v4.10.0

Compare Source

Features

• ChatPrompt: add body slot and focus highlight (#​6709) (123184b)
• ChatTool: add actions prop for tool approval (#​6694) (1a3a9dc)
• ContentSearch/DashboardSearch: support unmountOnHide prop (#​6523) (f03f98b)
• ContentToc: scroll list independently and center active link (#​6697) (64b9f7d)
• Drawer: add close and closeIcon props (#​6669) (53e88a4)
• Editor: allow disabling starter kit for plain text (#​6713) (76d613c)
• Empty: add loading and loadingIcon props (#​6707) (86cd25c)
• InputRating: new component (#​5757) (cba2c2c)
• Modal/Slideover: support unmountOnHide prop (#​6626) (4deb61b), closes #​5839 #​3605
• module: pre-bundle used icons into @nuxt/icon client bundle (#​6633) (8d46034)
• Popover: support enableTouch prop (#​6626) (54125f3), closes #​2346
• Prompt: add claude action (#​6693) (7bdcb13)
• prose: configurable heading anchors and copy button (#​6735) (f419731)
• ScrollArea: add getScrollElement virtualize option (#​6650) (a84de85)
• Table: add getScrollElement virtualize option (#​6657) (7e6d0f7)
• unplugin: pre-bundle used icons into the Vue/Vite build (#​6635) (dcf7cbc)

Bug Fixes

• AuthForm: track password visibility per field (#​6638) (0faeb92)
• BlogPost/ChangelogVersion: format date in UTC to prevent hydration mismatch (#​6722) (fe5bb23)
• Button: allow inline event handlers with non-void return types (#​6668) (269080a)
• Carousel: prevent reset when plugin props use inline objects (f41d11e), closes #​6221
• ChatMessages: re-evaluate streaming indicator on each render (#​6673) (5c986dd)
• components: forward $attrs to root element when to prop is absent (#​6628) (d3b5f1d)
• components: forward data-slot to component root (#​6643) (c9c5232)
• components: respect prefers-reduced-motion in animations (#​6723) (f951529)
• ContentNavigation: key items by identity to prevent leading icon flash (#​6640) (09fb52b)
• defineShortcuts: add missing arrowdown to shiftable keys (#​6702) (2128414)
• defineShortcuts: defer standalone shortcuts that prefix a chain (#​6703) (76ee176)
• Editor: prevent suggestion menu blinking on keystroke (#​6712) (7e6d8b0)
• FileUpload: add aria-disabled attribute when disabled (#​6653) (c3b2996)
• inertia: make useRoute().fullPath reactive across navigations (#​6696) (c256997)
• Link: apply rel prop to internal links (#​6677) (276302e)
• Link: fall back to original path when localePath fails (#​6637) (906e8fd)
• LocaleSelect: add missing keys in emoji mapping (#​6629) (fab73ab)
• module: avoid unhead v2-only hookOnce in colors plugin (#​6658) (e4ca579)
• SelectMenu/InputMenu: only re-highlight first item with create-item (#​6689) (a71dece)
• Separator: forward fall-through attributes to root (#​6641) (88baabc)
• theme: use logical properties for RTL (#​6724) (3179012)
• types: type prose components in app config (#​6711) (d56e39a)
• useComponentProps: let app config defaultVariants override withDefaults (#​6686) (f5e58fb)
• useFileUpload: keep dropzone type filter reactive to accept (#​6699) (000aba4)
• useResizable: recover from corrupted persisted storage (#​6704) (4c60745)
• useResizable: share resize logic between mouse and touch (#​6705) (730a54c)
• useScrollspy: unobserve previous headings on update (#​6700) (5944067)
• useToast: dedupe duplicate ids and handle max of 0 (#​6698) (71c623b)

Performance Improvements

• components: drop the redundant inner in component extend (#​6647) (3bf1a92)
• module: declare sideEffects for barrel tree-shaking (#​6729) (2cc2849)
• types: decouple useComponentProps from the component-types barrel (#​6648) (6576fb8)
• types: import cross-component types from source, not the barrel (#​6646) (7eab4bc)
• vue: skip rewriting unchanged templates (#​6730) (14b6001)

v0.0.9

Compare Source

compare changes

v6.0.3

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

v6.0.2

Compare Source

• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in #​2356

v10.4.0

Compare Source

What's Changed

Bug Fix

• Fixed only-issue-types validation by @​trueberryless in #​1338

Dependency Updates

• Bump undici to 6.27.0 via override, clean up stale license files, and version to 10.4.0. by @​dependabot in #​1342

New Contributors

• @​trueberryless made their first contribution in #​1338

Full Changelog: actions/stale@v10.3.0...v10.4.0

v10.3.0

Compare Source

What's Changed

Bug Fix

• Enhancement: ignore stale labeling events by @​shamoon in #​1311

Dependency Updates

• Upgrade dependencies (@​actions/core, @​octokit/plugin-retry, @​typescript-eslint) by @​Copilot in #​1335

New Contributors

• @​shamoon made their first contribution in #​1311

Full Changelog: actions/stale@v10...v10.3.0

v10.2.0

Compare Source

What's Changed

Bug Fix

• Fix checking state cache (fix #​1136) and switch to Octokit helper methods by @​itchyny in #​1152

Dependency Updates

• Upgrade js-yaml from 4.1.0 to 4.1.1 by @​dependabot in #​1304
• Upgrade lodash from 4.17.21 to 4.17.23 by @​dependabot in #​1313
• Upgrade actions/cache from 4.0.3 to 5.0.2 and actions/github from 5.1.1 to 7.0.0 by @​chiranjib-swain in #​1312

New Contributors

• @​itchyny made their first contribution in #​1152

Full Changelog: actions/stale@v10...v10.2.0

v10.1.1

Compare Source

What's Changed

Bug Fix

• Add Missing Input Reading for only-issue-types by @​Bibo-Joshi in #​1298

Improvement

• Improves error handling when rate limiting is disabled on GHES. by @​chiranjib-swain in #​1300

Dependency Upgrades

• Upgrade eslint-config-prettier from 8.10.0 to 10.1.8 by @​dependabot in #​1276
• Upgrade @​types/node from 20.10.3 to 24.2.0 and document breaking changes in v10 by @​dependabot in #​1280
• Upgrade actions/publish-action from 0.3.0 to 0.4.0 by @​dependabot in #​1291
• Upgrade actions/checkout from 4 to 6 by @​dependabot in #​1306

New Contributors

• @​chiranjib-swain made their first contribution in #​1300

Full Changelog: actions/stale@v10...v10.1.1

v10.1.0

Compare Source

What's Changed

• Add only-issue-types option to filter issues by type by @​Bibo-Joshi in #​1255

New Contributors

• @​Bibo-Joshi made their first contribution in #​1255

Full Changelog: actions/stale@v10...v10.1.0

v11.13.1: pnpm 11.13.1

Compare Source

Patch Changes

• Fixed pnpm pack applying workspace-root ignore rules when a workspace package has its own .npmignore file.
• Keep the interactive minimumReleaseAge approval prompt visible during pnpm install. The progress reporter now pauses its redraws while a prompt is waiting for input instead of overwriting it, so the install no longer hangs on a question the user cannot see #​13019.
• Fixed pnpm self-update failing to link native platform binaries stored in sibling global virtual store slots.

v11.13.0: pnpm 11.13

Compare Source

Minor Changes

• Added versioning.epics to pnpm-workspace.yaml. An epic ties a group of member packages to a lead package, constraining every member's major version to a band derived from the lead's major: while the lead is on major M, members live in M*100 … M*100+99. Members move independently inside the band (patch, minor, and a major intent that stays in-band); a bump that would carry a member past the band ceiling is rejected until the lead advances its own major. When a release plan takes the lead to a new stable major, every member re-bases to the band floor in the same plan. Membership is matched with pnpm's package selectors — name globs, ./-prefixed directory globs, and !-prefixed negations.

• Added the team command for managing organization teams and team memberships on the registry, with create, destroy, add, rm, and ls subcommands and support for --otp, --parseable, and --json flags.

• Added native workspace release management #​12952: the new pnpm change command records change intents as changesets-compatible .changeset/*.md files (pnpm change status shows the pending release plan), and the bare pnpm version -r consumes them — bumping versions across the workspace with dependent propagation through workspace: ranges, fixed groups, a maxBump cap, --filter narrowing, and --dry-run — writing changelogs, and recording consumed intents in a committed ledger that keeps cherry-picks and merge-backs between release branches safe. Packages can be moved onto per-package release lanes with the new pnpm lane <name> --filter <pkg> command and back with pnpm lane main --filter <pkg> (pnpm lane shows the membership), releasing X.Y.Z-lane.N prereleases from the same runs that release stable versions of the packages on the main lane. Configuration lives under the new versioning key of pnpm-workspace.yaml (fixed, ignore, maxBump, lanes, changelog). When two workspace projects publish the same name, intent files, versioning.lanes, and versioning.fixed/ignore may reference a project by its workspace-relative directory path (e.g. "./pnpm/npm/pnpm") — the one additive extension to the changesets format, applied automatically by pnpm change.

  Release changelogs default to registry storage (versioning.changelog.storage): no CHANGELOG.md is committed. Each release's section is composed at publish time and packed into the published tarball on top of the previously published version's changelog, and the consumed change intents are garbage-collected by a later pnpm version -r only once the registry confirms the version is published with its section. Set versioning.changelog.storage: repository to keep committed CHANGELOG.md files instead.

• Added a new override selector form with an empty range — "pkg@": "<version>" — called a convergence override. It rewrites a dependency edge only when its exact version satisfies the edge's declared range, so compatible consumers converge on one version while incompatible consumers keep their own resolution — now and for any dependent added in the future #​12794.

  overrides:
    "form-data@": 4.0.6

  The value must be an exact version. When a full resolution detects that every declared range also admits a newer version, pnpm warns that the override is stale and names the version to converge on. Previously an empty range in an override selector was undocumented and behaved like a bare (unscoped) override.

Patch Changes

• A tokenHelper set in the global pnpm auth.ini is no longer rejected as project-level configuration. The guard that blocks tokenHelper from a project .npmrc only treated ~/.npmrc as a trusted source, so a helper written to auth.ini (for example by pnpm config set) failed on every command and could not even be removed with pnpm config delete. A tokenHelper in a workspace or project .npmrc is still rejected.

• pnpm cache delete now removes a package's metadata from every metadata cache directory (metadata, metadata-full, and metadata-full-filtered), instead of only the one the current resolution mode reads. Previously a package cached under a different mode (e.g. metadata-full-filtered) was left behind. Closes #​12753.

• Fixed an injected workspace dependency (injectWorkspacePackages: true) incorrectly staying as file: instead of deduping back to link: when an unrelated, ordinary shared dependency resolved to a peer-suffixed variant for the target project's own copy but not for the injected occurrence. See #​10433.

• pnpm deploy now supports workspaces that use catalogs.

• Fixed pnpm deploy with a shared lockfile so local file: tarball dependencies keep their package name in the generated deploy lockfile. This prevents warm-store deploys from failing with ERR_PNPM_UNEXPECTED_PKG_CONTENT_IN_STORE when the tarball filename includes the version.

• Options that follow create, exec, or test appearing as a subcommand of another command are now parsed instead of being silently treated as positional parameters. For example, pnpm team create @&#8203;org:team --registry <url> previously ignored the --registry option and sent the request to the default registry.

• pnpm add -g, pnpm update -g, pnpm setup, and the self-updater no longer fail with ERR_PNPM_MISSING_TIME when trustPolicy: no-downgrade or resolutionMode: time-based is set in the global config #​12883. The decision to fetch full registry metadata now lives in one place, and the no-downgrade trust policy always requests full metadata (matching the self-updater), since the trust evidence it checks is missing from abbreviated metadata even on registries that include the time field.

• pnpm list and pnpm why no longer crash with EMFILE: too many open files when a project has a large number of unsaved dependencies (packages present in node_modules but not in the lockfile). The reads of those packages are now concurrency-limited.

• The published pnpm package no longer declares dependencies or devDependencies. Because the CLI bundles its runtime dependencies into dist/node_modules, those fields are dropped when packing, so npm install of the tarball no longer tries to resolve internal-only packages such as @pnpm/test-ipc-server. Closes #​12955.

• Fixed pnpm publish --otp and pnpm publish --batch --otp to send the configured OTP to the registry.

• pnpm publish again sends the package's README to the registry as metadata, so registries can render it on the package page. The readme is always included in the published metadata (matching the npm CLI), while the embed-readme setting continues to control only whether the readme is written into the package.json inside the tarball. This restores the behavior that was lost when publishing became fully native. Closes #​12966.

• Fixed the dependency status check wrongly reporting "up to date" when a package.json, .pnpmfile.cjs, or patch file was edited in the same second as the previous install, on filesystems that record mtimes at whole-second resolution (for example ext4 with 128-byte inodes). The optimistic repeat-install fast path and verify-deps-before-run compared mtimes strictly, so a same-second edit whose mtime rounded down looked unchanged and re-resolution was skipped. Such a file's whole second is now treated as possibly-modified, falling through to the content check; behavior on sub-second filesystems is unchanged.

• Retry package metadata requests when a registry or proxy returns 304 Not Modified to an unconditional request, preventing false ERR_PNPM_CACHE_MISSING_AFTER_304 failures pnpm/pnpm#12882.

  If the retry also returns 304, report ERR_PNPM_META_NOT_MODIFIED_WITHOUT_CACHE instead.

• Fixed pnpm update removing transitive lockfile entries when dedupePeerDependents is disabled and the selected package is absent pnpm/pnpm#12456.

• Limit modern deploy lockfiles and localized virtual stores to dependencies reachable from the selected dependency groups.

• A tokenHelper command is now given a 60-second time limit. A helper that hangs (deadlock, stuck I/O) is killed and reported as an error instead of leaving the command waiting forever.

• Fixed orphaned child processes on Windows when pnpm exits on an error while commands spawned by pnpm exec or pnpm dlx are still running (for example, when one project's command fails during pnpm --recursive exec). The PIDs of these commands are now recorded when they are spawned and their whole process trees are terminated with taskkill on an error exit. Previously the cleanup relied on enumerating the system process list, which is so slow on Windows that the enumeration hit its timeout and the cleanup was silently skipped #​12406.

• pnpm pack now respects workspace-root .npmignore and .gitignore files when packing workspace packages.

Platinum Sponsors

Gold Sponsors

v11.12.0: pnpm 11.12

Compare Source

Minor Changes

• a897ef7: Custom fetchers exported from a pnpmfile can now delegate by returning a { delegate: <resolution> } envelope: pnpm rewrites the package's resolution to the delegated shape and runs the built-in fetcher on it. This is the portable delegation form that also works in pacquet, where cafs and fetchers cannot be passed to the hook. Related to pnpm/pnpm#11685.

Patch Changes

• 2b02764: The changed-packages filter (--filter "...[<since>]") no longer allows an option-like <since> value (such as --output=<path>) to be interpreted as a git option — git now rejects it as a bad revision. The repository root is also resolved to the nearest .git entry, so the filter works in a git worktree checked out inside another repository's tree.

• 43711ce: pnpm outdated no longer checks the registry for dependencies that are resolved from local link:, file:, or workspace: references in the lockfile #​12827.

• 3c6718b: Fixed a deadlock in peer dependency resolution: pnpm install hung forever when a peer dependency cycle spanned a project's own dependencies and auto-installed peer providers, for example when installing electron-builder@26.15.3 #​12921.

• 252f15e: Fixed peer dependency auto-install picking a version the peer range rejects. In a workspace with several projects, a package declaring a peer dependency with a semver range (for example ^1.0.0) could get the highest version found anywhere in the workspace (for example a 2.0.0 resolved for another project) instead of a version that satisfies the range. Peers are now deduplicated onto the highest preferred version that satisfies the declared range, and when none does, the range is resolved from the registry.

  Also fixed re-resolving with an existing lockfile hoisting a different peer version than a fresh install of the same manifest: root dependencies reused from the lockfile were invisible to peer hoisting, so a peer that a root dependency provides could be bound to another version.

• a38adda: pnpm self-update <version> now installs the requested pnpm version when it matches the currently running version but is missing from the global self-update directory.

• 6a85968: pnpm stage list now stops paginating after a fail-safe cap of 1000 pages, so a misbehaving registry cannot keep the command looping forever.

• eee7c9a: verify-deps-before-run no longer spawns a pnpm install when pnpm is executed in a directory that has no package.json. A mistyped command run outside a project (for example pnpm witch 10 login) used to crash with a confusing error from the spawned install; now it fails with the regular "no package.json found" error.

Platinum Sponsors

Gold Sponsors

v1.402.3

Compare Source

1.402.3

Patch Changes

• #​4157 4a2ecf5 Thanks @​posthog! - Session recording no longer emits an uncaught NotAllowedError ("Sharing constructed stylesheets in multiple documents is not allowed") when a page assigns a CSSStyleSheet constructed in a different document to adoptedStyleSheets. That assignment is the host page's own invalid operation, but the recorder's patched setter sat on the call stack, so the exception was attributed to rrweb and churned fingerprints in error tracking. The recorder now contains this specific rejection (matched by its standardized NotAllowedError name, so it works even when the setter throws from an iframe realm) and skips recording those sheets, while still re-throwing any other native-setter error so host-page behaviour is preserved.
  (2026-07-15)

• #​4158 0dc389e Thanks @​posthog! - fix(replay): session recording no longer throws TypeError: Converting circular structure to JSON when replay event data contains a circular reference. The circular-reference guard now also detects cycles that pass through an array, and affected events are captured with [Circular] markers instead of surfacing an unhandled error and being dropped.
  (2026-07-15)

• Updated dependencies [fc2cb2e]:

  • @​posthog/core@​1.42.1

v1.402.2

Compare Source

1.402.2

Patch Changes

• #​4151 81adbfd Thanks @​posthog! - Session recording no longer emits an uncaught TypeError: Illegal invocation when a programmatic input-value change happens on an object that is not a genuine native input element (for example a proxy on the element prototype chain). The recorder drops that one replay update instead of throwing.
  (2026-07-15)

v1.402.1

Compare Source

1.402.1

Patch Changes

• #​4117 1eddff7 Thanks @​DanielVisca! - add the posthog.metrics API (count, gauge, histogram) to posthog-node — alpha

  Backend services can now record metrics through the same statsd-style pre-aggregating client the browser SDK ships, with no OpenTelemetry setup:

  const client = new PostHog('phc_...', { metrics: { serviceName: 'billing-worker' } })
  client.metrics.count('invoices.processed', 1, { attributes: { plan: 'pro' } })
  client.metrics.gauge('queue.depth', 42)
  client.metrics.histogram('job.duration', 187, { unit: 'ms' })

  Samples aggregate in memory and flush as OTLP/JSON to /i/v1/metrics (one data point per series per window). Pending metrics are flushed on shutdown(). Core gains _sendMetricsBatch on PostHogCoreStateless (same outcome contract as _sendLogsBatch) and a shared resolveMetricsConfig, so any core-based SDK can host PostHogMetrics. (2026-07-15)

• Updated dependencies [1eddff7]:

  • @​posthog/core@​1.42.0

v1.402.0

Compare Source

1.402.0

Minor Changes

• #​4143 0e8ad14 Thanks @​robbie-c! - Stamp the current hostname as $snapshot_host on every $snapshot event the session recorder sends. The value is derived from the page URL after it passes through the existing replay URL masking pipeline (maskCapturedNetworkRequestFn / deprecated maskNetworkRequestFn, hash stripping, personal-data query-param masking), so it cannot bypass a customer's masking config. When masking removes the URL or the masked result doesn't parse as a URL, the property is omitted entirely. This gives ingestion consumers a per-message host signal even for mid-session snapshot batches that contain no URL-bearing events.
  (2026-07-15)

v1.401.0

Compare Source

1.401.0

Minor Changes

• #​4129 800af7c Thanks @​pauldambra! - feat: add session_recording.attributeFilter option that passes an attribute allowlist through to the native MutationObserver, so mutations to unlisted attributes (e.g. animation-driven inline style churn) never cost recording CPU (port of upstream rrweb #​1873)
  (2026-07-15)

Patch Changes

• Updated dependencies [800af7c]:
  • @​posthog/types@​1.395.0

v1.400.1

Compare Source

1.400.1

Patch Changes

• #​4090 6dd8827 Thanks @​lucasheriques! - chore: survey seen-key and repeat-activation helpers now live in @​posthog/core, shared by the web and React Native SDKs. Core's survey enums are now const-object literal unions (matching the web SDK's existing pattern), so the same values type-check across both SDKs. No behavior change. Type-level note: enum members no longer work as standalone type annotations (e.g. SurveyType.Popover as a type); use the exported union types instead. Runtime values are unchanged.
  (2026-07-14)
• Updated dependencies [6dd8827]:
  • @​posthog/core@​1.41.1

v1.400.0

Compare Source

1.400.0

Minor Changes

• #​4101 dc2aa5b Thanks @​posthog! - Normalize the error tracking rate-limiter config to first-class options. The browser SDK now reads exceptionRateLimiterRefillRate / exceptionRateLimiterBucketSize on error_tracking, with the previous double-underscore __exceptionRateLimiterRefillRate / `__excepti

✂ Note

PR body was truncated to here.