com/lucide-icons/lucide/compare/0.565.0...0.566.0> ### [`v0.565.0`](https://github.com/lucide-icons/lucide/releases/tag/0.565.0): Version 0.565.0 [Compare Source](https://github.com/lucide-icons/lucide/compare/0.564.0...0.565.0) #### What's Changed - feat(icons): add `lens-concave` and `lens-convex` by [@Muhammad-Aqib-Bashir](https://github.com/Muhammad-Aqib-Bashir) in [#3831](https://github.com/lucide-icons/lucide/pull/3831) **Full Changelog**: <https://github.com/lucide-icons/lucide/compare/0.564.0...0.565.0> ### [`v0.564.0`](https://github.com/lucide-icons/lucide/releases/tag/0.564.0): Version 0.564.0 [Compare Source](https://github.com/lucide-icons/lucide/compare/0.563.0...0.564.0) #### What's Changed - chore(docs): Improve SEO icon detail pages by [@ericfennis](https://github.com/ericfennis) in [#4040](https://github.com/lucide-icons/lucide/pull/4040) - feat(icons): added `database-search` icon by [@Spleefies](https://github.com/Spleefies) in [#4003](https://github.com/lucide-icons/lucide/pull/4003) - fix(icons): changed `user-lock` icon by [@jguddas](https://github.com/jguddas) in [#3971](https://github.com/lucide-icons/lucide/pull/3971) - fix(icons): changed `bug-off` icon by [@jguddas](https://github.com/jguddas) in [#3972](https://github.com/lucide-icons/lucide/pull/3972) - fix(icons): changed `bell-dot` icon by [@jguddas](https://github.com/jguddas) in [#3973](https://github.com/lucide-icons/lucide/pull/3973) - fix(icons): changed `bandage` icon by [@jguddas](https://github.com/jguddas) in [#3967](https://github.com/lucide-icons/lucide/pull/3967) - fix(icons): changed `hard-drive` icon by [@jguddas](https://github.com/jguddas) in [#3622](https://github.com/lucide-icons/lucide/pull/3622) - fix(icons): changed `git-branch` icon by [@jguddas](https://github.com/jguddas) in [#3938](https://github.com/lucide-icons/lucide/pull/3938) - fix(icons): changed `file-cog` icon by [@jguddas](https://github.com/jguddas) in [#3965](https://github.com/lucide-icons/lucide/pull/3965) - fix(icons): changed `cloud-alert` and `cloud-check` icon by [@jguddas](https://github.com/jguddas) in [#3976](https://github.com/lucide-icons/lucide/pull/3976) - feat(icons): adds `user-key` and `user-round-key`, updates other `-key` icons to match by [@karsa-mistmere](https://github.com/karsa-mistmere) in [#4044](https://github.com/lucide-icons/lucide/pull/4044) #### New Contributors - [@Spleefies](https://github.com/Spleefies) made their first contribution in [#4003](https://github.com/lucide-icons/lucide/pull/4003) **Full Changelog**: <https://github.com/lucide-icons/lucide/compare/0.563.1...0.564.0> </details> <details> <summary>motiondivision/motion (motion)</summary> ### [`v12.42.2`](https://github.com/motiondivision/motion/blob/HEAD/CHANGELOG.md#12422-2026-07-01) [Compare Source](https://github.com/motiondivision/motion/compare/v12.42.1...v12.42.2) ##### Fixed - `animateView`: Cropped group layers now animate `border-radius` from the old to new radius. ### [`v12.42.1`](https://github.com/motiondivision/motion/blob/HEAD/CHANGELOG.md#12421-2026-06-30) [Compare Source](https://github.com/motiondivision/motion/compare/v12.42.0...v12.42.1) ##### Fixed - `animateView`: Old layer fade out now cancelled when defining `.new()`. ### [`v12.42.0`](https://github.com/motiondivision/motion/blob/HEAD/CHANGELOG.md#12420-2026-06-24) [Compare Source](https://github.com/motiondivision/motion/compare/v12.41.0...v12.42.0) ##### Changed - `animateView`: Layers are automatically grouped to match their DOM-hierarchy. New `.group(false)` method opts-out. ##### Fixed - `animateView`: Auto-crop is now aspect-ratio aware, disabling crops for matching aspect-ratios. - `animateView`: Disabled automatic `border-radius` animation. ### [`v12.41.0`](https://github.com/motiondivision/motion/blob/HEAD/CHANGELOG.md#12410-2026-06-23) [Compare Source](https://github.com/motiondivision/motion/compare/v12.40.0...v12.41.0) ##### Added - `animateView`: Moves from Motion+ Early Access and alpha to main library. - `animateView`: `.add()` resolves a CSS selector or `Element` to automatically generate, apply and remove `view-transition-name`. - `animateView`: `.new()` and `.old()` configures values to animate on new and old layers. - `animateView`: `.layout()` can set a custom transition on the size/position animation of the currently selected elements. - `animateView`: Group layers now automatically crop with children set to `cover`, with `border-radius` animating from old radius to new. `.crop(false)` disables this behaviour. - `animateView`: `.class(name)` tags currently selected elements with a `view-transition-class` as a custom CSS hook. ##### Fixed - `AnimatePresence`: Prevent stuck exit animations when children interrupt. - `drag`: Child `e.stopPropagation()` no longer break drag end. - Fixing Next.js OOM on Windows when importing via `motion` package. - `animateLayout`: Improve handling of parallel/interleaved calls. ##### Changed - `animateView`: `.enter()` and `.exit()` now refer specifically to `new` and `old` layers where there are no matching `old` or `new` layers. - `animateView`: Interrupted transition setups now return resolved animation rather than throwing. ### [`v12.40.0`](https://github.com/motiondivision/motion/blob/HEAD/CHANGELOG.md#12400-2026-05-21) [Compare Source](https://github.com/motiondivision/motion/compare/v12.39.0...v12.40.0) ##### Added - `path` option to `transition`. - `arc()` for motion along an arc. ### [`v12.39.0`](https://github.com/motiondivision/motion/blob/HEAD/CHANGELOG.md#12390-2026-05-18) [Compare Source](https://github.com/motiondivision/motion/compare/v12.38.0...v12.39.0) ##### Added - Support for `repeatType` and `repeatDelay` in animation sequences. ##### Fixed - Variants: Re-run keyframe animations when switching between variant labels even when they share identical keyframe arrays. - Drag: Preserve in-flight motion value animations across React 19 reorder unmount/remount so `dragSnapToOrigin` no longer leaves the drag transform stranded after a layout swap. - `LazyMotion`: Share React contexts between the `framer-motion` and `framer-motion/m` (and therefore `motion/react` and `motion/react-m`) CJS bundles so that `<m.div>` from the `/m` subpath picks up features loaded by `<LazyMotion>` from the main entry point. - `useScroll`: Support hydrating `target` and `container` refs from anywhere in the tree. - Drag: Gesture no longer starts from incorrect start point when rendered inside `<AnimatePresence initial={false} />`. - Drag: `dragConstraints`, when set as viewport-relative ref, no longer break on scroll.§ - Updated `visualElement` hydration order. - `useAnimate`: Now respects `skipAnimations`. - `AnimatePresence`: Fix object-form `initial` values not applied on re-entry after exit completes. - `scroll`: Fixed callback progress when tracking an element. - `useScroll`: Fix hardware acceleration when tracking an element. </details> <details> <summary>mapbox/pixelmatch (pixelmatch)</summary> ### [`v7.2.0`](https://github.com/mapbox/pixelmatch/releases/tag/v7.2.0) [Compare Source](https://github.com/mapbox/pixelmatch/compare/v7.1.1...v7.2.0) Add a `checkerboard` option that controls whether to blend semi-transparent pixels against a checkerboard pattern (true, default) or plain white (false, pre-v7 behavior) when comparing images. ### [`v7.1.1`](https://github.com/mapbox/pixelmatch/releases/tag/v7.1.1) [Compare Source](https://github.com/mapbox/pixelmatch/compare/v7.1.0...v7.1.1) - Improve performance by \~8%. [#165](https://github.com/mapbox/pixelmatch/issues/165) - Clearer errors on image size mismatch. [#161](https://github.com/mapbox/pixelmatch/issues/161) (by [@VendorMap](https://github.com/VendorMap)) - Skip antialiasing checks when `includeAA` is true. [#160](https://github.com/mapbox/pixelmatch/issues/160) (by [@mongoose700](https://github.com/mongoose700)) </details> <details> <summary>PostHog/posthog-js (posthog-js)</summary> ### [`v1.407.0`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.407.0) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.406.2...posthog-js@1.407.0) #### 1.407.0 ##### Minor Changes - [#4222](https://github.com/PostHog/posthog-js/pull/4222) [`0f2407b`](https://github.com/PostHog/posthog-js/commit/0f2407bbd98cab7d38a23f0466bbdccf3e0bdbf3) Thanks [@turnipdabeets](https://github.com/turnipdabeets)! - feat: add a default-value option to `isFeatureEnabled` `isFeatureEnabled(key, { defaultValue: false })` now returns the given default when the flag has no value — flags not loaded yet, or no flag with that key — and the return type narrows to `boolean`. The option name is the same in posthog-js, posthog-js-lite, and posthog-react-native. Without `defaultValue`, behavior is unchanged: `boolean | undefined`. (2026-07-22) ##### Patch Changes - [#4203](https://github.com/PostHog/posthog-js/pull/4203) [`90e7483`](https://github.com/PostHog/posthog-js/commit/90e7483435757b6e650210e7d9d2f2ed2acb92e7) Thanks [@posthog](https://github.com/apps/posthog)! - fix(conversations): let users start a new conversation while a ticket is still open The support widget now surfaces the ticket list navigation (and its "New conversation" button) whenever the user has any ticket, instead of only when they have multiple tickets or a single resolved one. Previously a user sitting on one open, unresolved ticket was locked into that conversation with no way to raise a second issue. (2026-07-22) - [#4221](https://github.com/PostHog/posthog-js/pull/4221) [`da6e082`](https://github.com/PostHog/posthog-js/commit/da6e082daeb6f03d3982a101d74ac4efae990f8a) Thanks [@posthog](https://github.com/apps/posthog)! - fix(exception-autocapture): don't throw when the page's onerror handler is non-callable The wrapped `window.onerror`, `window.onunhandledrejection`, and `console.error` handlers chained to the page's original handler using optional chaining, which only guards against `null`/`undefined`. When a page had one of these set to a truthy non-callable value (e.g. via `Object.defineProperty`, or clobbered by another script/extension), our wrapper threw a `TypeError` from inside its own handler. We now check the original handler is actually callable before invoking it and fall back to `false` otherwise. (2026-07-22) - [#4209](https://github.com/PostHog/posthog-js/pull/4209) [`569fc62`](https://github.com/PostHog/posthog-js/commit/569fc62f418b3c5b7daed27e8fed38b208e9061c) Thanks [@posthog](https://github.com/apps/posthog)! - Session recording no longer emits an uncaught `TypeError: Illegal invocation` from the input observer's *synchronous* native-setter call. The previous fix only guarded the deferred hooked setter; the synchronous `original.set.call(this, value)` still ran with a non-native `this` (a proxy, custom element, or cross-realm object) and threw inside the host page's own assignment. The recorder now probes the native getter — which fails the same internal-slot brand check as the setter — before forwarding: a non-native `this` is skipped, so the recorder no longer re-throws from its own frame, while genuine elements (including file inputs that legitimately throw on a programmatic value) keep their native behavior. The input event handler and `getInputType` are similarly guarded against reading native accessors on a non-native `this`. (2026-07-22) - [#4068](https://github.com/PostHog/posthog-js/pull/4068) [`d5e1188`](https://github.com/PostHog/posthog-js/commit/d5e1188c380832bae0980d82ac6a35069908b7df) Thanks [@posthog](https://github.com/apps/posthog)! - Fix event-triggered surveys re-displaying in a fresh session without their trigger firing. A non-repeatable event/action-triggered survey that was shown but never dismissed or answered had its activation persisted indefinitely, so it kept being treated as "triggered" on later page loads. The persisted activation is now scoped to the triggering session: it still survives a reload within that session, but a brand-new session drops it until the trigger fires again. Repeatable surveys are unaffected. (2026-07-22) - [#4205](https://github.com/PostHog/posthog-js/pull/4205) [`de3ad61`](https://github.com/PostHog/posthog-js/commit/de3ad612aebbd9bad6b6f63bbe5bc8c1a3ea076c) Thanks [@posthog](https://github.com/apps/posthog)! - Warn when session recording masking options in `posthog.init` shadow the project-level "Privacy and masking" setting. Client-side masking still intentionally takes precedence, but previously the override was silent — a developer could set masking in the dashboard and see it quietly ignored because their SDK config diverged. The recorder now logs a console warning (in debug mode) naming the diverging fields so the precedence is self-explaining. (2026-07-22) - Updated dependencies \[[`0f2407b`](https://github.com/PostHog/posthog-js/commit/0f2407bbd98cab7d38a23f0466bbdccf3e0bdbf3)]: - [@posthog/core](https://github.com/posthog/core)@1.45.0 - [@posthog/types](https://github.com/posthog/types)@1.398.0 ### [`v1.406.2`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.406.2) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.406.1...posthog-js@1.406.2) #### 1.406.2 ##### Patch Changes - [#4206](https://github.com/PostHog/posthog-js/pull/4206) [`a3112d9`](https://github.com/PostHog/posthog-js/commit/a3112d9f3328e0dee30505b6f2c242f2b5baa9ec) Thanks [@posthog](https://github.com/apps/posthog)! - fix(surveys): stop recurring surveys re-showing off a stale internal targeting flag Recurring surveys could re-display and record a duplicate response when the eligibility check ran against a cached internal targeting flag before fresh flags had loaded. The display loop now waits for feature flags to actually load before trusting the internal targeting flag, and forces a flag reload after a survey is completed so the flag recomputes promptly. (2026-07-21) ### [`v1.406.1`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.406.1) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.406.0...posthog-js@1.406.1) #### 1.406.1 ##### Patch Changes - [#4127](https://github.com/PostHog/posthog-js/pull/4127) [`220fa2c`](https://github.com/PostHog/posthog-js/commit/220fa2ce1c5cbb65d9f52dad05e3c8070f616e4a) Thanks [@sarmah-rup](https://github.com/sarmah-rup)! - Don't let save\_referrer overwrite a $referrer / $referring\_domain that was explicitly set via posthog.register(), so registered attribution values survive pageviews in SPA and iframe contexts (2026-07-21) ### [`v1.406.0`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.406.0) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.405.3...posthog-js@1.406.0) #### 1.406.0 ##### Minor Changes - [#4194](https://github.com/PostHog/posthog-js/pull/4194) [`d39b903`](https://github.com/PostHog/posthog-js/commit/d39b903f8f77e32f729703156fa5a9430d778104) Thanks [@dustinbyrne](https://github.com/dustinbyrne)! - Move shared browser utility implementations into `@posthog/browser-common` and consume them directly from `posthog-js`. (2026-07-21) ##### Patch Changes - [#4204](https://github.com/PostHog/posthog-js/pull/4204) [`ba977d0`](https://github.com/PostHog/posthog-js/commit/ba977d0b36ec4fbf0b514008ba0643dcfcca26bf) Thanks [@turnipdabeets](https://github.com/turnipdabeets)! - Keep autocapture off when a remote config response omits `autocapture_opt_out`. The SDK now retains the last known server value for the missing-field case, the same as when the config fetch fails, instead of enabling autocapture. Values persisted by earlier SDK versions are still trusted; a browser holding a stale value corrects itself on the first config response that includes the field. (2026-07-21) - Updated dependencies \[[`d39b903`](https://github.com/PostHog/posthog-js/commit/d39b903f8f77e32f729703156fa5a9430d778104)]: - [@posthog/browser-common](https://github.com/posthog/browser-common)@0.2.0 ### [`v1.405.3`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.405.3) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.405.2...posthog-js@1.405.3) #### 1.405.3 ##### Patch Changes - [#4200](https://github.com/PostHog/posthog-js/pull/4200) [`91505ba`](https://github.com/PostHog/posthog-js/commit/91505baaeb22c8fb90568c7c53087a490e92ef49) Thanks [@pauldambra](https://github.com/pauldambra)! - fix: apply the active full snapshot interval as soon as a recording trigger matches (2026-07-21) ### [`v1.405.2`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.405.2) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.405.1...posthog-js@1.405.2) #### 1.405.2 ##### Patch Changes - [#4198](https://github.com/PostHog/posthog-js/pull/4198) [`fbfc84f`](https://github.com/PostHog/posthog-js/commit/fbfc84f56dda3cc4332cb8cecffe3da6ddfd5b32) Thanks [@pauldambra](https://github.com/pauldambra)! - feat: make the pending session recording trigger buffer interval configurable (2026-07-20) - Updated dependencies \[[`fbfc84f`](https://github.com/PostHog/posthog-js/commit/fbfc84f56dda3cc4332cb8cecffe3da6ddfd5b32)]: - [@posthog/types](https://github.com/posthog/types)@1.397.1 ### [`v1.405.1`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.405.1) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.405.0...posthog-js@1.405.1) #### 1.405.1 ##### Patch Changes - [#4193](https://github.com/PostHog/posthog-js/pull/4193) [`dec8fe7`](https://github.com/PostHog/posthog-js/commit/dec8fe7ec1a64da0caa7a49f92b255e1701a2ec7) Thanks [@turnipdabeets](https://github.com/turnipdabeets)! - Internal restructuring of remote config failure handling across SDK extensions; no behavior change. (2026-07-20) ### [`v1.405.0`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.405.0) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.404.1...posthog-js@1.405.0) #### 1.405.0 ##### Minor Changes - [#4172](https://github.com/PostHog/posthog-js/pull/4172) [`9621830`](https://github.com/PostHog/posthog-js/commit/9621830c359a9955ffec0db61164e5fc450e5443) Thanks [@haacked](https://github.com/haacked)! - send minimal `$feature_flag_called` events when the server enables it When the v2 `/flags` response carries `minimalFlagCalledEvents: true` (or, for posthog-node local evaluation, the flag-definitions payload carries `minimal_flag_called_events: true`) and the evaluated flag is not linked to an experiment (`$feature_flag_has_experiment === false`), `$feature_flag_called` events are rebuilt from a strict allowlist of flag-evaluation, processing-control, and SDK-identity properties. Super properties, `$set`/`$set_once`, the `$feature/<key>` enumeration, `$active_feature_flags`, and the context envelope are stripped. Any missing signal (no gate on the response, bootstrapped or locally injected flags, `has_experiment` unknown) falls back to the full event, and experiment-linked flags always send the full envelope. The gate is stored alongside the cached flags (posthog-js persistence, posthog-node poller state) and is server-controlled, with no SDK-side configuration. `before_send` runs after the filter and may re-add stripped properties. (2026-07-20) ##### Patch Changes - Updated dependencies \[[`9621830`](https://github.com/PostHog/posthog-js/commit/9621830c359a9955ffec0db61164e5fc450e5443)]: - [@posthog/core](https://github.com/posthog/core)@1.44.0 ### [`v1.404.1`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.404.1) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.404.0...posthog-js@1.404.1) #### 1.404.1 ##### Patch Changes - [#4191](https://github.com/PostHog/posthog-js/pull/4191) [`66c1666`](https://github.com/PostHog/posthog-js/commit/66c1666465c5aa36bedca81b31f025c83f229569) Thanks [@turnipdabeets](https://github.com/turnipdabeets)! - Honour the project-level autocapture opt-out when the remote config request fails. Previously a failed config fetch (network error, timeout, blocked request) enabled autocapture on opted-out projects and persisted that state for later page loads. Autocapture now keeps the last successfully received server value, and stays off until the first successful config response. (2026-07-17) ### [`v1.404.0`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.404.0) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.403.0...posthog-js@1.404.0) #### 1.404.0 ##### Minor Changes - [#4149](https://github.com/PostHog/posthog-js/pull/4149) [`607bf54`](https://github.com/PostHog/posthog-js/commit/607bf543b63dd8f9c9a2ad891048194601a942e8) Thanks [@pauldambra](https://github.com/pauldambra)! - Add dead swipe detection to dead clicks autocapture. When dead clicks autocapture is enabled, touch swipe gestures that produce no observable screen change (no scroll, mutation, selection or visibility change) are now captured as `$dead_swipe` events, surfacing failed navigations on touch devices. Configurable via `capture_dead_swipes` (default `true`) and `swipe_threshold_px` (default `30`) on the `capture_dead_clicks` config. Swipes over surfaces whose response cannot be observed (canvas, video and other media elements under the finger) are skipped, and captures are limited per page load via `max_dead_swipes_per_page_load` (default `10`). (2026-07-16) ##### Patch Changes - [#4171](https://github.com/PostHog/posthog-js/pull/4171) [`df17ddc`](https://github.com/PostHog/posthog-js/commit/df17ddc02108114dece09801ad67007274490a9e) Thanks [@posthog](https://github.com/apps/posthog)! - Catch synchronous throws from a monkey-patched `window.fetch` so they no longer escape as unhandled exceptions. A synchronous throw is now routed through the same handling as an async rejection, so the request queue retries instead of the error leaking into error tracking. (2026-07-16) - Updated dependencies \[[`607bf54`](https://github.com/PostHog/posthog-js/commit/607bf543b63dd8f9c9a2ad891048194601a942e8)]: - [@posthog/types](https://github.com/posthog/types)@1.397.0 ### [`v1.403.0`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.403.0) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.402.3...posthog-js@1.403.0) #### 1.403.0 ##### Minor Changes - [#4159](https://github.com/PostHog/posthog-js/pull/4159) [`fad6d9a`](https://github.com/PostHog/posthog-js/commit/fad6d9adae4163cd63859766916cdcbae629a110) Thanks [@haacked](https://github.com/haacked)! - add `$feature_flag_has_experiment` to `$feature_flag_called` events `$feature_flag_called` events now carry a `$feature_flag_has_experiment` boolean sourced from the server's `has_experiment` flag metadata (the `/flags?v=2` response for remote evaluation, the `/api/feature_flag/local_evaluation` definitions for posthog-node local evaluation). The property is only sent when the server explicitly reports `has_experiment`; it is omitted entirely when the value is unknown (older servers, missing metadata, bootstrapped or locally injected flags). (2026-07-16) ##### Patch Changes - Updated dependencies \[[`fad6d9a`](https://github.com/PostHog/posthog-js/commit/fad6d9adae4163cd63859766916cdcbae629a110)]: - [@posthog/core](https://github.com/posthog/core)@1.43.0 - [@posthog/types](https://github.com/posthog/types)@1.396.0 ### [`v1.402.3`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.402.3) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.402.2...posthog-js@1.402.3) #### 1.402.3 ##### Patch Changes - [#4157](https://github.com/PostHog/posthog-js/pull/4157) [`4a2ecf5`](https://github.com/PostHog/posthog-js/commit/4a2ecf5ccdc3ed2567a5d59dcdcf88c6541d9b1b) Thanks [@posthog](https://github.com/apps/posthog)! - Session recording no longer emits an uncaught `NotAllowedError` ("Sharing constructed stylesheets in multiple documents is not allowed") when a page assigns a `CSSStyleSheet` constructed in a different document to `adoptedStyleSheets`. That assignment is the host page's own invalid operation, but the recorder's patched setter sat on the call stack, so the exception was attributed to rrweb and churned fingerprints in error tracking. The recorder now contains this specific rejection (matched by its standardized `NotAllowedError` name, so it works even when the setter throws from an iframe realm) and skips recording those sheets, while still re-throwing any other native-setter error so host-page behaviour is preserved. (2026-07-15) - [#4158](https://github.com/PostHog/posthog-js/pull/4158) [`0dc389e`](https://github.com/PostHog/posthog-js/commit/0dc389e656ab07056ae5ea77e22c74518a4271d3) Thanks [@posthog](https://github.com/apps/posthog)! - fix(replay): session recording no longer throws `TypeError: Converting circular structure to JSON` when replay event data contains a circular reference. The circular-reference guard now also detects cycles that pass through an array, and affected events are captured with `[Circular]` markers instead of surfacing an unhandled error and being dropped. (2026-07-15) - Updated dependencies \[[`fc2cb2e`](https://github.com/PostHog/posthog-js/commit/fc2cb2e6e7accf23ed1f075f6da996f6ba575276)]: - [@posthog/core](https://github.com/posthog/core)@1.42.1 ### [`v1.402.2`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.402.2) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.402.1...posthog-js@1.402.2) #### 1.402.2 ##### Patch Changes - [#4151](https://github.com/PostHog/posthog-js/pull/4151) [`81adbfd`](https://github.com/PostHog/posthog-js/commit/81adbfde4cb7932435804cc55c8e9d975b94f3f5) Thanks [@posthog](https://github.com/apps/posthog)! - Session recording no longer emits an uncaught `TypeError: Illegal invocation` when a programmatic input-value change happens on an object that is not a genuine native input element (for example a proxy on the element prototype chain). The recorder drops that one replay update instead of throwing. (2026-07-15) ### [`v1.402.1`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.402.1) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.402.0...posthog-js@1.402.1) #### 1.402.1 ##### Patch Changes - [#4117](https://github.com/PostHog/posthog-js/pull/4117) [`1eddff7`](https://github.com/PostHog/posthog-js/commit/1eddff74e63ff539eb3144f075b14ab5ffec84cc) Thanks [@DanielVisca](https://github.com/DanielVisca)! - add the posthog.metrics API (count, gauge, histogram) to posthog-node — alpha Backend services can now record metrics through the same statsd-style pre-aggregating client the browser SDK ships, with no OpenTelemetry setup: ```ts const client = new PostHog('phc_...', { metrics: { serviceName: 'billing-worker' } }) client.metrics.count('invoices.processed', 1, { attributes: { plan: 'pro' } }) client.metrics.gauge('queue.depth', 42) client.metrics.histogram('job.duration', 187, { unit: 'ms' }) ``` Samples aggregate in memory and flush as OTLP/JSON to `/i/v1/metrics` (one data point per series per window). Pending metrics are flushed on `shutdown()`. Core gains `_sendMetricsBatch` on `PostHogCoreStateless` (same outcome contract as `_sendLogsBatch`) and a shared `resolveMetricsConfig`, so any core-based SDK can host `PostHogMetrics`. (2026-07-15) - Updated dependencies \[[`1eddff7`](https://github.com/PostHog/posthog-js/commit/1eddff74e63ff539eb3144f075b14ab5ffec84cc)]: - [@posthog/core](https://github.com/posthog/core)@1.42.0 ### [`v1.402.0`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.402.0) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.401.0...posthog-js@1.402.0) #### 1.402.0 ##### Minor Changes - [#4143](https://github.com/PostHog/posthog-js/pull/4143) [`0e8ad14`](https://github.com/PostHog/posthog-js/commit/0e8ad14fdadd7984da985df4936c9a3b128bb772) Thanks [@robbie-c](https://github.com/robbie-c)! - Stamp the current hostname as `$snapshot_host` on every `$snapshot` event the session recorder sends. The value is derived from the page URL after it passes through the existing replay URL masking pipeline (`maskCapturedNetworkRequestFn` / deprecated `maskNetworkRequestFn`, hash stripping, personal-data query-param masking), so it cannot bypass a customer's masking config. When masking removes the URL or the masked result doesn't parse as a URL, the property is omitted entirely. This gives ingestion consumers a per-message host signal even for mid-session snapshot batches that contain no URL-bearing events. (2026-07-15) ### [`v1.401.0`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.401.0) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.400.1...posthog-js@1.401.0) #### 1.401.0 ##### Minor Changes - [#4129](https://github.com/PostHog/posthog-js/pull/4129) [`800af7c`](https://github.com/PostHog/posthog-js/commit/800af7cae4e2cf103d0089918e778a97dccee35f) Thanks [@pauldambra](https://github.com/pauldambra)! - feat: add `session_recording.attributeFilter` option that passes an attribute allowlist through to the native MutationObserver, so mutations to unlisted attributes (e.g. animation-driven inline `style` churn) never cost recording CPU (port of upstream rrweb [#1873](https://github.com/PostHog/posthog-js/issues/1873)) (2026-07-15) ##### Patch Changes - Updated dependencies \[[`800af7c`](https://github.com/PostHog/posthog-js/commit/800af7cae4e2cf103d0089918e778a97dccee35f)]: - [@posthog/types](https://github.com/posthog/types)@1.395.0 ### [`v1.400.1`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.400.1) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.400.0...posthog-js@1.400.1) #### 1.400.1 ##### Patch Changes - [#4090](https://github.com/PostHog/posthog-js/pull/4090) [`6dd8827`](https://github.com/PostHog/posthog-js/commit/6dd88274193e07a5f9f4bcb816dfca49cfe072d7) Thanks [@lucasheriques](https://github.com/lucasheriques)! - chore: survey seen-key and repeat-activation helpers now live in [@posthog/core](https://github.com/posthog/core), shared by the web and React Native SDKs. Core's survey enums are now const-object literal unions (matching the web SDK's existing pattern), so the same values type-check across both SDKs. No behavior change. Type-level note: enum members no longer work as standalone type annotations (e.g. `SurveyType.Popover` as a type); use the exported union types instead. Runtime values are unchanged. (2026-07-14) - Updated dependencies \[[`6dd8827`](https://github.com/PostHog/posthog-js/commit/6dd88274193e07a5f9f4bcb816dfca49cfe072d7)]: - [@posthog/core](https://github.com/posthog/core)@1.41.1 ### [`v1.400.0`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.400.0) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.399.5...posthog-js@1.400.0) #### 1.400.0 ##### Minor Changes - [#4101](https://github.com/PostHog/posthog-js/pull/4101) [`dc2aa5b`](https://github.com/PostHog/posthog-js/commit/dc2aa5b3175dd4112347c16d16725045d63387f9) Thanks [@posthog](https://github.com/apps/posthog)! - Normalize the error tracking rate-limiter config to first-class options. The browser SDK now reads `exceptionRateLimiterRefillRate` / `exceptionRateLimiterBucketSize` on `error_tracking`, with the previous double-underscore `__exceptionRateLimiterRefillRate` / `__exceptionRateLimiterBucketSize` options deprecated but still honoured as a fallback. The option shape (`ExceptionRateLimiterConfig`) and default-resolution logic (`resolveExceptionRateLimiterConfig`) now live in `@posthog/core` and are shared between the browser and Node SDKs. (2026-07-14) ##### Patch Changes - [#4140](https://github.com/PostHog/posthog-js/pull/4140) [`1eabd30`](https://github.com/PostHog/posthog-js/commit/1eabd30ea17977a300405c3889c18ff4c3544485) Thanks [@turnipdabeets](https://github.com/turnipdabeets)! - Handle `sendBeacon` quota rejections instead of silently dropping events. A beacon rejected by the browser (over the page's shared \~64KiB in-flight keepalive quota) is now split in half and re-sent recursively so the batch delivers as far as the quota allows; a rejected payload that cannot be split falls back to a non-keepalive fetch and logs a warning. Previously the boolean return of `sendBeacon` was ignored and an over-quota unload batch was lost with no signal. (2026-07-14) - Updated dependencies \[[`dc2aa5b`](https://github.com/PostHog/posthog-js/commit/dc2aa5b3175dd4112347c16d16725045d63387f9)]: - [@posthog/core](https://github.com/posthog/core)@1.41.0 - [@posthog/types](https://github.com/posthog/types)@1.394.0 ### [`v1.399.5`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.399.5) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.399.4...posthog-js@1.399.5) #### 1.399.5 ##### Patch Changes - [#4134](https://github.com/PostHog/posthog-js/pull/4134) [`ab10064`](https://github.com/PostHog/posthog-js/commit/ab100642da425590b9dcb78a9e8573eeeb29f52a) Thanks [@posthog](https://github.com/apps/posthog)! - Bound autocapture's DOM ancestor walks against abnormal host-page DOM trees. `autocapturePropertiesForElement` and `shouldCaptureElement` now stop climbing the `parentNode` chain after 1000 ancestors or if they revisit a node (only possible when a page patches `parentNode`, since native DOMs cannot contain cycles), instead of walking indefinitely. When `shouldCaptureElement` cannot finish checking ancestors for `ph-no-capture`/`ph-sensitive`, it fails closed and reports the element as not capturable. Behavior on normal DOM trees is unchanged. (2026-07-14) - [#4141](https://github.com/PostHog/posthog-js/pull/4141) [`17d956c`](https://github.com/PostHog/posthog-js/commit/17d956c6639e83396aa19a5974d7550b46928c68) Thanks [@posthog](https://github.com/apps/posthog)! - Log network-level fetch failures from posthog-js's own request layer (ad blocker, dropped connection, CORS, page teardown) at `warn` instead of `error`. The browser rejects these with a generic `TypeError` (`Failed to fetch`, Firefox's `NetworkError...`, or Safari's `Load failed`); they are already caught and retried by the request queue, so they are expected noise rather than SDK errors — `_fetch` now gives them the same `warn` treatment as our own timeout aborts. Genuine, unexpected errors still log at `error`. (2026-07-14) ### [`v1.399.4`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.399.4) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.399.3...posthog-js@1.399.4) #### 1.399.4 ##### Patch Changes - [#4139](https://github.com/PostHog/posthog-js/pull/4139) [`7c339be`](https://github.com/PostHog/posthog-js/commit/7c339bed0655c3e00b1860ba2da9f41c4f9013e1) Thanks [@turnipdabeets](https://github.com/turnipdabeets)! - Encode uncompressed `sendBeacon` bodies as base64 form data so the beacon keeps a CORS-simple content type. Previously an uncompressed unload beacon was sent as `application/json`, which forces a CORS preflight — a preflight cannot complete while the page unloads, so on cross-origin hosts the browser silently dropped the POST and the final batch of events was lost. Compression is inactive whenever the remote config request fails (flaky network, blocked endpoint), when the config response omits `supportedCompression`, or with `disable_compression: true`. (2026-07-13) ### [`v1.399.3`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.399.3) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.399.2...posthog-js@1.399.3) #### 1.399.3 ##### Patch Changes - [#4133](https://github.com/PostHog/posthog-js/pull/4133) [`4ebb618`](https://github.com/PostHog/posthog-js/commit/4ebb61837adaed8960abbe3f8e0e28781e6bf905) Thanks [@mikenicholls88](https://github.com/mikenicholls88)! - Make `jsonStringify` circular-safe so event serialization never throws. Previously a captured property holding a circular value — most commonly a DOM node that retains a React fiber pointing back at the element — made `JSON.stringify` throw `Converting circular structure to JSON`; with `capture_exceptions` enabled that throw was recaptured as a new `$exception`, at times in a loop. On a throw we now fall back to `safeJsonStringify` from `@posthog/core`. The fast (non-circular) path is unchanged, and only true cycles become `"[Circular]"`, so shared-but-acyclic references keep their real values. (2026-07-13) ### [`v1.399.2`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.399.2) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.399.1...posthog-js@1.399.2) #### 1.399.2 ##### Patch Changes - [#4118](https://github.com/PostHog/posthog-js/pull/4118) [`f630394`](https://github.com/PostHog/posthog-js/commit/f6303946729b2882e495a06d75b8458433a74646) Thanks [@posthog](https://github.com/apps/posthog)! - Fix a `RangeError: Maximum call stack size exceeded` originating from the shared rrweb `patch()` helper. It patches shared globals such as `Element.prototype.attachShadow` (shadow-dom-manager) and the DOM/canvas observers, so multiple recorder instances or repeated start/stop cycles wrap the same global more than once. Previously an out-of-order restore silently no-op'd, leaving the wrapper in the call path; repeated cycles grew the wrapper chain without bound until a real call walked a chain deep enough to overflow the stack. Wrappers now delegate through a mutable per-layer link so any layer can be torn down even when newer wrappers sit on top of it, keeping the chain bounded. Recording behavior is unchanged. This applies the same fix as [#4063](https://github.com/PostHog/posthog-js/issues/4063) (fetch/XHR) to the shared helper so every rrweb-record caller inherits the bounded-chain behavior. (2026-07-10) ### [`v1.399.1`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.399.1) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.399.0...posthog-js@1.399.1) #### 1.399.1 ##### Patch Changes - [#4122](https://github.com/PostHog/posthog-js/pull/4122) [`c915581`](https://github.com/PostHog/posthog-js/commit/c91558173dc5fdde3fca1e2f4cd0812049057818) Thanks [@github-actions](https://github.com/apps/github-actions)! - Fix `TypeError: handlePageUnload is not a function` thrown on page unload when a version-skewed lazy-loaded surveys chunk produces a survey manager whose prototype lacks `handlePageUnload`. The delegated call in `PostHogSurveys.handlePageUnload()` now guards the method as well as the receiver. (2026-07-09) - [#4124](https://github.com/PostHog/posthog-js/pull/4124) [`562ceeb`](https://github.com/PostHog/posthog-js/commit/562ceeb802e8a5adc26e3a5edcd9f1dfd52c20ed) Thanks [@posthog](https://github.com/apps/posthog)! - Session recording no longer crashes on startup when a CDN-loaded recorder chunk runs against an older bundled core. Calls into `SessionIdManager.on`/`onSessionId` are now guarded so a core without those methods degrades gracefully instead of throwing a `TypeError` during `start()`. (2026-07-09) ### [`v1.399.0`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.399.0) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.398.7...posthog-js@1.399.0) #### 1.399.0 ##### Minor Changes - [#4115](https://github.com/PostHog/posthog-js/pull/4115) [`86bb3a5`](https://github.com/PostHog/posthog-js/commit/86bb3a50c122852b47b7ced16bec239b801d05f2) Thanks [@DanielVisca](https://github.com/DanielVisca)! - add the posthog.metrics API (count, gauge, histogram) — alpha A statsd-style pre-aggregating metrics client for the PostHog Metrics product (alpha). Samples are folded into per-series aggregates in memory (counts sum, gauges keep the last value, histograms accumulate buckets) and flushed periodically as OTLP/JSON to `/i/v1/metrics` — one data point per series per flush window, no matter how many calls. No OpenTelemetry SDK setup required: ```ts posthog.metrics.count('orders_created', 1) posthog.metrics.gauge('active_connections', 42) posthog.metrics.histogram('api_latency', 187, { unit: 'ms' }) ``` Configure via `metrics: { serviceName, environment, flushIntervalMs, maxSeriesPerFlush, beforeSend, ... }`. (2026-07-08) ##### Patch Changes - Updated dependencies \[[`86bb3a5`](https://github.com/PostHog/posthog-js/commit/86bb3a50c122852b47b7ced16bec239b801d05f2)]: - [@posthog/core](https://github.com/posthog/core)@1.40.0 - [@posthog/types](https://github.com/posthog/types)@1.393.0 ### [`v1.398.7`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.398.7) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.398.6...posthog-js@1.398.7) #### 1.398.7 ##### Patch Changes - [#4113](https://github.com/PostHog/posthog-js/pull/4113) [`45f17ee`](https://github.com/PostHog/posthog-js/commit/45f17eeb14a5fefd160309e50b29ddad4d044c53) Thanks [@TueHaulund](https://github.com/TueHaulund)! - fix session replay leaking a shadow-root observer when a same-origin iframe is removed Follow-up to the shadow-observer iframe-teardown fix: `takeFullSnapshot`'s `onSerialize` registers every shadow root with the top-level document, so a root nested in a same-origin iframe was keyed to the wrong document and its observer/buffer were not disconnected when that iframe was removed (they lingered until the next full snapshot). `addShadowRoot` now derives the owning document from the host element, so per-document teardown matches iframe-nested roots too. (2026-07-08) ### [`v1.398.6`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.398.6) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.398.5...posthog-js@1.398.6) #### 1.398.6 ##### Patch Changes - [#4114](https://github.com/PostHog/posthog-js/pull/4114) [`c75c0ba`](https://github.com/PostHog/posthog-js/commit/c75c0baaaf107844de57a5ce496790cac6adcf8b) Thanks [@hpouillot](https://github.com/hpouillot)! - fix: avoid throwing when rrweb recorder cleanup cannot remove a listener (2026-07-08) ### [`v1.398.5`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.398.5) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.398.4...posthog-js@1.398.5) #### 1.398.5 ##### Patch Changes - [#4103](https://github.com/PostHog/posthog-js/pull/4103) [`be8242a`](https://github.com/PostHog/posthog-js/commit/be8242a209cdccfc7a2ec9869067af7045fbedb7) Thanks [@rafaeelaudibert](https://github.com/rafaeelaudibert)! - Publish the code-split ESM toolbar bundle when the build emits one. The release tooling now recursively includes `dist/toolbar/` (with explicit JS content types for the strict-MIME ESM chunks) across the immutable, major-alias, and compatibility upload prefixes, and the workflow accepts the canonical `toolbar.js`/`toolbar.css` layout. This is a no-op against today's single-file build. (2026-07-08) ### [`v1.398.4`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.398.4) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.398.3...posthog-js@1.398.4) #### 1.398.4 ##### Patch Changes - [#4104](https://github.com/PostHog/posthog-js/pull/4104) [`ec5e401`](https://github.com/PostHog/posthog-js/commit/ec5e4010f49295d200bf714573e61e55e7296e58) Thanks [@TueHaulund](https://github.com/TueHaulund)! - fix session recordings missing their initial full snapshot after an idle session-id rotation When the session id rotated while the recorder was idle, the restarted recorder's Meta and FullSnapshot were appended to the previous session's buffer and shipped under the old session id, leaving the new recording unplayable until the next periodic snapshot. The buffer now rebinds on any session-id change regardless of idle state, and as a safety net the recorder requests a full snapshot whenever an incremental is about to ship for a session that has not produced one. (2026-07-08) ### [`v1.398.3`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.398.3) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.398.2...posthog-js@1.398.3) #### 1.398.3 ##### Patch Changes - [#4112](https://github.com/PostHog/posthog-js/pull/4112) [`38bb185`](https://github.com/PostHog/posthog-js/commit/38bb185fac9d0e20250620932e2dcbcf44dd1da9) Thanks [@TueHaulund](https://github.com/TueHaulund)! - fix session replay silently dropping shadow DOM mutations after an iframe teardown The single shared ShadowDomManager observes every shadow root on the page, but MutationBuffer.reset() disconnected it. That reset fires whenever any one buffer is torn down, so an iframe being removed or navigating away disconnected every shadow-root observer page-wide. Shadow DOM content (for example a widget mounted in an open shadow root) then stopped recording until the next periodic full snapshot re-registered it. Buffer teardown now releases only its own resources; global shadow observation is reset by takeFullSnapshot and on recording stop. (2026-07-08) ### [`v1.398.2`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.398.2) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.398.1...posthog-js@1.398.2) #### 1.398.2 ##### Patch Changes - [#4063](https://github.com/PostHog/posthog-js/pull/4063) [`24aadd5`](https://github.com/PostHog/posthog-js/commit/24aadd5b645766a64f72315a08ef7fc35cffb23e) Thanks [@posthog](https://github.com/apps/posthog)! - Fix a `RangeError: Maximum call stack size exceeded` that could originate from the shared `patch()` fetch/XHR wrapper. posthog-js wraps `window.fetch` in two independent places (tracing headers and session-recording network capture), so their restores routinely ran out of order. Previously an out-of-order restore silently no-op'd, leaving the wrapper in the call path; repeated start/stop cycles grew the wrapper chain without bound until a real `fetch` walked a chain deep enough to overflow the stack. Wrappers now delegate through a mutable link so any layer can be torn down even when newer wrappers sit on top of it, keeping the chain bounded. Header-injection and network-capture behavior is unchanged. (2026-07-07) - [#4100](https://github.com/PostHog/posthog-js/pull/4100) [`e250a24`](https://github.com/PostHog/posthog-js/commit/e250a2409566a46592f1eb71f9c40b652385d13f) Thanks [@marandaneto](https://github.com/marandaneto)! - Stop adding the gzip compression query parameter to browser SDK requests. (2026-07-07) - [#4083](https://github.com/PostHog/posthog-js/pull/4083) [`f07e241`](https://github.com/PostHog/posthog-js/commit/f07e241bed4201978045cd7c86826c7feff3aebb) Thanks [@posthog](https://github.com/apps/posthog)! - fix(replay): harden session-replay network capture so instrumentation that throws (e.g. `new Request()` rejecting a URL/method) degrades gracefully and never breaks or misattributes the host application's own `xhr.open()` / `fetch()` calls (2026-07-07) ### [`v1.398.1`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.398.1) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.398.0...posthog-js@1.398.1) #### 1.398.1 ##### Patch Changes - [#4096](https://github.com/PostHog/posthog-js/pull/4096) [`5013ab6`](https://github.com/PostHog/posthog-js/commit/5013ab6acd64b4200304cdf9464805c06c07a05f) Thanks [@marandaneto](https://github.com/marandaneto)! - Stop sending the deprecated `ver` query parameter to capture and session recording endpoints. (2026-07-07) ### [`v1.398.0`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.398.0) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.397.0...posthog-js@1.398.0) #### 1.398.0 ##### Minor Changes - [#4070](https://github.com/PostHog/posthog-js/pull/4070) [`ef119bf`](https://github.com/PostHog/posthog-js/commit/ef119bfbc4d39a9b10a6a774ca987c3fbac12519) Thanks [@posthog](https://github.com/apps/posthog)! - Add a `disableAutofocus` survey appearance option. When set, open-text survey questions no longer steal focus when they render, which is useful for embedded (inline) surveys that shouldn't grab the caret or scroll the page on load. Defaults to `false`, preserving the existing autofocus behavior. (2026-07-06) ### [`v1.397.0`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.397.0) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.396.9...posthog-js@1.397.0) #### 1.397.0 ##### Minor Changes - [#4089](https://github.com/PostHog/posthog-js/pull/4089) [`cc340db`](https://github.com/PostHog/posthog-js/commit/cc340dbc62b18d6f4fb8bb7b96c3944956b9b435) Thanks [@bs1180](https://github.com/bs1180)! - feat(web): add a `posthog-js/customizations` subpath entry point exposing the optional customizations (`setAllPersonProfilePropertiesAsPersonPropertiesForFlags`, the `before-send` sampling helpers, and the redux/kea loggers) as a proper ES module with bundled types, replacing the internal `posthog-js/lib/src/customizations` deep import. Also fixes the TypeScript definitions so `setAllPersonProfilePropertiesAsPersonPropertiesForFlags` accepts the instance passed to the `loaded` callback (the documented usage), and the `loaded` callback's instance type now includes `config`. (2026-07-06) ### [`v1.396.9`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.396.9) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.396.8...posthog-js@1.396.9) #### 1.396.9 ##### Patch Changes - [#4077](https://github.com/PostHog/posthog-js/pull/4077) [`2595440`](https://github.com/PostHog/posthog-js/commit/2595440b0e8771a59388a119ab56857de42b53ee) Thanks [@pauldambra](https://github.com/pauldambra)! - fix(web): stop retrying log batches forever when requests die before an HTTP response (status 0, e.g. an ad blocker) — after 3 consecutive such failures while the browser reports itself online, the logs pipeline stops sending and drops batches instead of buffering and retrying for the life of the page; the `online` event reopens it, and genuine offline periods still queue for the reconnect flush (2026-07-06) ### [`v1.396.8`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.396.8) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.396.7...posthog-js@1.396.8) #### 1.396.8 ##### Patch Changes - [#4062](https://github.com/PostHog/posthog-js/pull/4062) [`2af0026`](https://github.com/PostHog/posthog-js/commit/2af002652afd87401e299a18295da08443753e89) Thanks [@posthog](https://github.com/apps/posthog)! - fix(web): prevent an infinite-recursion stack overflow in the logs console capture. The console wrapper's own capture path can emit internal debug lines through PostHog's logger, which wrote back to the wrapped console and re-entered capture until the stack blew (`RangeError: Maximum call stack size exceeded`). The wrapper now exposes the original console method via `__rrweb_original__` (so the internal logger bypasses it) and guards against re-entrancy from any code that logs mid-capture. (2026-07-06) ### [`v1.396.7`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.396.7) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.396.6...posthog-js@1.396.7) #### 1.396.7 ##### Patch Changes - [#4080](https://github.com/PostHog/posthog-js/pull/4080) [`08cd27b`](https://github.com/PostHog/posthog-js/commit/08cd27bfd602ab378b2e48833ddf837abffbd8c2) Thanks [@marandaneto](https://github.com/marandaneto)! - fix(web): stop repeatedly hitting blocked feature flag and conversations polling endpoints after consecutive status-0 failures (2026-07-06) ### [`v1.396.6`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.396.6) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.396.5...posthog-js@1.396.6) #### 1.396.6 ##### Patch Changes - [#4053](https://github.com/PostHog/posthog-js/pull/4053) [`45d1b36`](https://github.com/PostHog/posthog-js/commit/45d1b36e517d9eeb3d68b0398d80599b88293386) Thanks [@posthog](https://github.com/apps/posthog)! - feat(web): add a graceful `shutdown()` to the browser client for parity with posthog-node, so isomorphic teardown code (e.g. the Nuxt module) that calls `posthog.shutdown()` on the client no longer throws `TypeError: shutdown is not a function`. It best-effort flushes the queued events and always resolves. (2026-07-03) - [#4054](https://github.com/PostHog/posthog-js/pull/4054) [`f0657eb`](https://github.com/PostHog/posthog-js/commit/f0657eb867604175ed44f9f2f43762c93db7ebf6) Thanks [@posthog](https://github.com/apps/posthog)! - fix(web): detect our own feature-flag request timeouts via a `timedOut` flag instead of the abort reason, so they are logged at `warn` (not `error`) on browsers that don't propagate `controller.abort(reason)` — keeping benign timeouts out of error tracking's console-error capture (2026-07-03) - [#4031](https://github.com/PostHog/posthog-js/pull/4031) [`94a0530`](https://github.com/PostHog/posthog-js/commit/94a053043847293a4427e315e67c798b58894107) Thanks [@posthog](https://github.com/apps/posthog)! - Improve survey display reliability: - **posthog-js**: refresh the cached `$surveys` definitions after a short TTL (stale-while-revalidate) so server-side changes such as switching a survey from popover to API propagate to long-lived tabs without a page reload. - **posthog-js**: add `posthog.surveys.markSurveyAsSeen(surveyId, { iteration })` so custom integrators that render surveys through their own backend can honour the "already seen" and wait-period checks. - **posthog-react-native**: guarantee the survey `Modal` notifies its parent on close even when iOS `Modal.onDismiss` fails to fire, so the transparent full-screen modal can no longer stay mounted intercepting touches and freezing the app. (2026-07-03) - Updated dependencies \[[`45d1b36`](https://github.com/PostHog/posthog-js/commit/45d1b36e517d9eeb3d68b0398d80599b88293386)]: - [@posthog/types](https://github.com/posthog/types)@1.392.1 ### [`v1.396.5`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.396.5) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.396.4...posthog-js@1.396.5) #### 1.396.5 ##### Patch Changes - [#4050](https://github.com/PostHog/posthog-js/pull/4050) [`d7cf13b`](https://github.com/PostHog/posthog-js/commit/d7cf13bf13a0c3c57f3f25a15ef69679f0456f0d) Thanks [@turnipdabeets](https://github.com/turnipdabeets)! - Prevent uncaught `getComputedStyle` crashes in heatmaps and autocapture when the event target is a cross-realm element (e.g. from an iframe or synthetic event) (2026-07-02) - Updated dependencies \[[`5e7e132`](https://github.com/PostHog/posthog-js/commit/5e7e132757682e4f91d40601506b635f346c7b67)]: - [@posthog/core](https://github.com/posthog/core)@1.39.5 ### [`v1.396.4`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.396.4) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.396.3...posthog-js@1.396.4) #### 1.396.4 ##### Patch Changes - [#4035](https://github.com/PostHog/posthog-js/pull/4035) [`18e543b`](https://github.com/PostHog/posthog-js/commit/18e543b301705048b2eef0d864088541a09a3150) Thanks [@posthog](https://github.com/apps/posthog)! - fix(web): isolate `onFeatureFlags` callbacks so a throwing user handler no longer breaks the remaining callback chain or gets misattributed as an SDK error (2026-07-01) - [#4039](https://github.com/PostHog/posthog-js/pull/4039) [`15bcb42`](https://github.com/PostHog/posthog-js/commit/15bcb42e3fa97bfec8de87a4118ee870b960d41f) Thanks [@github-actions](https://github.com/apps/github-actions)! - fix(replay): measure `$snapshot_bytes` as UTF-8 byte length instead of UTF-16 string length, so non-ASCII session replay payloads are counted accurately against the message size limit (2026-07-01) ### [`v1.396.3`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.396.3) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.396.2...posthog-js@1.396.3) #### 1.396.3 ##### Patch Changes - [#4020](https://github.com/PostHog/posthog-js/pull/4020) [`e0ad8ef`](https://github.com/PostHog/posthog-js/commit/e0ad8ef9f53f2113122681b74c7436a8df060699) Thanks [@posthog](https://github.com/apps/posthog)! - Fix `TypeError: ....at is not a function` thrown by the bundled `web-vitals` dependency on browsers that predate `Array.prototype.at()` (Chrome <92, iOS Safari <15.4). The web-vitals entrypoints now install a tiny `Array.prototype.at` polyfill before web-vitals runs, so web vitals capture works again on older browsers instead of crashing with an unhandled error. (2026-06-30) ### [`v1.396.2`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.396.2) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.396.1...posthog-js@1.396.2) #### 1.396.2 ##### Patch Changes - [#4003](https://github.com/PostHog/posthog-js/pull/4003) [`b6261e7`](https://github.com/PostHog/posthog-js/commit/b6261e7ede71a2d92215eab365b43f33cb5c4863) Thanks [@marandaneto](https://github.com/marandaneto)! - Include a Promise polyfill in the IE11 bundle and avoid Promise-dependent async compression paths when Promise support is unavailable. (2026-06-29) ### [`v1.396.1`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.396.1) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.396.0...posthog-js@1.396.1) #### 1.396.1 ##### Patch Changes - [#3999](https://github.com/PostHog/posthog-js/pull/3999) [`cdeae17`](https://github.com/PostHog/posthog-js/commit/cdeae17236f08f1950a04a2478fbd3ef550ca292) Thanks [@marandaneto](https://github.com/marandaneto)! - Fall back to uncompressed browser requests when gzip encoding fails. (2026-06-29) ### [`v1.396.0`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.396.0) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.395.0...posthog-js@1.396.0) #### 1.396.0 ##### Minor Changes - [#3987](https://github.com/PostHog/posthog-js/pull/3987) [`74cc6bb`](https://github.com/PostHog/posthog-js/commit/74cc6bb6f255b944846567406dfac449be17095c) Thanks [@TueHaulund](https://github.com/TueHaulund)! - Add a `get_current_url` config option that overrides the URL used for client-side URL targeting — session replay URL triggers, the session replay URL blocklist, survey URL display conditions, product tour URL conditions, web experiment URL conditions, and autocapture URL allow/ignore lists. These match against `window.location.href` directly, which does not reflect a `$current_url` rewritten in `before_send`. Apps where the browser URL is not meaningful for targeting (e.g. Electron/desktop builds served from a generated host) can now return the logical URL to match against. Defaults to `window.location.href` when not set. (2026-06-29) ##### Patch Changes - Updated dependencies \[[`74cc6bb`](https://github.com/PostHog/posthog-js/commit/74cc6bb6f255b944846567406dfac449be17095c)]: - [@posthog/types](https://github.com/posthog/types)@1.392.0 ### [`v1.395.0`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.395.0) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.394.0...posthog-js@1.395.0) #### 1.395.0 ##### Minor Changes - [#3977](https://github.com/PostHog/posthog-js/pull/3977) [`6200888`](https://github.com/PostHog/posthog-js/commit/6200888e5741dea2e6e11a5da1c98b6c79e62a3f) Thanks [@turnipdabeets](https://github.com/turnipdabeets)! - Add `getAllFeatureFlags()`, which returns all currently loaded feature flags as structured `FeatureFlagResult`s (`key`, `enabled`, `variant`, `payload`). It is a synchronous read of the cached flags and does not send a `$feature_flag_called` event. (2026-06-26) ##### Patch Changes - Updated dependencies \[[`6200888`](https://github.com/PostHog/posthog-js/commit/6200888e5741dea2e6e11a5da1c98b6c79e62a3f)]: - [@posthog/core](https://github.com/posthog/core)@1.38.0 ### [`v1.394.0`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.394.0) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.393.6...posthog-js@1.394.0) #### 1.394.0 ##### Minor Changes - [#3986](https://github.com/PostHog/posthog-js/pull/3986) [`919abca`](https://github.com/PostHog/posthog-js/commit/919abcaea82513bc0422d398bf26ff03810e69ad) Thanks [@ioannisj](https://github.com/ioannisj)! - Capture the `$device_model` super-property on Android Chromium via `navigator.userAgentData.getHighEntropyValues(['model'])`. Resolved once during init and sent on subsequent events; opt out with `disableDeviceModel: true`. (2026-06-26) ### [`v1.393.6`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.393.6) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.393.5...posthog-js@1.393.6) #### 1.393.6 ##### Patch Changes - [#3965](https://github.com/PostHog/posthog-js/pull/3965) [`6ef9179`](https://github.com/PostHog/posthog-js/commit/6ef91798097d59950e3787cbb20fe95d5cde9401) Thanks [@marandaneto](https://github.com/marandaneto)! - Handle request serialization errors without throwing or blocking queued requests. (2026-06-26) ### [`v1.393.5`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.393.5) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.393.4...posthog-js@1.393.5) #### 1.393.5 ##### Patch Changes - [#3960](https://github.com/PostHog/posthog-js/pull/3960) [`619d318`](https://github.com/PostHog/posthog-js/commit/619d31827e780fecd4d644fb99063d878764fb8e) Thanks [@marandaneto](https://github.com/marandaneto)! - Improve console log capture performance for truncated large objects. (2026-06-25) ### [`v1.393.4`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.393.4) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.393.3...posthog-js@1.393.4) #### 1.393.4 ##### Patch Changes - [#3942](https://github.com/PostHog/posthog-js/pull/3942) [`c9c8925`](https://github.com/PostHog/posthog-js/commit/c9c8925b1c63d2f02c3caeef5dc962ad31866459) Thanks [@hpouillot](https://github.com/hpouillot)! - Fix browser console log capture when session activity timestamps are missing and refresh session attributes for each log. (2026-06-24) - Updated dependencies \[[`c9c8925`](https://github.com/PostHog/posthog-js/commit/c9c8925b1c63d2f02c3caeef5dc962ad31866459)]: - [@posthog/core](https://github.com/posthog/core)@1.37.2 ### [`v1.393.3`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.393.3) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.393.2...posthog-js@1.393.3) #### 1.393.3 ##### Patch Changes - [#3945](https://github.com/PostHog/posthog-js/pull/3945) [`f94deaf`](https://github.com/PostHog/posthog-js/commit/f94deaf3eee16e2ff96505d44f0fbcd055dff057) Thanks [@ioannisj](https://github.com/ioannisj)! - fix(surveys): guard handlePageUnload against version-skewed surveys instance missing the method (2026-06-24) ### [`v1.393.2`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.393.2) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.393.1...posthog-js@1.393.2) #### 1.393.2 ##### Patch Changes - [#3944](https://github.com/PostHog/posthog-js/pull/3944) [`1c9a811`](https://github.com/PostHog/posthog-js/commit/1c9a811d36e390562b6b2d30e0270696e6c05ffe) Thanks [@ioannisj](https://github.com/ioannisj)! - Stop logging a misleading "upgrade your PostHog server" warning for valid v2 flags responses that have no flags. (2026-06-24) ### [`v1.393.1`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.393.1) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.393.0...posthog-js@1.393.1) #### 1.393.1 ##### Patch Changes - [#3919](https://github.com/PostHog/posthog-js/pull/3919) [`99bad9c`](https://github.com/PostHog/posthog-js/commit/99bad9c8332f5511b1b8caf33dd6f0fd9489c742) Thanks [@pauldambra](https://github.com/pauldambra)! - Session replay network capture: add an opt-in streaming reader for request/response bodies that stops at the payload size limit instead of buffering the whole body and then discarding it — bounding memory and pre-request latency when a body is very large. It reads only a clone of the body, so it never consumes the stream the page itself reads, and always resolves (never rejects) into the page's `fetch`. Off by default; enabled for `defaults: '2026-06-25'` and settable directly via `session_recording.streamNetworkBody`. (2026-06-24) - Updated dependencies \[[`99bad9c`](https://github.com/PostHog/posthog-js/commit/99bad9c8332f5511b1b8caf33dd6f0fd9489c742)]: - [@posthog/types](https://github.com/posthog/types)@1.391.1 ### [`v1.393.0`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.393.0) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.392.0...posthog-js@1.393.0) #### 1.393.0 ##### Minor Changes - [#3921](https://github.com/PostHog/posthog-js/pull/3921) [`c28b161`](https://github.com/PostHog/posthog-js/commit/c28b16143d04caade1d024819017b89cef3162ad) Thanks [@marandaneto](https://github.com/marandaneto)! - Add `disable_capture_url_hashes` to strip URL fragments from automatically captured URLs. It is disabled by default for backwards compatibility, and enabled automatically when `config.defaults` is `'2026-06-25'` or later. Enabling it (either explicitly or via the `'2026-06-25'` defaults) is a breaking behavior change for SPAs that rely on URL hashes for routing or analytics, because hash-based routes will be collapsed to the same URL without the fragment in fields such as `$current_url`, `$initial_current_url`, `$session_entry_url`, autocapture `$elements[*].attr__href`, `$external_click_url`, replay `href` URLs, heatmaps, web vitals `$current_url`, logs `url.full`, conversations `current_url`/`request_url`, or Next.js Pages Router `$pageview` `$current_url`. If you only want to capture some hashes, leave hash capture enabled and use `before_send` to remove or redact sensitive hash values before events are sent. (2026-06-23) ##### Patch Changes - Updated dependencies \[[`c28b161`](https://github.com/PostHog/posthog-js/commit/c28b16143d04caade1d024819017b89cef3162ad)]: - [@posthog/core](https://github.com/posthog/core)@1.36.0 - [@posthog/types](https://github.com/posthog/types)@1.391.0 ### [`v1.392.0`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.392.0) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.391.9...posthog-js@1.392.0) #### 1.392.0 ##### Minor Changes - [#3895](https://github.com/PostHog/posthog-js/pull/3895) [`ce528ed`](https://github.com/PostHog/posthog-js/commit/ce528ed73936bbefa47f52e90cce8e11bb4205cc) Thanks [@turnipdabeets](https://github.com/turnipdabeets)! - Console log auto-capture (`logs: { captureConsoleLogs: true }`) now flows through the same pipeline as `posthog.captureLog()`, `posthog.logger.*`, and PostHog's other SDKs, instead of OpenTelemetry. As a result: - the bundled OpenTelemetry dependencies are removed, shrinking the lazily-loaded logs chunk - auto-captured console logs now run through `logs.beforeSend` (the same hook as `captureLog`/`logger.*`), so you can redact or drop sensitive console output before it's sent. To treat console logs differently from manual logs, branch on the record's `log.source` attribute: auto-captured console logs set it to `console.<method>` (e.g. `console.error`), while manual `captureLog`/`logger.*` logs leave it unset - console logs now link to the person's profile: they carry the person id as `posthogDistinctId`, the attribute PostHog uses to associate logs with a person ([docs](https://posthog.com/docs/logs/link-person)). The old path used `distinct_id`, which isn't used for person linking by default, so console logs previously didn't appear on person profiles unless you'd configured a custom key. Console logs keep their `posthog-browser-logs` `service.name`, their `console` instrumentation scope, and their `log.source: console.<level>` attribute. As part of moving onto the shared pipeline, console records now use PostHog's standard log field names — the same ones programmatic web logs and other SDKs use, and the ones the Logs UI surfaces. For the fields below the **values are unchanged** — only the attribute names/locations differ: - `distinct_id` → `posthogDistinctId` (record attribute) - `location.href` → `url.full` (record attribute; same value — the page URL) - `session.id` (resource attribute) → `sessionId` (record attribute) — renamed and moved - `host` and `window.id` move from resource attributes to record attributes (names unchanged) - records also now carry the standard SDK context shared by other logs, including `feature_flags` For most projects this needs no action — these are already the canonical log fields. The only thing to update is a saved Logs query or dashboard built specifically on an **old** console attribute name, for example: - `attributes.distinct_id` → `attributes.posthogDistinctId` - `attributes.location.href` → `attributes.url.full` - `resource.attributes.session.id` → `attributes.sessionId` - `resource.attributes.host` / `resource.attributes.window.id` → `attributes.host` / `attributes.window.id` (2026-06-22) ##### Patch Changes - Updated dependencies \[[`ce528ed`](https://github.com/PostHog/posthog-js/commit/ce528ed73936bbefa47f52e90cce8e11bb4205cc)]: - [@posthog/core](https://github.com/posthog/core)@1.35.4 ### [`v1.391.9`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.391.9) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.391.8...posthog-js@1.391.9) #### 1.391.9 ##### Patch Changes - [#3922](https://github.com/PostHog/posthog-js/pull/3922) [`26aa9ba`](https://github.com/PostHog/posthog-js/commit/26aa9ba470313835ec81eebaa156b7620b287274) Thanks [@posthog](https://github.com/apps/posthog)! - Exception autocapture: posthog-js's own fetch timeout now aborts with an explicit, descriptive reason (`PostHog request timed out after <n>ms`) instead of a reason-less `DOMException: AbortError: signal is aborted without reason`. This keeps `name === 'AbortError'` so existing timeout handling (e.g. feature flag timeout detection) is unchanged, but makes our own timeouts identifiable and stops them being re-captured as noise by console-error exception autocapture. (2026-06-22) ### [`v1.391.8`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.391.8) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.391.7...posthog-js@1.391.8) #### 1.391.8 ##### Patch Changes - [#3908](https://github.com/PostHog/posthog-js/pull/3908) [`1fce04f`](https://github.com/PostHog/posthog-js/commit/1fce04f79240971dc2776e4d9381dadeb0aff1c3) Thanks [@marandaneto](https://github.com/marandaneto)! - Apply CSP stylesheet preparation hook to Product Tours styles. (2026-06-22) ### [`v1.391.7`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.391.7) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.391.6...posthog-js@1.391.7) #### 1.391.7 ##### Patch Changes - [#3914](https://github.com/PostHog/posthog-js/pull/3914) [`dac4edb`](https://github.com/PostHog/posthog-js/commit/dac4edb389d0c5b6d146206a37c3a2123c7a8710) Thanks [@pauldambra](https://github.com/pauldambra)! - Session replay network capture: redact credential-bearing headers on both request and response (previously only request), and match credential-shaped custom header names by substring (e.g. `x-gist-encoded-user-token`) in addition to the exact deny list - avoiding accidental capture of tokens/cookies in recordings. (2026-06-22) ### [`v1.391.6`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.391.6) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.391.5...posthog-js@1.391.6) #### 1.391.6 ##### Patch Changes - [#3901](https://github.com/PostHog/posthog-js/pull/3901) [`049eeb6`](https://github.com/PostHog/posthog-js/commit/049eeb654138ba3e3345665b94046e29e8f8c899) Thanks [@marandaneto](https://github.com/marandaneto)! - Stop adding the unused `beacon` query parameter to browser SDK sendBeacon requests. (2026-06-22) - [#3900](https://github.com/PostHog/posthog-js/pull/3900) [`3ee8667`](https://github.com/PostHog/posthog-js/commit/3ee8667652fbd77b4e2b764bc4c19d748ef90c06) Thanks [@marandaneto](https://github.com/marandaneto)! - Stop adding the unused `ip` query parameter to browser SDK requests. (2026-06-22) ### [`v1.391.5`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.391.5) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.391.4...posthog-js@1.391.5) #### 1.391.5 ##### Patch Changes - [#3915](https://github.com/PostHog/posthog-js/pull/3915) [`beaccc3`](https://github.com/PostHog/posthog-js/commit/beaccc392d840a201412e28bebda157004f88adb) Thanks [@pauldambra](https://github.com/pauldambra)! - Session replay: apply the existing base64 image size cap (`maxBase64ImageLength`) to SVG `<image>` elements with `data:` URIs on both `href` and `xlink:href`. Previously the cap only covered `<img>` elements, so large inline data URIs inside SVGs were recorded in full - this also covers them in mutations, replacing oversized ones with the striped placeholder. (2026-06-22) ### [`v1.391.4`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.391.4) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.391.3...posthog-js@1.391.4) #### 1.391.4 ##### Patch Changes - [#3913](https://github.com/PostHog/posthog-js/pull/3913) [`ee9f2a8`](https://github.com/PostHog/posthog-js/commit/ee9f2a839e0e05f27a612f2be29c0a4eda6bcdca) Thanks [@pauldambra](https://github.com/pauldambra)! - Session replay network capture: expand the default payload host deny list to skip third-party analytics, RUM, and session-replay telemetry whose payloads have no replay value - Datadog, Segment, RudderStack, Amplitude, Mixpanel, Hotjar (both `.com` and `.io`), and FullStory. Also covers both Google Analytics beacon hosts (`google-analytics.com`, plus `analytics.google.com` which gtag uses when Google Signals is enabled) and widens New Relic to `nr-data.net`. (2026-06-22) ### [`v1.391.3`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.391.3) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.391.2...posthog-js@1.391.3) #### 1.391.3 ##### Patch Changes - [#3909](https://github.com/PostHog/posthog-js/pull/3909) [`ab4a220`](https://github.com/PostHog/posthog-js/commit/ab4a2203392af6e63225fcfc93483bc8577c16ae) Thanks [@marandaneto](https://github.com/marandaneto)! - Avoid `style-src-attr` CSP violations when diffing rrweb style mutations. (2026-06-22) - [#3912](https://github.com/PostHog/posthog-js/pull/3912) [`78ac40c`](https://github.com/PostHog/posthog-js/commit/78ac40c5e69a016455abe0fbb2ef94f6f4302e8a) Thanks [@pauldambra](https://github.com/pauldambra)! - Session replay network capture: never record binary/asset response or request bodies (image, video, audio, font, octet-stream, pdf, zip, wasm) even when `recordBody` is enabled - they bloat recordings, duplicate what the replay already shows, and the body is no longer read. (2026-06-22) ### [`v1.391.2`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.391.2) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.391.1...posthog-js@1.391.2) #### 1.391.2 ##### Patch Changes - [#3903](https://github.com/PostHog/posthog-js/pull/3903) [`6b21f77`](https://github.com/PostHog/posthog-js/commit/6b21f77291aeea64ce8229eb28196d1acacc20ce) Thanks [@marandaneto](https://github.com/marandaneto)! - Validate custom event UUID overrides and generate new UUIDs when invalid. (2026-06-19) - Updated dependencies \[[`6b21f77`](https://github.com/PostHog/posthog-js/commit/6b21f77291aeea64ce8229eb28196d1acacc20ce)]: - [@posthog/core](https://github.com/posthog/core)@1.35.3 - [@posthog/types](https://github.com/posthog/types)@1.390.2 ### [`v1.391.1`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.391.1) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.391.0...posthog-js@1.391.1) #### 1.391.1 ##### Patch Changes - [#3899](https://github.com/PostHog/posthog-js/pull/3899) [`d090a7c`](https://github.com/PostHog/posthog-js/commit/d090a7c295b2a9990cd83c2be5f051a21e27fc2e) Thanks [@lucasheriques](https://github.com/lucasheriques)! - Surveys: re-check eligibility when a popover's display delay elapses, instead of only re-checking the URL. A survey with a display delay could be queued while a visitor was still anonymous (the targeting flag passed for the anonymous profile), and then displayed after the delay even though `identify()` had reloaded feature flags and the survey's internal targeting flag was now false for the identified profile (e.g. a "show once per user" survey the person had already dismissed). The delayed display now re-runs the full display predicate (eligibility, URL/device/selector conditions, event/action trigger, and feature flags) before rendering, so a survey that became ineligible during the delay is no longer shown. Pending delayed surveys are also cancelled promptly when a later evaluation cycle finds them ineligible. (2026-06-19) ### [`v1.391.0`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.391.0) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.390.2...posthog-js@1.391.0) #### 1.391.0 ##### Minor Changes - [#3885](https://github.com/PostHog/posthog-js/pull/3885) [`5392a55`](https://github.com/PostHog/posthog-js/commit/5392a55f75ac94e98bb49a04db9453e62e188927) Thanks [@pauldambra](https://github.com/pauldambra)! - feat(replay): capture canvas at reduced resolution Adds `session_recording.canvasCapture.resolutionScale` - a `(0, 1]` fraction of the canvas display size to capture replay frames at. The captured bitmap is downscaled (pixel-area savings are quadratic) while the canvas's true display size is still recorded, so playback stretches the smaller frame back to the correct dimensions and aspect ratio - only sharpness drops, never layout. It defaults to `1` (full resolution, matching today's behaviour), and the latest `defaults` bundle (`2026-05-30`) opts new installs into `0.6`. The canvas's true display size travels with each frame through the encode worker (as required message fields), so the encoded reply is always drawn back to the correct dimensions — no per-canvas state is retained on the main thread, and downscaling can never mislabel a canvas's dimensions. At full resolution the captured pixels are unchanged (the quality resampling hint is only applied when actually downscaling); the emitted `drawImage` now always uses the explicit destination-size form, which is pixel-equivalent on replay. Mechanically, `@posthog/rrweb`'s canvas FPS-snapshot observer takes an optional `canvasResolutionScale` record option and downscales each captured frame accordingly. (2026-06-19) ##### Patch Changes - Updated dependencies \[[`5392a55`](https://github.com/PostHog/posthog-js/commit/5392a55f75ac94e98bb49a04db9453e62e188927)]: - [@posthog/types](https://github.com/posthog/types)@1.390.1 ### [`v1.390.2`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.390.2) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.390.1...posthog-js@1.390.2) #### 1.390.2 ##### Patch Changes - [#3868](https://github.com/PostHog/posthog-js/pull/3868) [`a5dd54a`](https://github.com/PostHog/posthog-js/commit/a5dd54afbc10dc2df32f401a68e57e2887b0f35e) Thanks [@pauldambra](https://github.com/pauldambra)! - fix(replay): scope the session-recording flushed-size tracker to the session `$sdk_debug_replay_flushed_size` was stored as a single device-global value in persistence and only reset on an in-page session rotation, so it leaked across page loads and tabs and over-counted on returning visitors. The tracker now keys the running total to the current session id, so a new session starts from zero and a fresh load reading an ongoing session sees the correct total. The internal persistence key backing this counter (`$sess_rec_flush_size`) was also unintentionally attached to every captured event as a super-property; it is now marked hidden so it no longer ships on events. The value remains available on session-replay debug events as `$sdk_debug_replay_flushed_size`. (2026-06-17) ### [`v1.390.1`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.390.1) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.390.0...posthog-js@1.390.1) #### 1.390.1 ##### Patch Changes - [#3784](https://github.com/PostHog/posthog-js/pull/3784) [`e25e629`](https://github.com/PostHog/posthog-js/commit/e25e629a8bb11a0f467a5c69241130bcaba600bd) Thanks [@lucasheriques](https://github.com/lucasheriques)! - Surveys: event-triggered surveys are now scoped to the page load the event fired in, and only persist across a page reload once they have actually been shown. Previously an event armed a survey by writing it to localStorage, where it stayed until shown. Because the activation survived reloads and the URL condition was only checked at display time, a survey armed by an exit-intent event (which fires as the user is leaving or reloading) could surface on a later page load with no event behind it. Activations now live in memory until the survey is shown, so an armed-but-unshown survey no longer reappears after a reload. Once a survey is shown it is promoted to persistence, so a non-repeatable survey survives a reload and re-displays until the user dismisses or answers it (instead of vanishing if they reload before interacting). Repeatable surveys (`schedule: 'always'` or "Show every time the event is captured") are still consumed when shown, so each captured trigger shows them once. Product tours follow the same model. Cross-page deferral (arm on one full page load, display on a later one) is no longer supported via event triggers; use audience targeting for that. (2026-06-17) ### [`v1.390.0`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.390.0) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.389.1...posthog-js@1.390.0) #### 1.390.0 ##### Minor Changes - [#3869](https://github.com/PostHog/posthog-js/pull/3869) [`81b79fb`](https://github.com/PostHog/posthog-js/commit/81b79fb9bcab3f4619e8fc7f1022f2ab24936b4e) Thanks [@turnipdabeets](https://github.com/turnipdabeets)! - Add a `beforeSend` option to the logs config, so you can inspect, redact, or drop log records before they're sent: ```js posthog.init('<token>', { logs: { beforeSend: (log) => { // return null to drop the log, or return the (optionally modified) log to keep it if (log.body.includes('password')) { return null } return log }, }, }) ``` `beforeSend` accepts a single function or an array of functions (applied left to right); returning `null` from any of them drops the record. It runs for logs sent via both `posthog.captureLog()` and `posthog.logger.*`. (2026-06-17) ##### Patch Changes - Updated dependencies \[[`81b79fb`](https://github.com/PostHog/posthog-js/commit/81b79fb9bcab3f4619e8fc7f1022f2ab24936b4e)]: - [@posthog/types](https://github.com/posthog/types)@1.390.0 ### [`v1.389.1`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.389.1) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.389.0...posthog-js@1.389.1) #### 1.389.1 ##### Patch Changes - [#3875](https://github.com/PostHog/posthog-js/pull/3875) [`43b4137`](https://github.com/PostHog/posthog-js/commit/43b413713440e7d62739d56ee7ffa01a6cf45678) Thanks [@marandaneto](https://github.com/marandaneto)! - Limit retries for transport failures without an HTTP response. (2026-06-17) ### [`v1.389.0`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.389.0) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.388.2...posthog-js@1.389.0) #### 1.389.0 ##### Minor Changes - [#3865](https://github.com/PostHog/posthog-js/pull/3865) [`b469830`](https://github.com/PostHog/posthog-js/commit/b469830a308761005c963872c349de5fa4b35f39) Thanks [@turnipdabeets](https://github.com/turnipdabeets)! - The browser's programmatic logs API (`posthog.captureLog()` / `posthog.logger.*`) now runs through the shared `@posthog/core` logs pipeline that React Native already uses — no change to the public API or existing behavior. Log delivery is more resilient as a result: oversized batches are split automatically, failed sends retry with exponential backoff, and delivery resumes when the browser comes back online. (2026-06-17) ##### Patch Changes - Updated dependencies \[[`b469830`](https://github.com/PostHog/posthog-js/commit/b469830a308761005c963872c349de5fa4b35f39)]: - [@posthog/core](https://github.com/posthog/core)@1.35.0 - [@posthog/types](https://github.com/posthog/types)@1.389.0 ### [`v1.388.2`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.388.2) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.388.1...posthog-js@1.388.2) #### 1.388.2 ##### Patch Changes - [#3870](https://github.com/PostHog/posthog-js/pull/3870) [`5edfee1`](https://github.com/PostHog/posthog-js/commit/5edfee1575860dda0a5bb099bc0e621ba6668bbb) Thanks [@turnipdabeets](https://github.com/turnipdabeets)! - Fix `updateFlags(flags, payloads, { merge: true })` baking an active feature flag override into the stored flags. The merge now seeds from the raw stored flags rather than the override-applied values, so clearing the override afterwards correctly restores the original flag. (2026-06-17) ### [`v1.388.1`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.388.1) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.388.0...posthog-js@1.388.1) #### 1.388.1 ##### Patch Changes - [#3851](https://github.com/PostHog/posthog-js/pull/3851) [`5c453cd`](https://github.com/PostHog/posthog-js/commit/5c453cd240788e45459dd08be6248d60a1cf1a73) Thanks [@marandaneto](https://github.com/marandaneto)! - Apply CSP nonce preparation hooks to style and script elements appended by site apps. (2026-06-17) ### [`v1.388.0`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.388.0) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.387.0...posthog-js@1.388.0) #### 1.388.0 ##### Minor Changes - [#3863](https://github.com/PostHog/posthog-js/pull/3863) [`b6bc9be`](https://github.com/PostHog/posthog-js/commit/b6bc9be241d6af91cae9d63b3fbb5b1d7ac8f343) Thanks [@marandaneto](https://github.com/marandaneto)! - Add autocapture-only CSS selector opt-outs for web interactions. (2026-06-17) ##### Patch Changes - Updated dependencies \[[`b6bc9be`](https://github.com/PostHog/posthog-js/commit/b6bc9be241d6af91cae9d63b3fbb5b1d7ac8f343)]: - [@posthog/types](https://github.com/posthog/types)@1.388.0 ### [`v1.387.0`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.387.0) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.386.8...posthog-js@1.387.0) #### 1.387.0 ##### Minor Changes - [#3709](https://github.com/PostHog/posthog-js/pull/3709) [`c6c163a`](https://github.com/PostHog/posthog-js/commit/c6c163aefb093d5609977ae243b056f96a2d3b4e) Thanks [@posthog](https://github.com/apps/posthog)! - Add `unsetPersonProperties()` to remove person properties, the counterpart to `setPersonProperties()`. Previously the only way to unset a person property was to hand-pass a `$unset` array inside a `capture()` call. (2026-06-16) ##### Patch Changes - [#3756](https://github.com/PostHog/posthog-js/pull/3756) [`b3ec845`](https://github.com/PostHog/posthog-js/commit/b3ec8453d3678bd7ab6737b25bae003e61117ef9) Thanks [@archievi](https://github.com/archievi)! - Drop the event and log a warning when a `before_send` hook removes the `token` property, instead of silently sending an event that ingest rejects with a 401. (2026-06-16) - [#3860](https://github.com/PostHog/posthog-js/pull/3860) [`c9c7df1`](https://github.com/PostHog/posthog-js/commit/c9c7df1e7f3ae6152aa80f98b49be206fdff1b23) Thanks [@marandaneto](https://github.com/marandaneto)! - Add `$unset` to capture options and pass it through in browser capture payloads. (2026-06-16) - [#3855](https://github.com/PostHog/posthog-js/pull/3855) [`fadaa4f`](https://github.com/PostHog/posthog-js/commit/fadaa4f38e9216cd5c8b43127202dbb4e8f5629a) Thanks [@haacked](https://github.com/haacked)! - Stop sending the `ip` query parameter on feature flag requests. The flags endpoint ignores it, and some ad blockers match `/flags…ip=` to block flag evaluation on any domain. Dropping it from flag requests avoids the block with no functional change. Event and session recording requests are unchanged. (2026-06-16) - [#3830](https://github.com/PostHog/posthog-js/pull/3830) [`0d837f5`](https://github.com/PostHog/posthog-js/commit/0d837f5aed4c7360b815a35866aba8f1a9a11852) Thanks [@dustinbyrne](https://github.com/dustinbyrne)! - Avoid reloading exception and dead-click autocapture external scripts when they are already present. (2026-06-16) - [#3853](https://github.com/PostHog/posthog-js/pull/3853) [`f95a0ec`](https://github.com/PostHog/posthog-js/commit/f95a0ec68270bf9116d29875733c1a43e9b91331) Thanks [@TueHaulund](https://github.com/TueHaulund)! - Capture native Fullscreen API transitions in session replay. Entering native fullscreen (`element.requestFullscreen()`) is rendered by the browser via the UA `:fullscreen` pseudo-class with no DOM mutation, so the recorder previously captured nothing and replays showed the element at its pre-fullscreen size with drifted click coordinates. The recorder now emits a reserved custom event on `fullscreenchange` (standard plus `webkit`/`moz`/`MS` prefixes), and the replayer re-applies fullscreen layout to the element on playback (including when scrubbing into a fullscreen region) via a reserved `rr_fullscreen` attribute, consistent with rrweb's existing `rr_*` attribute namespace. Known limitation: fullscreen of an element inside a same-origin iframe is recorded against the `<iframe>` element rather than the inner element, so replay pins the iframe. (2026-06-16) - Updated dependencies \[[`b3ec845`](https://github.com/PostHog/posthog-js/commit/b3ec8453d3678bd7ab6737b25bae003e61117ef9), [`c9c7df1`](https://github.com/PostHog/posthog-js/commit/c9c7df1e7f3ae6152aa80f98b49be206fdff1b23), [`c6c163a`](https://github.com/PostHog/posthog-js/commit/c6c163aefb093d5609977ae243b056f96a2d3b4e)]: - [@posthog/core](https://github.com/posthog/core)@1.33.0 - [@posthog/types](https://github.com/posthog/types)@1.387.0 ### [`v1.386.8`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.386.8) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.386.7...posthog-js@1.386.8) #### 1.386.8 ##### Patch Changes - [#3838](https://github.com/PostHog/posthog-js/pull/3838) [`3094f73`](https://github.com/PostHog/posthog-js/commit/3094f733bfda34b09b5bc14ad919898b95a189f3) Thanks [@TueHaulund](https://github.com/TueHaulund)! - fix(replay): discard the prior session's buffer when start() bails out a pending stop(). On a stopSessionRecording() → reset() → identify(newUser) → startSessionRecording() sequence, stopSessionRecording() takes the async compression-drain path, deferring its buffer flush and teardown. start() correctly invalidates that pending cleanup so the new recorder survives, but it left the stopped session's snapshot buffer in place. The re-entrant session-id restart then flushed those previous-user snapshots under the OLD session id, producing a mixed-distinct\_id session that server-side `any(distinct_id)` attribution resolves to the wrong person — recordings showing the previous user's identity. start() now clears that stale buffer alongside invalidating the compression queue, matching the drop-trailing-data trade-off the bailed-out stop() path already accepts. (2026-06-15) ### [`v1.386.7`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.386.7) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.386.6...posthog-js@1.386.7) #### 1.386.7 ##### Patch Changes - [#3837](https://github.com/PostHog/posthog-js/pull/3837) [`29bf8e3`](https://github.com/PostHog/posthog-js/commit/29bf8e386a4050531e9cfd906c33b75945fcb6ad) Thanks [@marandaneto](https://github.com/marandaneto)! - Add missing bugs metadata to package manifests. (2026-06-15) - [#3832](https://github.com/PostHog/posthog-js/pull/3832) [`d3a9462`](https://github.com/PostHog/posthog-js/commit/d3a9462b8b21994764bdd2802973d82ffe472294) Thanks [@archievi](https://github.com/archievi)! - Surveys: guard the remaining unprotected `localStorage` accesses (`reset()` and the `lastSeenSurveyDate` write) so a `SecurityError` in cross-origin iframes is swallowed instead of bubbling up to user monitoring. (2026-06-15) - Updated dependencies \[[`29bf8e3`](https://github.com/PostHog/posthog-js/commit/29bf8e386a4050531e9cfd906c33b75945fcb6ad)]: - [@posthog/core](https://github.com/posthog/core)@1.32.4 - [@posthog/types](https://github.com/posthog/types)@1.386.4 ### [`v1.386.6`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.386.6) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.386.5...posthog-js@1.386.6) #### 1.386.6 ##### Patch Changes - [#3804](https://github.com/PostHog/posthog-js/pull/3804) [`a27b163`](https://github.com/PostHog/posthog-js/commit/a27b16305eaef7fa8b4b36e6d2ffff1dbec7ba6b) Thanks [@pauldambra](https://github.com/pauldambra)! - fix(product-tours): drop the cached tours blob when product tours is not enabled Tours fetched while product tours was enabled are cached under `ph_product_tours` in the main persistence blob. Once product tours is disabled (remote config or the `disable_product_tours` option) that cache was never cleaned up, so a potentially large stale blob kept riding on every persistence write — and on every cross-tab `storage` event those writes broadcast. `onRemoteConfig` now clears the cached tours whenever product tours resolves to disabled; they are re-fetched if it is ever re-enabled. (2026-06-11) ### [`v1.386.5`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.386.5) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.386.4...posthog-js@1.386.5) #### 1.386.5 ##### Patch Changes - [#3801](https://github.com/PostHog/posthog-js/pull/3801) [`bd06ac7`](https://github.com/PostHog/posthog-js/commit/bd06ac7c09f48dc31b3019525561536452297b8d) Thanks [@ksvat](https://github.com/ksvat)! - fix(replay): prevent silent recorder teardown on session-id rotation. When the session id rotates during active rrweb capture, `_updateWindowAndSessionIds` calls `stop()` then synchronously `start('session_id_changed')`. If `stop()` took the `_stopAfterCompressionQueueDrains` path (which fires whenever the compression queue is non-empty — common during steady recording), its async cleanup would later resolve and call `_teardown()` against the freshly-started recorder, stopping rrweb, removing event listeners, and emptying the V2 trigger-group matchers. From that point on, the recorder's `status` getter kept reporting `active`/`sampled` (the `_strategy` reference was still set), but rrweb was no longer producing events, no listeners were registered, and no `$snapshot` data reached the server — the session looked recording-eligible from event metadata yet produced no replay. `start()` now invalidates the compression-queue state (generation bump plus reset of the stop-in-progress flag and queued-event count), so any pending cleanup from a prior `stop()` bails at its existing generation check and a later `stop()` of the new recorder is not mistaken for the old in-progress one. Affects long-running tabs that rotate session id mid-use (idle timeout, session-past-max-length, or `posthog.reset()`). (2026-06-11) ### [`v1.386.4`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.386.4) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.386.3...posthog-js@1.386.4) #### 1.386.4 ##### Patch Changes - [#3767](https://github.com/PostHog/posthog-js/pull/3767) [`fdc07f3`](https://github.com/PostHog/posthog-js/commit/fdc07f32f886602504d7c1132adfbcccdb4112ec) Thanks [@arnohillen](https://github.com/arnohillen)! - replay: jump scrolls instantly when seeking past pages that use `scroll-behavior: smooth`. During fast-forward the replayer applied scrolls with `behavior: 'auto'`, which inherits the page's CSS `scroll-behavior` — so on sites that set `scroll-behavior: smooth` (e.g. Silk bottom sheets/modals) a seeked scroll animated from 0 instead of jumping, leaving scroll-revealed content (the open sheet) out of view and showing only the backdrop until the animation caught up. Sync scrolls now use `behavior: 'instant'`, matching the method's stated intent that smooth scrolling be disabled while fast-forwarding. Full snapshot rebuilds apply their initial offset with `behavior: 'instant'` too, so the document-level scroll doesn't animate either. (2026-06-11) ### [`v1.386.3`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.386.3) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.386.2...posthog-js@1.386.3) #### 1.386.3 ##### Patch Changes - [#3760](https://github.com/PostHog/posthog-js/pull/3760) [`5ddfd44`](https://github.com/PostHog/posthog-js/commit/5ddfd44d21ebcc17df65466dd03226e278e4a89d) Thanks [@benben](https://github.com/benben)! - fix(conversations): re-attach the support widget after SPA navigations that replace `document.body` (e.g. Turbo Drive), so the widget no longer disappears until a full page reload (2026-06-11) - [#3690](https://github.com/PostHog/posthog-js/pull/3690) [`dbf2377`](https://github.com/PostHog/posthog-js/commit/dbf23777e1c14a811c67697684d56145518ebe16) Thanks [@pauldambra](https://github.com/pauldambra)! - fix(sessionid): keep the session id stable across tabs A session now rotates only when every tab has been idle past the timeout, rather than whenever a single background tab decides it is idle. On the active event path an idle tab re-reads the session id from storage before rotating: if a sibling tab kept the session alive it does not rotate, and if a sibling already rotated it adopts that id instead of minting a new one. This removes spurious cross-tab session fragmentation (inflated session counts, truncated session durations, split replays). When a sibling session is adopted, `onSessionId` handlers fire with `changeReason.crossTabAdoption: true` so session recording, pageview state, and session-scoped properties follow the new session. When `persistence_save_debounce_ms > 0` (the `2026-05-30` default) the refresh reads only the session-id key so it cannot clobber a sibling's write. Note: projects with significant multi-tab usage will see fewer but longer sessions after upgrading — this is a correction of previously over-counted sessions, not a traffic change. (2026-06-11) - [#3795](https://github.com/PostHog/posthog-js/pull/3795) [`21441a8`](https://github.com/PostHog/posthog-js/commit/21441a8203006ca878d89cdd60cd21beec1bb537) Thanks [@pauldambra](https://github.com/pauldambra)! - fix(persistence): stop per-request metadata rewriting the split-storage entries on every load `$feature_flag_evaluated_at`, `$feature_flag_request_id`, and `$surveys_loaded_at` change on every `/flags` (or `/surveys`) load even when the flag and survey content is unchanged. With `split_storage` enabled that made the multi-hundred-KB `__flags` / `__surveys` localStorage entries dirty on every SPA navigation, re-broadcasting the full payload to every open same-origin tab via cross-tab `storage` events — the exact pressure the split exists to remove. These keys are now marked volatile: a value-only change neither dirties the group nor alters its fingerprint, so the write is skipped and the freshest value rides along on the next real content write. Adding or deleting a volatile key still writes through (presence is fingerprinted, the moving value is not), and the in-memory value is always current — only the on-disk copy may lag until the next content change. (2026-06-11) - Updated dependencies \[[`dbf2377`](https://github.com/PostHog/posthog-js/commit/dbf23777e1c14a811c67697684d56145518ebe16)]: - [@posthog/types](https://github.com/posthog/types)@1.386.3 - [@posthog/core](https://github.com/posthog/core)@1.32.3 ### [`v1.386.2`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.386.2) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.386.1...posthog-js@1.386.2) #### 1.386.2 ##### Patch Changes - Updated dependencies \[[`25822ac`](https://github.com/PostHog/posthog-js/commit/25822acc0d16f9f1d6fbbd65da57b3e060c6c558)]: - [@posthog/core](https://github.com/posthog/core)@1.32.2 - [@posthog/types](https://github.com/posthog/types)@1.386.2 ### [`v1.386.1`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.386.1) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.386.0...posthog-js@1.386.1) #### 1.386.1 ##### Patch Changes - [#3780](https://github.com/PostHog/posthog-js/pull/3780) [`93e0461`](https://github.com/PostHog/posthog-js/commit/93e046108d889a9b5b322f7083d81e29f88bc8a3) Thanks [@dustinbyrne](https://github.com/dustinbyrne)! - Fix stale sampled-in session replay decisions after the configured replay sample rate changes. (2026-06-10) - [#3788](https://github.com/PostHog/posthog-js/pull/3788) [`6da86d0`](https://github.com/PostHog/posthog-js/commit/6da86d047414029c91b9b6f9b24dd4ebc36709ad) Thanks [@TueHaulund](https://github.com/TueHaulund)! - fix(replay): never record or flush snapshots while the sampling decision is missing When the stored sampling decision was wiped while the recorder was running (e.g. by `posthog.reset()`), the undecided session reported an `active` status and could leak short junk recordings from sessions that then decided not to record. Sampling decisions are now persisted tagged with the session id they were made for (`'!' + sessionId` when sampled out), are re-made on every session id change regardless of config availability, and a buffer is never flushed without a decision when sampling is configured. Because the decision is a deterministic hash of the session id, re-deciding never flips the outcome for the same session. This also stops a stale `false` decision from a previous session being inherited by a new session, which chronically under-recorded returning visitors. (2026-06-10) - Updated dependencies \[]: - [@posthog/types](https://github.com/posthog/types)@1.386.1 - [@posthog/core](https://github.com/posthog/core)@1.32.1 ### [`v1.386.0`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.386.0) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.385.0...posthog-js@1.386.0) #### 1.386.0 ##### Minor Changes - [#3634](https://github.com/PostHog/posthog-js/pull/3634) [`612f97a`](https://github.com/PostHog/posthog-js/commit/612f97adebd3d863602533180ac4bee3f3ed731d) Thanks [@lucasheriques](https://github.com/lucasheriques)! - feat(surveys): add opt-in `appearance.allowGoBack` for multi-question surveys, and make button labels translatable Renders a "Back" button on web surveys after the first question. Default is off — existing surveys are unchanged. Uses a visited-index history stack so back-navigation respects branching paths (`response_based`, `specific_question`), and abandoned-branch responses are pruned before submission so analytics aren't polluted. Returning to a question pre-fills the prior answer. `appearance.backButtonText` overrides the default label. The button uses the survey's text color so it stays readable on any background, and it also shows in survey previews. Also adds `submitButtonText` and `backButtonText` to survey-level translations, so both the submit and back button labels can be localized via `appearance` translations (previously only the per-question button text was translatable). (2026-06-10) ##### Patch Changes - Updated dependencies \[[`612f97a`](https://github.com/PostHog/posthog-js/commit/612f97adebd3d863602533180ac4bee3f3ed731d)]: - [@posthog/core](https://github.com/posthog/core)@1.32.0 - [@posthog/types](https://github.com/posthog/types)@1.386.0 ### [`v1.385.0`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.385.0) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.384.3...posthog-js@1.385.0) #### 1.385.0 ##### Minor Changes - [#3777](https://github.com/PostHog/posthog-js/pull/3777) [`f601c49`](https://github.com/PostHog/posthog-js/commit/f601c496338ed0be8853f94160ee3edca542ac7d) Thanks [@dustinbyrne](https://github.com/dustinbyrne)! - Promote external dependency script versioning to supported `strict_script_versioning` and `asset_host` config options. (2026-06-10) ##### Patch Changes - [#3753](https://github.com/PostHog/posthog-js/pull/3753) [`c11794d`](https://github.com/PostHog/posthog-js/commit/c11794dd5fbb73d99bb88600ae487f8f08f625be) Thanks [@dustinbyrne](https://github.com/dustinbyrne)! - Reload feature flags by default when resetting person properties for flags. (2026-06-10) - [#3742](https://github.com/PostHog/posthog-js/pull/3742) [`23b2af1`](https://github.com/PostHog/posthog-js/commit/23b2af19031527c8a9934535915db5d15b6abd94) Thanks [@arnohillen](https://github.com/arnohillen)! - record: capture resting scroll offset on `scrollend` when a reveal scroll clamps to 0 before its target is scrollable (e.g. Silk sheets). Deduped against `scroll` so normal gestures don't double event volume. (2026-06-10) - Updated dependencies \[[`c11794d`](https://github.com/PostHog/posthog-js/commit/c11794dd5fbb73d99bb88600ae487f8f08f625be), [`f601c49`](https://github.com/PostHog/posthog-js/commit/f601c496338ed0be8853f94160ee3edca542ac7d)]: - [@posthog/types](https://github.com/posthog/types)@1.385.0 - [@posthog/core](https://github.com/posthog/core)@1.31.4 ### [`v1.384.3`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.384.3) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.384.2...posthog-js@1.384.3) #### 1.384.3 ##### Patch Changes - [#3791](https://github.com/PostHog/posthog-js/pull/3791) [`2d21ada`](https://github.com/PostHog/posthog-js/commit/2d21ada24479c0d4f561dd3b6f5922ce3f8e4afd) Thanks [@marandaneto](https://github.com/marandaneto)! - Deprecate `__preview_disable_beacon` in favor of `disable_beacon` and mark `__preview_disable_xhr_credentials` as a no-op. (2026-06-10) - Updated dependencies \[[`2d21ada`](https://github.com/PostHog/posthog-js/commit/2d21ada24479c0d4f561dd3b6f5922ce3f8e4afd)]: - [@posthog/types](https://github.com/posthog/types)@1.384.3 - [@posthog/core](https://github.com/posthog/core)@1.31.3 ### [`v1.384.2`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.384.2) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.384.1...posthog-js@1.384.2) #### 1.384.2 ##### Patch Changes - [#3789](https://github.com/PostHog/posthog-js/pull/3789) [`d9462b3`](https://github.com/PostHog/posthog-js/commit/d9462b3567a0b7c9b755552c303814b6fcbe3a97) Thanks [@marandaneto](https://github.com/marandaneto)! - Deprecate `__preview_eager_load_replay` as a no-op now that session replay lazy loading is the default. (2026-06-10) - Updated dependencies \[[`d9462b3`](https://github.com/PostHog/posthog-js/commit/d9462b3567a0b7c9b755552c303814b6fcbe3a97)]: - [@posthog/types](https://github.com/posthog/types)@1.384.2 - [@posthog/core](https://github.com/posthog/core)@1.31.2 ### [`v1.384.1`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.384.1) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.384.0...posthog-js@1.384.1) #### 1.384.1 ##### Patch Changes - [#3787](https://github.com/PostHog/posthog-js/pull/3787) [`0e22d77`](https://github.com/PostHog/posthog-js/commit/0e22d778a439188f32294b5932194efe86ad1e6a) Thanks [@TueHaulund](https://github.com/TueHaulund)! - replayer: stop corrupting recordings when events are added behind the playhead. `addEvent()` used to apply any event older than the playback baseline synchronously onto the current DOM — correct for live-mode catch-up, but wrong for on-demand playback where snapshot chunks can finish loading after the user has seeked ahead. Applying those past mutations onto a DOM at a different position made their `removes` fail mirror lookups, and `applyMutation` then deleted the failed entries from the event objects themselves, so every later seek rebuilt from corrupted data (DOM nodes accumulating, e.g. duplicated text) and exports serialized the stripped events. Past events are now only applied synchronously in live mode (otherwise they are just inserted for the next seek to pick up), and `applyMutation` filters removes into a local copy instead of mutating the event data. (2026-06-10) - Updated dependencies \[]: - [@posthog/types](https://github.com/posthog/types)@1.384.1 - [@posthog/core](https://github.com/posthog/core)@1.31.1 ### [`v1.384.0`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.384.0) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.383.3...posthog-js@1.384.0) #### 1.384.0 ##### Minor Changes - [#3782](https://github.com/PostHog/posthog-js/pull/3782) [`0c2acb9`](https://github.com/PostHog/posthog-js/commit/0c2acb9f30d545bb89d1f950ba8f840c76e47dc2) Thanks [@pauldambra](https://github.com/pauldambra)! - Detect the Google Search App (GSA) as its own `$browser` value (`Google Search App`) via the cross-platform `GSA/` UA marker, instead of reporting the embedded webview as Mobile Safari (iOS) or Chrome (Android). Gated behind the new `detect_google_search_app` config option, which the `2026-05-30` config defaults opt into automatically — left off otherwise to keep existing browser attribution backwards-compatible. Note: `$browser_version` for `Google Search App` is not comparable across platforms — iOS yields a version like `284.0` (from `GSA/284.0.564099828`) while Android yields a version like `14.21` (from `GSA/14.21.20.28.arm64`), since Google maintains separate versioning schemes for the two apps. Avoid building cross-platform version dashboards on `$browser_version` for this browser. (2026-06-10) ##### Patch Changes - Updated dependencies \[[`0c2acb9`](https://github.com/PostHog/posthog-js/commit/0c2acb9f30d545bb89d1f950ba8f840c76e47dc2)]: - [@posthog/core](https://github.com/posthog/core)@1.31.0 - [@posthog/types](https://github.com/posthog/types)@1.384.0 ### [`v1.383.3`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.383.3) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.383.2...posthog-js@1.383.3) #### 1.383.3 ##### Patch Changes - [#3776](https://github.com/PostHog/posthog-js/pull/3776) [`783ba46`](https://github.com/PostHog/posthog-js/commit/783ba461b0916c3f379c227d08470687d38d0768) Thanks [@marandaneto](https://github.com/marandaneto)! - Deprecate the no-op `__preview_flags_v2` browser SDK config option. The SDK already uses the `/flags/?v=2` endpoint by default. (2026-06-09) - Updated dependencies \[[`783ba46`](https://github.com/PostHog/posthog-js/commit/783ba461b0916c3f379c227d08470687d38d0768)]: - [@posthog/types](https://github.com/posthog/types)@1.383.3 - [@posthog/core](https://github.com/posthog/core)@1.30.14 ### [`v1.383.2`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.383.2) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.383.1...posthog-js@1.383.2) #### 1.383.2 ##### Patch Changes - [#3748](https://github.com/PostHog/posthog-js/pull/3748) [`7820929`](https://github.com/PostHog/posthog-js/commit/78209299874f932e55b0050d3b891f5c8dbd66a6) Thanks [@marandaneto](https://github.com/marandaneto)! - Reduce duplicate internal code found by dry4ts. (2026-06-09) - Updated dependencies \[]: - [@posthog/types](https://github.com/posthog/types)@1.383.2 - [@posthog/core](https://github.com/posthog/core)@1.30.13 ### [`v1.383.1`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.383.1) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.383.0...posthog-js@1.383.1) #### 1.383.1 ##### Patch Changes - [#3770](https://github.com/PostHog/posthog-js/pull/3770) [`e481b0c`](https://github.com/PostHog/posthog-js/commit/e481b0c9c52b5f67dba351f7f140958f99da9854) Thanks [@dustinbyrne](https://github.com/dustinbyrne)! - Respect `capture_pageview: false` when opting out in cookieless `on_reject` mode. (2026-06-08) - Updated dependencies \[]: - [@posthog/types](https://github.com/posthog/types)@1.383.1 - [@posthog/core](https://github.com/posthog/core)@1.30.12 ### [`v1.383.0`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.383.0) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.382.0...posthog-js@1.383.0) #### 1.383.0 ##### Minor Changes - [#3771](https://github.com/PostHog/posthog-js/pull/3771) [`227c9b0`](https://github.com/PostHog/posthog-js/commit/227c9b03c19dcb93d9a15abb1ee6b9523d366767) Thanks [@dustinbyrne](https://github.com/dustinbyrne)! - feat(persistence): add `split_storage` config option to store the feature-flag config cluster in its own localStorage entry (`<name>__flags`) instead of the single main persistence blob. This payload is large and changes rarely, so keeping it out of the main blob stops it riding on every high-frequency main-blob write and broadcasting on cross-tab `storage` events. Reads are unchanged: on load the entry is merged back into the in-memory props, and the old main-blob location is read once and migrated forward so upgrades never miss a cached flag. The split only applies when persistence resolves to `localStorage` / `localStorage+cookie` (it is pointless for `memory` / `sessionStorage` and impossible for `cookie`), and `reset()` / opt-out wipe every entry. Defaults to `false` for backwards compatibility; the new `2026-05-30` config default opts in automatically. (2026-06-08) - [#3727](https://github.com/PostHog/posthog-js/pull/3727) [`393f9e2`](https://github.com/PostHog/posthog-js/commit/393f9e2a4697c6ffe52402cad6fb8550b48b5e00) Thanks [@pauldambra](https://github.com/pauldambra)! - feat(surveys): extend `split_storage` to also move the survey config (`$surveys`) out of the main persistence blob into its own `<name>__surveys` localStorage entry, on top of the feature-flag split. Surveys now stamp a `$surveys_loaded_at` freshness timestamp on every `/surveys` load — the survey analogue of `$feature_flag_evaluated_at` — so a stale `__surveys` entry can no longer win over a fresher survey payload written back into the main blob by a gate-off / older-SDK tab. With no timestamp on either side (migration leftover) the group entry still wins, so the migration path is unchanged. Same backend and `reset()` / opt-out semantics as the flag split. (2026-06-08) ##### Patch Changes - Updated dependencies \[[`227c9b0`](https://github.com/PostHog/posthog-js/commit/227c9b03c19dcb93d9a15abb1ee6b9523d366767), [`393f9e2`](https://github.com/PostHog/posthog-js/commit/393f9e2a4697c6ffe52402cad6fb8550b48b5e00)]: - [@posthog/types](https://github.com/posthog/types)@1.383.0 - [@posthog/core](https://github.com/posthog/core)@1.30.11 ### [`v1.382.0`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.382.0) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.381.0...posthog-js@1.382.0) #### 1.382.0 ##### Minor Changes - [#3749](https://github.com/PostHog/posthog-js/pull/3749) [`9877710`](https://github.com/PostHog/posthog-js/commit/98777104a586651f27c0838c7377209e556d5511) Thanks [@pauldambra](https://github.com/pauldambra)! - Stop classifying intentional repeated clicks as rageclicks. From the `2026-05-30` config defaults, rageclick detection now ignores: - text-editing surfaces (`textarea`, text-like `input`s, and `contenteditable` elements), where rapid clicks are double/triple-click text selection rather than rage (`rageclick.ignore_text_selection`) - `+`/`-` stepper buttons, added to the default `content_ignorelist` Symbol-only keywords in `content_ignorelist` (e.g. `+`, `-`, `>`, `<`) now match the element's text exactly instead of as a substring, so labels like `sign-up`, `5 > 3`, or `C++` are no longer treated as repeatedly-clicked controls. The heatmaps rageclick marker now applies the same suppression as the `$rageclick` event. A partial `rageclick` config object is now merged with the date-gated defaults instead of replacing them, so e.g. `rageclick: { threshold_px: 50 }` keeps the default `content_ignorelist` / `ignore_text_selection`. Pass an explicit value (e.g. `content_ignorelist: false`) to override a specific default, or a boolean to opt out entirely. **Behaviour change for existing `content_ignorelist: true` users (available since `2025-11-30`):** the default list already includes `>` and `<`. After this release, buttons whose text *contains* `>` or `<` but is not exactly that symbol (e.g. `Learn more >`, `< Back`, `home > settings`) will no longer be suppressed. Bare `>` and `<` buttons remain suppressed. This is the intended fix, but if you rely on the old substring behaviour for those keywords, replace `content_ignorelist: true` with an explicit array listing the exact terms you want to suppress. (2026-06-06) ##### Patch Changes - Updated dependencies \[]: - [@posthog/types](https://github.com/posthog/types)@1.382.0 - [@posthog/core](https://github.com/posthog/core)@1.30.10 ### [`v1.381.0`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.381.0) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.380.1...posthog-js@1.381.0) #### 1.381.0 ##### Minor Changes - [#3719](https://github.com/PostHog/posthog-js/pull/3719) [`a7bd828`](https://github.com/PostHog/posthog-js/commit/a7bd828050d070e1b88eb69c3f9db71c5d08f446) Thanks [@lricoy](https://github.com/lricoy)! - Add `__preview_cookie_wins_on_conflict` opt-in config to prefer cookie values over localStorage when merging persistence state in `localStorage+cookie` mode, fixing cross-subdomain identify and session disconnects. (2026-06-05) ##### Patch Changes - Updated dependencies \[[`a7bd828`](https://github.com/PostHog/posthog-js/commit/a7bd828050d070e1b88eb69c3f9db71c5d08f446)]: - [@posthog/types](https://github.com/posthog/types)@1.381.0 - [@posthog/core](https://github.com/posthog/core)@1.30.9 ### [`v1.380.1`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.380.1) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.380.0...posthog-js@1.380.1) #### 1.380.1 ##### Patch Changes - [#3743](https://github.com/PostHog/posthog-js/pull/3743) [`ced0039`](https://github.com/PostHog/posthog-js/commit/ced00399ed5f44018412d4b4bb214b8252e48bdb) Thanks [@robbie-c](https://github.com/robbie-c)! - fix(surveys): stop the survey CSS from using `:has(.survey-question:empty)`, which crashes some WebKit builds during text-node style invalidation while a survey renders. The empty-header margin tweak now keys off a JS-set `question-header--empty` class and a sibling selector instead. (2026-06-05) - Updated dependencies \[]: - [@posthog/types](https://github.com/posthog/types)@1.380.1 - [@posthog/core](https://github.com/posthog/core)@1.30.8 ### [`v1.380.0`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.380.0) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.379.3...posthog-js@1.380.0) #### 1.380.0 ##### Minor Changes - [#3715](https://github.com/PostHog/posthog-js/pull/3715) [`2387084`](https://github.com/PostHog/posthog-js/commit/2387084d4d7e28c606a0b0ab23ac0762dcf904d7) Thanks [@dustinbyrne](https://github.com/dustinbyrne)! - Promote browser tracing header configuration to the public `tracing_headers` option while keeping `addTracingHeaders` and `__add_tracing_headers` as deprecated aliases. (2026-06-04) ##### Patch Changes - [#3715](https://github.com/PostHog/posthog-js/pull/3715) [`2387084`](https://github.com/PostHog/posthog-js/commit/2387084d4d7e28c606a0b0ab23ac0762dcf904d7) Thanks [@dustinbyrne](https://github.com/dustinbyrne)! - When using tracing headers, `X-POSTHOG-DISTINCT-ID` is read at request time instead of when fetch/XHR is patched, ensuring it reflects bootstrap, identify, reset, and other identity changes. (2026-06-04) - Updated dependencies \[[`2387084`](https://github.com/PostHog/posthog-js/commit/2387084d4d7e28c606a0b0ab23ac0762dcf904d7)]: - [@posthog/types](https://github.com/posthog/types)@1.380.0 - [@posthog/core](https://github.com/posthog/core)@1.30.7 ### [`v1.379.3`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.379.3) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.379.2...posthog-js@1.379.3) #### 1.379.3 ##### Patch Changes - [#3741](https://github.com/PostHog/posthog-js/pull/3741) [`32de5d2`](https://github.com/PostHog/posthog-js/commit/32de5d2a061f04dc852b1cf31f63af5b86121f46) Thanks [@clr182](https://github.com/clr182)! - logs: the console-log integration now respects `opt_out_capturing()` — it checks `is_capturing()` before emitting, so log events stop on opt-out (and resume on opt-in). (2026-06-04) - Updated dependencies \[]: - [@posthog/types](https://github.com/posthog/types)@1.379.3 - [@posthog/core](https://github.com/posthog/core)@1.30.6 ### [`v1.379.2`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.379.2) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.379.1...posthog-js@1.379.2) #### 1.379.2 ##### Patch Changes - [#3736](https://github.com/PostHog/posthog-js/pull/3736) [`374962a`](https://github.com/PostHog/posthog-js/commit/374962a01267a37e9dedf44e0848ece4b3562749) Thanks [@arnohillen](https://github.com/arnohillen)! - replay: re-apply scroll positions after fast-forward/seek. Scrolls applied mid-catch-up could clamp to 0 when the target wasn't scrollable yet (e.g. scroll-revealed sheets/modals whose content sits below the fold), leaving the content scrolled out of view on replay. The last scroll per node is now re-applied in the flush stage once layout has settled. `posthog-js` is bumped too so the rebuilt bundle containing the fix is published. (2026-06-03) - Updated dependencies \[]: - [@posthog/types](https://github.com/posthog/types)@1.379.2 - [@posthog/core](https://github.com/posthog/core)@1.30.5 ### [`v1.379.1`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.379.1) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.379.0...posthog-js@1.379.1) #### 1.379.1 ##### Patch Changes - [#3570](https://github.com/PostHog/posthog-js/pull/3570) [`4a27ced`](https://github.com/PostHog/posthog-js/commit/4a27ced9567cf6aa6d5044fe3a0378f730661cfe) Thanks [@gruessi](https://github.com/gruessi)! - fix(record): release iframe documents and observers on iframe removal — same-origin iframes mounted and unmounted while session recording is active no longer leak their `Document`, every node serialized into the mirror, or one `MutationObserver` per mount. Closes eight retainer chains: load-listener disposers, named pagehide handlers, the `recordCrossOriginIframes` cleanup gate (now applied to same-origin too), captured `Document` / `Window` sets that survive `iframe.src` swap-to-`about:blank` before removal, and the global `mutationBuffers[]` / `handlers[]` arrays which previously accumulated forever. Validated end-to-end: a host page that mounts/unmounts 5 blob-URL iframes every 2s for 110s went from +118 MB / +390 leaked `HTMLDocument`s to \~0 MB / 0. (2026-06-03) - [#3717](https://github.com/PostHog/posthog-js/pull/3717) [`1688b38`](https://github.com/PostHog/posthog-js/commit/1688b380a27a57d6439d0bca936019a3fd6d63e2) Thanks [@turnipdabeets](https://github.com/turnipdabeets)! - Move the OpenTelemetry logs dependencies to `devDependencies`. They are only used to build the CDN-served `logs` extension chunk, which inlines them, so consumers no longer install the transitive `protobufjs` (whose `eval("require")` tripped `unsafe-eval` Content Security Policies). If you imported `@opentelemetry/*` directly while relying on it being hoisted from `posthog-js`, add it to your own dependencies. (2026-06-03) - Updated dependencies \[]: - [@posthog/types](https://github.com/posthog/types)@1.379.1 - [@posthog/core](https://github.com/posthog/core)@1.30.4 ### [`v1.379.0`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.379.0) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.378.1...posthog-js@1.379.0) #### 1.379.0 ##### Minor Changes - [#3722](https://github.com/PostHog/posthog-js/pull/3722) [`c487070`](https://github.com/PostHog/posthog-js/commit/c48707071586135de3357bf94e4165605c93e321) Thanks [@marandaneto](https://github.com/marandaneto)! - Add `$sdk_dist_channel` event property for browser SDK `npm` and `cdn` distribution channels. (2026-06-02) ##### Patch Changes - Updated dependencies \[]: - [@posthog/types](https://github.com/posthog/types)@1.379.0 - [@posthog/core](https://github.com/posthog/core)@1.30.3 ### [`v1.378.1`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.378.1) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.378.0...posthog-js@1.378.1) #### 1.378.1 ##### Patch Changes - [#3706](https://github.com/PostHog/posthog-js/pull/3706) [`8fcf40d`](https://github.com/PostHog/posthog-js/commit/8fcf40d3798a107f446dd75b13b81088eac1ab2c) Thanks [@dustinbyrne](https://github.com/dustinbyrne)! - fix(browser): avoid exposing internally-created Request bodies to downstream fetch wrappers in Safari. (2026-06-01) - Updated dependencies \[]: - [@posthog/types](https://github.com/posthog/types)@1.378.1 - [@posthog/core](https://github.com/posthog/core)@1.30.2 ### [`v1.378.0`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.378.0) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.377.0...posthog-js@1.378.0) #### 1.378.0 ##### Minor Changes - [#3688](https://github.com/PostHog/posthog-js/pull/3688) [`8181354`](https://github.com/PostHog/posthog-js/commit/8181354cae602f3f2b5e8c5b5bcd2e090e25edcc) Thanks [@pauldambra](https://github.com/pauldambra)! - feat(persistence): add `persistence_save_debounce_ms` config option to coalesce rapid storage saves into a single write. Setting a positive value debounces writes to localStorage/cookie by that window; the in-memory `props` object still updates synchronously so within-tab reads see the latest values immediately, and pending writes flush on `beforeunload` and `pagehide` so no state is lost on tab close. Cross-tab `storage` events are reduced proportionally to the debounce window. Defaults to `0` (no debouncing) for backwards compatibility. On pages that capture many events per second, `250` is a reasonable starting point. The new `2026-05-30` config default opts into `persistence_save_debounce_ms: 250` automatically. (2026-06-01) ##### Patch Changes - Updated dependencies \[[`8181354`](https://github.com/PostHog/posthog-js/commit/8181354cae602f3f2b5e8c5b5bcd2e090e25edcc)]: - [@posthog/types](https://github.com/posthog/types)@1.378.0 - [@posthog/core](https://github.com/posthog/core)@1.30.1 ### [`v1.377.0`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.377.0) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.376.6...posthog-js@1.377.0) #### 1.377.0 ##### Minor Changes - [#3708](https://github.com/PostHog/posthog-js/pull/3708) [`3d4a76f`](https://github.com/PostHog/posthog-js/commit/3d4a76f323ac789df91448fdb05d356dc91bb87f) Thanks [@pauldambra](https://github.com/pauldambra)! - Detect Brave (desktop, Android, iOS), Vivaldi, Yandex, Naver Whale, DuckDuckGo, Pale Moon, and Waterfox so users on these browsers no longer get bucketed as Chrome or Firefox. `detectBrowser` / `detectBrowserVersion` now accept an optional third argument, `BrowserDetectionHints`, with a `brave` flag (set when `navigator.brave` exists). The browser SDK populates this automatically to catch desktop / Android Brave, which is Chromium-based and carries no UA marker. Brave on iOS is picked up purely from the `Brave/` UA marker — WebKit doesn't ship `navigator.brave`. The original two-argument signature still works for non-DOM callers. (2026-06-01) ##### Patch Changes - [#3703](https://github.com/PostHog/posthog-js/pull/3703) [`f3cc6fa`](https://github.com/PostHog/posthog-js/commit/f3cc6fa8278547e8ea75c0b87d79cffa10158e45) Thanks [@marandaneto](https://github.com/marandaneto)! - Disable/no-op initialization paths instead of throwing or sending requests when PostHog project tokens are missing or blank. (2026-06-01) - Updated dependencies \[[`3d4a76f`](https://github.com/PostHog/posthog-js/commit/3d4a76f323ac789df91448fdb05d356dc91bb87f)]: - [@posthog/core](https://github.com/posthog/core)@1.30.0 - [@posthog/types](https://github.com/posthog/types)@1.377.0 ### [`v1.376.6`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.376.6) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.376.5...posthog-js@1.376.6) #### 1.376.6 ##### Patch Changes - [#3687](https://github.com/PostHog/posthog-js/pull/3687) [`663e250`](https://github.com/PostHog/posthog-js/commit/663e250b10df6bcadf42b7938fa3a77fb91f427b) Thanks [@pauldambra](https://github.com/pauldambra)! - fix(persistence): skip the storage write when the serialized props are unchanged. Callers spam `save()` after every property change, and many of those changes leave the serialized payload identical (e.g. resetting a value to its current value). Writing identical bytes to localStorage still fires a cross-tab `storage` event in every same-origin tab, where Chrome allocates the payload buffer in mojo IPC even though no listener reacts. Now `save()` compares the serialized payload against the last successful write and bails out when nothing changed. (2026-05-31) - Updated dependencies \[]: - [@posthog/types](https://github.com/posthog/types)@1.376.6 - [@posthog/core](https://github.com/posthog/core)@1.29.15 ### [`v1.376.5`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.376.5) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.376.4...posthog-js@1.376.5) #### 1.376.5 ##### Patch Changes - [#3686](https://github.com/PostHog/posthog-js/pull/3686) [`66cbc59`](https://github.com/PostHog/posthog-js/commit/66cbc5987427d539999834a2db3f0110ba6bd8c5) Thanks [@pauldambra](https://github.com/pauldambra)! - fix(persistence): throttle session-activity timestamp writes to a 5s granularity. The in-memory value still moves at full resolution; only writes to localStorage/cookie are coalesced. Activity-timestamp-only updates within the granularity window are skipped, dropping localStorage write pressure and cross-tab `storage` event broadcasts on pages that capture many events per second. The pending in-memory value is flushed on `destroy` and `beforeunload` so a tab close inside the window does not leave the persisted value up to 5s stale for sibling tabs. The flush re-reads storage first and bails out if a sibling tab has rotated the session, so the flush cannot clobber the new session with the old id/start. (2026-05-31) - Updated dependencies \[[`d9ad199`](https://github.com/PostHog/posthog-js/commit/d9ad1993d320ffc899dd57ce2f1cf1787e9c6635)]: - [@posthog/core](https://github.com/posthog/core)@1.29.14 - [@posthog/types](https://github.com/posthog/types)@1.376.5 ### [`v1.376.4`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.376.4) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.376.3...posthog-js@1.376.4) #### 1.376.4 ##### Patch Changes - [#3685](https://github.com/PostHog/posthog-js/pull/3685) [`f59f35a`](https://github.com/PostHog/posthog-js/commit/f59f35ac5a6a0aa98be5f3ea3b88370df8d398aa) Thanks [@ioannisj](https://github.com/ioannisj)! - fix(cookieless): enable request queue when opting out in `on_reject` mode. When using `cookieless_mode: "on_reject"`, calling `opt_out_capturing()` correctly switched the SDK into cookieless capturing but never enabled the `RequestQueue` — so batched events were enqueued but never flushed over the network. At init time the queue was not started because consent was `PENDING` and `is_capturing()` returned `false`; `opt_out_capturing()` is the first moment capturing becomes active but was missing the `_start_queue_if_opted_in()` call that `opt_in_capturing()` already had. (2026-05-28) - [#3692](https://github.com/PostHog/posthog-js/pull/3692) [`f01cd93`](https://github.com/PostHog/posthog-js/commit/f01cd939e096820b84666a463a61775ef69ce4c4) Thanks [@ksvat](https://github.com/ksvat)! - fix(replay): take a fresh full snapshot after session ID rotates via `forcedIdleReset`. Previously, when the session manager's idle enforcement timer rotated the session id, the recorder tore down rrweb and set `_isIdle = 'unknown'` before the new session id was observed. Neither restart path then fired (the `_onSessionIdCallback` guard only restarted when `_isIdle === true`, and `_updateWindowAndSessionIds` could not run with rrweb stopped), so the new session received only incremental mutations until a later snapshot — leaving the player stuck on "Buffering". The restart guard now also fires when rrweb isn't running. (2026-05-28) - [#3691](https://github.com/PostHog/posthog-js/pull/3691) [`cc71f3f`](https://github.com/PostHog/posthog-js/commit/cc71f3fa1f87838c28a68e593cd3f274f63db397) Thanks [@ksvat](https://github.com/ksvat)! - fix(replay): ship `ph-no-capture` absolute-position fix from [#3678](https://github.com/PostHog/posthog-js/issues/3678) to `posthog-js`. The original changeset only bumped `@posthog/rrweb` and `@posthog/rrweb-snapshot`; because `posthog-js` depends on `@posthog/rrweb` via `workspace:*`, the cascade did not bump `posthog-js`, so the rebuilt bundle containing the fix was not published. This changeset re-publishes `posthog-js` with the fix. (2026-05-28) - [#3695](https://github.com/PostHog/posthog-js/pull/3695) [`e1ff722`](https://github.com/PostHog/posthog-js/commit/e1ff722bf0bd333ffdf5d077f8f60893aaf7ef5e) Thanks [@ksvat](https://github.com/ksvat)! - chore(replay): expose `$sdk_debug_rrweb_attached` and `$sdk_debug_rrweb_start_attempted` debug properties on captured events. Today the SDK already stamps several `$sdk_debug_*` properties (start reason, linked-flag trigger status, recording status) that report the SDK's *intent* to record — they all flip to "active" as soon as the state machine evaluates the configured triggers. None of them observe whether rrweb actually attached and is producing events. The new booleans close that gap: `$sdk_debug_rrweb_start_attempted` is set when `_startRecorder()` is first entered, and `$sdk_debug_rrweb_attached` reflects whether `_stopRrweb` is currently a non-falsy stop handle (i.e. `rrwebRecord({...})` returned successfully and the recorder has not been torn down). No behavior change — this only adds two booleans to the existing `sdkDebugProperties` channel, used to diagnose cases where a session reports `trigger_activated` / `recording_status: active` but no `$snapshot` data is ever uploaded. (2026-05-28) - Updated dependencies \[[`7b84b75`](https://github.com/PostHog/posthog-js/commit/7b84b7599d076c9c3c86f923f7d56cf937ad9874)]: - [@posthog/core](https://github.com/posthog/core)@1.29.13 - [@posthog/types](https://github.com/posthog/types)@1.376.4 ### [`v1.376.3`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.376.3) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.376.2...posthog-js@1.376.3) #### 1.376.3 ##### Patch Changes - [#3649](https://github.com/PostHog/posthog-js/pull/3649) [`9cac1f6`](https://github.com/PostHog/posthog-js/commit/9cac1f650ed994a067bbffc5ec16b6d4dc65254f) Thanks [@marandaneto](https://github.com/marandaneto)! - Improve console log serialization performance for large objects. (2026-05-27) - Updated dependencies \[]: - [@posthog/types](https://github.com/posthog/types)@1.376.3 - [@posthog/core](https://github.com/posthog/core)@1.29.12 ### [`v1.376.2`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.376.2) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.376.1...posthog-js@1.376.2) #### 1.376.2 ##### Patch Changes - [#3667](https://github.com/PostHog/posthog-js/pull/3667) [`cafa9cc`](https://github.com/PostHog/posthog-js/commit/cafa9cc786a07613677ec16f2fc9f0c4e833a12c) Thanks [@pauldambra](https://github.com/pauldambra)! - fix(replay): stop polling preload-as-style `<link>` elements forever. Session recorder treated `<link rel="preload" as="style" href="*.css">` as if it were a stylesheet and waited for `link.sheet` to populate. Per spec preload links never instantiate a `CSSStyleSheet`, so the wait timed out, re-serialized the link, scheduled another wait, and leaked a `load` listener on every cycle — multiplying further on every real `load` event. Pages with Next.js-style CSS preloads accumulated thousands of active polling chains, saturating the main thread and freezing the tab on refocus (2026-05-26) - Updated dependencies \[]: - [@posthog/types](https://github.com/posthog/types)@1.376.2 - [@posthog/core](https://github.com/posthog/core)@1.29.11 ### [`v1.376.1`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.376.1) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.376.0...posthog-js@1.376.1) #### 1.376.1 ##### Patch Changes - Updated dependencies \[[`5568f12`](https://github.com/PostHog/posthog-js/commit/5568f12f46b4ebb7539f261edddda2f695ba03a2)]: - [@posthog/core](https://github.com/posthog/core)@1.29.10 - [@posthog/types](https://github.com/posthog/types)@1.376.1 ### [`v1.376.0`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.376.0) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.375.0...posthog-js@1.376.0) #### 1.376.0 ##### Minor Changes - [#3655](https://github.com/PostHog/posthog-js/pull/3655) [`6e8d349`](https://github.com/PostHog/posthog-js/commit/6e8d3495d0a29076aeea5220e19e646aeb7f063f) Thanks [@arnaudhillen](https://github.com/arnaudhillen)! - Expose the in-repo `@posthog/rrweb`, `@posthog/rrweb-types`, and `@posthog/rrweb-plugin-console-record` packages as subpath entry points on `posthog-js`. Consumers can now `import { Replayer } from 'posthog-js/rrweb'`, `import type { eventWithTime } from 'posthog-js/rrweb-types'`, and `import { LogLevel } from 'posthog-js/rrweb-plugin-console-record'` instead of installing the underlying rrweb packages directly. The rrweb worker sourcemap (`image-bitmap-data-url-worker-*.js.map`) is also shipped from `posthog-js/dist/` so downstream bundlers no longer need to reach into `node_modules/@posthog/rrweb`. (2026-05-22) ##### Patch Changes - [#3639](https://github.com/PostHog/posthog-js/pull/3639) [`c806cca`](https://github.com/PostHog/posthog-js/commit/c806ccafdcc39b38e9554f8a17a8c2fbd3361dda) Thanks [@marandaneto](https://github.com/marandaneto)! - Use native async gzip compression for session recording events when CompressionStream is available. (2026-05-22) - Updated dependencies \[[`c806cca`](https://github.com/PostHog/posthog-js/commit/c806ccafdcc39b38e9554f8a17a8c2fbd3361dda)]: - [@posthog/core](https://github.com/posthog/core)@1.29.9 - [@posthog/types](https://github.com/posthog/types)@1.376.0 ### [`v1.375.0`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.375.0) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.374.4...posthog-js@1.375.0) #### 1.375.0 ##### Minor Changes - [#3641](https://github.com/PostHog/posthog-js/pull/3641) [`2e1d5f4`](https://github.com/PostHog/posthog-js/commit/2e1d5f4081c98a04e6a16f57e42491911453994d) Thanks [@dustinbyrne](https://github.com/dustinbyrne)! - Add `flag_keys` config to restrict browser feature flag remote evaluation to specific flag keys. (2026-05-21) ##### Patch Changes - Updated dependencies \[[`2e1d5f4`](https://github.com/PostHog/posthog-js/commit/2e1d5f4081c98a04e6a16f57e42491911453994d)]: - [@posthog/types](https://github.com/posthog/types)@1.375.0 - [@posthog/core](https://github.com/posthog/core)@1.29.8 ### [`v1.374.4`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.374.4) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.374.3...posthog-js@1.374.4) #### 1.374.4 ##### Patch Changes - [#3638](https://github.com/PostHog/posthog-js/pull/3638) [`87e2145`](https://github.com/PostHog/posthog-js/commit/87e2145b5d09ed8a24df1fc337dad5c3c90c1b8a) Thanks [@marandaneto](https://github.com/marandaneto)! - Apply tracing headers to matching XMLHttpRequest requests (2026-05-21) - [#3646](https://github.com/PostHog/posthog-js/pull/3646) [`4f87827`](https://github.com/PostHog/posthog-js/commit/4f87827dda9c102a6deded986f2afd9fdddfb2e5) Thanks [@marandaneto](https://github.com/marandaneto)! - Avoid throwing or initializing PostHogProvider when no API key or client is provided (2026-05-21) - [#3645](https://github.com/PostHog/posthog-js/pull/3645) [`280832b`](https://github.com/PostHog/posthog-js/commit/280832b50b4c058e010436c4aab861cb143577c1) Thanks [@TueHaulund](https://github.com/TueHaulund)! - Capture `<link rel="stylesheet">` URLs from `link.sheet.href` and try `link.sheet` directly for inlining, so recordings survive SPA `history.pushState` navigations between routes of different path depths (where `link.href` re-resolves against a new baseURI but `link.sheet.href` preserves the URL the browser actually fetched). Ships the fix landed in [#3635](https://github.com/PostHog/posthog-js/issues/3635), which only bumped the internal `@posthog/rrweb-snapshot` package — that package is bundled into `posthog-js` at build time but is not published to npm on its own, so a `posthog-js` bump is needed to actually deliver the change. (2026-05-21) - Updated dependencies \[]: - [@posthog/types](https://github.com/posthog/types)@1.374.4 - [@posthog/core](https://github.com/posthog/core)@1.29.7 ### [`v1.374.3`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.374.3) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.374.2...posthog-js@1.374.3) #### 1.374.3 ##### Patch Changes - [#3607](https://github.com/PostHog/posthog-js/pull/3607) [`557b893`](https://github.com/PostHog/posthog-js/commit/557b8934aa0b990184e0376fb1fc28433ad336c6) Thanks [@eli-r-ph](https://github.com/eli-r-ph)! - Enable $web\_vitals reporting when cookieless mode is enabled (2026-05-20) - Updated dependencies \[[`557b893`](https://github.com/PostHog/posthog-js/commit/557b8934aa0b990184e0376fb1fc28433ad336c6), [`a880dbc`](https://github.com/PostHog/posthog-js/commit/a880dbcbbfd01bbef939c627f3b541744e3c3587)]: - [@posthog/types](https://github.com/posthog/types)@1.374.3 - [@posthog/core](https://github.com/posthog/core)@1.29.6 ### [`v1.374.2`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.374.2) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.374.1...posthog-js@1.374.2) #### 1.374.2 ##### Patch Changes - [#3550](https://github.com/PostHog/posthog-js/pull/3550) [`df91995`](https://github.com/PostHog/posthog-js/commit/df919950f298741980ed302828736cbf6785b1eb) Thanks [@TueHaulund](https://github.com/TueHaulund)! - Preserve session-recording remote config across `posthog.reset()`. `posthog.reset()` was clearing the entire persistence store, which wiped `$session_recording_remote_config` along with user state. On the next session rotation triggered by the reset, `start('session_id_changed')` would early-return because the remote config was missing — leaving rrweb torn down and the new session opening with no Meta + FullSnapshot until the next periodic 5-minute checkout. This affected any flow where an app calls `posthog.reset()` mid-session (e.g. on sign-out / sign-in) and was particularly visible on Flutter Web recordings that depend on a fresh FullSnapshot to anchor the CanvasKit DOM. (2026-05-18) - Updated dependencies \[]: - [@posthog/types](https://github.com/posthog/types)@1.374.2 - [@posthog/core](https://github.com/posthog/core)@1.29.5 ### [`v1.374.1`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.374.1) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.374.0...posthog-js@1.374.1) #### 1.374.1 ##### Patch Changes - [#3627](https://github.com/PostHog/posthog-js/pull/3627) [`07a0f5f`](https://github.com/PostHog/posthog-js/commit/07a0f5f7a25f9867047dd6c633b881f45caef72c) Thanks [@marandaneto](https://github.com/marandaneto)! - Respect transport overrides passed to posthog.capture. (2026-05-18) - Updated dependencies \[]: - [@posthog/types](https://github.com/posthog/types)@1.374.1 - [@posthog/core](https://github.com/posthog/core)@1.29.4 ### [`v1.374.0`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.374.0) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.373.5...posthog-js@1.374.0) #### 1.374.0 ##### Minor Changes - [#3620](https://github.com/PostHog/posthog-js/pull/3620) [`594ea11`](https://github.com/PostHog/posthog-js/commit/594ea1146045d49080f6dfd951b037c13278e975) Thanks [@pauldambra](https://github.com/pauldambra)! - Dead clicks: add a `.ph-no-deadclick` CSS class (and `capture_dead_clicks.css_selector_ignorelist` config option) to exclude specific elements from dead-click detection without affecting autocapture, session replay, or heatmaps. Mirrors the existing `.ph-no-rageclick` pattern. (2026-05-18) ##### Patch Changes - [#3621](https://github.com/PostHog/posthog-js/pull/3621) [`3c0a09f`](https://github.com/PostHog/posthog-js/commit/3c0a09f05ab768b94b5518a3109e44a5c9f33c70) Thanks [@pauldambra](https://github.com/pauldambra)! - Dead clicks: a click on an `<a>` (or any element inside an `<a>`, including across shadow DOM) is no longer flagged as a dead click — the browser navigates / downloads / opens a new window and we can't observe that. Reuses autocapture's existing DOM walker for the ancestor walk. Direct clicks on `<button>`, `<input>`, `<select>`, `<textarea>`, `<label>`, and `<form>` (previously all skipped) are now eligible for dead-click detection: if their JS handler ran, the existing mutation / scroll / selection observers see the effect; if it didn't, dead-click correctly surfaces the bug. A broken `<button>` with no handler, or an `<svg>` icon inside one, will now flag — which is exactly the dead-click case we want to catch. (2026-05-18) - Updated dependencies \[[`594ea11`](https://github.com/PostHog/posthog-js/commit/594ea1146045d49080f6dfd951b037c13278e975)]: - [@posthog/types](https://github.com/posthog/types)@1.374.0 - [@posthog/core](https://github.com/posthog/core)@1.29.3 ### [`v1.373.5`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.373.5) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.373.4...posthog-js@1.373.5) #### 1.373.5 ##### Patch Changes - [#3613](https://github.com/PostHog/posthog-js/pull/3613) [`221973e`](https://github.com/PostHog/posthog-js/commit/221973e4a2a50196ffb5c45c468f3de812ed82cf) Thanks [@lucasheriques](https://github.com/lucasheriques)! - Surveys: submit open text questions with Cmd/Ctrl+Enter. The textarea still inserts a newline on plain Enter (native behaviour), matching the convention used by Slack, GitHub, Discord, and ChatGPT for multi-line inputs. Single-line "Other:" inputs continue to submit on plain Enter as before. (2026-05-15) - Updated dependencies \[]: - [@posthog/types](https://github.com/posthog/types)@1.373.5 - [@posthog/core](https://github.com/posthog/core)@1.29.2 ### [`v1.373.4`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.373.4) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.373.3...posthog-js@1.373.4) #### 1.373.4 ##### Patch Changes - [#3602](https://github.com/PostHog/posthog-js/pull/3602) [`4b895bf`](https://github.com/PostHog/posthog-js/commit/4b895bf0151f24c0b72e8ce4cae47906795b29b8) Thanks [@marandaneto](https://github.com/marandaneto)! - Validate gzip request bodies at the browser send boundary and fall back to JSON if the outgoing body is not gzip data. (2026-05-12) - Updated dependencies \[[`4b895bf`](https://github.com/PostHog/posthog-js/commit/4b895bf0151f24c0b72e8ce4cae47906795b29b8)]: - [@posthog/core](https://github.com/posthog/core)@1.29.1 - [@posthog/types](https://github.com/posthog/types)@1.373.4 ### [`v1.373.3`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.373.3) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.373.2...posthog-js@1.373.3) #### 1.373.3 ##### Patch Changes - Updated dependencies \[[`ad60818`](https://github.com/PostHog/posthog-js/commit/ad60818222252f1b65bb8778b12862c287168422)]: - [@posthog/core](https://github.com/posthog/core)@1.29.0 - [@posthog/types](https://github.com/posthog/types)@1.373.3 ### [`v1.373.2`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.373.2) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.373.1...posthog-js@1.373.2) #### 1.373.2 ##### Patch Changes - [#3568](https://github.com/PostHog/posthog-js/pull/3568) [`223d925`](https://github.com/PostHog/posthog-js/commit/223d9255e3dfb02af099b7529292cb56854daa77) Thanks [@marandaneto](https://github.com/marandaneto)! - Validate native gzip output before sending requests and fall back when CompressionStream returns malformed data. (2026-05-11) - Updated dependencies \[[`223d925`](https://github.com/PostHog/posthog-js/commit/223d9255e3dfb02af099b7529292cb56854daa77)]: - [@posthog/core](https://github.com/posthog/core)@1.28.7 - [@posthog/types](https://github.com/posthog/types)@1.373.2 ### [`v1.373.1`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.373.1) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.373.0...posthog-js@1.373.1) #### 1.373.1 ##### Patch Changes - [#3566](https://github.com/PostHog/posthog-js/pull/3566) [`7d027bc`](https://github.com/PostHog/posthog-js/commit/7d027bcfef3f0ffa47bdb31cd41f07784c2f2e7c) Thanks [@dustinbyrne](https://github.com/dustinbyrne)! - Prevent browser log capture from throwing when console arguments contain unreadable properties. (2026-05-11) - Updated dependencies \[]: - [@posthog/types](https://github.com/posthog/types)@1.373.1 - [@posthog/core](https://github.com/posthog/core)@1.28.6 ### [`v1.373.0`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.373.0) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.372.10...posthog-js@1.373.0) #### 1.373.0 ##### Minor Changes - [#3547](https://github.com/PostHog/posthog-js/pull/3547) [`4c0c7d9`](https://github.com/PostHog/posthog-js/commit/4c0c7d9f48e6f4f5301f8208285191f62dc8407a) Thanks [@williamchong](https://github.com/williamchong)! - `capture()` now accepts an optional `uuid` on `CaptureOptions`. (2026-05-11) ##### Patch Changes - [#3561](https://github.com/PostHog/posthog-js/pull/3561) [`3511848`](https://github.com/PostHog/posthog-js/commit/3511848fd03bd77b117dccc6f06237a06d38d618) Thanks [@marandaneto](https://github.com/marandaneto)! - Handle invalid persisted session replay config JSON gracefully (2026-05-11) - [#3559](https://github.com/PostHog/posthog-js/pull/3559) [`0a835fa`](https://github.com/PostHog/posthog-js/commit/0a835fa1d5db988d508aa023240ab5b4b50f0969) Thanks [@marandaneto](https://github.com/marandaneto)! - Skip remote config background refreshes when no document is available. (2026-05-11) - Updated dependencies \[[`4c0c7d9`](https://github.com/PostHog/posthog-js/commit/4c0c7d9f48e6f4f5301f8208285191f62dc8407a), [`0a835fa`](https://github.com/PostHog/posthog-js/commit/0a835fa1d5db988d508aa023240ab5b4b50f0969)]: - [@posthog/types](https://github.com/posthog/types)@1.373.0 - [@posthog/core](https://github.com/posthog/core)@1.28.5 ### [`v1.372.10`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.372.10) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.372.9...posthog-js@1.372.10) #### 1.372.10 ##### Patch Changes - [#3544](https://github.com/PostHog/posthog-js/pull/3544) [`d120042`](https://github.com/PostHog/posthog-js/commit/d12004237985bc552423e31e75bb0fa42d0921ca) Thanks [@ksvat](https://github.com/ksvat)! - fix: stop session recording before destroying sessionManager in `opt_out_capturing()` with `cookieless_mode: "on_reject"`. Previously, queued/throttled rrweb events (e.g. mousemove) could fire after the sessionManager was set to `undefined` and throw `[SessionRecording] must be started with a valid sessionManager`. Also adds a defensive early-return in `onRRwebEmit` so any remaining late events bail out instead of throwing. (2026-05-07) - [#3542](https://github.com/PostHog/posthog-js/pull/3542) [`94a5ba0`](https://github.com/PostHog/posthog-js/commit/94a5ba0cf6d3a0f943517a126a59f52baa77f2fe) Thanks [@TueHaulund](https://github.com/TueHaulund)! - Preserve `<style>` textContent when the browser's CSSOM serialization would emit empty longhands from `var()` inside a shorthand. When a stylesheet has e.g. `padding: var(--p); padding-bottom: var(--pb);`, browsers store the shorthand's longhands with empty token lists per the CSS Custom Properties spec, and `CSSStyleRule.cssText` re-emits them as `padding-top: ; padding-right: ; padding-left: ;`. The previous behavior replaced the `<style>` text with that corrupted output, silently dropping layout rules on replay. We now detect the empty-longhand pattern and keep the original textContent in that case. Affects users of any CSS-in-JS framework that combines `var()` with shorthands (Chakra UI v3, Panda CSS, Emotion, etc.). Same class of bug as [rrweb-io/rrweb#1667](https://github.com/rrweb-io/rrweb/issues/1667). (2026-05-07) - Updated dependencies \[]: - [@posthog/types](https://github.com/posthog/types)@1.372.10 - [@posthog/core](https://github.com/posthog/core)@1.28.4 ### [`v1.372.9`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.372.9) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.372.8...posthog-js@1.372.9) #### 1.372.9 ##### Patch Changes - [#3537](https://github.com/PostHog/posthog-js/pull/3537) [`026e09d`](https://github.com/PostHog/posthog-js/commit/026e09d3d540ce39c06e88cd39db6c08403e855d) Thanks [@TueHaulund](https://github.com/TueHaulund)! - Pull in the canvas-manager fix from `@posthog/rrweb` 0.0.61: skip canvas snapshots while the WebGL context is lost so transparent bitmaps don't poison the worker's fingerprint dedup map and silently kill canvas recording for the rest of the session. Also wraps `getCanvas()` in try/catch so DOM/shadow-root traversal errors can't cancel the rAF loop. See PR [#3527](https://github.com/PostHog/posthog-js/issues/3527) for context. (2026-05-05) - Updated dependencies \[]: - [@posthog/types](https://github.com/posthog/types)@1.372.9 - [@posthog/core](https://github.com/posthog/core)@1.28.3 ### [`v1.372.8`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.372.8) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.372.7...posthog-js@1.372.8) #### 1.372.8 ##### Patch Changes - [#3515](https://github.com/PostHog/posthog-js/pull/3515) [`255b273`](https://github.com/PostHog/posthog-js/commit/255b27380658b450d1427d4a478e4d7a4bf773f1) Thanks [@marandaneto](https://github.com/marandaneto)! - Gate survey translation logs behind SDK debug logging to avoid production console spam. (2026-05-04) - Updated dependencies \[[`220cd61`](https://github.com/PostHog/posthog-js/commit/220cd61e332ca4982c7bc3b6f740d797ef9e4e7f), [`255b273`](https://github.com/PostHog/posthog-js/commit/255b27380658b450d1427d4a478e4d7a4bf773f1)]: - [@posthog/core](https://github.com/posthog/core)@1.28.2 - [@posthog/types](https://github.com/posthog/types)@1.372.8 ### [`v1.372.7`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.372.7) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.372.6...posthog-js@1.372.7) #### 1.372.7 ##### Patch Changes - Updated dependencies \[[`8aee3d5`](https://github.com/PostHog/posthog-js/commit/8aee3d55f8e2bf7a14a534c940327d8e08ba64f6)]: - [@posthog/core](https://github.com/posthog/core)@1.28.1 - [@posthog/types](https://github.com/posthog/types)@1.372.7 ### [`v1.372.6`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.372.6) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.372.5...posthog-js@1.372.6) #### 1.372.6 ##### Patch Changes - [#3492](https://github.com/PostHog/posthog-js/pull/3492) [`cf56753`](https://github.com/PostHog/posthog-js/commit/cf56753d775225df2751dee2de7987d4a47fef8c) Thanks [@lucasheriques](https://github.com/lucasheriques)! - Add translated survey rendering support in React Native and share survey translation logic through `@posthog/core`. (2026-05-01) - Updated dependencies \[[`cf56753`](https://github.com/PostHog/posthog-js/commit/cf56753d775225df2751dee2de7987d4a47fef8c), [`04db756`](https://github.com/PostHog/posthog-js/commit/04db75663208251d1b09c80b09e5d00188e897fd)]: - [@posthog/core](https://github.com/posthog/core)@1.28.0 - [@posthog/types](https://github.com/posthog/types)@1.372.6 ### [`v1.372.5`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.372.5) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.372.4...posthog-js@1.372.5) #### 1.372.5 ##### Patch Changes - [#3448](https://github.com/PostHog/posthog-js/pull/3448) [`c726aae`](https://github.com/PostHog/posthog-js/commit/c726aaea62483509469317870e6c3a3bedee3f18) Thanks [@posthog](https://github.com/apps/posthog)! - fix(exceptions): avoid cross-origin property access when calling the previous `window.onunhandledrejection` handler (2026-04-29) - Updated dependencies \[]: - [@posthog/types](https://github.com/posthog/types)@1.372.5 - [@posthog/core](https://github.com/posthog/core)@1.27.9 ### [`v1.372.4`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.372.4) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.372.3...posthog-js@1.372.4) #### 1.372.4 ##### Patch Changes - [#3495](https://github.com/PostHog/posthog-js/pull/3495) [`5a6b2a5`](https://github.com/PostHog/posthog-js/commit/5a6b2a55c015345909f93f744ebddd618e1fc85d) Thanks [@posthog](https://github.com/apps/posthog)! - Fix copy autocapture when copying or cutting text from Shadow DOM or document fragment contexts. (2026-04-29) - Updated dependencies \[]: - [@posthog/types](https://github.com/posthog/types)@1.372.4 - [@posthog/core](https://github.com/posthog/core)@1.27.8 ### [`v1.372.3`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.372.3) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.372.2...posthog-js@1.372.3) #### 1.372.3 ##### Patch Changes - [#3488](https://github.com/PostHog/posthog-js/pull/3488) [`5b8efc3`](https://github.com/PostHog/posthog-js/commit/5b8efc35d9acf77db2d6979ffa4b655b5f279721) Thanks [@lucasheriques](https://github.com/lucasheriques)! - Add browser survey translation rendering and language tracking. (2026-04-27) - Updated dependencies \[]: - [@posthog/types](https://github.com/posthog/types)@1.372.3 - [@posthog/core](https://github.com/posthog/core)@1.27.7 ### [`v1.372.2`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.372.2) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.372.1...posthog-js@1.372.2) #### 1.372.2 ##### Patch Changes - [#3484](https://github.com/PostHog/posthog-js/pull/3484) [`cba2570`](https://github.com/PostHog/posthog-js/commit/cba25700dca2e8d8e138ea6034bd42dc9d002596) Thanks [@veryayskiy](https://github.com/veryayskiy)! - Fix autofocus (2026-04-27) - Updated dependencies \[]: - [@posthog/types](https://github.com/posthog/types)@1.372.2 - [@posthog/core](https://github.com/posthog/core)@1.27.6 ### [`v1.372.1`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.372.1) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.372.0...posthog-js@1.372.1) #### 1.372.1 ##### Patch Changes - [#3464](https://github.com/PostHog/posthog-js/pull/3464) [`70508df`](https://github.com/PostHog/posthog-js/commit/70508dfd7dd1201dd9c61c126a3c27ad39311c6a) Thanks [@dustinbyrne](https://github.com/dustinbyrne)! - Avoid using `Blob.stream()` for native async gzip compression to prevent Safari `NotReadableError` stream failures. (2026-04-24) - Updated dependencies \[[`70508df`](https://github.com/PostHog/posthog-js/commit/70508dfd7dd1201dd9c61c126a3c27ad39311c6a)]: - [@posthog/core](https://github.com/posthog/core)@1.27.5 - [@posthog/types](https://github.com/posthog/types)@1.372.1 ### [`v1.372.0`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.372.0) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.371.4...posthog-js@1.372.0) #### 1.372.0 ##### Minor Changes - [#3470](https://github.com/PostHog/posthog-js/pull/3470) [`eaa1322`](https://github.com/PostHog/posthog-js/commit/eaa1322bcbf6606bb188f84ac64246a8cfb22256) Thanks [@veryayskiy](https://github.com/veryayskiy)! - You cannot write to a resolve ticket. Start a new one. (2026-04-24) ##### Patch Changes - Updated dependencies \[]: - [@posthog/types](https://github.com/posthog/types)@1.372.0 - [@posthog/core](https://github.com/posthog/core)@1.27.4 ### [`v1.371.4`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.371.4) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.371.3...posthog-js@1.371.4) #### 1.371.4 ##### Patch Changes - [#3469](https://github.com/PostHog/posthog-js/pull/3469) [`3c4fc1e`](https://github.com/PostHog/posthog-js/commit/3c4fc1e70f3f2394fbdd141efda44bdbddbb9062) Thanks [@fasyy612](https://github.com/fasyy612)! - bump rrweb to 0.0.60 (2026-04-24) - Updated dependencies \[]: - [@posthog/types](https://github.com/posthog/types)@1.371.4 - [@posthog/core](https://github.com/posthog/core)@1.27.3 ### [`v1.371.3`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.371.3) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.371.2...posthog-js@1.371.3) #### 1.371.3 ##### Patch Changes - [#3445](https://github.com/PostHog/posthog-js/pull/3445) [`61cf83e`](https://github.com/PostHog/posthog-js/commit/61cf83efbd0dd846ace9281b001daa0d633fcd8c) Thanks [@dustinbyrne](https://github.com/dustinbyrne)! - Fix session recording in the full no-external browser bundles (2026-04-24) - Updated dependencies \[[`daf028d`](https://github.com/PostHog/posthog-js/commit/daf028d553f756b9f58c01b848ad2d431239458b)]: - [@posthog/core](https://github.com/posthog/core)@1.27.2 - [@posthog/types](https://github.com/posthog/types)@1.371.3 ### [`v1.371.2`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.371.2) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.371.1...posthog-js@1.371.2) #### 1.371.2 ##### Patch Changes - [#3453](https://github.com/PostHog/posthog-js/pull/3453) [`96f19b7`](https://github.com/PostHog/posthog-js/commit/96f19b79d563937ed8f98e12796eee541a2dae7f) Thanks [@turnipdabeets](https://github.com/turnipdabeets)! - Lift OTLP log serialization helpers from posthog-js into [@posthog/core](https://github.com/posthog/core) so the upcoming React Native logs feature consumes the same builders. Browser gains two fixes as a side effect: NaN and ±Infinity attribute values no longer get silently dropped during JSON encoding, and the scope.version OTLP field is now populated with the SDK version (changes the server's instrumentation\_scope column from "posthog-js@" to "posthog-js@<semver>"). (2026-04-23) - Updated dependencies \[[`96f19b7`](https://github.com/PostHog/posthog-js/commit/96f19b79d563937ed8f98e12796eee541a2dae7f)]: - [@posthog/types](https://github.com/posthog/types)@1.371.2 - [@posthog/core](https://github.com/posthog/core)@1.27.1 ### [`v1.371.1`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.371.1) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.371.0...posthog-js@1.371.1) #### 1.371.1 ##### Patch Changes - [#3425](https://github.com/PostHog/posthog-js/pull/3425) [`2da17e8`](https://github.com/PostHog/posthog-js/commit/2da17e8c94b2705cb5852a9fe993925bf1e24b55) Thanks [@marandaneto](https://github.com/marandaneto)! - Classify SDK-owned persistence keys with an explicit event exposure policy so new internal persistence state must be intentionally marked as event-visible, hidden, or derived. (2026-04-23) - Updated dependencies \[]: - [@posthog/types](https://github.com/posthog/types)@1.371.1 ### [`v1.371.0`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.371.0) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.370.1...posthog-js@1.371.0) #### 1.371.0 ##### Patch Changes - [#3432](https://github.com/PostHog/posthog-js/pull/3432) [`1a8b727`](https://github.com/PostHog/posthog-js/commit/1a8b7277c50a42bbb3f736afd530ff1c3389a7de) Thanks [@richardsolomou](https://github.com/richardsolomou)! - refactor: rename `__add_tracing_headers` to `addTracingHeaders`. The `__` prefix signalled an internal/experimental option, but the config is a public API (documented for linking LLM traces to session replays). `__add_tracing_headers` continues to work as a deprecated alias on the browser SDK. Also exposes `patchFetchForTracingHeaders` from `@posthog/core` so non-browser SDKs can reuse the implementation. (2026-04-23) - Updated dependencies \[[`1a8b727`](https://github.com/PostHog/posthog-js/commit/1a8b7277c50a42bbb3f736afd530ff1c3389a7de)]: - [@posthog/core](https://github.com/posthog/core)@1.27.0 - [@posthog/types](https://github.com/posthog/types)@1.371.0 ### [`v1.370.1`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.370.1) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.370.0...posthog-js@1.370.1) #### 1.370.1 ##### Patch Changes - [#3442](https://github.com/PostHog/posthog-js/pull/3442) [`6f19ce8`](https://github.com/PostHog/posthog-js/commit/6f19ce8fed80f81e75552c5725b648e5f2e53634) Thanks [@marandaneto](https://github.com/marandaneto)! - fix(surveys): guard survey seen localStorage access (2026-04-22) - Updated dependencies \[]: - [@posthog/types](https://github.com/posthog/types)@1.370.1 ### [`v1.370.0`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.370.0) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.369.5...posthog-js@1.370.0) #### 1.370.0 ##### Minor Changes - [#3389](https://github.com/PostHog/posthog-js/pull/3389) [`922a1c1`](https://github.com/PostHog/posthog-js/commit/922a1c1838a5ed2ad37f59dade5fc3cc81bb4246) Thanks [@hpouillot](https://github.com/hpouillot)! - Add exception steps to error tracking (aka breadcrumbs) (2026-04-22) ##### Patch Changes - Updated dependencies \[[`922a1c1`](https://github.com/PostHog/posthog-js/commit/922a1c1838a5ed2ad37f59dade5fc3cc81bb4246)]: - [@posthog/types](https://github.com/posthog/types)@1.370.0 - [@posthog/core](https://github.com/posthog/core)@1.26.0 ### [`v1.369.5`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.369.5) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.369.4...posthog-js@1.369.5) #### 1.369.5 ##### Patch Changes - Updated dependencies \[[`1a0b58d`](https://github.com/PostHog/posthog-js/commit/1a0b58d1d07c61662169d3bc56eed8cfd8855d65)]: - [@posthog/core](https://github.com/posthog/core)@1.25.3 - [@posthog/types](https://github.com/posthog/types)@1.369.5 ### [`v1.369.4`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.369.4) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.369.3...posthog-js@1.369.4) #### 1.369.4 ##### Patch Changes - [#3362](https://github.com/PostHog/posthog-js/pull/3362) [`d61bce1`](https://github.com/PostHog/posthog-js/commit/d61bce11b4bd3abe95bcc76960bde585945a7edc) Thanks [@sampennington](https://github.com/sampennington)! - fix(cookieless): start in cookieless mode when opt\_out\_capturing\_by\_default is set (2026-04-21) - Updated dependencies \[]: - [@posthog/types](https://github.com/posthog/types)@1.369.4 ### [`v1.369.3`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.369.3) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.369.2...posthog-js@1.369.3) #### 1.369.3 ##### Patch Changes - [#3419](https://github.com/PostHog/posthog-js/pull/3419) [`ea08727`](https://github.com/PostHog/posthog-js/commit/ea087272bbe210e5610c9271aa1194776e927353) Thanks [@haacked](https://github.com/haacked)! - Reinstate `$feature_flag_payloads` and `$surveys_activated` in captured event properties. (2026-04-18) - [#3416](https://github.com/PostHog/posthog-js/pull/3416) [`3d8b2e2`](https://github.com/PostHog/posthog-js/commit/3d8b2e282927d0c09670b3f112c7dc159cebf059) Thanks [@feliperalmeida](https://github.com/feliperalmeida)! - Updated dependencies: - protobufjs\@7.5.5 (2026-04-18) - Updated dependencies \[]: - [@posthog/types](https://github.com/posthog/types)@1.369.3 ### [`v1.369.2`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.369.2) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.369.1...posthog-js@1.369.2) #### 1.369.2 ##### Patch Changes - [#3386](https://github.com/PostHog/posthog-js/pull/3386) [`4a65604`](https://github.com/PostHog/posthog-js/commit/4a65604775fe87c47e5fbdb5f03673f2481c26ea) Thanks [@dustinbyrne](https://github.com/dustinbyrne)! - Add a preview flag for versioned browser lazy bundle asset paths. (2026-04-16) - Updated dependencies \[[`4a65604`](https://github.com/PostHog/posthog-js/commit/4a65604775fe87c47e5fbdb5f03673f2481c26ea)]: - [@posthog/types](https://github.com/posthog/types)@1.369.2 ### [`v1.369.1`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.369.1) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.369.0...posthog-js@1.369.1) #### 1.369.1 ##### Patch Changes - [#3393](https://github.com/PostHog/posthog-js/pull/3393) [`85ae4d9`](https://github.com/PostHog/posthog-js/commit/85ae4d9e2bb4e3f487c9b27fc581ed38c1a82c99) Thanks [@haacked](https://github.com/haacked)! - Exclude active feature flag payloads from event properties (2026-04-16) - [#3392](https://github.com/PostHog/posthog-js/pull/3392) [`00cd1ce`](https://github.com/PostHog/posthog-js/commit/00cd1cef1d2d8a02339997bd3156aa1e395bea40) Thanks [@haacked](https://github.com/haacked)! - Fix unnecessary persisted config and activation properties (including product tours, surveys, and session recording config) added to captured events (2026-04-16) - Updated dependencies \[]: - [@posthog/types](https://github.com/posthog/types)@1.369.1 ### [`v1.369.0`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.369.0) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.368.2...posthog-js@1.369.0) #### 1.369.0 ##### Minor Changes - [#3342](https://github.com/PostHog/posthog-js/pull/3342) [`eea5260`](https://github.com/PostHog/posthog-js/commit/eea5260bbd58fb8b2d7f0550bb03d741aaab376a) Thanks [@ksvat](https://github.com/ksvat)! - Account for property filters on events in recording triggers for v2 triggers (2026-04-14) - [#3281](https://github.com/PostHog/posthog-js/pull/3281) [`b1fd228`](https://github.com/PostHog/posthog-js/commit/b1fd228eab45dc688b769378afa96a0f74167fab) Thanks [@ksvat](https://github.com/ksvat)! - Add session replay trigger groups handling (V2) (2026-04-14) ##### Patch Changes - Updated dependencies \[]: - [@posthog/types](https://github.com/posthog/types)@1.369.0 ### [`v1.368.2`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.368.2) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.368.1...posthog-js@1.368.2) #### 1.368.2 ##### Patch Changes - [#3378](https://github.com/PostHog/posthog-js/pull/3378) [`f1bea33`](https://github.com/PostHog/posthog-js/commit/f1bea33f64800c187f09a0989426ea0e73f43128) Thanks [@marandaneto](https://github.com/marandaneto)! - Disable native gzip compression after a NotReadableError in the browser SDK (2026-04-14) - Updated dependencies \[]: - [@posthog/types](https://github.com/posthog/types)@1.368.2 ### [`v1.368.1`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.368.1) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.368.0...posthog-js@1.368.1) #### 1.368.1 ##### Patch Changes - [#3379](https://github.com/PostHog/posthog-js/pull/3379) [`d7c71b1`](https://github.com/PostHog/posthog-js/commit/d7c71b1316720d972e41b63987ef57512d615ea7) Thanks [@dmarticus](https://github.com/dmarticus)! - Fix bootstrapped feature flags being overwritten by partial /flags response when `advanced_only_evaluate_survey_feature_flags` is enabled (2026-04-14) - Updated dependencies \[]: - [@posthog/types](https://github.com/posthog/types)@1.368.1 ### [`v1.368.0`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.368.0) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.367.0...posthog-js@1.368.0) #### 1.368.0 ##### Minor Changes - [#3345](https://github.com/PostHog/posthog-js/pull/3345) [`3fcf5c4`](https://github.com/PostHog/posthog-js/commit/3fcf5c449b3fe10ce187d40ea03425de9f94e85f) Thanks [@jonmcwest](https://github.com/jonmcwest)! - Add posthog.captureLog() API for sending structured log entries to PostHog logs (2026-04-13) ##### Patch Changes - [#3373](https://github.com/PostHog/posthog-js/pull/3373) [`f5fe0a8`](https://github.com/PostHog/posthog-js/commit/f5fe0a8b11457a33c02029162a43e4eb2d3cb2d9) Thanks [@ksvat](https://github.com/ksvat)! - bump rrweb version (2026-04-13) - Updated dependencies \[[`3fcf5c4`](https://github.com/PostHog/posthog-js/commit/3fcf5c449b3fe10ce187d40ea03425de9f94e85f)]: - [@posthog/types](https://github.com/posthog/types)@1.368.0 ### [`v1.367.0`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.367.0) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.366.2...posthog-js@1.367.0) #### 1.367.0 ##### Minor Changes - [#3242](https://github.com/PostHog/posthog-js/pull/3242) [`353be9a`](https://github.com/PostHog/posthog-js/commit/353be9a878fe209a032f2d70376ece78ee67303c) Thanks [@dustinbyrne](https://github.com/dustinbyrne)! - feat: Add support for pre-loaded remote-config (2026-04-09) ##### Patch Changes - Updated dependencies \[]: - [@posthog/types](https://github.com/posthog/types)@1.367.0 ### [`v1.366.2`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.366.2) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.366.1...posthog-js@1.366.2) #### 1.366.2 ##### Patch Changes - [#3364](https://github.com/PostHog/posthog-js/pull/3364) [`575e354`](https://github.com/PostHog/posthog-js/commit/575e354d0040bd83ac698495a4f0a07dece83eb3) Thanks [@lucasheriques](https://github.com/lucasheriques)! - Add a hover state to numeric survey rating options so they provide clearer pointer feedback before selection. (2026-04-09) - Updated dependencies \[]: - [@posthog/types](https://github.com/posthog/types)@1.366.2 ### [`v1.366.1`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.366.1) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.366.0...posthog-js@1.366.1) #### 1.366.1 ##### Patch Changes - [#3360](https://github.com/PostHog/posthog-js/pull/3360) [`802bf39`](https://github.com/PostHog/posthog-js/commit/802bf3919304f66694788bf0cb93e457326ab44b) Thanks [@jabahamondes](https://github.com/jabahamondes)! - Re-evaluate consent persistent store when config changes to support cross-subdomain consent sharing (2026-04-09) - Updated dependencies \[]: - [@posthog/types](https://github.com/posthog/types)@1.366.1 ### [`v1.366.0`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.366.0) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.365.5...posthog-js@1.366.0) #### 1.366.0 ##### Minor Changes - [#3305](https://github.com/PostHog/posthog-js/pull/3305) [`b599672`](https://github.com/PostHog/posthog-js/commit/b5996729b1d30fb99429c509e6a85ef8d7aca955) Thanks [@veryayskiy](https://github.com/veryayskiy)! - Add customer side identification (2026-04-09) ##### Patch Changes - Updated dependencies \[]: - [@posthog/types](https://github.com/posthog/types)@1.366.0 ### [`v1.365.5`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.365.5) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.365.4...posthog-js@1.365.5) #### 1.365.5 ##### Patch Changes - Updated dependencies \[[`c735b08`](https://github.com/PostHog/posthog-js/commit/c735b08577f8fa85935dcec5bc5814870ac4ed56)]: - [@posthog/core](https://github.com/posthog/core)@1.25.2 - [@posthog/types](https://github.com/posthog/types)@1.365.5 ### [`v1.365.4`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.365.4) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.365.3...posthog-js@1.365.4) #### 1.365.4 ##### Patch Changes - [#3353](https://github.com/PostHog/posthog-js/pull/3353) [`3939856`](https://github.com/PostHog/posthog-js/commit/3939856b917a3bad696cb7e5da73d4d50c3e0c53) Thanks [@lucasheriques](https://github.com/lucasheriques)! - Expose the current question index on `.survey-box` via a `data-question-index` attribute. This gives consumers rendering surveys via the API a reliable way to know which question is currently displayed without parsing input ids or class names — works for every question type, including link questions which render no input or rating element. (2026-04-08) - Updated dependencies \[]: - [@posthog/types](https://github.com/posthog/types)@1.365.4 ### [`v1.365.3`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.365.3) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.365.2...posthog-js@1.365.3) #### 1.365.3 ##### Patch Changes - [#3357](https://github.com/PostHog/posthog-js/pull/3357) [`dbdddca`](https://github.com/PostHog/posthog-js/commit/dbdddcad578adf282f620d2afcd5808600a9c287) Thanks [@pauldambra](https://github.com/pauldambra)! - Bump [@posthog/rrweb](https://github.com/posthog/rrweb) packages to 0.0.56, which includes: - [PostHog/posthog-rrweb#157](https://github.com/PostHog/posthog-rrweb/issues/157): fix: clear mutation buffer on iframe pagehide to prevent recording corruption - [PostHog/posthog-rrweb#158](https://github.com/PostHog/posthog-rrweb/issues/158): fix: skip unchanged setAttribute calls to prevent replay flicker - [PostHog/posthog-rrweb#159](https://github.com/PostHog/posthog-rrweb/issues/159): fix: prevent iframe leak in untainted prototype and avoid unnecessary iframe creation - [PostHog/posthog-rrweb#163](https://github.com/PostHog/posthog-rrweb/issues/163): fix: handle SecurityError in IframeManager destroy and removeIframeById - [PostHog/posthog-rrweb#166](https://github.com/PostHog/posthog-rrweb/issues/166): fix: remove postcss from [@posthog/rrweb-record](https://github.com/posthog/rrweb-record) bundle (420KB → 170KB) (2026-04-08) - Updated dependencies \[]: - [@posthog/types](https://github.com/posthog/types)@1.365.3 ### [`v1.365.2`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.365.2) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.365.1...posthog-js@1.365.2) #### 1.365.2 ##### Patch Changes - [#3323](https://github.com/PostHog/posthog-js/pull/3323) [`c387f6d`](https://github.com/PostHog/posthog-js/commit/c387f6dc146c9c09640e471e66043ad832b0476e) Thanks [@pauldambra](https://github.com/pauldambra)! - perf(replay): reduce memory and CPU cost of event compression by caching gzipped empty arrays and eliminating redundant JSON.stringify for size estimation (2026-04-08) - Updated dependencies \[[`c387f6d`](https://github.com/PostHog/posthog-js/commit/c387f6dc146c9c09640e471e66043ad832b0476e)]: - [@posthog/types](https://github.com/posthog/types)@1.365.2 ### [`v1.365.1`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.365.1) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.365.0...posthog-js@1.365.1) #### 1.365.1 ##### Patch Changes - Updated dependencies \[[`57ee5b2`](https://github.com/PostHog/posthog-js/commit/57ee5b25fd2c97f334f52b4eba28ea925033d6ed)]: - [@posthog/core](https://github.com/posthog/core)@1.25.1 - [@posthog/types](https://github.com/posthog/types)@1.365.1 ### [`v1.365.0`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.365.0) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.364.7...posthog-js@1.365.0) #### 1.365.0 ##### Minor Changes - [#3302](https://github.com/PostHog/posthog-js/pull/3302) [`fc5589f`](https://github.com/PostHog/posthog-js/commit/fc5589fcc51bd53ba818822831867d3c00d83a11) Thanks [@dmarticus](https://github.com/dmarticus)! - preserve $set\_once semantics in local flag evaluation cache (2026-04-07) ##### Patch Changes - Updated dependencies \[[`fc5589f`](https://github.com/PostHog/posthog-js/commit/fc5589fcc51bd53ba818822831867d3c00d83a11)]: - [@posthog/core](https://github.com/posthog/core)@1.25.0 - [@posthog/types](https://github.com/posthog/types)@1.365.0 ### [`v1.364.7`](https://github.com/PostHog/posthog-js/releases/tag/posthog-js%401.364.7) [Compare Source](https://github.com/PostHog/posthog-js/compare/posthog-js@1.364.6...posthog-js@1.364.7) #### 1.364.7 ##### Patch Changes - [#3319](https://github.com/PostHog/posthog-js/pull/3319) [`b25b689`](https://github.com/PostHog/posthog-js/commit/b25b68967f7e85317e2aacb8ecc4dc66a95095eb) Thanks [@dustinbyrne](https://github.com/dustinbyrne)! - fix: send $groupidentify for new groups even when no properties are provided (2026-04-03) - Updated dependencies \[]: - [@posthog/types](https://github.com/posthog/types)@1.364.7 </details> <details> <summary>react/react (react)</summary> ### [`v19.2.8`](https://github.com/react/react/releases/tag/v19.2.8): 19.2.8 (July 21st, 2026) [Compare Source](https://github.com/react/react/compare/v19.2.7...v19.2.8) ##### React Server Components - Performance improvements when decoding ([#37087](https://github.com/facebook/react/pull/37087) by [@eps1lon](https://github.com/eps1lon)) ### [`v19.2.7`](https://github.com/react/react/blob/HEAD/CHANGELOG.md#1927-June-1-2026) [Compare Source](https://github.com/react/react/compare/v19.2.6...v19.2.7) ##### React Server Components - Fixed missing `FormData` entries in Server Actions which regressed in 19.2.6 ([@unstubbable](https://github.com/unstubbable) [#36566](https://github.com/facebook/react/pull/36566)) ### [`v19.2.6`](https://github.com/react/react/blob/HEAD/CHANGELOG.md#1926-May-6-2026) [Compare Source](https://github.com/react/react/compare/v19.2.5...v19.2.6) ##### React Server Components - Type hardening and performance improvements ([@eps1lon](https://github.com/eps1lon), [@unstubbable](https://github.com/unstubbable) [#36425](https://github.com/facebook/react/pull/36425)) ### [`v19.2.5`](https://github.com/react/react/blob/HEAD/CHANGELOG.md#1925-March-18-2026) [Compare Source](https://github.com/react/react/compare/v19.2.4...v19.2.5) ##### React Server Components - Add more cycle protections ([@eps1lon](https://github.com/eps1lon), [@unstubbable](https://github.com/unstubbable) [#36236](https://github.com/facebook/react/pull/36236)) </details> <details> <summary>omgovich/react-colorful (react-colorful)</summary> ### [`v5.8.0`](https://github.com/omgovich/react-colorful/blob/HEAD/CHANGELOG.md#580) [Compare Source](https://github.com/omgovich/react-colorful/compare/5.7.0...v5.8.0) - Shadow DOM support: the picker now injects its styles into the closest `ShadowRoot` when rendered inside one (via [#232](https://github.com/omgovich/react-colorful/issues/232)) ### [`v5.7.0`](https://github.com/omgovich/react-colorful/blob/HEAD/CHANGELOG.md#570) [Compare Source](https://github.com/omgovich/react-colorful/compare/v5.6.2...5.7.0) - Add `onChangeEnd` callback that fires when the user finishes changing a color (on mouse up, touch end, or arrow key up). Useful for undo/redo, saving to a database, or other expensive operations (via [#230](https://github.com/omgovich/react-colorful/issues/230)) ### [`v5.6.2`](https://github.com/omgovich/react-colorful/blob/HEAD/CHANGELOG.md#562) [Compare Source](https://github.com/omgovich/react-colorful/compare/c7e87161d71be9156b0c149d0e110fa24fd7037d...v5.6.2) - Fix React 19 TypeScript compatibility (via [#229](https://github.com/omgovich/react-colorful/issues/229)) </details> <details> <summary>dcastil/tailwind-merge (tailwind-merge)</summary> ### [`v3.6.0`](https://github.com/dcastil/tailwind-merge/releases/tag/v3.6.0) [Compare Source](https://github.com/dcastil/tailwind-merge/compare/v3.5.0...v3.6.0) ##### New Features - Add support for Tailwind CSS v4.3 by [@dcastil](https://github.com/dcastil) in [#677](https://github.com/dcastil/tailwind-merge/pull/677) - Add `postfixLookupClassGroups` option to config to support Tailwind utilities where a slash is part of the full class name, like named container queries - Add support for readonly array values by [@unional](https://github.com/unional) in [#652](https://github.com/dcastil/tailwind-merge/pull/652) ##### Documentation - Fix broken links in README by [@maurer2](https://github.com/maurer2) in [#662](https://github.com/dcastil/tailwind-merge/pull/662) ##### Other - Harden internal CI pipeline security by omitting git checkout by [@dcastil](https://github.com/dcastil), suggested by [@kyletaylored](https://github.com/kyletaylored) in [`6b2499c`](https://github.com/dcastil/tailwind-merge/commit/6b2499c10cf52bed42426d30b4219e90374b30d6) **Full Changelog**: <https://github.com/dcastil/tailwind-merge/compare/v3.5.0...v3.6.0> Thanks to [@brandonmcconnell](https://github.com/brandonmcconnell), [@manavm1990](https://github.com/manavm1990), [@langy](https://github.com/langy), [@roboflow](https://github.com/roboflow), [@syntaxfm](https://github.com/syntaxfm), [@getsentry](https://github.com/getsentry), [@codecov](https://github.com/codecov), a private sponsor, [@block](https://github.com/block), [@openclaw](https://github.com/openclaw), [@sourcegraph](https://github.com/sourcegraph), [@mike-healy](https://github.com/mike-healy) and more via [@thnxdev](https://github.com/thnxdev) for sponsoring tailwind-merge! ❤️ ### [`v3.5.0`](https://github.com/dcastil/tailwind-merge/releases/tag/v3.5.0) [Compare Source](https://github.com/dcastil/tailwind-merge/compare/v3.4.1...v3.5.0) ##### New Features - Add support for Tailwind CSS v4.2 by [@dcastil](https://github.com/dcastil) in [#651](https://github.com/dcastil/tailwind-merge/pull/651) **Full Changelog**: <https://github.com/dcastil/tailwind-merge/compare/v3.4.1...v3.5.0> Thanks to [@brandonmcconnell](https://github.com/brandonmcconnell), [@manavm1990](https://github.com/manavm1990), [@langy](https://github.com/langy), [@roboflow](https://github.com/roboflow), [@syntaxfm](https://github.com/syntaxfm), [@getsentry](https://github.com/getsentry), [@codecov](https://github.com/codecov), a private sponsor, [@block](https://github.com/block), [@openclaw](https://github.com/openclaw), [@sourcegraph](https://github.com/sourcegraph) and more via [@thnxdev](https://github.com/thnxdev) for sponsoring tailwind-merge! ❤️ ### [`v3.4.1`](https://github.com/dcastil/tailwind-merge/releases/tag/v3.4.1) [Compare Source](https://github.com/dcastil/tailwind-merge/compare/v3.4.0...v3.4.1) ##### Bug Fixes - Prevent arbitrary font-family and font-weight from merging by [@roneymoon](https://github.com/roneymoon) in [#635](https://github.com/dcastil/tailwind-merge/pull/635) **Full Changelog**: <https://github.com/dcastil/tailwind-merge/compare/v3.4.0...v3.4.1> Thanks to [@brandonmcconnell](https://github.com/brandonmcconnell), [@manavm1990](https://github.com/manavm1990), [@langy](https://github.com/langy), [@roboflow](https://github.com/roboflow), [@syntaxfm](https://github.com/syntaxfm), [@getsentry](https://github.com/getsentry), [@codecov](https://github.com/codecov), a private sponsor, [@block](https://github.com/block), [@openclaw](https://github.com/openclaw), [@sourcegraph](https://github.com/sourcegraph) and more via [@thnxdev](https://github.com/thnxdev) for sponsoring tailwind-merge! ❤️ </details> <details> <summary>privatenumber/tsx (tsx)</summary> ### [`v4.23.1`](https://github.com/privatenumber/tsx/releases/tag/v4.23.1) [Compare Source](https://github.com/privatenumber/tsx/compare/v4.23.0...v4.23.1) ##### Bug Fixes - support tsImport after global preload ([8d4ffc2](https://github.com/privatenumber/tsx/commit/8d4ffc24f37b396ca2fe3f251aa92c4919f2c1a4)) - **watch:** avoid clearing piped output ([95d0672](https://github.com/privatenumber/tsx/commit/95d0672e0247a829ae4469daa493212967ea768e)) - **watch:** treat script and dependency paths literally ([79fddde](https://github.com/privatenumber/tsx/commit/79fddde523d3bb7d0af66682ce1265f95113a073)) ##### Performance Improvements - index transform cache lazily ([e818ad6](https://github.com/privatenumber/tsx/commit/e818ad608159a6fb36fb8a0bd59327fec313323d)) - load esbuild lazily in CLI ([d067938](https://github.com/privatenumber/tsx/commit/d0679381b60a55a9b5863603a4022a81db5d13c8)) - map Node TypeScript formats directly ([cdcc623](https://github.com/privatenumber/tsx/commit/cdcc6232a3277fb3028b226958b66c49a6d86c17)) - use sync module hooks on Node v22.22.3+ ([f8992f1](https://github.com/privatenumber/tsx/commit/f8992f1a50213e11b7ef8ab5121c78e0d2f29384)) *** This release is also available on: - [npm package (@latest dist-tag)](https://www.npmjs.com/package/tsx/v/4.23.1) ### [`v4.23.0`](https://github.com/privatenumber/tsx/releases/tag/v4.23.0) [Compare Source](https://github.com/privatenumber/tsx/compare/v4.22.5...v4.23.0) ##### Bug Fixes - avoid redundant filesystem probes during module resolution ([257bbbb](https://github.com/privatenumber/tsx/commit/257bbbb7eb2784cad6a3bb7a2d9c9747d28d96ec)), closes [privatenumber/tsx#809](https://github.com/privatenumber/tsx/issues/809) ##### Features - add multi-scenario startup benchmark suite ([c178197](https://github.com/privatenumber/tsx/commit/c178197b104d055fd3431f7448982f3156394d12)), closes [privatenumber/tsx#809](https://github.com/privatenumber/tsx/issues/809) [#809](https://github.com/privatenumber/tsx/issues/809) [hi#signal](https://github.com/hi/issues/signal) [privatenumber/tsx#145](https://github.com/privatenumber/tsx/issues/145) [#809](https://github.com/privatenumber/tsx/issues/809) *** This release is also available on: - [npm package (@latest dist-tag)](https://www.npmjs.com/package/tsx/v/4.23.0) ### [`v4.22.5`](https://github.com/privatenumber/tsx/releases/tag/v4.22.5) [Compare Source](https://github.com/privatenumber/tsx/compare/v4.22.4...v4.22.5) ##### Bug Fixes - isolate hook state per async module.register() registration ([a305f36](https://github.com/privatenumber/tsx/commit/a305f365f0cbcc31a44549dcbb0e63dc2883e96d)) *** This release is also available on: - [npm package (@latest dist-tag)](https://www.npmjs.com/package/tsx/v/4.22.5) ### [`v4.22.4`](https://github.com/privatenumber/tsx/releases/tag/v4.22.4) [Compare Source](https://github.com/privatenumber/tsx/compare/v4.22.3...v4.22.4) ##### Bug Fixes - resolve CommonJS directory requires inside dependencies ([#803](https://github.com/privatenumber/tsx/issues/803)) ([1ce8463](https://github.com/privatenumber/tsx/commit/1ce846335b7c445a3328c7d27f06424949356d97)) *** This release is also available on: - [npm package (@latest dist-tag)](https://www.npmjs.com/package/tsx/v/4.22.4) ### [`v4.22.3`](https://github.com/privatenumber/tsx/releases/tag/v4.22.3) [Compare Source](https://github.com/privatenumber/tsx/compare/v4.22.2...v4.22.3) ##### Bug Fixes - decode typed loader source ([dce02fc](https://github.com/privatenumber/tsx/commit/dce02fc3b8b64a58d24560714902b16f89332f1f)) - preserve entrypoint with TypeScript preload hooks ([68f72f3](https://github.com/privatenumber/tsx/commit/68f72f3304d8c3ff7048bde8571af9c163fcefa2)) *** This release is also available on: - [npm package (@latest dist-tag)](https://www.npmjs.com/package/tsx/v/4.22.3) ### [`v4.22.2`](https://github.com/privatenumber/tsx/releases/tag/v4.22.2) [Compare Source](https://github.com/privatenumber/tsx/compare/v4.22.1...v4.22.2) ##### Bug Fixes - preserve CJS JSON require in ESM hooks ([35b700b](https://github.com/privatenumber/tsx/commit/35b700bd8620696df03827068af29dcd0d091a60)) - preserve named exports from CommonJS TypeScript ([11de737](https://github.com/privatenumber/tsx/commit/11de737dae1fb9dae28db3716df5b1a7e1a6a089)) - support module.exports require(esm) interop ([cf8f199](https://github.com/privatenumber/tsx/commit/cf8f19918e4e0a0dc5ee5c52d8cc15e5e22d7c49)) *** This release is also available on: - [npm package (@latest dist-tag)](https://www.npmjs.com/package/tsx/v/4.22.2) ### [`v4.22.1`](https://github.com/privatenumber/tsx/releases/tag/v4.22.1) [Compare Source](https://github.com/privatenumber/tsx/compare/v4.22.0...v4.22.1) ##### Bug Fixes - resolve tsconfig path aliases containing a colon ([#780](https://github.com/privatenumber/tsx/issues/780)) ([6979f28](https://github.com/privatenumber/tsx/commit/6979f28810829dc79ec9baf406e162a18b65ab4b)) *** This release is also available on: - [npm package (@latest dist-tag)](https://www.npmjs.com/package/tsx/v/4.22.1) ### [`v4.22.0`](https://github.com/privatenumber/tsx/releases/tag/v4.22.0) [Compare Source](https://github.com/privatenumber/tsx/compare/v4.21.1...v4.22.0) ##### Features - upgrade esbuild to 0.28 ([#789](https://github.com/privatenumber/tsx/issues/789)) ([b29f6ee](https://github.com/privatenumber/tsx/commit/b29f6ee4d6872fdef474eb0a89c6d4e982478a77)) *** This release is also available on: - [npm package (@latest dist-tag)](https://www.npmjs.com/package/tsx/v/4.22.0) ### [`v4.21.1`](https://github.com/privatenumber/tsx/releases/tag/v4.21.1) [Compare Source](https://github.com/privatenumber/tsx/compare/v4.21.0...v4.21.1) ##### Bug Fixes - support Node 20.11/21.2 import.meta paths ([acf3d8f](https://github.com/privatenumber/tsx/commit/acf3d8ffee39fcb4655956fc052b78666aacbc3d)) - support Node.js 24.15.0 ([c1d2d45](https://github.com/privatenumber/tsx/commit/c1d2d45432eba7c6ff0785a43b0aeae85b5a3391)) - support Node.js 26.1.0 and 25.9.0 ([1d7e528](https://github.com/privatenumber/tsx/commit/1d7e528762a7e4f801175fd7d7d6082b00df3e5c)) *** This release is also available on: - [npm package (@latest dist-tag)](https://www.npmjs.com/package/tsx/v/4.21.1) </details> <details> <summary>microsoft/TypeScript (typescript)</summary> ### [`v6.0.3`](https://github.com/microsoft/TypeScript/releases/tag/v6.0.3): TypeScript 6.0.3 [Compare Source](https://github.com/microsoft/TypeScript/compare/v6.0.2...v6.0.3) For release notes, check out the [release announcement blog post](https://devblogs.microsoft.com/typescript/announcing-typescript-6-0/). - [fixed issues query for TypeScript 6.0.0 (Beta)](https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93\&q=milestone%3A%22TypeScript+6.0.0%22). - [fixed issues query for TypeScript 6.0.1 (RC)](https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93\&q=milestone%3A%22TypeScript+6.0.1%22). - [fixed issues query for TypeScript 6.0.2 (Stable)](https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93\&q=milestone%3A%22TypeScript+6.0.2%22). - [fixed issues query for TypeScript 6.0.3 (Stable)](https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93\&q=milestone%3A%22TypeScript+6.0.3%22). Downloads are available on: - [npm](https://www.npmjs.com/package/typescript) </details> <details> <summary>vitest-dev/vitest (vitest)</summary> ### [`v4.1.10`](https://github.com/vitest-dev/vitest/releases/tag/v4.1.10) [Compare Source](https://github.com/vitest-dev/vitest/compare/v4.1.9...v4.1.10) ##### 🐞 Bug Fixes - **browser**: Check fs access in builtin commands \[backport to v4] - by [@hi-ogawa](https://github.com/hi-ogawa), **Hiroshi Ogawa** and **OpenCode (claude-opus-4-8)** in [#10680](https://github.com/vitest-dev/vitest/issues/10680) [<samp>(5c18d)</samp>](https://github.com/vitest-dev/vitest/commit/5c18dd267) - **vm**: Fix external module resolve error with deps optimizer query for encoded URI \[backport to v4] - by [@SveLil](https://github.com/SveLil) and [@hi-ogawa](https://github.com/hi-ogawa) in [#10661](https://github.com/vitest-dev/vitest/issues/10661) [<samp>(bae52)</samp>](https://github.com/vitest-dev/vitest/commit/bae52b511) ##### [View changes on GitHub](https://github.com/vitest-dev/vitest/compare/v4.1.9...v4.1.10) ### [`v4.1.9`](https://github.com/vitest-dev/vitest/releases/tag/v4.1.9) [Compare Source](https://github.com/vitest-dev/vitest/compare/v4.1.8...v4.1.9) ##### 🐞 Bug Fixes - Fix `importOriginal` with optimizer and query import \[backport to v4] - by **Hiroshi Ogawa**, **David Harris**, **Codex**and **Vladimir** in [#10546](https://github.com/vitest-dev/vitest/issues/10546) [<samp>(a5180)</samp>](https://github.com/vitest-dev/vitest/commit/a5180190c) - **browser**: - Wait for orchestrator readiness before resolving browser sessions \[backport to v4] - by **Vladimir** and **Séamus O'Connor** in [#10555](https://github.com/vitest-dev/vitest/issues/10555) [<samp>(7fb29)</samp>](https://github.com/vitest-dev/vitest/commit/7fb29651a) - Wait for iframe tester readiness before preparing \[backport to v4] - by **Vladimir** and **Séamus O'Connor** in [#10497](https://github.com/vitest-dev/vitest/issues/10497) and [#10556](https://github.com/vitest-dev/vitest/issues/10556) [<samp>(fbc62)</samp>](https://github.com/vitest-dev/vitest/commit/fbc626c40) - **mocker**: - Hoist vi.mock() for vite-plus/test imports \[backport to v4] - by **Hiroshi Ogawa**, **LongYinan**, **Claude Opus 4.8** and **Vladimir** in [#10548](https://github.com/vitest-dev/vitest/issues/10548) [<samp>(2c955)</samp>](https://github.com/vitest-dev/vitest/commit/2c9559c02) - **pool**: - Prevent test run hang on worker crash \[backport to v4] - by **Ari Perkkiö** and **Jattioui Ismail** in [#10543](https://github.com/vitest-dev/vitest/issues/10543) and [#10564](https://github.com/vitest-dev/vitest/issues/10564) [<samp>(934b0)</samp>](https://github.com/vitest-dev/vitest/commit/934b0f587) ##### [View changes on GitHub](https://github.com/vitest-dev/vitest/compare/v4.1.8...v4.1.9) ### [`v4.1.8`](https://github.com/vitest-dev/vitest/releases/tag/v4.1.8) [Compare Source](https://github.com/vitest-dev/vitest/compare/v4.1.7...v4.1.8) ##### 🐞 Bug Fixes - **browser**: - Disable client `cdp` API when `allowWrite/allowExec: false` \[backport to v4] - by [@hi-ogawa](https://github.com/hi-ogawa) and **Codex** in [#10450](https://github.com/vitest-dev/vitest/issues/10450) [<samp>(e4067)</samp>](https://github.com/vitest-dev/vitest/commit/e4067b3b1) - Remove orphaned Playwright route when same module is mocked via multiple ids \[backport to v4] - by [@toxik](https://github.com/toxik) and [@Zelys-DFKH](https://github.com/Zelys-DFKH) in [#10474](https://github.com/vitest-dev/vitest/issues/10474) [<samp>(675b4)</samp>](https://github.com/vitest-dev/vitest/commit/675b4343f) ##### [View changes on GitHub](https://github.com/vitest-dev/vitest/compare/v4.1.7...v4.1.8) ### [`v4.1.7`](https://github.com/vitest-dev/vitest/releases/tag/v4.1.7) [Compare Source](https://github.com/vitest-dev/vitest/compare/v4.1.6...v4.1.7) ##### 🐞 Bug Fixes - **runner**: Limit concurrency per task branch in addition to per leaf callbacks (backport) - by [@hi-ogawa](https://github.com/hi-ogawa) in [#10384](https://github.com/vitest-dev/vitest/issues/10384) [<samp>(4f0f2)</samp>](https://github.com/vitest-dev/vitest/commit/4f0f2a1ee) ##### [View changes on GitHub](https://github.com/vitest-dev/vitest/compare/v4.1.6...v4.1.7) ### [`v4.1.6`](https://github.com/vitest-dev/vitest/releases/tag/v4.1.6) [Compare Source](https://github.com/vitest-dev/vitest/compare/v4.1.5...v4.1.6) ##### 🐞 Bug Fixes - **browser**: Provide project reference in `ToMatchScreenshotResolvePath` - by [@macarie](https://github.com/macarie) and [@sheremet-va](https://github.com/sheremet-va) in [#10138](https://github.com/vitest-dev/vitest/issues/10138) [<samp>(31882)</samp>](https://github.com/vitest-dev/vitest/commit/31882607c) - Global `sequence.concurrent: true` with top-level `test(..., { concurrent: false })` + depreacte `sequential` test API and options - by [@hi-ogawa](https://github.com/hi-ogawa), **Codex** and [@sheremet-va](https://github.com/sheremet-va) in [#10196](https://github.com/vitest-dev/vitest/issues/10196) [<samp>(2847d)</samp>](https://github.com/vitest-dev/vitest/commit/2847dfa2a) - **browser**: Simplify orchestrator otel carrier - by [@hi-ogawa](https://github.com/hi-ogawa) in [#10285](https://github.com/vitest-dev/vitest/issues/10285) [<samp>(18af9)</samp>](https://github.com/vitest-dev/vitest/commit/18af98cee) ##### 🏎 Performance - Stringify diff objects only once - by [@sheremet-va](https://github.com/sheremet-va) in [#10276](https://github.com/vitest-dev/vitest/issues/10276) [<samp>(9f7b1)</samp>](https://github.com/vitest-dev/vitest/commit/9f7b1528c) ##### [View changes on GitHub](https://github.com/vitest-dev/vitest/compare/v4.1.5...v4.1.6) ### [`v4.1.5`](https://github.com/vitest-dev/vitest/releases/tag/v4.1.5) [Compare Source](https://github.com/vitest-dev/vitest/compare/v4.1.4...v4.1.5) ##### 🚀 Experimental Features - **coverage**: Istanbul to support `instrumenter` option - by [@BartWaardenburg](https://github.com/BartWaardenburg) and [@AriPerkkio](https://github.com/AriPerkkio) in [#10119](https://github.com/vitest-dev/vitest/issues/10119) [<samp>(0e0ff)</samp>](https://github.com/vitest-dev/vitest/commit/0e0ff41c7) ##### 🐞 Bug Fixes - \--project negation excludes browser instances - by [@felamaslen](https://github.com/felamaslen) in [#10131](https://github.com/vitest-dev/vitest/issues/10131) [<samp>(9423d)</samp>](https://github.com/vitest-dev/vitest/commit/9423dc084) - Project color label on html reporter - by [@hi-ogawa](https://github.com/hi-ogawa) in [#10142](https://github.com/vitest-dev/vitest/issues/10142) [<samp>(596f7)</samp>](https://github.com/vitest-dev/vitest/commit/596f73986) - Fix `vi.defineHelper` called as object method - by [@hi-ogawa](https://github.com/hi-ogawa) in [#10163](https://github.com/vitest-dev/vitest/issues/10163) [<samp>(122c2)</samp>](https://github.com/vitest-dev/vitest/commit/122c25b5b) - Alias `agent` reporter to `minimal` - by [@sheremet-va](https://github.com/sheremet-va) in [#10157](https://github.com/vitest-dev/vitest/issues/10157) [<samp>(663b9)</samp>](https://github.com/vitest-dev/vitest/commit/663b99fe3) - Respect diff config options in soft assertions - by [@Copilot](https://github.com/Copilot), **sheremet-va** and [@sheremet-va](https://github.com/sheremet-va) in [#8696](https://github.com/vitest-dev/vitest/issues/8696) [<samp>(9787d)</samp>](https://github.com/vitest-dev/vitest/commit/9787dedad) - Respect diff config options in soft assertions " - by [@sheremet-va](https://github.com/sheremet-va) in [#8696](https://github.com/vitest-dev/vitest/issues/8696) [<samp>(7dc6d)</samp>](https://github.com/vitest-dev/vitest/commit/7dc6d54fd) - **ast-collect**: Recognize \_*vi\_import* prefix in static test discovery - by [@Yejneshwar](https://github.com/Yejneshwar) in [#10129](https://github.com/vitest-dev/vitest/issues/10129) [<samp>(32546)</samp>](https://github.com/vitest-dev/vitest/commit/325463ab2) - **coverage**: Descriptive error message when reports directory is removed during test run - by [@DaveT1991](https://github.com/DaveT1991) and [@AriPerkkio](https://github.com/AriPerkkio) in [#10117](https://github.com/vitest-dev/vitest/issues/10117) [<samp>(14133)</samp>](https://github.com/vitest-dev/vitest/commit/1413382e1) - **snapshot**: Increase default snapshot max output length - by [@hi-ogawa](https://github.com/hi-ogawa) and **Codex** in [#10150](https://github.com/vitest-dev/vitest/issues/10150) [<samp>(21e66)</samp>](https://github.com/vitest-dev/vitest/commit/21e66ff63) - **ui**: Fix jsx/tsx syntax highlight - by [@hi-ogawa](https://github.com/hi-ogawa) in [#10152](https://github.com/vitest-dev/vitest/issues/10152) [<samp>(f1b1f)</samp>](https://github.com/vitest-dev/vitest/commit/f1b1f6c7b) - **web-worker**: Support MessagePort objects referenced inside postMessage data - by [@whitphx](https://github.com/whitphx) and **Claude Opus 4.6 (1M context)** in [#9927](https://github.com/vitest-dev/vitest/issues/9927) and [#10124](https://github.com/vitest-dev/vitest/issues/10124) [<samp>(7ad7d)</samp>](https://github.com/vitest-dev/vitest/commit/7ad7d39af) - **api**: Make test-specification options writable - by [@sheremet-va](https://github.com/sheremet-va) in [#10154](https://github.com/vitest-dev/vitest/issues/10154) [<samp>(6abd5)</samp>](https://github.com/vitest-dev/vitest/commit/6abd557b7) ##### [View changes on GitHub](https://github.com/vitest-dev/vitest/compare/v4.1.4...v4.1.5) ### [`v4.1.4`](https://github.com/vitest-dev/vitest/releases/tag/v4.1.4) [Compare Source](https://github.com/vitest-dev/vitest/compare/v4.1.3...v4.1.4) ##### 🚀 Experimental Features - **coverage**: - Default to text reporter `skipFull` if agent detected - by [@hi-ogawa](https://github.com/hi-ogawa) in [#10018](https://github.com/vitest-dev/vitest/issues/10018) [<samp>(53757)</samp>](https://github.com/vitest-dev/vitest/commit/53757804c) - **experimental**: - Expose `assertion` as a public field - by [@sheremet-va](https://github.com/sheremet-va) in [#10095](https://github.com/vitest-dev/vitest/issues/10095) [<samp>(a120e)</samp>](https://github.com/vitest-dev/vitest/commit/a120e3ab8) - Support aria snapshot - by [@hi-ogawa](https://github.com/hi-ogawa), **Claude Opus 4.6 (1M context)**, [@AriPerkkio](https://github.com/AriPerkkio), **Codex** and [@sheremet-va](https://github.com/sheremet-va) in [#9668](https://github.com/vitest-dev/vitest/issues/9668) [<samp>(d4fbb)</samp>](https://github.com/vitest-dev/vitest/commit/d4fbb5cc9) - **reporter**: - Add filterMeta option to json reporter - by [@nami8824](https://github.com/nami8824) and [@sheremet-va](https://github.com/sheremet-va) in [#10078](https://github.com/vitest-dev/vitest/issues/10078) [<samp>(b77de)</samp>](https://github.com/vitest-dev/vitest/commit/b77de968e) ##### 🐞 Bug Fixes - Use "black" foreground for labeled terminal message to ensure contrast - by [@hi-ogawa](https://github.com/hi-ogawa) in [#10076](https://github.com/vitest-dev/vitest/issues/10076) [<samp>(203f0)</samp>](https://github.com/vitest-dev/vitest/commit/203f07af7) - Make `expect(..., message)` consistent as error message prefix - by [@hi-ogawa](https://github.com/hi-ogawa) and **Codex** in [#10068](https://github.com/vitest-dev/vitest/issues/10068) [<samp>(a1b5f)</samp>](https://github.com/vitest-dev/vitest/commit/a1b5f0f4f) - Do not hoist imports whose names match class properties . - by [@SunsetFi](https://github.com/SunsetFi) in [#10093](https://github.com/vitest-dev/vitest/issues/10093) and [#10094](https://github.com/vitest-dev/vitest/issues/10094) [<samp>(0fc4b)</samp>](https://github.com/vitest-dev/vitest/commit/0fc4b47e0) - **browser**: Spread user server options into browser Vite server in project - by [@GoldStrikeArch](https://github.com/GoldStrikeArch) in [#10049](https://github.com/vitest-dev/vitest/issues/10049) [<samp>(65c9d)</samp>](https://github.com/vitest-dev/vitest/commit/65c9d55eb) ##### [View changes on GitHub](https://github.com/vitest-dev/vitest/compare/v4.1.3...v4.1.4) ### [`v4.1.3`](https://github.com/vitest-dev/vitest/releases/tag/v4.1.3) [Compare Source](https://github.com/vitest-dev/vitest/compare/v4.1.2...v4.1.3) ##### 🚀 Experimental Features - Add `experimental.preParse` flag - by [@sheremet-va](https://github.com/sheremet-va) in [#10070](https://github.com/vitest-dev/vitest/issues/10070) [<samp>(78273)</samp>](https://github.com/vitest-dev/vitest/commit/7827363bd) - Support `browser.locators.exact` option - by [@sheremet-va](https://github.com/sheremet-va) in [#10013](https://github.com/vitest-dev/vitest/issues/10013) [<samp>(48799)</samp>](https://github.com/vitest-dev/vitest/commit/487990a19) - Add `TestAttachment.bodyEncoding` - by [@hi-ogawa](https://github.com/hi-ogawa) in [#9969](https://github.com/vitest-dev/vitest/issues/9969) [<samp>(89ca0)</samp>](https://github.com/vitest-dev/vitest/commit/89ca0e254) - Support custom snapshot matcher - by [@hi-ogawa](https://github.com/hi-ogawa), **Claude Sonnet 4.6** and **Codex** in [#9973](https://github.com/vitest-dev/vitest/issues/9973) [<samp>(59b0e)</samp>](https://github.com/vitest-dev/vitest/commit/59b0e6411) ##### 🐞 Bug Fixes - Advance fake timers with `expect.poll` interval - by [@hi-ogawa](https://github.com/hi-ogawa) and **Claude Sonnet 4.6** in [#10022](https://github.com/vitest-dev/vitest/issues/10022) [<samp>(3f5bf)</samp>](https://github.com/vitest-dev/vitest/commit/3f5bfa365) - Add `@vitest/coverage-v8` and `@vitest/coverage-istanbul` as optional dependency - by [@alan-agius4](https://github.com/alan-agius4) in [#10025](https://github.com/vitest-dev/vitest/issues/10025) [<samp>(146d4)</samp>](https://github.com/vitest-dev/vitest/commit/146d4f0a0) - Fix `defineHelper` for webkit async stack trace + update playwright 1.59.0 - by [@hi-ogawa](https://github.com/hi-ogawa) in [#10036](https://github.com/vitest-dev/vitest/issues/10036) [<samp>(5a5fa)</samp>](https://github.com/vitest-dev/vitest/commit/5a5fa49fe) - Fix suite hook throwing errors for unused auto test-scoped fixture - by [@hi-ogawa](https://github.com/hi-ogawa) and **Claude Sonnet 4.6** in [#10035](https://github.com/vitest-dev/vitest/issues/10035) [<samp>(39865)</samp>](https://github.com/vitest-dev/vitest/commit/398657e8d) - **expect**: - Remove `JestExtendError.context` from verbose error reporting - by [@hi-ogawa](https://github.com/hi-ogawa) in [#9983](https://github.com/vitest-dev/vitest/issues/9983) [<samp>(66751)</samp>](https://github.com/vitest-dev/vitest/commit/66751c9e8) - Don't leak "runner" types - by [@sheremet-va](https://github.com/sheremet-va) in [#10004](https://github.com/vitest-dev/vitest/issues/10004) [<samp>(ec204)</samp>](https://github.com/vitest-dev/vitest/commit/ec2045543) - **snapshot**: - Fix flagging obsolete snapshots for snapshot properties mismatch - by [@hi-ogawa](https://github.com/hi-ogawa) and **Claude Sonnet 4.6** in [#9986](https://github.com/vitest-dev/vitest/issues/9986) [<samp>(6b869)</samp>](https://github.com/vitest-dev/vitest/commit/6b869156b) - Export custom snapshot matcher helper from `vitest` - by [@hi-ogawa](https://github.com/hi-ogawa) and **Codex** in [#10042](https://github.com/vitest-dev/vitest/issues/10042) [<samp>(691d3)</samp>](https://github.com/vitest-dev/vitest/commit/691d341fd) - **ui**: - Don't leak vite types - by [@sheremet-va](https://github.com/sheremet-va) in [#10005](https://github.com/vitest-dev/vitest/issues/10005) [<samp>(fdff1)</samp>](https://github.com/vitest-dev/vitest/commit/fdff1bf9a) - **vm**: - Fix external module resolve error with deps optimizer query - by [@hi-ogawa](https://github.com/hi-ogawa) and **Claude Sonnet 4.6** in [#10024](https://github.com/vitest-dev/vitest/issues/10024) [<samp>(9dbf4)</samp>](https://github.com/vitest-dev/vitest/commit/9dbf47786) ##### [View changes on GitHub](https://github.com/vitest-dev/vitest/compare/v4.1.2...v4.1.3) </details> <details> <summary>colinhacks/zod (zod)</summary> ### [`v4.4.3`](https://github.com/colinhacks/zod/releases/tag/v4.4.3) [Compare Source](https://github.com/colinhacks/zod/compare/v4.4.2...v4.4.3) #### Commits: - [`4c2fa95`](https://github.com/colinhacks/zod/commit/4c2fa95ce3f3390fbc522324e406b4e9e89b88f9) docs: use Zernio primary wordmark for gold sponsor logo - [`2aeec83`](https://github.com/colinhacks/zod/commit/2aeec83eb135e3a83756e973ef44845fc5a455d2) docs: prune lapsed gold sponsors and rebalance logo sizing - [`7391be8`](https://github.com/colinhacks/zod/commit/7391be88ac1ee5cd02057f5ccc012a1f5df4efd0) docs: prune lapsed silver/bronze sponsors and add active ones - [`2c70332`](https://github.com/colinhacks/zod/commit/2c703322a21b4e2b12f33f49ea8430c451a68b4f) docs: normalize bronze sponsor logos to github avatar pattern - [`9195250`](https://github.com/colinhacks/zod/commit/9195250cab0e7950efe39c3926d6c203b4b0a170) docs: remove Mintlify from bronze sponsors (churned) - [`b8dffe9`](https://github.com/colinhacks/zod/commit/b8dffe9e62f17e6571e6249d05cc5102b54d94e4) docs: remove Numeric and Speakeasy (2+ missed monthly cycles) - [`1cab693`](https://github.com/colinhacks/zod/commit/1cab69383fcdeae2a366d5e2a2fc4d8fc765d168) fix(v4): restore catch handling for absent object keys ([#5937](https://github.com/colinhacks/zod/issues/5937)) ([#5939](https://github.com/colinhacks/zod/issues/5939)) - [`c2be4f8`](https://github.com/colinhacks/zod/commit/c2be4f819064eed62c7c350a2d399b5faecd15f8) fix(v4): generalize optin/fallback to transform; restore preprocess on absent keys ([#5941](https://github.com/colinhacks/zod/issues/5941)) - [`f3c9ec0`](https://github.com/colinhacks/zod/commit/f3c9ec03ba7a28ae72d25cc295f38674bee0f559) 4.4.3 - [`1fb56a5`](https://github.com/colinhacks/zod/commit/1fb56a5c18c27102dbc92260a4007c7732a0ccca) docs: document release procedure in AGENTS.md ### [`v4.4.2`](https://github.com/colinhacks/zod/releases/tag/v4.4.2) [Compare Source](https://github.com/colinhacks/zod/compare/v4.4.1...v4.4.2) #### Commits: - [`0c62df0`](https://github.com/colinhacks/zod/commit/0c62df0ea19fd05abdf90473e9eef7eea530fab2) Clean up docs navigation and stale labels ([#5901](https://github.com/colinhacks/zod/issues/5901)) - [`20cc794`](https://github.com/colinhacks/zod/commit/20cc794895cc8604fe0c87d83a5d1c3f89fad0ac) chore: add security policy and refresh tooling deps - [`6fbe07b`](https://github.com/colinhacks/zod/commit/6fbe07b0177efdd1bf1c0b05160e70d7a0702337) fix(docs): heading anchor links now include the hash so it doesnt scoll all the way up, follows navbar logic ([#5791](https://github.com/colinhacks/zod/issues/5791)) - [`4bbed1b`](https://github.com/colinhacks/zod/commit/4bbed1b1c73eca4ce9e59b1189ed236aa6c8b5bd) Tighten discriminated union option typing - [`bbac3e5`](https://github.com/colinhacks/zod/commit/bbac3e567e7fccfaaf7cdc97f1ce30c295e2c908) Update PR guidance for agents - [`cf0dc94`](https://github.com/colinhacks/zod/commit/cf0dc942a32805c292fff59ade20a7ace980735a) Merge remote-tracking branch 'origin/main' into fix-discriminated-union-key-constraint - [`292c894`](https://github.com/colinhacks/zod/commit/292c894a5fd2aa42e527900b83d8d7a3009a709c) docs: add Zernio gold sponsor - [`1fc9f31`](https://github.com/colinhacks/zod/commit/1fc9f311c28dcf80d0bb5a36b177086cbc3d8eca) docs: document codec inversion - [`1373c85`](https://github.com/colinhacks/zod/commit/1373c85da9aeff704a9762d27bc58699618aefb7) docs: remove AI disclosure guidance - [`e20d02b`](https://github.com/colinhacks/zod/commit/e20d02b473c08e3a4e557bc610b1b5fac079b649) chore: ignore triage notes - [`e58ea4d`](https://github.com/colinhacks/zod/commit/e58ea4d91b1dfe8194b73508203213cbc7e9c936) docs: test Zod Mini tab code heights - [`905761a`](https://github.com/colinhacks/zod/commit/905761a5d127e8d5dd2ebb3bc88c75cb0b8149ff) docs: document preprocess input type narrowing - [`bf64bac`](https://github.com/colinhacks/zod/commit/bf64bac850d4dee2b7dde7e64909d5d796d32043) chore: tighten test guidance in AGENTS.md - [`8ec4e73`](https://github.com/colinhacks/zod/commit/8ec4e73f4c4693b6361ad591be40fb41eb8a9f95) chore: update play.ts scratch - [`02c2baf`](https://github.com/colinhacks/zod/commit/02c2baf7d0d615872fa4528a8020603b71211702) Make z.preprocess defer optionality to inner schema ([#5929](https://github.com/colinhacks/zod/issues/5929)) - [`88015df`](https://github.com/colinhacks/zod/commit/88015df8e25c44fb5385eb3ef28935119cd5edea) fix(docs): drop deprecated `baseUrl` from tsconfig - [`c59d447`](https://github.com/colinhacks/zod/commit/c59d4474e3b4cad1b323462186cf607178ce8267) 4.4.2 ### [`v4.4.1`](https://github.com/colinhacks/zod/releases/tag/v4.4.1) [Compare Source](https://github.com/colinhacks/zod/compare/v4.4.0...v4.4.1) #### Commits: - [`481f7be`](https://github.com/colinhacks/zod/commit/481f7be4238c83ed58183f921b2646f340a91c6a) ci: gate release publishing on full test workflow - [`95ccab4`](https://github.com/colinhacks/zod/commit/95ccab423aec720b2523c3a64cdc7e3204537cc7) test(v3): restore optional undefined expectations - [`cede2c6`](https://github.com/colinhacks/zod/commit/cede2c63739a5823d6aa5093d291e9a111da943d) fix(v4): reject tuple holes before required defaults ([#5900](https://github.com/colinhacks/zod/issues/5900)) - [`edd0bf0`](https://github.com/colinhacks/zod/commit/edd0bf0f5ada4a8dc581c259407d7bbad0a71ea7) release: 4.4.1 - [`180d83d`](https://github.com/colinhacks/zod/commit/180d83d1dbe6a59260710cc8637a3dea2281ee56) docs: remove Jazz featured sponsor ### [`v4.4.0`](https://github.com/colinhacks/zod/releases/tag/v4.4.0) [Compare Source](https://github.com/colinhacks/zod/compare/v4.3.6...v4.4.0) #### 4.4.0 This is a minor release with a wide set of correctness and soundness fixes. Some fixes intentionally make Zod stricter, so code that depended on previously accepted invalid or ambiguous inputs may need small updates. #### Potentially breaking bug fixes ##### Tuple defaults now materialize output values correctly Fixed in [#5661](https://github.com/colinhacks/zod/pull/5661). Tuple parsing now more accurately reflects defaults, optional tails, explicit `undefined`, and under-filled inputs. The headline behavior is that defaults in tuple positions now properly appear in parsed output. ```ts const schema = z.tuple([ z.string(), z.string().default("fallback"), ]); schema.parse(["a"]); // ["a", "fallback"] ``` Trailing optional elements that are absent still stay absent; they are not filled with `undefined`. ```ts const schema = z.tuple([ z.string(), z.string().optional(), ]); schema.parse(["a"]); // ["a"] ``` But explicit `undefined` values supplied by the caller are preserved. ```ts schema.parse(["a", undefined]); // ["a", undefined] ``` When optional elements appear before later defaults, the parsed tuple is now dense so array operations behave predictably. ```ts const schema = z.tuple([ z.string(), z.string().optional(), z.string().default("fallback"), ]); schema.parse(["a"]); // ["a", undefined, "fallback"] ``` Tuple length errors are also more consistent now. Since `z.function()` arguments are tuple-shaped, function input errors may look different. ##### Required object properties with `z.undefined()` Fixed in [#5661](https://github.com/colinhacks/zod/pull/5661), with follow-up coverage in [`57d80a82`](https://github.com/colinhacks/zod/commit/57d80a82bde8877f3eb79e5dad9786096c37490f). A property whose schema is `z.undefined()` is now treated as required. The key must be present, but its value may be `undefined`. ```ts const schema = z.object({ value: z.undefined(), }); schema.safeParse({}).success; // false schema.safeParse({ value: undefined }).success; // true ``` Use `.optional()` when the key itself may be absent. ```ts const schema = z.object({ value: z.undefined().optional(), }); schema.safeParse({}).success; // true ``` This also affects related `.catch()`, `.partial()`, `.default()`, and `.prefault()` combinations that previously relied on missing `z.undefined()` keys being treated as optional. ##### Safer `.merge()` behavior with refinements Fixed in [#5856](https://github.com/colinhacks/zod/pull/5856). The `.merge()` method now throws when the receiver has refinements, rather than silently producing ambiguous refinement behavior. Refinements from the second schema are preserved. ```ts const a = z.object({ a: z.string() }).refine((val) => val.a.length > 0); const b = z.object({ b: z.string() }); a.merge(b); // throws ``` > Prefer `.extend()` or `.safeExtend()` for object composition. The `.merge()` method is still supported for compatibility, but it is discouraged for new code because its semantics around overlapping keys and refinements are easier to misread. ##### JSON Schema `$defs` entries no longer include redundant `id` Fixed in [#5759](https://github.com/colinhacks/zod/pull/5759). JSON Schema conversion through `z.toJSONSchema()` now strips redundant `id` fields from `$defs` entries. This is required for correctness in older JSON Schema dialects from before `$id` was introduced: in those dialects, `id` changes the resolution scope, so leaving it inside an extracted definition can make references resolve incorrectly. The removed value was redundant because the schema had already been extracted into `$defs`, so the definition key itself is the identifier. This may affect consumers that were reading those internal `id` fields directly. Other JSON Schema fixes in this release: - Draft-04/OpenAPI 3.0 min/max intersections: [#5700](https://github.com/colinhacks/zod/pull/5700) - Recursive lazy schemas with `.describe()`: [#5797](https://github.com/colinhacks/zod/pull/5797) - Falsy prefault values emitted as defaults: [#5893](https://github.com/colinhacks/zod/pull/5893) - CUID pattern output tightened: [#5880](https://github.com/colinhacks/zod/pull/5880) ##### String validators are stricter Base64 validation now rejects whitespace instead of allowing `atob()`-style whitespace stripping. Fixed in [#5888](https://github.com/colinhacks/zod/pull/5888). ```ts z.base64().safeParse("Zm9v").success; // true z.base64().safeParse("Zm 9v").success; // false ``` Other string validator changes: - CUID validation through `z.cuid()` has been tightened, and CUID v1 is now deprecated. Fixed in [#5880](https://github.com/colinhacks/zod/pull/5880). - HTTP URL validation through `z.httpUrl()` now rejects malformed HTTP(S) URLs with a missing slash after the protocol. The underlying `URL` constructor normalizes inputs like `https:/example.com`, but Zod now rejects them instead of accepting the repaired URL. Fixed in [#5672](https://github.com/colinhacks/zod/pull/5672), related to [#5284](https://github.com/colinhacks/zod/issues/5284). ```ts z.httpUrl().safeParse("https://example.com").success; // true z.httpUrl().safeParse("https:/example.com").success; // false z.httpUrl().safeParse("http:/www.apple.com").success; // false ``` ##### Union paths are fixed in formatted errors Two union-related error fixes landed: - Nested union paths are now preserved correctly in the output of `z.treeifyError()` and `z.formatError()`. Fixed in [#5708](https://github.com/colinhacks/zod/pull/5708) and [`60ff3987`](https://github.com/colinhacks/zod/commit/60ff398771bb4b6df04d96f00b9a10ee561ee7af). - Invalid discriminated union errors now include discriminator options and improved messages. Fixed in [#5723](https://github.com/colinhacks/zod/pull/5723). This may affect users snapshotting `ZodError` output. #### Other fixes ##### Record key transforms now run Fixed in [#5891](https://github.com/colinhacks/zod/pull/5891). Record schemas now run transforms on record keys. ```ts const schema = z.record( z.string().transform((key) => key.toUpperCase()), z.number() ); schema.parse({ foo: 1 }); // { FOO: 1 } ``` Related record fixes: - Key refinement failures now surface as structured `invalid_key` issues. Fixed in [#5719](https://github.com/colinhacks/zod/pull/5719). - Non-enumerable properties are skipped more consistently. Fixed in [#5719](https://github.com/colinhacks/zod/pull/5719). - The v3-style single-argument `z.record(valueType)` form works again. Fixed in [`0e960108`](https://github.com/colinhacks/zod/commit/0e960108f0d98dbea7844a8ff914f0980352f636). ##### Metadata and input handling in `fromJSONSchema()` Schema generation from JSON Schema now applies metadata more consistently across `enum`, `const`, `not`, `anyOf`, and multi-type schemas. Fixed in [#5758](https://github.com/colinhacks/zod/pull/5758). It also rejects or normalizes more non-JSON-like inputs, including cyclic objects and `BigInt`. Fixed in [`87cf0f93`](https://github.com/colinhacks/zod/commit/87cf0f93cd0f34bdc69f11c9377568e6812841c4). ##### Codecs Codec changes: - Encoding through `z.discriminatedUnion().encode()` now works when the discriminator uses a codec. Fixed in [#5769](https://github.com/colinhacks/zod/pull/5769). - Codec inversion was added in [#5770](https://github.com/colinhacks/zod/pull/5770). ```ts const stringToNumber = z.codec( z.string(), z.number(), { decode: Number, encode: String, } ); const numberToString = z.invertCodec(stringToNumber); ``` ##### Transform context Transform callbacks now support `ctx.addIssue()`. Fixed in [#5699](https://github.com/colinhacks/zod/pull/5699). ##### Conditional `.superRefine()` with `when` The `when` option was added for `.superRefine()`. Added in [#5741](https://github.com/colinhacks/zod/pull/5741), with related abort behavior fixed in [#5681](https://github.com/colinhacks/zod/pull/5681). ##### Defaults for `Map` and `Set` Defaults for `Map` and `Set` are now cloned instead of shared across parses. Fixed in [#5855](https://github.com/colinhacks/zod/pull/5855). ```ts const schema = z.map(z.string(), z.number()).default(new Map()); const a = schema.parse(undefined); const b = schema.parse(undefined); a === b; // false ``` ##### Empty unions Empty `z.union([])`, `z.xor([])`, and discriminated unions no longer crash at construction time. They construct and fail at parse time. Fixed in [#5869](https://github.com/colinhacks/zod/pull/5869). ##### Floating-point multiples Number `multipleOf()` / `step()` validation is more accurate for decimal and exponent edge cases. Fixed in [#5687](https://github.com/colinhacks/zod/pull/5687) and [#5793](https://github.com/colinhacks/zod/pull/5793). ##### Global config and `jitless` Configuration fixes: - Global configuration is now shared through `globalThis`, improving behavior across mixed CJS/ESM module instances. Fixed in [#5889](https://github.com/colinhacks/zod/pull/5889). - Jitless mode now avoids eval probing when set before first access. Fixed in [#5864](https://github.com/colinhacks/zod/pull/5864). ##### Prototype pollution hardening Object catchall paths now skip `__proto__` keys. Fixed in [#5898](https://github.com/colinhacks/zod/pull/5898). #### Performance improvements ##### Reduced memory usage from lazy-bound methods Fixed in [#5897](https://github.com/colinhacks/zod/pull/5897). Classic builder methods are now lazy-bound through a shared internal prototype instead of eagerly attached per schema instance. This significantly reduces per-schema method allocation overhead, especially in codebases that construct many schemas. Detached methods continue to work: ```ts const schema = z.string(); const optional = schema.optional; optional.call(schema); // still works ``` ##### Improved tree-shaking Implemented in [`195e8696`](https://github.com/colinhacks/zod/commit/195e86962b5156012a4cdcfbff87dffddce87b78) and [#5689](https://github.com/colinhacks/zod/pull/5689). Top-level factory calls are annotated as pure, and generated stub package manifests now include `sideEffects: false`. This gives bundlers more room to remove unused Zod code. This is intended as the conclusive fix for a long-standing class of tree-shaking and bundle-size issues, especially in Next.js and Turbopack projects. The most visible symptom was that unused validators and locales could survive bundling even when importing from `zod/mini` or from a narrow subpath. Related reports include: - Next.js and Turbopack tree-shaking reports: [#4433](https://github.com/colinhacks/zod/issues/4433), [#5641](https://github.com/colinhacks/zod/issues/5641), [#5095](https://github.com/colinhacks/zod/issues/5095), [#4810](https://github.com/colinhacks/zod/issues/4810) - Locale and `zod/mini` bundle-size reports: [#5561](https://github.com/colinhacks/zod/issues/5561), [#5665](https://github.com/colinhacks/zod/issues/5665), [#4369](https://github.com/colinhacks/zod/issues/4369), [#4572](https://github.com/colinhacks/zod/issues/4572) - Broader v4 bundle-size reports: [#2596](https://github.com/colinhacks/zod/issues/2596), [#4637](https://github.com/colinhacks/zod/issues/4637), [#4798](https://github.com/colinhacks/zod/issues/4798), [#5206](https://github.com/colinhacks/zod/issues/5206) ```json { "sideEffects": false } ``` #### Locales Added or updated locale support: - Croatian: [#5610](https://github.com/colinhacks/zod/pull/5610) - Greek: [#5840](https://github.com/colinhacks/zod/pull/5840) - Romanian: [#5657](https://github.com/colinhacks/zod/pull/5657) - Uzbek map support: [#5599](https://github.com/colinhacks/zod/pull/5599) - Georgian translation fix: [#5655](https://github.com/colinhacks/zod/pull/5655) - French issue origin translations: [#5845](https://github.com/colinhacks/zod/pull/5845) - Italian validation message updates: [#5852](https://github.com/colinhacks/zod/pull/5852) Locale message text changed in some cases, which may affect snapshots. #### Closed issues The following issues were closed by PRs included in this release: - Closed [#5466](https://github.com/colinhacks/zod/issues/5466) via [#5632](https://github.com/colinhacks/zod/pull/5632): preserve context immutability in parse functions. - Closed [#5617](https://github.com/colinhacks/zod/issues/5617) via [#5655](https://github.com/colinhacks/zod/pull/5655): correct Georgian translation for `string`. - Closed [#5619](https://github.com/colinhacks/zod/issues/5619) via [#5657](https://github.com/colinhacks/zod/pull/5657): add Romanian locale. - Closed [#5229](https://github.com/colinhacks/zod/issues/5229) via [#5661](https://github.com/colinhacks/zod/pull/5661): align object and tuple optionality handling. - Closed [#5680](https://github.com/colinhacks/zod/issues/5680) via [#5681](https://github.com/colinhacks/zod/pull/5681): respect `abort: true` in `.refine()` checks with `when`. - Closed [#5678](https://github.com/colinhacks/zod/issues/5678) via [#5699](https://github.com/colinhacks/zod/pull/5699): add missing `addIssue` to transform context. - Closed [#5717](https://github.com/colinhacks/zod/issues/5717) via [#5718](https://github.com/colinhacks/zod/pull/5718): avoid `delete` in `finalizeIssue`. - Closed [#5714](https://github.com/colinhacks/zod/issues/5714) via [#5719](https://github.com/colinhacks/zod/pull/5719): skip non-enumerable properties in record validation. - Closed [#5670](https://github.com/colinhacks/zod/issues/5670) via [#5723](https://github.com/colinhacks/zod/pull/5723): add discriminator `options` to invalid discriminator errors. - Closed [#5743](https://github.com/colinhacks/zod/issues/5743) via [#5744](https://github.com/colinhacks/zod/pull/5744): increase timeout for the datetime ReDoS checker test. - Closed [#5732](https://github.com/colinhacks/zod/issues/5732) via [#5758](https://github.com/colinhacks/zod/pull/5758): apply description and default metadata in `fromJSONSchema()`. - Closed [#5731](https://github.com/colinhacks/zod/issues/5731) via [#5759](https://github.com/colinhacks/zod/pull/5759): strip redundant `id` from `$defs` entries in JSON Schema output. - Closed [#5605](https://github.com/colinhacks/zod/issues/5605) via [#5763](https://github.com/colinhacks/zod/pull/5763): update `z.custom()` docs for v4 compatibility. - Closed [#5593](https://github.com/colinhacks/zod/issues/5593) via [#5769](https://github.com/colinhacks/zod/pull/5769): support `discriminatedUnion().encode()` with codec discriminators. - Closed [#5625](https://github.com/colinhacks/zod/issues/5625) via [#5770](https://github.com/colinhacks/zod/pull/5770): add codec inversion. - Closed [#5778](https://github.com/colinhacks/zod/issues/5778) via [#5779](https://github.com/colinhacks/zod/pull/5779): add custom docs 404 page. - Closed [#5792](https://github.com/colinhacks/zod/issues/5792) via [#5793](https://github.com/colinhacks/zod/pull/5793): correct floating-point `multipleOf()` validation. - Closed [#5777](https://github.com/colinhacks/zod/issues/5777) via [#5797](https://github.com/colinhacks/zod/pull/5797): resolve recursive lazy JSON Schema stack overflow. - Closed [#5805](https://github.com/colinhacks/zod/issues/5805) via [#5812](https://github.com/colinhacks/zod/pull/5812): fix self-referencing schema docs. - Closed [#5826](https://github.com/colinhacks/zod/issues/5826) via [#5855](https://github.com/colinhacks/zod/pull/5855): clone `Map` and `Set` defaults. - Closed [#5842](https://github.com/colinhacks/zod/issues/5842) via [#5856](https://github.com/colinhacks/zod/pull/5856): align `.merge()` refinement semantics with `.extend()`. - Closed [#4461](https://github.com/colinhacks/zod/issues/4461) and [#5414](https://github.com/colinhacks/zod/issues/5414) via [#5864](https://github.com/colinhacks/zod/pull/5864): honor `jitless` config in the eval probe. - Closed [#5868](https://github.com/colinhacks/zod/issues/5868) via [#5869](https://github.com/colinhacks/zod/pull/5869): handle empty `z.union([])` and `z.xor([])`. - Closed [#5296](https://github.com/colinhacks/zod/issues/5296) via [#5891](https://github.com/colinhacks/zod/pull/5891): apply key schema transforms in `z.record()`. - Closed [#5824](https://github.com/colinhacks/zod/issues/5824) via [#5893](https://github.com/colinhacks/zod/pull/5893): emit falsy prefault values in JSON Schema output. #### Commits - Commit [`44f6a03e`](https://github.com/colinhacks/zod/commit/44f6a03e1d7cd918bfb9d9962d967deb6718335b) fix(locales): correct Georgian translation for 'string' to 'ველი' ([#5655](https://github.com/colinhacks/zod/pull/5655)) by [@tushargr0ver](https://github.com/tushargr0ver) - Commit [`7b43bc64`](https://github.com/colinhacks/zod/commit/7b43bc64e7a2720fe66d6e99239c2a00c782e06b) docs(ecosystem): add Hono Takibi ([#5651](https://github.com/colinhacks/zod/pull/5651)) by [@nakita628](https://github.com/nakita628) - Commit [`119376b9`](https://github.com/colinhacks/zod/commit/119376b9dc2e80f44bedd282702b46e18e2ee72c) feat: add map support to Uzbek locale ([#5599](https://github.com/colinhacks/zod/pull/5599)) by [@uchkunr](https://github.com/uchkunr) - Commit [`8fbf701e`](https://github.com/colinhacks/zod/commit/8fbf701e6c3770682803988bb20183f6628987da) test: add edge case tests for boundary values ([#5601](https://github.com/colinhacks/zod/pull/5601)) by [@uchkunr](https://github.com/uchkunr) - Commit [`f1f93c2b`](https://github.com/colinhacks/zod/commit/f1f93c2bca9984f844017c768183d2ea4b7c9cc4) Fix order of brand method examples in api.mdx ([#5604](https://github.com/colinhacks/zod/pull/5604)) by [@onurtemiz](https://github.com/onurtemiz) - Commit [`10105ee4`](https://github.com/colinhacks/zod/commit/10105ee40f6aba0d89454c42a49554296cabf992) docs: Fix typos in json-schema documentation ([#5608](https://github.com/colinhacks/zod/pull/5608)) by [@SaKaNa-Y](https://github.com/SaKaNa-Y) - Commit [`2d367139`](https://github.com/colinhacks/zod/commit/2d3671390f6cae4254642cf9ac7f16783eb6ff20) feat: add hr translation ([#5610](https://github.com/colinhacks/zod/pull/5610)) by [@vuki656](https://github.com/vuki656) - Commit [`54902cb7`](https://github.com/colinhacks/zod/commit/54902cb794f24f4ceb0cf8830e5a27b3490191f7) chore: update pullfrog.yml workflow - Commit [`89ba70f2`](https://github.com/colinhacks/zod/commit/89ba70f2d50d33a70549bedbd5c79785810ee21b) chore: add sideEffects false to stub package.json for tree-shaking ([#5689](https://github.com/colinhacks/zod/pull/5689)) by [@jesse-holden](https://github.com/jesse-holden) - Commit [`eaa3c2c3`](https://github.com/colinhacks/zod/commit/eaa3c2c3633a5e6494d8ac03c14365d181794e71) Update positive checks to use alias `.gt(0)` in the docs ([#5671](https://github.com/colinhacks/zod/pull/5671)) by [@Fredkiss3](https://github.com/Fredkiss3) - Commit [`65f1f404`](https://github.com/colinhacks/zod/commit/65f1f404f644cfc9b7f790d310500a05b9d30ca4) fix typo ([#5676](https://github.com/colinhacks/zod/pull/5676)) by [@Nikita0x](https://github.com/Nikita0x) - Commit [`5b574501`](https://github.com/colinhacks/zod/commit/5b5745014af2a3b0ea6339ccd7bbcbdf845f7181) fix: respect `abort: true` in `.refine()` for checks with `when` function ([#5681](https://github.com/colinhacks/zod/pull/5681)) - Commit [`539de140`](https://github.com/colinhacks/zod/commit/539de140773587724723601720082a9231ba6d64) docs: fix README links for async refinements/transforms ([#5682](https://github.com/colinhacks/zod/pull/5682)) by [@pavan-sh](https://github.com/pavan-sh) - Commit [`46cd10e7`](https://github.com/colinhacks/zod/commit/46cd10e76339c2f9cf8ad99df49b808e58e69879) docs: fix README anchor links for async APIs ([#5683](https://github.com/colinhacks/zod/pull/5683)) by [@pavan-sh](https://github.com/pavan-sh) - Commit [`55747b3c`](https://github.com/colinhacks/zod/commit/55747b3cd05cd8b60b4f3d6a6348e2c508069c12) Remove deprecated downlevelIteration option ([#5684](https://github.com/colinhacks/zod/pull/5684)) by [@RyanCavanaugh](https://github.com/RyanCavanaugh) - Commit [`3a818de1`](https://github.com/colinhacks/zod/commit/3a818de145dc2fa9b5753bc8bf97b0b8484cfbaf) fix(v4): handle multi-digit exponents in floatSafeRemainder ([#5687](https://github.com/colinhacks/zod/pull/5687)) by [@shakecodeslikecray](https://github.com/shakecodeslikecray) - Commit [`3cd45ebc`](https://github.com/colinhacks/zod/commit/3cd45ebcbcf06a3f16e702a010074dfceca3ea50) fix(v4): add strict validation to `httpUrl()` ([#5672](https://github.com/colinhacks/zod/pull/5672)) by [@LuckySilver0021](https://github.com/LuckySilver0021) - Commit [`7d98c909`](https://github.com/colinhacks/zod/commit/7d98c909329713cb2f478620f8a67aaf3ef40ce2) add Sanity as silver sponsor and Mintlify as bronze sponsor - Commit [`c7805073`](https://github.com/colinhacks/zod/commit/c7805073fef5b6b8857307c3d4b3597a70613bc2) move Sanity and Mintlify to top of sponsor lists - Commit [`bee2dc8d`](https://github.com/colinhacks/zod/commit/bee2dc8d4971a5142d6197a01426837e2a57f69d) docs: move `z.iso.time()` from format to pattern section ([#5696](https://github.com/colinhacks/zod/pull/5696)) - Commit [`2f8414bc`](https://github.com/colinhacks/zod/commit/2f8414bc90cebc76be87c3640617e300a5d9b060) fix: add missing addIssue to transform context ([#5699](https://github.com/colinhacks/zod/pull/5699)) by [@F-A-N-D-E](https://github.com/F-A-N-D-E) - Commit [`d3c0ec87`](https://github.com/colinhacks/zod/commit/d3c0ec8764ede3aa7f7c7d47cb5fa985db15be20) docs: add note about removed `.errors` alias in v4 changelog ([#5705](https://github.com/colinhacks/zod/pull/5705)) by [@togami2864](https://github.com/togami2864) - Commit [`fa338a3b`](https://github.com/colinhacks/zod/commit/fa338a3b885e6f8aeefc439b50982132ec0af1b5) fix(v4): JSON schema min/max intersection for draft-04 and openapi-3.0 ([#5700](https://github.com/colinhacks/zod/pull/5700)) by [@ebroder](https://github.com/ebroder) - Commit [`3473b288`](https://github.com/colinhacks/zod/commit/3473b288e02d536252db517a4c51b5adc23603b4) chore: bump zshy to ^0.7.1 - Commit [`cc8f9b7c`](https://github.com/colinhacks/zod/commit/cc8f9b7cb5674c0df03803d05b2a3a00569cdb07) docs: improve README wording and fix typos ([#5736](https://github.com/colinhacks/zod/pull/5736)) by [@vedanshshetti](https://github.com/vedanshshetti) - Commit [`f5336717`](https://github.com/colinhacks/zod/commit/f533671752ae7247bc25dca8f2dbfda80fa2fccc) feat: add json-up to ecosystem ([#5740](https://github.com/colinhacks/zod/pull/5740)) by [@mrspence](https://github.com/mrspence) - Commit [`60ff3987`](https://github.com/colinhacks/zod/commit/60ff398771bb4b6df04d96f00b9a10ee561ee7af) fix(v4): preserve parent path when treeifying nested union/key/element issues - Commit [`08b14b51`](https://github.com/colinhacks/zod/commit/08b14b51501335a3e0de3cb92c3b2fdeae00a0d6) perf: avoid `delete` in `finalizeIssue` to keep V8 fast mode ([#5718](https://github.com/colinhacks/zod/pull/5718)) - Commit [`9cf868d2`](https://github.com/colinhacks/zod/commit/9cf868d20cdaf4cf80f6d33a6eaf31582f1cdeba) fix(v4): treeify error nested union bug ([#5708](https://github.com/colinhacks/zod/pull/5708)) by [@dstashevskyi](https://github.com/dstashevskyi) - Commit [`28f39a6d`](https://github.com/colinhacks/zod/commit/28f39a6d97ce903ed0d2f6cd99a60d390faa7adf) Add JSONType export ([#5709](https://github.com/colinhacks/zod/pull/5709)) by [@RobinVdBroeck](https://github.com/RobinVdBroeck) - Commit [`65fab33e`](https://github.com/colinhacks/zod/commit/65fab33e287bba2db5942c7f9ad905ac98f62fce) feat: allow `when` parameter in `.superRefine()` ([#5741](https://github.com/colinhacks/zod/pull/5741)) by [@vilvai](https://github.com/vilvai) - Commit [`7f87df1e`](https://github.com/colinhacks/zod/commit/7f87df1e8ae61679ed9dc3ba223572ce3d7bc716) refactor(v4): remove unnecessary type assertions ([#5720](https://github.com/colinhacks/zod/pull/5720)) by [@chisaki66](https://github.com/chisaki66) - Commit [`518f15dd`](https://github.com/colinhacks/zod/commit/518f15ddada3b5d959f4ff32b094789e2d85349a) Preprocess is not deprecated ([#5721](https://github.com/colinhacks/zod/pull/5721)) by [@mxdvl](https://github.com/mxdvl) - Commit [`2e5b23dc`](https://github.com/colinhacks/zod/commit/2e5b23dcd41eb257bda434b9997fd60a19cdf38f) fix: add options to invalid discriminator errors ([#5723](https://github.com/colinhacks/zod/pull/5723)) by [@Danielchinasa](https://github.com/Danielchinasa) - Commit [`7f789def`](https://github.com/colinhacks/zod/commit/7f789defd73ee35f3099ab5c2091cb19bd2b3578) fix: skip non-enumerable properties in record validation ([#5719](https://github.com/colinhacks/zod/pull/5719)) by [@veeceey](https://github.com/veeceey) - Commit [`ee15fa19`](https://github.com/colinhacks/zod/commit/ee15fa1905f7c6626dea5f8dc880e66cdb4700ad) docs: add AGENTS notes for JSDoc, PR comments, and PR worktree workflow - Commit [`f52b4d28`](https://github.com/colinhacks/zod/commit/f52b4d288fabb03b98ff3f893c58e285eb310e96) Revert "docs: improve README wording and fix typos ([#5736](https://github.com/colinhacks/zod/issues/5736))" - Commit [`ddb41391`](https://github.com/colinhacks/zod/commit/ddb413916bc238e8d2d6ba67a2ce4b48ff2aa930) test: increase timeout for redos checker in datetime.test.ts ([#5744](https://github.com/colinhacks/zod/pull/5744)) by [@rishadaufa](https://github.com/rishadaufa) - Commit [`bc07e459`](https://github.com/colinhacks/zod/commit/bc07e459bab4f895bf1c99f182c6841d577c16b3) docs: fix doc ([#5745](https://github.com/colinhacks/zod/pull/5745)) by [@xgaia](https://github.com/xgaia) - Commit [`e06af5de`](https://github.com/colinhacks/zod/commit/e06af5de314f1cad8dfaa0a5f1909e21ffff9e49) Update Hey API description ([#5748](https://github.com/colinhacks/zod/pull/5748)) by [@mrlubos](https://github.com/mrlubos) - Commit [`28c156e2`](https://github.com/colinhacks/zod/commit/28c156e254ebdf65d9ed3de4caf1d4293f7e7a84) fix: apply description and default metadata to enum, const, and not schemas in fromJSONSchema ([#5758](https://github.com/colinhacks/zod/pull/5758)) by [@mibragimov](https://github.com/mibragimov) - Commit [`f457edf1`](https://github.com/colinhacks/zod/commit/f457edf1e504787eadfe2dffe51a77c64e3f0e17) Fix grammar in CONTRIBUTING.md ([#5765](https://github.com/colinhacks/zod/pull/5765)) by [@siekmang](https://github.com/siekmang) - Commit [`411f6c64`](https://github.com/colinhacks/zod/commit/411f6c64e910c5e18799d0a7a09bcd7a4e40f23e) fix(v4): resolve stack overflow in toJSONSchema for recursive lazy with describe ([#5797](https://github.com/colinhacks/zod/pull/5797)) by [@Hassad674](https://github.com/Hassad674) - Commit [`45dd421e`](https://github.com/colinhacks/zod/commit/45dd421e72e989752fa5f85529dfbf50bdbd3f61) docs: add tone guidelines for issue and PR comments to AGENTS.md - Commit [`ddd20a30`](https://github.com/colinhacks/zod/commit/ddd20a300441d7cffd59821461ed0c2fe9c96bbc) test: align optional property assertions with actual inferred types - Commit [`a1cf8a93`](https://github.com/colinhacks/zod/commit/a1cf8a9312582591d9cdccdd677ba1d90e706cc0) docs: update z.custom example for v4 compatibility ([#5763](https://github.com/colinhacks/zod/pull/5763)) by [@andrewdamelio](https://github.com/andrewdamelio) - Commit [`b6a3b336`](https://github.com/colinhacks/zod/commit/b6a3b3369a5b9fdde9adde8203b96b71c0634ad5) fix: strip redundant id from `$defs` entries in toJSONSchema ([#5759](https://github.com/colinhacks/zod/pull/5759)) by [@mibragimov](https://github.com/mibragimov) - Commit [`c7a8ccc0`](https://github.com/colinhacks/zod/commit/c7a8ccc0d0fb4f2bd1c938b8d79873a8ebd6573e) fix: discriminatedUnion encode() with codec discriminator ([#5769](https://github.com/colinhacks/zod/pull/5769)) by [@mahmoodhamdi](https://github.com/mahmoodhamdi) - Commit [`87cf0f93`](https://github.com/colinhacks/zod/commit/87cf0f93cd0f34bdc69f11c9377568e6812841c4) fix(fromJSONSchema): normalize input via JSON round-trip - Commit [`7163e6f2`](https://github.com/colinhacks/zod/commit/7163e6f25ae8c90be79bd588417440c047ee30b0) feat: add `.invert()` method to ZodCodec ([#5770](https://github.com/colinhacks/zod/pull/5770)) by [@mahmoodhamdi](https://github.com/mahmoodhamdi) - Commit [`b59b9b13`](https://github.com/colinhacks/zod/commit/b59b9b13c20397389c5d4dc3a2ecbcd5e9349395) fix: replace `.default` with `.prefault` ([#5776](https://github.com/colinhacks/zod/pull/5776)) by [@alanskovrlj](https://github.com/alanskovrlj) - Commit [`93bba686`](https://github.com/colinhacks/zod/commit/93bba686325e09dced20da8d7bc18c7e61b71562) docs: add Zod AOT to ecosystem page ([#5806](https://github.com/colinhacks/zod/pull/5806)) by [@wakita181009](https://github.com/wakita181009) - Commit [`2564caa4`](https://github.com/colinhacks/zod/commit/2564caa440e690fd3ad58ce55fdff0fe073d6cc0) fix(docs): add custom 404 page with proper theme support ([#5779](https://github.com/colinhacks/zod/pull/5779)) by [@WolfieLeader](https://github.com/WolfieLeader) - Commit [`5b7ed214`](https://github.com/colinhacks/zod/commit/5b7ed214526cb5a7cc508aec236603ff79ae9579) fix: correct multipleOf float validation using tolerance-based comparison ([#5793](https://github.com/colinhacks/zod/pull/5793)) by [@cyphercodes](https://github.com/cyphercodes) - Commit [`cc9139d2`](https://github.com/colinhacks/zod/commit/cc9139d209001bfdeb23dfe2d5b0262c02c950cf) docs: fix self-referencing schema in refine when() example ([#5812](https://github.com/colinhacks/zod/pull/5812)) by [@claygeo](https://github.com/claygeo) - Commit [`0e960108`](https://github.com/colinhacks/zod/commit/0e960108f0d98dbea7844a8ff914f0980352f636) fix(v4): support v3-style single-arg z.record(valueType) - Commit [`41b25af9`](https://github.com/colinhacks/zod/commit/41b25af98f108d7b6f695576d4e0330b97252bfd) docs(agents): refine PR comment tone guidance - Commit [`4c03c20d`](https://github.com/colinhacks/zod/commit/4c03c20d2bc7e013e8b80ce55380cd4b82bfe352) Update Italian locale error messages for validation ([#5852](https://github.com/colinhacks/zod/pull/5852)) by [@pastorello](https://github.com/pastorello) - Commit [`37ac1ba0`](https://github.com/colinhacks/zod/commit/37ac1ba0d694b3b80e22c006dc6e2b78b0c956dc) fix(fr): translate issue.origin in too\_big/too\_small errors ([#5845](https://github.com/colinhacks/zod/pull/5845)) by [@Ouaziz-chedli](https://github.com/Ouaziz-chedli) - Commit [`345be203`](https://github.com/colinhacks/zod/commit/345be2039463516aaac90640c14de1b697e775b6) docs: add validex to ecosystem ([#5848](https://github.com/colinhacks/zod/pull/5848)) by [@chiptoma](https://github.com/chiptoma) - Commit [`3c1f32bd`](https://github.com/colinhacks/zod/commit/3c1f32bd280c01b836d4790981fd769cf9041d29) feat(locales/en): handle instanceof and add comprehensive locale tests - Commit [`888e52bb`](https://github.com/colinhacks/zod/commit/888e52bb1762f8a8b881af48d9f1bdc353372af8) feat(locales): add Greek (el) locale ([#5840](https://github.com/colinhacks/zod/pull/5840)) by [@saileshbro](https://github.com/saileshbro) - Commit [`bf6d99ed`](https://github.com/colinhacks/zod/commit/bf6d99ed76be86e4871d2381ecd9832293c13406) Revert "feat(locales/en): handle instanceof and add comprehensive locale tests" - Commit [`e8196a8d`](https://github.com/colinhacks/zod/commit/e8196a8d98e3bc3cc6714ef5ff34b5abf33eff4a) fix(resolution): align expected fr message with translated locale - Commit [`b6b12882`](https://github.com/colinhacks/zod/commit/b6b1288277e6ca87dab0ad1c7251b92612b7445c) correct logic for validating length ([#5843](https://github.com/colinhacks/zod/pull/5843)) by [@nameearly](https://github.com/nameearly) - Commit [`34f60159`](https://github.com/colinhacks/zod/commit/34f601590351e5d3a57fe20c001155940ba65324) fix(v4): clone Map and Set in shallowClone to prevent shared state across `.default()` parses ([#5855](https://github.com/colinhacks/zod/pull/5855)) by [@artur-seppa](https://github.com/artur-seppa) - Commit [`91a7d0d1`](https://github.com/colinhacks/zod/commit/91a7d0d1e0d3c8338e9fd92cf819cded87e8973f) fix(v4): reject whitespace in z.base64() to close atob bypass - Commit [`23edf484`](https://github.com/colinhacks/zod/commit/23edf4844bcd89fa37c549dab187ce7f86728540) Revert "fix(v4): reject whitespace in z.base64() to close atob bypass" - Commit [`15cafa13`](https://github.com/colinhacks/zod/commit/15cafa13940b7055cc21e4ef440a6a0c6b7af72b) fix(v4): throw on `.merge()` receiver with refinements; preserve refinements from second schema ([#5856](https://github.com/colinhacks/zod/pull/5856)) by [@solssak](https://github.com/solssak) - Commit [`584b1089`](https://github.com/colinhacks/zod/commit/584b1089e1fc7bfcc97797576eff8da85bcdf031) fix(v4): reject whitespace in z.base64() to close atob bypass ([#5888](https://github.com/colinhacks/zod/pull/5888)) by [@colinhacks](https://github.com/colinhacks) - Commit [`b9b62c65`](https://github.com/colinhacks/zod/commit/b9b62c65357c2b0fed4ae046a30c8e84e4094202) fix(core): honour `jitless` config in `allowsEval` probe ([#5864](https://github.com/colinhacks/zod/pull/5864)) by [@dokson](https://github.com/dokson) - Commit [`fffe99bd`](https://github.com/colinhacks/zod/commit/fffe99bdd7445cc072b5ed2d74b2a6204bdbc86c) fix(v4): construct empty unions instead of crashing ([#5869](https://github.com/colinhacks/zod/pull/5869)) by [@tjenkinson](https://github.com/tjenkinson) - Commit [`285bde7f`](https://github.com/colinhacks/zod/commit/285bde7f43ca66938eeac38dea852256d4757336) feat(core): share `globalConfig` across module systems via `globalThis` ([#5889](https://github.com/colinhacks/zod/pull/5889)) by [@colinhacks](https://github.com/colinhacks) - Commit [`195e8696`](https://github.com/colinhacks/zod/commit/195e86962b5156012a4cdcfbff87dffddce87b78) perf(v4): mark top-level factory calls as `/*@__PURE__*/` for tree-shaking - Commit [`61d7bedb`](https://github.com/colinhacks/zod/commit/61d7bedb873bf8185162bb51d027fd8acf2710ee) fix(v4): apply key schema transforms in z.record() ([#5891](https://github.com/colinhacks/zod/pull/5891)) by [@colinhacks](https://github.com/colinhacks) - Commit [`45acd2ad`](https://github.com/colinhacks/zod/commit/45acd2ad78fb34ef61c5b72e9c03dfeaa432bef9) ci(release): switch to npm trusted publishing via OIDC ([#5890](https://github.com/colinhacks/zod/pull/5890)) by [@colinhacks](https://github.com/colinhacks) - Commit [`476ae243`](https://github.com/colinhacks/zod/commit/476ae243e86344af08d6c396deed082e83d7d7e1) Tighten cuid() regex and deprecate CUID v1 ([#5880](https://github.com/colinhacks/zod/pull/5880)) by [@colinhacks](https://github.com/colinhacks) - Commit [`6217527e`](https://github.com/colinhacks/zod/commit/6217527e4880054dda5e4d33aa12192a36a35062) docs(agents): document push-to-main footgun and version-bump rule ([#5883](https://github.com/colinhacks/zod/pull/5883)) by [@colinhacks](https://github.com/colinhacks) - Commit [`757f0b0f`](https://github.com/colinhacks/zod/commit/757f0b0f5217e0e7125478cd91af1e2c0cd21aa9) fix(v4): apply util.Writeable<T> in strictObject/looseObject for shape display parity ([#5882](https://github.com/colinhacks/zod/pull/5882)) by [@colinhacks](https://github.com/colinhacks) - Commit [`fa4a3740`](https://github.com/colinhacks/zod/commit/fa4a37404966d7ada0f5bb02ceeb592f1d4d9c52) fix(v4): apply util.Writeable in mini object constructors and extend/safeExtend/partial/required ([#5895](https://github.com/colinhacks/zod/pull/5895)) by [@colinhacks](https://github.com/colinhacks) - Commit [`ebc8287c`](https://github.com/colinhacks/zod/commit/ebc8287ca206402cf3a9aceb745b204493cbadfb) fix(v4): emit falsy prefault values in toJSONSchema ([#5893](https://github.com/colinhacks/zod/pull/5893)) by [@mixelburg](https://github.com/mixelburg) - Commit [`8fcb71a5`](https://github.com/colinhacks/zod/commit/8fcb71a5ffa5b32a508ac8bb38b7e1e13c387bf5) perf(v4): lazy-bind builder methods to shared internal prototype ([#5897](https://github.com/colinhacks/zod/pull/5897)) by [@colinhacks](https://github.com/colinhacks) - Commit [`76e8f706`](https://github.com/colinhacks/zod/commit/76e8f706bb554de82234106de8299d0139cb3b8e) fix(v4): skip `__proto__` key in object catchall ([#5898](https://github.com/colinhacks/zod/pull/5898)) by [@colinhacks](https://github.com/colinhacks) - Commit [`f0b0608e`](https://github.com/colinhacks/zod/commit/f0b0608ee300e609772405501ab4b219f0e19680) ecosystem: `eslint-plugin-zod-x` is `eslint-plugin-zod` now ([#5637](https://github.com/colinhacks/zod/pull/5637)) by [@marcalexiei](https://github.com/marcalexiei) - Commit [`0b5c3bc2`](https://github.com/colinhacks/zod/commit/0b5c3bc2b9e095e06687d2381bdd741185fbfee9) docs: fix refinements examples in api.mdx ([#5649](https://github.com/colinhacks/zod/pull/5649)) by [@playoffthecuff](https://github.com/playoffthecuff) - Commit [`327e152e`](https://github.com/colinhacks/zod/commit/327e152e463c85e6404388738d397ed92e5f3999) docs(agents): refine PR comment tone guidance further - Commit [`57d80a82`](https://github.com/colinhacks/zod/commit/57d80a82bde8877f3eb79e5dad9786096c37490f) test(v4): pin object/tuple key optionality through optout propagation - Commit [`f19860f1`](https://github.com/colinhacks/zod/commit/f19860f1f17e3bdc3e696ee5290441bba093d7a4) fix: preserve context immutability in parse functions ([#5632](https://github.com/colinhacks/zod/pull/5632)) by [@bgk614](https://github.com/bgk614) - Commit [`ec979ad7`](https://github.com/colinhacks/zod/commit/ec979ad783a9e9c992d3c9bd4e5f3b56110b1ef8) feat: add Romanian (ro) locale ([#5657](https://github.com/colinhacks/zod/pull/5657)) by [@tushargr0ver](https://github.com/tushargr0ver) - Commit [`b6066b3e`](https://github.com/colinhacks/zod/commit/b6066b3e4730fc8b966d13974b4abae8dce25df4) fix(v4): align object and tuple optionality handling ([#5661](https://github.com/colinhacks/zod/pull/5661)) by [@Cyjin-jani](https://github.com/Cyjin-jani) - Commit [`ad0b8271`](https://github.com/colinhacks/zod/commit/ad0b82713e70e53707dd5e6497c9d922fcba3721) ci: update release workflow for trusted publishing - Commit [`6db607be`](https://github.com/colinhacks/zod/commit/6db607be3c218ad9f23fef8975de1f37469680e7) fix(release): keep JSR manifest publishable - Commit [`f778e02a`](https://github.com/colinhacks/zod/commit/f778e02a81842cbc40b1a448a85b29747227c49d) build: bump zshy for JSR wildcard exports </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Berlin) - Branch creation - "before 6am on monday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

renovate-bot added 1 commit

2026-07-20 03:35:34 +00:00

chore(deps): update non-major dependencies 99d5ddf5d8

renovate-bot force-pushed renovate/all-minor-patch from 99d5ddf5d8 to c4bd5c25b8

2026-07-21 03:38:41 +00:00

Compare

renovate-bot force-pushed renovate/all-minor-patch from c4bd5c25b8 to 76d08a134a

2026-07-22 03:38:37 +00:00

Compare

renovate-bot force-pushed renovate/all-minor-patch from 76d08a134a to 2f4ccd609d

2026-07-22 19:12:15 +00:00

Compare