[ioannisj]

Problem

With the merge queue the push to main comes from github-merge-queue[bot], so GitHub's "Prevent self-review" on the NPM Release environment never excludes the PR author or whoever queued it. The approval guard catches that after the fact and fails the release, but the Slack approval request gives no hint who's excluded, and nothing posts back when the guard rejects an approval. In run 39750702665 I queued #5273, approved it myself, the guard failed, and a teammate had to re-run and approve.

Changes

Picks up PostHog/.github#82 (merged as f0431489d137b9e7474fc428cf176e4c668cc4a2), which teaches the shared notify-approval-needed.yml to name the excluded approvers and list the PRs in the Slack message when the caller lets it read PRs.

• Grants the notify job pull-requests: read so the shared workflow can run the guard in report mode.
• Bumps both PostHog/.github pins to f0431489d137b9e7474fc428cf176e4c668cc4a2.
• Replies in the Slack thread when the guard rejects an approval, naming who approved and pointing at the re-run, since re-running the failed jobs asks for a fresh approval. This only fires when the guard reported a violation.
• Replies separately when the guard itself failed to run (API error, no approval found), pointing at the job log, so an outage isn't announced as a rejected approval.

CI only, no library code changes, so no changeset.

Release info Sub-libraries affected

Libraries affected

• All of them
• posthog-js (web)
• posthog-js-lite (web lite)
• posthog-node
• posthog-react-native
• @posthog/react-native-plugin
• @posthog/react
• @posthog/ai
• @posthog/convex
• @posthog/next
• @posthog/nextjs-config
• @posthog/nuxt
• @posthog/openfeature-node-provider
• @posthog/openfeature-web-provider
• @posthog/rollup-plugin
• @posthog/webpack-plugin
• @posthog/types
• @posthog/browser-common

Checklist

• Tests for new code
• Accounted for the impact of any changes across different platforms
• Accounted for backwards compatibility of any changes (no breaking changes!)
• Took care not to unnecessarily increase the bundle size

If releasing new changes

• Ran pnpm changeset to generate a changeset file

🤖 Agent context

DRI: @ioannisj
Autonomy: Human-driven (agent-assisted)

[github-actions]

📝 No Changeset Found

This PR doesn't include a changeset. A changeset is required to release a new version.

How to add a changeset

Run this command and follow the prompts:

pnpm changeset

Remember: Never use major version bumps for posthog-js as it's autoloaded by clients.

[posthog]

PostHog Review · Standard · reviewed 46d6eba: 1 Should fix.

This is the only automatic review while this pull request is a draft. Comment @posthog review to review new changes sooner. Otherwise, a review of the new changes runs when you mark it ready for review.

[github-actions]

Coherence

4 spec problems · 0 failing chokepoints · 2 spec gaps · 0 guard failures

44 components, 7 bullets (5 invariants, 2 requirements), 4 problems

Spec problems (spec --check)

• packages/ai/src/otel/Otel.spec.md:7 an invariant bullet starts with <name>: <sentence>
• packages/ai/src/otel/Otel.spec.md:8 an invariant bullet starts with <name>: <sentence>
• Posthog-js.practice.md:20 practice add an invariant cites 187a5c5, which is no commit in this repository
• Posthog-js.practice.md:20 practice add an invariant cites 8922ab2, which is no commit in this repository

Chokepoints: none declared.

Spec gaps: 2 entrances with outside or unknown trust and no traced control, and 10 more held by the adoption baseline

• packages/web/Web.spec.md entrance public api (trust host-app): packages/web
• packages/webpack-plugin/Webpack-plugin.spec.md entrance webpack plugin (trust build): packages/webpack-plugin

Close one with guard: <chokepoint>, an invariant that names it on its entrances: line, or control: none — <reason>; scaffold control proposes it.