build(deps): bump the minor-and-patch group across 1 directory with 7 updates

[dependabot]

Bumps the minor-and-patch group with 7 updates in the / directory:

Package	From	To
@fontsource-variable/geist	5.2.9	5.3.0
@fontsource-variable/geist-mono	5.2.8	5.3.0
posthog-js	1.399.5	1.411.0
simple-icons	16.26.0	16.28.0
@astrojs/check	0.9.9	0.9.10
@types/node	26.1.1	26.1.2
wrangler	4.114.0	4.118.0

Updates @fontsource-variable/geist from 5.2.9 to 5.3.0

Commits

• See full diff in compare view

Updates @fontsource-variable/geist-mono from 5.2.8 to 5.3.0

Commits

• See full diff in compare view

Updates posthog-js from 1.399.5 to 1.411.0

Release notes

Sourced from posthog-js's releases.

posthog-js@1.411.0

1.411.0

Minor Changes

• #4266 43d1850 Thanks @​posthog! - feat: add opt-in capture_performance.__preview_web_vitals_soft_navs to fix inflated web vitals on single-page apps

  Client-side route changes in SPAs previously left web vitals (LCP especially) accumulating against the original hard-navigation timestamp, inflating the top tail of Core Web Vitals. Setting capture_performance: { __preview_web_vitals_soft_navs: true } now scopes metrics to the browser's Soft Navigation entries so each route change starts a fresh measurement window. It's a preview option because it relies on Chrome's experimental Soft Navigation Detection API and loads pinned stable web-vitals 6.x callbacks; when disabled (the default), the existing web-vitals 5.x behavior remains unchanged. (2026-08-04)

Patch Changes

• #4287 d3c4538 Thanks @​posthog! - Keep $referring_domain and canonical utm_*/campaign parameters on minimal $feature_flag_called events. Previously the minimal allowlist stripped every campaign parameter, so a flag-called event landing first in a session could set the session's UTM attribution and channel type to NULL in web analytics. (2026-08-04)
• Updated dependencies [d3c4538, 43d1850]:
  • @​posthog/core@​1.46.7
  • @​posthog/types@​1.401.0

posthog-js@1.410.10

1.410.10

Patch Changes

• #4271 3d4e2fd Thanks @​felipeatom! - Fix inline surveys rendering an empty container when a stale persisted question index (left over from a prior completion) points past the last question. When the persisted index is out of range the whole in-progress record is now discarded and the survey starts fresh, instead of clamping the index while keeping the equally-stale responses and visited indices. Restored visited indices are also filtered to valid questions so the Back button can never navigate to a non-existent question and re-empty the container. (2026-08-04)

• #4412 5f2b78a Thanks @​TueHaulund! - fix(replay): hold fresh interaction-less session recordings until there is evidence someone cares

  A tab that loads but never sees any user interaction (prefetched pages, background tabs, in-app browser preloads) no longer ships a billable recording while it sits untouched. Like rotation-born sessions, a fresh recording epoch is held until there is evidence someone cares about it: a user interaction, an event trigger match, or an explicit override (posthog.startSessionRecording(...)) releases the hold and ships the buffer on the normal flush cadence, so released recordings are playable from the session's start. A clean unload also ships a fresh-start hold, so passive visits (reading, watching a video) are still captured exactly as before; rotation-born holds are discarded on unload as before. A held buffer that reaches the size cap is dropped to bound memory, and a later release takes a fresh full snapshot so the recording resumes playable. (2026-08-04)

• #4410 064874a Thanks @​ioannisj! - Fix held rotation-born session replay buffers not flushing when a V2 event trigger matches (2026-08-04)

• #4343 83a9b67 Thanks @​arnohillen! - Session replay no longer freezes the page re-encoding base64 images that are already small. When canvas recording is enabled, every <img> with a data: URL was synchronously redrawn and re-encoded through canvas.toDataURL during full snapshots and attribute mutations. The encode cost scales with pixel dimensions, not payload size, so a page of base64 lazy-load placeholders (measured: 18 images of 4096x3072 at ~33KB each) blocked the main thread for 7+ seconds to produce outputs that were larger than the inputs. Recompression now skips data URLs under 100KB (where it cannot save meaningful payload), keeps the original when the re-encoded output is not smaller, and memoizes by input so repeated snapshots and src-swapping mutations never pay for the same image twice. Genuinely large base64 images are still recompressed as before. (2026-08-04)

• #4339 f865818 Thanks @​posthog! - Report privacy-aware dropped-event count, page and session context in the client rate limit warning (2026-08-04)

• Updated dependencies [f865818]:

  • @​posthog/types@​1.400.2

posthog-js@1.410.9

1.410.9

Patch Changes

• #4314 feb9e2a Thanks @​posthog! - fix: warn when reset() silently opts the user back out

  reset() clears stored consent along with the rest of the user's state. With opt_out_capturing_by_default, this returns the instance to the opted-out default, so calling reset() after opt_in_capturing() would stop capturing without warning. It now logs a warning when that happens and documents the required ordering. (2026-08-04)

• #4288 877418e Thanks @​posthog! - Fix event-triggered survey popup delays resetting on every page navigation. The popup delay now resumes from when the trigger fired (persisted for the session) instead of restarting a fresh countdown on each page load, so a survey configured with an event/action trigger and a popup delay no longer gets lost when the user navigates before the delay elapses.

... (truncated)

Commits

• 323f1c8 chore: update versions and lockfile [version bump]
• d3c4538 fix(core): keep session-attribution props on minimal $feature_flag_called eve...
• 43d1850 feat(browser): opt-in web_vitals_soft_navs to fix inflated SPA web vitals (#4...
• 242ca40 chore: update versions and lockfile [version bump]
• 83a9b67 fix(replay): skip base64 image recompression when it cannot shrink the payloa...
• f865818 feat(browser): make the client rate limit warning say what tripped it (#4339)
• 3d4e2fd fix(surveys): render inline survey instead of empty container on stale questi...
• 5f2b78a fix(replay): hold fresh interaction-less recordings until user interaction (#...
• 064874a fix(replay): release interaction hold on V2 event-trigger matches (#4410)
• 3418e1e chore: update versions and lockfile [version bump]
• Additional commits viewable in compare view

Updates simple-icons from 16.26.0 to 16.28.0

Release notes

Sourced from simple-icons's releases.

Release 16.28.0

3 new icons

• TRAE (#14918) (@​cscnk52)
• ZecTrix (#14907) (@​LitoMore)
• zx (#14914) (@​quepasaquepasa)

2 updated icons

• LM Studio (#14905) (@​azisislm)
• TanStack (#14912) (@​cscnk52)

Release 16.27.1

2 updated icons

• Kimi (#14883) (@​LitoMore)
• Threads (#14879) (@​coopbri)

Release 16.27.0

1 new icon

• CodeBuddy (#14865) (@​LitoMore)

Commits

• fc91ef0 Replace README CDN theme image links
• c956d67 Release 16.28.0
• 34c2250 Bump version to 16.28.0
• 9bb22b1 Add TRAE icon (#14918)
• c4682b5 Add ZecTrix icon (#14907)
• ced7668 Add zx icon (#14914)
• 45ba1e9 Update TanStack icon (#14912)
• a487766 Fix JSON schema validation on Node.js 26 (#14906)
• fadc823 Update LM Studio icon (#14905)
• dbea629 Release 16.27.1
• Additional commits viewable in compare view

Updates @astrojs/check from 0.9.9 to 0.9.10

Release notes

Sourced from @​astrojs/check's releases.

@​astrojs/check@​0.9.10

Patch Changes

• #17447 b01a692 Thanks @​ocavue! - Update dependency yargs to version 18. See the yargs changelog for details.

Changelog

Sourced from @​astrojs/check's changelog.

0.9.10

Patch Changes

• #17447 b01a692 Thanks @​ocavue! - Update dependency yargs to version 18. See the yargs changelog for details.

Commits

• 112d3ea [ci] release (#17469)
• b01a692 chore(deps): update yargs to v18 (#17447)
• 3652d1c chore: merge main into next
• 8062391 chore(deps): dedupe vite installations (#16788)
• ce88423 Dedupe vite (#16787)
• b8061a6 refactor: use TypeScript project service in ESLint (#16623)
• 5a8cd09 refactor: update tsconfig to use TypeScript project references (#16505)
• See full diff in compare view

Updates @types/node from 26.1.1 to 26.1.2

Commits

• See full diff in compare view

Updates wrangler from 4.114.0 to 4.118.0

Release notes

Sourced from wrangler's releases.

wrangler@4.118.0

Minor Changes

• #14057 cc63aae Thanks @​matingathani! - Add --json flag to wrangler containers info for consistent JSON output with sibling commands list and instances

• #14944 a249591 Thanks @​nickpatt! - Enable local observability capture by default in dev

  wrangler dev and the Vite plugin now capture request traces and console logs into the Local Explorer's Observability tab out of the box — previously this was opt-in behind X_LOCAL_OBSERVABILITY=true. Set X_LOCAL_OBSERVABILITY=false to opt out (for example if the extra per-worker collector/streaming-tail services cause trouble in a multi-process dev-registry setup).

• #14919 e0bbf55 Thanks @​avenceslau! - Add additional triggers to Workflows

  Workers can now declaratively start a locally defined Workflow. Configure event subscriptions under triggers.events; Wrangler validates each target and updates the script's event triggers during deployment.

  {
    "triggers": {
      "events": [
        {
          "type": "cf.artifacts.repo.pushed",
          "filter": {
            "namespace": "my-namespace",
            "repo_name": "my-repo"
          },
          "targets": [
            {
              "type": "workflow",
              "workflow_name": "my-workflow"
            }
          ]
        }
      ]
    }
  }

Patch Changes

• #14936 f92d1fc Thanks @​petebacondarwin! - Fix jsx_fragment being ignored when wrangler dev runs a custom build

  If your project uses a custom build and sets both jsx_factory and jsx_fragment, wrangler dev used your jsx_factory value for JSX fragments as well, so fragments compiled incorrectly. Your jsx_fragment value is now used.

• #14936 f92d1fc Thanks @​petebacondarwin! - Stop wrangler dev starting new work after you stop it or it reloads

  Stopping wrangler dev, or having it reload after a configuration change, could still leave it starting work for the state it had just left behind: your custom build command could run once more after dev had stopped, a change to a file in your assets directory could be reported against configuration that had already been replaced, and in some cases the process could stay alive instead of exiting.

  That work is now discarded, so stopping or reloading wrangler dev leaves nothing running behind it.

• #14936 f92d1fc Thanks @​petebacondarwin! - Stop wrangler dev from running custom builds concurrently

  When several watched files changed at once — for example during a git pull or a "save all" — wrangler dev started a custom build for every file that changed, so multiple copies of your build command ran at the same time and fought over the same output files.

... (truncated)

Commits

• 95d9b12 Version Packages (#14946)
• e0bbf55 [wrangler] Fix workflows errors messages (#14919)
• 38403cb [wrangler] Remove duplicated Workers + Assets deploy E2E (#14947)
• cec9d88 [workers-auth] Validate account IDs before using them in API requests (#13746)
• cc63aae [wrangler] fix(containers): add --json flag to wrangler containers info (#1...
• f92d1fc [wrangler] Serialize custom build watcher events to avoid concurrent runs (#1...
• 17dca96 [wrangler] Fix circular dependency build warning between api/index.ts and bin...
• fcb5402 Version Packages (#14939)
• 5a56dda Miniflare v5 alpha (#14586)
• 96fd16f Version Packages (#14898)
• Additional commits viewable in compare view

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.