fix(deps): next 16.4.2 (уязвимости Next.js от 14.10) и 26 минорных обновлений сайта (#457)

[dependabot]

Bumps the npm group with 27 updates:

Package	From	To
@base-ui/react	1.8.0	1.9.0
@clerk/localizations	4.22.0	4.23.0
@clerk/nextjs	7.9.11	7.9.14
@sentry/nextjs	11.4.0	11.7.0
drizzle-orm	0.45.3	0.45.4
lucide-react	1.52.0	1.56.0
next	16.3.8	16.4.0
posthog-js	1.436.1	1.438.9
posthog-node	5.55.0	5.55.3
resend	6.32.0	6.32.1
shadcn	4.21.3	4.21.4
@types/node	24.19.1	24.19.2
@vitest/coverage-v8	5.0.3	5.0.4
dotenv	18.0.5	18.0.7
eslint-config-next	16.3.8	16.4.0
vitest	5.0.3	5.0.4
storybook	10.6.1	10.6.2
@storybook/nextjs-vite	10.6.1	10.6.2
@chromatic-com/storybook	5.4.0	5.5.1
@storybook/addon-vitest	10.6.1	10.6.2
@storybook/addon-a11y	10.6.1	10.6.2
@storybook/addon-docs	10.6.1	10.6.2
@storybook/addon-mcp	10.6.1	10.6.2
vite	8.3.3	8.3.4
eslint-plugin-storybook	10.6.1	10.6.2
@vitest/browser-playwright	5.0.3	5.0.4
playwright	1.63.0	1.64.0

Updates @base-ui/react from 1.8.0 to 1.9.0

Release notes

Sourced from @​base-ui/react's releases.

v1.9.0

General changes

• Export CssVariables and DataAttributes types (#5243) by @​superhooman
• Fix stale focused field state (#5345) by @​atomiks
• Fix animation waits retaining detached elements (#5719) by @​flaviendelangle
• Keep item registration in sync when items change under Strict Mode (#5862) by @​atomiks
• Avoid re-rendering inactive triggers on open and close (#5865) by @​atomiks

Accordion

• Fix <Accordion.Trigger>'s data-value and data-index attributes (#5705) by @​cpruijsen
• Apply the native disabled attribute to <Accordion.Trigger> when using native buttons (#5607) by @​atomiks
• Expand hiddenUntilFound panels synchronously on beforematch (#5514) by @​aarongarciah

Alert Dialog

• Don't associate a programmatically opened popup with a trigger that did not open it (#5641) by @​michaldudak

Autocomplete

• Fix autoHighlight for asynchronous results (#5818) by @​atomiks
• Pass the originating event to onItemHighlighted. Pointer events may be MouseEvent or PointerEvent; typing reports the reason none (#5838) by @​atomiks
• Decouple automatic unmounting from actionsRef. Call eventDetails.preventUnmountOnClose() in onOpenChange to opt out of automatic unmounting (#5734) by @​michaldudak

Checkbox

• Prefer aria-label over associated labels (#5787) by @​atomiks

Collapsible

• Apply the native disabled attribute to <Collapsible.Trigger> when using native buttons (#5607) by @​atomiks
• Finish closing when the render function removes the panel (#5890) by @​michaldudak
• Restore animations when a removed panel reopens (#5891) by @​michaldudak
• Expand hiddenUntilFound panels synchronously on beforematch (#5514) by @​aarongarciah

Combobox

• Fix stale chip focus after returning to the input (#5879) by @​mdm317
• Fix autoHighlight for asynchronous results (#5818) by @​atomiks
• Decouple automatic unmounting from actionsRef. Call eventDetails.preventUnmountOnClose() in onOpenChange to opt out of automatic unmounting (#5734) by @​michaldudak
• Fix label focus in Shadow DOM (#5871) by @​lyzno1
• Pass the originating event to onItemHighlighted. Pointer events may be MouseEvent or PointerEvent; typing reports the reason none (#5838) by @​atomiks
• Reset typeahead state when closing without moving focus (#5816) by @​mdm317
• Accept readonly arrays for multiple values (#5710) by @​MonstraG
• Share item indicator implementation (#5728) by @​flaviendelangle
• Improve mount performance of large lists (#5819) by @​atomiks
• Combine item store subscriptions (#5863) by @​atomiks

Dialog

... (truncated)

Changelog

Sourced from @​base-ui/react's changelog.

v1.9.0

Oct 9, 2026

General changes

• Export CssVariables and DataAttributes types (#5243) by @​superhooman
• Fix stale focused field state (#5345) by @​atomiks
• Fix animation waits retaining detached elements (#5719) by @​flaviendelangle
• Keep item registration in sync when items change under Strict Mode (#5862) by @​atomiks
• Avoid re-rendering inactive triggers on open and close (#5865) by @​atomiks

Accordion

• Fix <Accordion.Trigger>'s data-value and data-index attributes (#5705) by @​cpruijsen
• Apply the native disabled attribute to <Accordion.Trigger> when using native buttons (#5607) by @​atomiks
• Expand hiddenUntilFound panels synchronously on beforematch (#5514) by @​aarongarciah

Alert Dialog

• Don't associate a programmatically opened popup with a trigger that did not open it (#5641) by @​michaldudak

Autocomplete

• Fix autoHighlight for asynchronous results (#5818) by @​atomiks
• Pass the originating event to onItemHighlighted. Pointer events may be MouseEvent or PointerEvent; typing reports the reason none (#5838) by @​atomiks
• Decouple automatic unmounting from actionsRef. Call eventDetails.preventUnmountOnClose() in onOpenChange to opt out of automatic unmounting (#5734) by @​michaldudak

Checkbox

• Prefer aria-label over associated labels (#5787) by @​atomiks

Collapsible

• Apply the native disabled attribute to <Collapsible.Trigger> when using native buttons (#5607) by @​atomiks
• Finish closing when the render function removes the panel (#5890) by @​michaldudak
• Restore animations when a removed panel reopens (#5891) by @​michaldudak
• Expand hiddenUntilFound panels synchronously on beforematch (#5514) by @​aarongarciah

Combobox

• Fix stale chip focus after returning to the input (#5879) by @​mdm317
• Fix autoHighlight for asynchronous results (#5818) by @​atomiks
• Decouple automatic unmounting from actionsRef. Call eventDetails.preventUnmountOnClose() in onOpenChange to opt out of automatic unmounting (#5734) by @​michaldudak
• Fix label focus in Shadow DOM (#5871) by @​lyzno1
• Pass the originating event to onItemHighlighted. Pointer events may be MouseEvent or PointerEvent; typing reports the reason none (#5838) by @​atomiks
• Reset typeahead state when closing without moving focus (#5816) by @​mdm317
• Accept readonly arrays for multiple values (#5710) by @​MonstraG

... (truncated)

Commits

• ad7ecda [release] v1.9.0 (#5906)
• 3296de3 [drawer] Avoid retaining unmounted drawers in DrawerProvider (#5921)
• 69c33b4 [drawer] Fix deferred touch swipes leaving the popup (#5922)
• 51b70db [menu] Strip internal filter components from public types (#5923)
• 8d8b98c [menu] Ignore filter input edits while the menu animates out (#5911)
• aeba3eb [combobox][menu][select] Revert highlightItem imperative action (#5910)
• ec6bf32 [field][select][combobox][slider] Fall back to the owner document when lookin...
• 1f112a5 [popups] Avoid re-rendering inactive triggers on open and close (#5865)
• bc53db6 [fieldset] Await render in Legend disabled-state test (#5909)
• 147092e [test] Strengthen tests, add test lint rules and share copied suites (#5892)
• Additional commits viewable in compare view

Updates @clerk/localizations from 4.22.0 to 4.23.0

Release notes

Sourced from @​clerk/localizations's releases.

@​clerk/localizations@​4.23.0

Minor Changes

• Add a role mapping step to the self-serve Directory Sync setup in <OrganizationProfile />. Organization admins can now assign an organization role to each directory group their identity provider pushes, set which group wins when a member belongs to several, and turn role syncing on or off. Members in no mapped group keep the organization's default role. The step is read-only for members without the org:sys_memberships:manage permission and while the organization's role set is being migrated. (#10081) by @​kalafut

Patch Changes

• Updated dependencies [dcb03d3, 31c1930]:
  • @​clerk/shared@​4.40.0

@​clerk/localizations@​4.22.1

Patch Changes

• Updated dependencies [568c668]:
  • @​clerk/shared@​4.39.1

Changelog

Sourced from @​clerk/localizations's changelog.

4.23.0

Minor Changes

• Add a role mapping step to the self-serve Directory Sync setup in <OrganizationProfile />. Organization admins can now assign an organization role to each directory group their identity provider pushes, set which group wins when a member belongs to several, and turn role syncing on or off. Members in no mapped group keep the organization's default role. The step is read-only for members without the org:sys_memberships:manage permission and while the organization's role set is being migrated. (#10081) by @​kalafut

Patch Changes

• Updated dependencies [dcb03d3, 31c1930]:
  • @​clerk/shared@​4.40.0

4.22.1

Patch Changes

• Updated dependencies [568c668]:
  • @​clerk/shared@​4.39.1

Commits

• a0ea270 ci(repo): Version packages (#10155)
• dcb03d3 feat(ui,clerk-js,shared): add a role mapping step to the Directory Sync wizar...
• ff81d5a ci(repo): Version packages (#10074)
• See full diff in compare view

Updates @clerk/nextjs from 7.9.11 to 7.9.14

Release notes

Sourced from @​clerk/nextjs's releases.

@​clerk/nextjs@​7.9.14

Patch Changes

• Updated dependencies [dcb03d3, 31c1930]:
  • @​clerk/shared@​4.40.0
  • @​clerk/react@​6.17.8
  • @​clerk/backend@​3.23.2

@​clerk/nextjs@​7.9.13

Patch Changes

• Export <HandleSSOCallback /> from @clerk/nextjs. Previously, importing it from @clerk/nextjs failed, so it could not be used on the SSO callback route of a custom flow. (#10140) by @​manovotny

@​clerk/nextjs@​7.9.12

Patch Changes

• Updated dependencies [fc7d050, 568c668]:
  • @​clerk/react@​6.17.7
  • @​clerk/shared@​4.39.1
  • @​clerk/backend@​3.23.1

Changelog

Sourced from @​clerk/nextjs's changelog.

7.9.14

Patch Changes

• Updated dependencies [dcb03d3, 31c1930]:
  • @​clerk/shared@​4.40.0
  • @​clerk/react@​6.17.8
  • @​clerk/backend@​3.23.2

7.9.13

Patch Changes

• Export <HandleSSOCallback /> from @clerk/nextjs. Previously, importing it from @clerk/nextjs failed, so it could not be used on the SSO callback route of a custom flow. (#10140) by @​manovotny

7.9.12

Patch Changes

• Updated dependencies [fc7d050, 568c668]:
  • @​clerk/react@​6.17.7
  • @​clerk/shared@​4.39.1
  • @​clerk/backend@​3.23.1

Commits

• a0ea270 ci(repo): Version packages (#10155)
• b08dd03 ci(repo): Version packages (#10141)
• 4a07953 fix(nextjs): Export HandleSSOCallback from @​clerk/nextjs (#10140)
• ff81d5a ci(repo): Version packages (#10074)
• See full diff in compare view

Updates @sentry/nextjs from 11.4.0 to 11.7.0

Release notes

Sourced from @​sentry/nextjs's releases.

11.7.0

Important Changes

• feat(cloudflare): Add opt-in cron monitoring for Cron Triggers (#25014)

  The new cronTriggersIntegration sends check-ins for Cron Triggers. Each check-in includes the schedule from controller.cron, so Sentry creates the monitor on the first run. The integration is opt-in, because monitors are billed.

  Cron Triggers have no names, so map each cron expression of your wrangler config to a monitor slug. With the Sentry Cloudflare Vite plugin, add the integration to src/instrument.server.ts:

  // src/monitorSlugs.ts
  export const monitorSlugs: Record<string, string> = {
    '30 9 * * MON-FRI': 'daily-report',
  };
  // src/instrument.server.ts
  import * as Sentry from '@​sentry/cloudflare';
  import { monitorSlugs } from './monitorSlugs';
  export default Sentry.defineCloudflareOptions(env => ({
  dsn: env.SENTRY_DSN,
  integrations: [Sentry.cronTriggersIntegration({ monitorSlug: cron => monitorSlugs[cron] })],
  }));
  // src/index.ts
  import { monitorSlugs } from './monitorSlugs';
  export default {
  async scheduled(controller, env) {
  switch (monitorSlugs[controller.cron]) {
  case 'daily-report':
  // Your daily report job
  break;
  }
  },
  };

  The monitorSlug function can also return monitor settings, for example { monitorSlug: 'daily-report', maxRuntime: 30 }, or undefined to send no check-ins for a trigger. Without monitorSlug, the SDK derives the slug from the cron expression. If you deploy with wrangler directly, pass the same integration to Sentry.withSentry.

• feat(node): Add neonIntegration for @​neondatabase/serverless (#25164, #25176)

  The new neonIntegration creates db spans for queries of the @neondatabase/serverless driver: for the WebSocket Client and Pool, and for the HTTP neon() function. This includes the neon-http and neon-serverless adapters of Drizzle. The integration is on by default when tracing is enabled.

• feat(node): Stop sending the process session once request sessions are tracked (#24915)

  Node servers sent release health data two times: as request session aggregates, and as the process session of processSessionIntegration. An error in a request also marked the process session as errored, so the SDK counted the error two times. Now the SDK drops the process session when it tracks the first request session. Scripts, CLIs and workers that do not serve requests keep the process session, and so do servers with httpServerIntegration({ sessions: false }). This changes the release health numbers of Node servers, because they no longer send the errored or crashed update of the process session.

• feat(server-utils): Record decide calls as gen_ai.decide spans (#25270, #25272, #25274, #25281)

... (truncated)

Changelog

Sourced from @​sentry/nextjs's changelog.

11.7.0

Important Changes

• feat(cloudflare): Add opt-in cron monitoring for Cron Triggers (#25014)

  The new cronTriggersIntegration sends check-ins for Cron Triggers. Each check-in includes the schedule from controller.cron, so Sentry creates the monitor on the first run. The integration is opt-in, because monitors are billed.

  Cron Triggers have no names, so map each cron expression of your wrangler config to a monitor slug. With the Sentry Cloudflare Vite plugin, add the integration to src/instrument.server.ts:

  // src/monitorSlugs.ts
  export const monitorSlugs: Record<string, string> = {
    '30 9 * * MON-FRI': 'daily-report',
  };
  // src/instrument.server.ts
  import * as Sentry from '@​sentry/cloudflare';
  import { monitorSlugs } from './monitorSlugs';
  export default Sentry.defineCloudflareOptions(env => ({
  dsn: env.SENTRY_DSN,
  integrations: [Sentry.cronTriggersIntegration({ monitorSlug: cron => monitorSlugs[cron] })],
  }));
  // src/index.ts
  import { monitorSlugs } from './monitorSlugs';
  export default {
  async scheduled(controller, env) {
  switch (monitorSlugs[controller.cron]) {
  case 'daily-report':
  // Your daily report job
  break;
  }
  },
  };

  The monitorSlug function can also return monitor settings, for example { monitorSlug: 'daily-report', maxRuntime: 30 }, or undefined to send no check-ins for a trigger. Without monitorSlug, the SDK derives the slug from the cron expression. If you deploy with wrangler directly, pass the same integration to Sentry.withSentry.

• feat(node): Add neonIntegration for @​neondatabase/serverless (#25164, #25176)

  The new neonIntegration creates db spans for queries of the @neondatabase/serverless driver: for the WebSocket Client and Pool, and for the HTTP neon() function. This includes the neon-http and neon-serverless adapters of Drizzle. The integration is on by default when tracing is enabled.

• feat(node): Stop sending the process session once request sessions are tracked (#24915)

  Node servers sent release health data two times: as request session aggregates, and as the process session of processSessionIntegration. An error in a request also marked the process session as errored, so the SDK counted the error two times. Now the SDK drops the process session when it tracks the first request session. Scripts, CLIs and workers that do not serve requests keep the process session, and so do servers with httpServerIntegration({ sessions: false }). This changes the release health numbers of Node servers, because they no longer send the errored or crashed update of the process session.

• feat(server-utils): Record decide calls as gen_ai.decide spans (#25270, #25272, #25274, #25281)

... (truncated)

Commits

• 47dff7d release: 11.7.0
• 72588e6 Merge pull request #25296 from getsentry/prepare-release/11.7.0
• 323307a meta(changelog): Update changelog for 11.7.0
• 87bdc84 fix(bundler-plugins): Escape JSON in generated injection code (#25265)
• b80300b fix(server-utils): Stop treating previous_response_id as the OpenAI conversat...
• 236c0ce fix(browser): Apply urlQueryParams to breadcrumb and element timing URLs (#...
• ee04661 fix(browser): Apply urlQueryParams to event URLs, static span names and LCP...
• 1e86178 fix(nuxt): Keep @sentry/server-runtime-injection external on Nitro v3 (#24901)
• 8a6b9ca test(node-integration): Stop exporting NODE_VERSION and RUNTIME from the ...
• 9f7cbad feat(server-utils): Map Mastra classifier evaluations to gen_ai.decide spans ...
• Additional commits viewable in compare view

Updates drizzle-orm from 0.45.3 to 0.45.4

Release notes

Sourced from drizzle-orm's releases.

0.45.4

• Fixed postgres-js not using prepared queries on explicit .prepare(name)

Commits

• eab8bed Fixed postgres-js not using prepared queries on explicit .prepare(name) (...
• See full diff in compare view

Updates lucide-react from 1.52.0 to 1.56.0

Release notes

Sourced from lucide-react's releases.

Version 1.56.0

What's Changed

• feat(icons): added server-nas icon by @​benhaube in lucide-icons/lucide#4537
• fix(icons,categories): fix notifications category name and refine circle-x tags by @​Rachit315 in lucide-icons/lucide#4994
• feat(icons): add message-circle-text icon by @​ericfennis in lucide-icons/lucide#4898

New Contributors

• @​Rachit315 made their first contribution in lucide-icons/lucide#4994

Full Changelog: lucide-icons/lucide@1.55.0...1.56.0

Version 1.55.0

What's Changed

• feat(icons): added mail-dot icon by @​elenakovelskikh in lucide-icons/lucide#3230
• ci(lint): split lint jobs and annotate Prettier and JSON schema errors in PRs by @​ericfennis in lucide-icons/lucide#4982
• chore(deps-dev): bump sharp from 0.35.4 to 0.35.5 by @​dependabot[bot] in lucide-icons/lucide#4987
• chore(deps): bump next from 16.3.6 to 16.3.8 by @​dependabot[bot] in lucide-icons/lucide#4988
• test(lucide): add tests for empty icons error and DocumentFragment root in createIcons by @​grzdev in lucide-icons/lucide#4967
• feat(icons): added phone-log icon by @​Levi-Bensley in lucide-icons/lucide#3598
• chore(copilot-instruction): Adjust instruction text to allow more then 4 use-cases by @​ericfennis in lucide-icons/lucide#4989
• feat(icons): added wifi-lock icon by @​benhaube in lucide-icons/lucide#4913
• feat(icons): Add handle-bottom-right icon by @​ocavue in lucide-icons/lucide#1793
• test(lucide-react): add tests for DynamicIcon fallback and ref forwarding by @​grzdev in lucide-icons/lucide#4966
• feat(icons): added screw icon by @​edik17 in lucide-icons/lucide#4932
• feat(icons): added user-round-star icon by @​karsa-mistmere in lucide-icons/lucide#3469
• feat(icons): added shield-house icon by @​benhaube in lucide-icons/lucide#4602

New Contributors

• @​grzdev made their first contribution in lucide-icons/lucide#4967
• @​Levi-Bensley made their first contribution in lucide-icons/lucide#3598
• @​edik17 made their first contribution in lucide-icons/lucide#4932

Full Changelog: lucide-icons/lucide@1.54.0...1.55.0

Version 1.54.0

What's Changed

• feat(icons): added lens icon by @​rrod497 in lucide-icons/lucide#4923

Full Changelog: lucide-icons/lucide@1.53.0...1.54.0

Version 1.53.0

What's Changed

• chore(deps-dev): bump preact from 10.29.8 to 11.0.0 in the preact-deps group by @​dependabot[bot] in lucide-icons/lucide#4961
• chore(deps): bump vue from 3.5.42 to 3.5.43 in the vue-deps group by @​dependabot[bot] in lucide-icons/lucide#4958
• fix(site): Fix reset button and rename absolute stroke width to non-scaling stroke by @​ericfennis in lucide-icons/lucide#4956
• chore(deps-dev): bump simple-git from 3.36.0 to 4.0.1 by @​dependabot[bot] in lucide-icons/lucide#4968
• chore(deps-dev): bump the angular-deps group across 1 directory with 11 updates by @​dependabot[bot] in lucide-icons/lucide#4960
• chore(categories): Add description field to categories by @​ericfennis in lucide-icons/lucide#4909
• feat(icons): added groceries icon by @​rrod497 in lucide-icons/lucide#4907

... (truncated)

Commits

• 949bc6d test(lucide-react): add tests for DynamicIcon fallback and ref forwarding (#4...
• See full diff in compare view

Updates next from 16.3.8 to 16.4.0

Release notes

Sourced from next's releases.

v16.4.0

Check out the 16.4 announcement post to get an overview of the changes.

Core Changes

• Show compiler plugin warning in more situations: #75682
• fix(scripts): correct typo in rm.mjs error message: #87015
• docs: improve clarity and punctuation in README: #86096
• Fix debug build paths Pages Router support entries: #93529
• bundle-analyzer: record historical snapshots on each analyze run: #93520
• fix: detect proxy.ts correctly with compound pageExtensions: #93246
• feat(turbopack): support false values for resolveAlias config: #93331

Misc Changes

• docs: correction to dynamicParams migration: #96624
• docs: proxy event argument: #96435
• docs: remove experimental note from runtime prefetching: #96615
• Preserve per-segment prefetching after dynamic navigation: #96583
• Rename static generation stream option to waitForAllReady: #96564
• Remove obsolete static generation plumbing: #96563
• [turbopack] Drop dead writes to exports: #96381
• [turbopack] Ignore writes to exports after a module.exports = {} writes: #96380
• [turbopack] Add test for sideEffects with optimizePackageImports: #96549
• [turbopack] Strip leading BOM before parsing CSS: #96678
• Upgrade React from cbb046ab-20260731 to 7dfc7ccd-20260803: #96550
• docs: use relative doc links in instant-navigation error pages: #96672
• Turbopack: terminate failed plugin worker threads: #96592
• Fix HTML-limited bot matching in prerender bypass rules: #96584
• [ci] Fix create_release_branch for new repo permissions: #96641
• test: skip action module instance deploy test: #96629
• docs: quote the dynamicParams build error in a blockquote: #96633
• [react-sync] Open pull requests as the bot that authors the commits: #96682
• [Bench] Fixes for pure Fizz bench: #96771
• Derive foreground cache revalidation from the consumer: #96731
• Fix race when navigating Back before hydration: #96252
• docs: present each Skill as steps in the AI agents guide: #96751
• Reuse completed cache entries for the rest of a request: #96727
• Upgrade React from 7dfc7ccd-20260803 to 11eddecd-20260805: #96735
• Remove WorkStore execution mode: #96674
• Remove cache revalidation execution mode reads: #96670
• Separate App Route render and prerender pipelines: #96662
• Remove App Page execution mode reads: #96660
• test: fix missing await in css-chunking test: #96725
• docs (Skills): stop assuming app/ at the root and port 3000: #96696
• Implement next/font BeforeResolvePlugins as ImportMappingReplacement: #95808
• Use Tailwind Turbopack loader in create-next-app: #96606
• docs: instant navigation quick start with an adoption prompt: #96663
• Separate App Page render and prerender pipelines: #96659
• Move App Router execution intent to entrypoints: #96640

... (truncated)

Commits

• e273d5b v16.4.0
• fdf41d6 [ai-upgrade] discover upgrade models and reasoning efforts from agent CLIs (#...
• c3e76ad v16.4.0-canary.63
• 47c6cc8 Document next analyze export in the package bundling guide (#99735)
• 5b10604 Revert stabilization of forbidden() and unauthorized() (#99734)
• f3a6f97 Preserve configured output directories during static export (#99507)
• b22e5a2 Rename skill to next-bundle-optimizer and document its usage (#99731)
• 74dc549 [turbo-tasks-backend] Clean up task state before publishing execution complet...
• ccf8c15 v16.4.0-canary.62
• b8c7c7f Improve static route error guidance (#99724)
• Additional commits viewable in compare view

Updates posthog-js from 1.436.1 to 1.438.9

Release notes

Sourced from posthog-js's releases.

posthog-js@1.438.9

1.438.9

Patch Changes

• #5281 8f2d581 Thanks @​marandaneto! - Fix before_send callback types to accept non-null events while still allowing null returns to drop events. (2026-10-12)
• Updated dependencies [8f2d581]:
  • @​posthog/types@​1.415.3
  • @​posthog/core@​1.58.1

posthog-js@1.438.8

1.438.8

Patch Changes

• #5259 ba4cc49 Thanks @​gesh! - Capture WebMCP error types and sanitized messages. (2026-10-12)

posthog-js@1.438.7

1.438.7

Patch Changes

• #4990 a66cada Thanks @​dustinbyrne! - Share browser logging across SDKs with consistent initialization and cleanup; captureLog and logger calls before logging setup are now dropped instead of buffered. (2026-10-09)
• Updated dependencies [a66cada]:
  • @​posthog/browser-common@​0.9.4

posthog-js@1.438.6

1.438.6

Patch Changes

• #5218 8bc2df6 Thanks @​lucasheriques! - Skip WebMCP intent and model injection for schemas with constraints that the extra fields could break. (2026-10-09)

• #5217 6af3aa8 Thanks @​lucasheriques! - Export WebMCPExtensions from the slim extension-bundles entry point. (2026-10-09)

posthog-js@1.438.5

1.438.5

Patch Changes

• #5258 429b5b2 Thanks @​hpouillot! - Recognize native bundler debug IDs and build-time error tracking release IDs. (2026-10-09)
• Updated dependencies [429b5b2]:
  • @​posthog/core@​1.57.4

... (truncated)

Commits

• 635149f chore: update versions and lockfile [version bump]
• 8f2d581 fix: make before_send callback inputs non-null (#5281)
• bdcc7c0 chore: update versions and lockfile [version bump]
• ba4cc49 feat: capture WebMCP error metadata (#5259)
• 1918f57 test(browser-next): pin retry jitter in the disposal retry budget test (#5275)
• d1b00d0 test(node): wait for local evaluation instead of a fixed delay (#5274)
• 4f590b3 chore: update versions and lockfile [version bump]
• 74d7eb2 fix(node): clarify server credential configuration errors (#5268)
• ddaaf68 chore: adopt Coherence (#5265)
• 7f82e9b chore: update versions and lockfile [version bump]
• Additional commits viewable in compare view

Updates posthog-node from 5.55.0 to 5.55.3

Release notes

Sourced from posthog-node's releases.

posthog-node@5.55.3

5.55.3

Patch Changes

• #5281 8f2d581 Thanks @​marandaneto! - Fix before_send callback types to accept non-null events while still allowing null returns to drop events. (2026-10-12)
• Updated dependencies [

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
matio	Ready	Preview	Oct 16, 2026 11:41am UTC
matio-staging	Ready	Preview	Oct 16, 2026 11:41am UTC

[github-actions]

Покрытие

=============================== Coverage summary ===============================
Statements   : 59.76% ( 5604/9376 )
Branches     : 53.29% ( 3709/6960 )
Functions    : 55.56% ( 1328/2390 )
Lines        : 60.28% ( 4910/8145 )
================================================================================

Изменённые строки (diff-cover, порог 85%)

-------------
Diff Coverage
Diff: origin/main...HEAD, staged and unstaged changes
-------------
No lines with coverage information in this diff.
-------------

[efymd9]

Основная сессия: поверх Dependabot подняла next / eslint-config-next до 16.4.2 (лок перегенерирован pnpm install): 16.4.0 из этого PR уязвима по трём advisory Next.js от 14.10, в т.ч. GHSA-p3m5-59mp-jv5r — DoS через Server Actions (High), фикс 16.4.1. Задача-инцидент #457. Ревью остального (Sentry 11.7, Clerk 7.9.14, PostHog, storybook/vitest/playwright) — без блокеров. Локально: lint, typecheck, test:unit 2143 — зелёные.