build(deps): bump posthog-js from 1.417.0 to 1.417.1

[dependabot]

Bumps posthog-js from 1.417.0 to 1.417.1.

Release notes

Sourced from posthog-js's releases.

posthog-js@1.417.1

1.417.1

Patch Changes

• #4521 0a0206f Thanks @​marandaneto! - Normalize capture timestamp overrides to equivalent UTC ISO strings in the browser and Node.js SDKs and shared core. (2026-08-14)

• #4523 6230b5b Thanks @​marandaneto! - Prevent swallowed rrweb observer initialization errors from breaking session replay teardown and subsequent recorder restarts. (2026-08-14)

• #4503 eb05237 Thanks @​pauldambra! - fix(dead-clicks): treat visibility and focus changes as liveness signals, not dead-click evidence

  The dead-click detector treated a visibilitychange as evidence a click was dead: it measured Math.abs(clickTimestamp - lastVisibilityChange) and, once that exceeded the threshold, timed the click out as dead. Because it only recorded the tab becoming visible, any click in a session where the tab had ever been backgrounded (median gap ~1 minute) was flagged.

  A visibility or focus change near a click is the opposite — a sign the click did something (it woke/focused the tab, opened a new tab, or opened a new window/popup) — so these signals now only ever suppress a dead click, never cause one:

  • Visibility changes are recorded in both directions (a click that opens a new tab sends the current tab to hidden), and a window focus/blur observer is added, since a click that opens a new window/popup may leave the tab visible and only surface as the current window losing focus.
  • A click within a wake-up/interaction window (1s, wide enough for a real "tab back, then click" gesture) of any such change is suppressed.
  • The visibility signal no longer feeds the dead-marking path at all. $dead_click_visibility_changed_timeout stays in the payload (always false) for shape compatibility, and a new $dead_click_focus_changed_delay_ms is emitted for observability.
  • Visibility/focus changes are now recorded onto each queued candidate the instant they fire (like scroll), instead of being read from a single shared timestamp when the click is checked ~1s later. A click that hides or blurs the tab (opening a new tab/window) suspends that check while the tab is backgrounded; by the time it resumes the tab has usually returned, and the shared timestamp would have been overwritten by that later transition — losing the click-correlated one and wrongly flagging the click dead. Stamping the candidate as the event fires makes delayed hide→show and blur→focus sequences suppress correctly. (2026-08-14)

• Updated dependencies [0a0206f, eb05237]:

  • @​posthog/core@​1.48.1
  • @​posthog/types@​1.404.1

Commits

• 6872a1c chore: update versions and lockfile [version bump]
• aba7d55 fix: perf(react-native): useFeatureFlags / useFeatureFlag re-read the full fl...
• 0a0206f fix: normalize SDK timestamps to UTC (#4521)
• eb05237 fix(dead-clicks): treat visibility and focus changes as liveness signals, not...
• 6230b5b fix(replay): recover from observer initialization failures (#4523)
• a4a25fe ci: upgrade React Native plugin in PostHog after releases (#4518)
• e4d64b6 ci: Remove auto-merge from PostHog upgrade workflow (#4519)
• 65c4809 chore: update versions and lockfile [version bump]
• 1030636 fix(rollup): inject chunk ids in-memory in renderChunk for SRI compatibility ...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)