chore(analytics): adopt posthog-js defaults 2026-05-30

[pauldambra]

Problem

The browser SDK was running without the defaults config flag, so it stayed on legacy posthog-js behavior instead of the current recommended defaults.

Changes

• Set defaults: "2026-05-30" on the browser posthog.init call in posthogAnalyticsImpl.ts, opting into the latest posthog-js default behaviors, with a comment documenting that it's a named epoch (not a date) and requires posthog-js >= 1.378.0.
• The 2026-05-30 defaults value was introduced in posthog-js 1.378.0, so bump the dependency from ^1.283.0 to ^1.378.0 (lockfile now resolves to 1.386.6).
• Set capture_pageview: false. The epoch flips capture_pageview to "history_change", but this app routes via createHashHistory() — the route lives in the URL hash and $pathname is identical for every screen, so automatic pageviews would collapse all routes into one and corrupt route-level analytics. Opt out and rely on explicit instrumentation. (If route-level pageviews are wanted later, a before_send that rewrites $pathname/$current_url from the hash is the path.)

Capture delta from adopting the epoch (for the record): session_recording.strictMinimumDuration, external_scripts_inject_target: head, persistence_save_debounce_ms: 250, split_storage, detect_google_search_app, and content-masking ignorelist tweaks. No new autocapture/network instrumentation; automatic pageviews explicitly disabled.

How did you test this?

• pnpm --filter @posthog/ui typecheck passes (confirms defaults: "2026-05-30" and capture_pageview: false are valid config in the bumped SDK).
• ⚠️ Not yet verified at runtime: that session recording still starts after the ~95-minor posthog-js bump (import paths unchanged, but a manual smoke test of the Electron app is worth doing before merge).

Automatic notifications

• Publish to changelog?
• Alert Sales and Marketing teams?

---

Created with PostHog Code from a Slack thread

[github-actions]

React Doctor found no issues in the changed files. 🎉

_{Reviewed by React Doctor for commit 398fedc.}

[greptile-apps]

_{Reviews (1): Last reviewed commit: "chore(analytics): adopt posthog-js defau..." | Re-trigger Greptile}

[pauldambra]

Note

🤖 Automated comment by QA Swarm — not written by a human

QA Swarm review complete. See inline comments.

[pauldambra]

Note

🤖 Automated comment by QA Swarm — not written by a human

Multi-perspective review: paul-reviewer, xp-reviewer, security-audit (qa-team skipped — not available on disk)

Verdict: 💬 APPROVE WITH NITS

No blockers. The whole change is one defaults: "2026-05-30" epoch flag plus the matching posthog-js floor bump — minimal and correct. The asks are about documenting and verifying what the new defaults epoch turns on, not about correctness.

Key findings

🟡 MEDIUM

• The defaults: "2026-05-30" magic string is an opaque posthog-js epoch, silently coupled to the ^1.378.0 floor, and overlaps options set explicitly below it. Confirm precedence (esp. capture_exceptions in dev) and add a one-line comment naming what it pins + the version it needs.
• Behaviour-change-to-everyone with no flag, while the motivation is "feels slow" — new defaults may add capture overhead. Note the expected before/after capture diff; consider whether a flag is warranted.

🟢 LOW

• Recording is now asserted three ways (epoch + disable_session_recording: false + startSessionRecording() in loaded); prune or annotate the redundant ones.
• ~95-minor jump (1.283 → 1.386.6): sanity-check the specifically-pinned recorder bundle still starts recording on the running app.

Convergence

Both paul and xp independently flagged (a) the opaque epoch string / version coupling and (b) that the epoch may make neighboring explicit options redundant — highest-confidence items.

Reviewer summaries

Reviewer	Assessment
👤 paul	approve-with-comments: document the epoch interaction, treat as a behaviour-change rollout, verify the recorder still works after the big version jump
📐 xp	clean minimal opt-in, no behaviour bug; two expressiveness nits — opaque epoch string and possibly-redundant neighboring options
🛡 security-audit	0 findings — privacy-neutral config flag + first-party SDK bump; defaults epoch does not loosen input masking

---

Automated by QA Swarm — not a human review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 23ecb810d8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[stamphog]

Gates denied: this is a dependency version bump (~100 minor versions of posthog-js) which requires human review. Additionally, there is an unresolved inline comment explicitly flagging that session recording correctness needs a manual runtime smoke test before merge, which the automated reviewer deferred to a human.