* chore: add Dependabot configuration

* chore: expand Dependabot ecosystems

Bumps [ctor](https://github.com/mmastrac/linktime) from 0.1.26 to 1.0.12.
- [Release notes](https://github.com/mmastrac/linktime/releases)
- [Changelog](https://github.com/mmastrac/linktime/blob/master/CHANGELOG.md)
- [Commits](https://github.com/mmastrac/linktime/commits/ctor-1.0.12)

---
updated-dependencies:
- dependency-name: ctor
  dependency-version: 1.0.12
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [actions/cache](https://github.com/actions/cache) from 5.0.5 to 6.1.0.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@27d5ce7...55cc834)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…#196)

Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) from 8.0.0 to 8.1.1.
- [Release notes](https://github.com/peter-evans/create-pull-request/releases)
- [Commits](peter-evans/create-pull-request@98357b1...5f6978f)

---
updated-dependencies:
- dependency-name: peter-evans/create-pull-request
  dependency-version: 8.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

….0 (#195)

Bumps [getsentry/action-github-app-token](https://github.com/getsentry/action-github-app-token) from 2.0.0 to 4.0.0.
- [Release notes](https://github.com/getsentry/action-github-app-token/releases)
- [Commits](getsentry/action-github-app-token@97c9e23...5c1e907)

---
updated-dependencies:
- dependency-name: getsentry/action-github-app-token
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…190)

Bumps [planetscale/ghcommit-action](https://github.com/planetscale/ghcommit-action) from 0.2.20 to 0.2.22.
- [Release notes](https://github.com/planetscale/ghcommit-action/releases)
- [Commits](planetscale/ghcommit-action@25309d8...a6b150b)

---
updated-dependencies:
- dependency-name: planetscale/ghcommit-action
  dependency-version: 0.2.22
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [brotli](https://github.com/dropbox/rust-brotli) from 7.0.0 to 8.0.4.
- [Release notes](https://github.com/dropbox/rust-brotli/releases)
- [Commits](dropbox/rust-brotli@7.0.0...8.0.4)

---
updated-dependencies:
- dependency-name: brotli
  dependency-version: 8.0.4
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…194)

* chore(deps): bump github/codeql-action/analyze from 4.35.5 to 4.37.4

Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.35.5 to 4.37.4.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@9e0d7b8...f205ea1)

---
updated-dependencies:
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* chore(deps): align CodeQL action versions

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Dustin Byrne <dustin@posthog.com>

* fix(flags): deserialize cohorts payload for local evaluation

The `/flags/definitions/?send_cohorts` response maps each cohort ID
straight to its property group (`{"type": "AND"|"OR", "values": [...]}`),
but `Cohort` required non-existent `id`/`name`/`properties` fields. serde
failed on any non-empty `cohorts` map, which took down the entire
`LocalEvaluationResponse` — so no flags loaded at all for projects with
cohorts.

`Cohort` is now transparent over the raw property group, and cohort
matching recurses through nested AND/OR groups and cohort references
(honoring `negation`) instead of flattening them and keeping only the
first property of any nested group.

Generated-By: PostHog Code
Task-Id: c95f4271-0d14-497f-b62a-49f1e8c919bb

* chore: update public API snapshot for Cohort field removal

The `Cohort` struct no longer carries the invented `id`/`name` fields — it
is now transparent over the raw cohort property group. Regenerate the
checked-in public API snapshot accordingly so the Public API check passes.

Generated-By: PostHog Code
Task-Id: c95f4271-0d14-497f-b62a-49f1e8c919bb

* fix(flags): harden local cohort evaluation

* fix(flags): support default cohort operators

* fix(flags): accept backend empty cohort groups

---------

Co-authored-by: posthog[bot] <206114724+posthog[bot]@users.noreply.github.com>
Co-authored-by: Manoel Aranda Neto <marandaneto@gmail.com>

* feat(flags): surface payloads from local flag evaluation

The definitions manifest carries each flag's payloads, but locally
evaluated flags always reported `payload: None`, so `get_flag_payload`
returned nothing for them. Worse, turning local evaluation on removed
payload access that remote-only callers had: when `flag_keys` is fully
covered locally there is no `/flags` round trip left to recover the
payload from, and locally evaluated keys are skipped when merging remote
records.

Local evaluation now resolves the payload for the matched value ("true"
for a boolean match, the variant key for a multivariate one) and decodes
it through the same `normalize_payload` the remote path uses, so a flag
returns the same payload whichever path evaluated it. A flag that
evaluated false gets no payload, matching `/flags`, which only attaches
one to a matching flag.

Generated-By: PostHog Code
Task-Id: 52072a7c-7431-4b59-8de1-90d9ababf0db

* fix(flags): keep local payloads snapshot-consistent

---------

Co-authored-by: Manoel Aranda Neto <marandaneto@gmail.com>
Co-authored-by: Manoel Aranda Neto <5731772+marandaneto@users.noreply.github.com>

* fix(flags): bound cohort recursion in local evaluation

Cohort resolution recursed through nested cohort references with nothing
bounding the recursion. A cohort referencing itself, directly or through
another cohort, recursed until the thread stack was exhausted, and a
Rust stack overflow aborts the process rather than panicking catchably,
so one bad definitions response takes down the calling server and does
it again on restart once the poller refetches.

A cycle check alone would not have been enough: a chain of distinct
cohorts is acyclic and still recurses once per link, and because each
cohort is a separate shallow entry in the manifest such a chain also
clears serde_json's nesting limit on the way in.

Resolution now tracks the cohorts on the active path, bounding both: a
repeat is a cycle, and the path is capped at 100. Both are inconclusive,
so the flag falls back to `/flags` rather than resolving wrongly. IDs are
released as the recursion unwinds, so the same cohort referenced down
sibling branches still resolves.

Generated-By: PostHog Code
Task-Id: 52072a7c-7431-4b59-8de1-90d9ababf0db

* fix(flags): bound combined cohort evaluation depth

---------

Co-authored-by: Manoel Aranda Neto <5731772+marandaneto@users.noreply.github.com>
Co-authored-by: Manoel Aranda Neto <marandaneto@gmail.com>