build(deps): bump posthog-js from 1.415.1 to 1.417.0

[dependabot]

Bumps posthog-js from 1.415.1 to 1.417.0.

Release notes

Sourced from posthog-js's releases.

posthog-js@1.417.0

1.417.0

Minor Changes

• #4485 8bc63c3 Thanks @​dustinbyrne! - Default external dependency loading to versioned asset paths with automatic fallback to legacy paths, and add a strict_script_versioning: 'fallback' mode. (2026-08-13)

Patch Changes

• Updated dependencies [8bc63c3]:
  • @​posthog/types@​1.404.0

posthog-js@1.416.1

1.416.1

Patch Changes

• #4443 b2c6830 Thanks @​arnohillen! - Harden the session replay stylesheet inlining budget (inlineStylesheetBudgetRules):

  • The default budget (10,000 rules) moves from the recorder chunk into posthog-js session recording options, so npm-pinned or cached bundles keep their configured override (including 0 to disable) and direct rrweb.record() consumers keep unbounded inlining unless they opt in.
  • Deferred inlining is bounded inside a sheet: a resumable cursor stringifies 200 rules per idle slice and emits a sheet's _cssText atomically, so monolithic sheets no longer produce one long task and partial CSS never reaches the wire.
  • Deferred sheets are flushed synchronously when recording stops and on pagehide; residual failure modes are counted via $sdk_debug_replay_deferred_stylesheets_failed / _abandoned.
  • CSSOM-only styles (insertRule output, adoptedStyleSheets) no longer charge the budget, since deferring <link> sheets buys those pages nothing.
  • Telemetry fixes: full-snapshot duration wraps the whole synchronous task, deferred counts are cumulative per session, new gauges cover non-deferrable rules and idle stringification cost, and duration samples straddling tab suspension are discarded ($sdk_debug_replay_discarded_duration_samples). (2026-08-13)

• Updated dependencies [c9086de, b2c6830]:

  • @​posthog/core@​1.48.0
  • @​posthog/types@​1.403.1

posthog-js@1.416.0

1.416.0

Minor Changes

• #4495 e4b9947 Thanks @​marandaneto! - feat(browser): add rewriteRequestPath to customize API, feature flag, and asset paths for reverse proxies (2026-08-12)

• #4493 e34ebf9 Thanks @​marandaneto! - Add reset options for applying bootstrapped identity, feature flag, and session values after posthog.reset() while preserving the legacy boolean argument. (2026-08-12)

Patch Changes

• Updated dependencies [e4b9947, e34ebf9]:
  • @​posthog/types@​1.403.0

posthog-js@1.415.7

1.415.7

Patch Changes

... (truncated)

Commits

• 9b41d8a chore: update versions and lockfile [version bump]
• 8bc63c3 feat(browser): default script versioning to fallback (#4485)
• c708fbd ci: upgrade PostHog monorepo dependencies after releases (#4517)
• f6d5ef8 chore: update versions and lockfile [version bump]
• 5698fd5 fix(mcp): attribute tool calls and handshakes to their own client (#4515)
• 5c5d26c chore: update versions and lockfile [version bump]
• 1c5bf6f chore: bump PostHog CLI to 0.11.1 (#4516)
• 48b1a0c fix(mcp): resolve identify on tools/list (#4504)
• c9086de feat(aio): public beta captureAi with dedicated AI capture lane (#4289)
• b2c6830 fix(replay): close the stylesheet budget review findings shipped in #4320 (#4...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)