chore: sync main into capture-v1 (posthog-node 5.58.0-5.61.1)

.changeset/posthog-next-nuxt-node-5-58.md

@@ -0,0 +1,6 @@
+---
+'@posthog/next': patch
+'@posthog/nuxt': patch
+---
+
+Require posthog-node 5.58.0 or later, the first version with the span-context helpers they use.

.github/workflows/bundled-size.yaml

@@ -43,7 +43,7 @@ jobs:
 
     steps:
       - name: Audit runner egress
-        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
         with:
           egress-policy: audit
 
@@ -107,4 +107,5 @@ jobs:
           NODE_OPTIONS: --disable-warning=DEP0169
         with:
           compression: "none"
-          strip-hash: '-(\w{8})\.'
+          # Build hashes contain an uppercase letter or a digit. Names like `analytics-delivery` must stay distinct.
+          strip-hash: '-((?=\w*[A-Z0-9])\w{8})\.'

.github/workflows/codeql.yml

@@ -58,7 +58,7 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
     - name: Audit runner egress
-      uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
+      uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
       with:
         egress-policy: audit
 
@@ -73,7 +73,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+      uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
       with:
         # If you wish to specify custom queries, you can do so here or in a config file.
         # By default, queries listed here will override any specified in a config file.
@@ -105,7 +105,7 @@ jobs:
 
     - name: Perform CodeQL Analysis
       id: analyze
-      uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+      uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
       with:
         category: "/language:${{matrix.language}}"
         output: sarif-results

.github/workflows/coherence.yml

@@ -26,7 +26,7 @@ jobs:
       contents: read
     steps:
       - name: Audit runner egress
-        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
         with:
           egress-policy: audit
 
@@ -79,7 +79,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Audit runner egress
-        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
         with:
           egress-policy: audit
 

.github/workflows/dependabot-changeset.yml

@@ -10,7 +10,7 @@ jobs:
       contents: read
     steps:
       - name: Audit runner egress
-        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
         with:
           egress-policy: audit
 

.github/workflows/error-tracking-harness.yml

@@ -0,0 +1,164 @@
+name: Error tracking smoke
+
+on:
+    pull_request:
+    merge_group:
+        types: [checks_requested]
+    push:
+        branches: [main]
+    workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+    group: error-tracking-harness-${{ github.event.pull_request.number || github.ref }}
+    cancel-in-progress: true
+
+jobs:
+    affected:
+        permissions:
+            contents: read
+        uses: ./.github/workflows/check-affected.yml
+        with:
+            package-name: '@posthog/plugin-utils'
+            additional-paths: |
+                packages/webpack-plugin/
+                packages/rollup-plugin/
+                packages/nextjs-config/
+                packages/nuxt/src/
+                packages/core/src/error-tracking/
+                packages/node/src/extensions/error-tracking/
+                packages/browser/src/posthog-exceptions.ts
+                packages/browser/src/extensions/exception-autocapture/
+                packages/browser/src/entrypoints/exception-autocapture.ts
+                tooling/error-tracking-harness/
+                pnpm-workspace.yaml
+                .github/workflows/error-tracking-harness.yml
+
+    pack:
+        name: Pack PR-built subject tarballs
+        needs: affected
+        if: ${{ !cancelled() && (github.event_name == 'workflow_dispatch' || needs.affected.outputs.is-affected != 'false') }}
+        runs-on: ubuntu-24.04
+        timeout-minutes: 15
+        permissions:
+            contents: read
+        steps:
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+              with:
+                  persist-credentials: false
+            - uses: ./.github/actions/setup
+              with:
+                  build: false
+            - name: Test PR report formatter
+              run: node --test tooling/error-tracking-harness/test-report.mjs
+            - name: Pack direct and transitive dependencies
+              run: tooling/error-tracking-harness/pack.sh "$RUNNER_TEMP/error-tracking-subject"
+            - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+              with:
+                  name: error-tracking-subject
+                  path: ${{ runner.temp }}/error-tracking-subject/
+                  retention-days: 1
+                  if-no-files-found: error
+
+    smoke:
+        name: Smoke test packed plugins
+        needs: pack
+        if: ${{ !cancelled() && needs.pack.result == 'success' }}
+        permissions:
+            actions: read
+            contents: read
+        uses: PostHog/error-tracking-harness/.github/workflows/subject-smoke.yml@37b54b2b55e0bc20c5c7740383dd771d8561f9f7
+        with:
+            subject-artifact: error-tracking-subject
+            # Image published from harness #19 merge commit bf2b305ea09f71f4c9ae327e3937abeb054e4b65.
+            harness-image: ghcr.io/posthog/error-tracking-harness@sha256:435cff06dbb51c85af4c78d3c9729af41bc636ee0a7f485dd0080855a4b6c636
+
+    report:
+        name: Post smoke results to PR
+        needs: [pack, smoke]
+        if: ${{ always() && github.event_name == 'pull_request' && needs.pack.result != 'skipped' && github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.user.login != 'dependabot[bot]' }}
+        runs-on: ubuntu-24.04
+        timeout-minutes: 5
+        permissions:
+            actions: read
+            pull-requests: write
+        steps:
+            # The write-capable job never checks out or runs PR code; the artifact is data only.
+            - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
+              with:
+                  egress-policy: audit
+            - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+              continue-on-error: true
+              with:
+                  name: subject-smoke-report
+                  path: ${{ runner.temp }}/smoke-report
+            - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+              env:
+                  REPORT_FILE: ${{ runner.temp }}/smoke-report/summary.json
+                  SMOKE_RESULT: ${{ needs.smoke.result }}
+              with:
+                  script: |
+                      const fs = require('node:fs');
+                      const marker = '<!-- posthog-error-tracking-smoke -->';
+                      const pr = context.payload.pull_request;
+                      if (!pr || pr.head.repo?.full_name !== `${context.repo.owner}/${context.repo.repo}`) return;
+                      const { data: current } = await github.rest.pulls.get({ ...context.repo, pull_number: pr.number });
+                      if (current.head.sha !== pr.head.sha) {
+                          core.info('PR head has changed; do not overwrite a newer smoke report.');
+                          return;
+                      }
+                      const escape = (value, limit = 180) => String(value).slice(0, limit)
+                          .replace(/[&<>@`*_\[\]\\|\r\n]/g, char => `&#${char.charCodeAt(0)};`);
+                      const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
+                      const expected = [
+                          ['rollup-4', 'baseline/smoke'],
+                          ['vite-8-autocapture', 'autoexception/baseline'],
+                          ['webpack-5.112', 'baseline/smoke'],
+                          ['next-14', 'next/smoke'],
+                          ['next-15', 'next/smoke'],
+                          ['next-16-webpack', 'next/smoke'],
+                          ['next-16-turbopack', 'next/smoke'],
+                          ['nuxt-4', 'nuxt/smoke'],
+                      ];
+                      const lines = [marker, '## Error tracking smoke', '',
+                          `Commit: \`${pr.head.sha}\` · [CI run and artifacts](${runUrl})`, ''];
+                      let reportError;
+                      try {
+                          const file = process.env.REPORT_FILE;
+                          if (fs.statSync(file).size > 1024 * 1024) throw new Error('Report exceeds 1 MiB');
+                          const report = JSON.parse(fs.readFileSync(file, 'utf8'));
+                          if (!Array.isArray(report.results) || report.results.length !== expected.length ||
+                              ![report.total, report.passed, report.failed, report.skipped, report.uncovered].every(n => Number.isSafeInteger(n) && n >= 0) ||
+                              report.total !== expected.length || report.passed + report.failed !== report.total ||
+                              report.skipped !== 0 || report.uncovered !== 0) throw new Error('Incomplete or invalid smoke summary');
+                          const rows = new Map();
+                          for (const result of report.results) {
+                              const key = `${result.fixture}/${result.case}`;
+                              if (result.cli !== '0.18.11' || rows.has(key) || !expected.some(([fixture, kase]) => key === `${fixture}/${kase}`))
+                                  throw new Error('Unexpected smoke cell in summary');
+                              rows.set(key, result);
+                          }
+                          if (rows.size !== expected.length) throw new Error('Smoke summary is missing a fixture');
+                          if (report.passed !== expected.filter(([fixture, kase]) => rows.get(`${fixture}/${kase}`).ok === true).length)
+                              throw new Error('Smoke pass count differs from cell results');
+                          lines.push(`**${report.passed}/${report.total} passed** (0 skipped, 0 uncovered)`, '',
+                              '| Fixture | Result | First failure |', '| --- | --- | --- |');
+                          for (const [fixture, kase] of expected) {
+                              const result = rows.get(`${fixture}/${kase}`);
+                              const status = result.ok === true ? '✅ Passed' : '❌ Failed';
+                              const reason = result.ok === true ? '—' : escape(result.failures?.[0] ?? 'See run artifacts');
+                              lines.push(`| ${fixture} | ${status} | ${reason} |`);
+                          }
+                      } catch (error) {
+                          reportError = error;
+                          lines.push(`**⚠️ No valid smoke summary** (job: ${escape(process.env.SMOKE_RESULT)})`, '',
+                              `${escape(error.message)}. Inspect the [CI run](${runUrl}).`);
+                      }
+                      const body = lines.join('\n');
+                      const comments = await github.paginate(github.rest.issues.listComments,
+                          { ...context.repo, issue_number: pr.number, per_page: 100 });
+                      const existing = comments.find(comment => comment.user?.login === 'github-actions[bot]' && comment.body?.startsWith(marker));
+                      if (existing) await github.rest.issues.updateComment({ ...context.repo, comment_id: existing.id, body });
+                      else await github.rest.issues.createComment({ ...context.repo, issue_number: pr.number, body });
+                      if (reportError && process.env.SMOKE_RESULT === 'success') core.setFailed('Successful smoke job produced no valid summary');

.github/workflows/generate-references.yml

@@ -23,7 +23,7 @@ jobs:
 
     steps:
       - name: Audit runner egress
-        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
         with:
           egress-policy: audit
 

.github/workflows/library-ci.yml

@@ -117,11 +117,17 @@ jobs:
         run: pnpm test:browser
         working-directory: packages/browser-next
 
+      - name: Run browser-next snippet tests
+        run: pnpm test:snippet
+        working-directory: packages/browser-next
+
       - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: ${{ !cancelled() }}
         with:
           name: playwright-report
-          path: packages/browser/playwright-report/
+          path: |
+            packages/browser/playwright-report/
+            packages/browser-next/test-results/
           retention-days: 30
 
   deployment-compatibility:
@@ -295,7 +301,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
         with:
           egress-policy: audit
 

.github/workflows/new-pr.yml

@@ -19,7 +19,7 @@ jobs:
             pull-requests: write
         steps:
             - name: Audit runner egress
-              uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
+              uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
               with:
                 egress-policy: audit
 

.github/workflows/nextjs-integration.yml

@@ -85,7 +85,7 @@ jobs:
 
             - name: Upload failure diagnostics
               if: failure()
-              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+              uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
               with:
                   name: nextjs-integration-failure
                   path: test-results/nextjs-integration/

.github/workflows/posthog-upgrade.yml

@@ -32,7 +32,7 @@ jobs:
 
         steps:
             - name: Audit runner egress
-              uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
+              uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
               with:
                 egress-policy: audit
 

.github/workflows/posthog-watcher-enqueue.yml

@@ -2,7 +2,7 @@ name: PostHog Watcher enqueue
 
 on:
     issues:
-        types: [opened, reopened, edited]
+        types: [opened, reopened, edited, closed]
     issue_comment:
         types: [created]
     pull_request:
@@ -38,7 +38,7 @@ jobs:
         runs-on: ubuntu-24.04
         steps:
             - name: Audit runner egress
-              uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
+              uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
               with:
                 egress-policy: audit
 

.github/workflows/posthog-watcher-sweep.yml

@@ -31,7 +31,7 @@ jobs:
         runs-on: ubuntu-24.04
         steps:
             - name: Audit runner egress
-              uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
+              uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
               with:
                 egress-policy: audit
 
@@ -60,6 +60,7 @@ jobs:
                   labels: '*'
                   allow-fix: 'true'
                   allow-close: 'true'
+                  allow-close-own-prs: 'true'
                   allow-security-ai: 'true'
                   max-repair-attempts: '3'
                   max-pi-calls: '16'

.github/workflows/posthog-watcher-worker.yml

@@ -37,7 +37,7 @@ jobs:
         runs-on: ubuntu-24.04
         steps:
             - name: Audit runner egress
-              uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
+              uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
               with:
                 egress-policy: audit
 
@@ -64,6 +64,7 @@ jobs:
                   labels: '*'
                   allow-fix: 'true'
                   allow-close: 'true'
+                  allow-close-own-prs: 'true'
                   allow-security-ai: 'true'
                   max-repair-attempts: '3'
                   max-pi-calls: '16'
@@ -84,7 +85,7 @@ jobs:
         runs-on: ubuntu-24.04
         steps:
             - name: Audit runner egress
-              uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
+              uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
               with:
                 egress-policy: audit
 
@@ -112,6 +113,7 @@ jobs:
                   labels: '*'
                   allow-fix: 'true'
                   allow-close: 'true'
+                  allow-close-own-prs: 'true'
                   allow-security-ai: 'true'
                   max-repair-attempts: '3'
                   max-pi-calls: '16'

.github/workflows/react-native-plugin-native-ci.yml

@@ -53,7 +53,7 @@ jobs:
 
       - name: Install JDK
         if: steps.is-affected.outputs.is-affected == 'true'
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: 'zulu'
           java-version: '17'