chore: update PostHog SDKs to latest versions by devin-ai-integration[bot] · Pull Request #5673 · Infisical/infisical

devin-ai-integration · 2026-03-12T17:04:04Z

Context

PostHog flagged outdated SDK versions sending >10-20% of events in the last 7 days:

Node.js SDK (posthog-node): ^3.6.2 → ^5.28.1 (latest: 5.28.1)
Web SDK (posthog-js): ^1.198.0 → ^1.360.1 (latest: 1.360.1)
Go SDK was already current at 2.0.0

The posthog-node upgrade is a major version bump (3→5). The old shutdownAsync() method was removed; the graceful-shutdown path in telemetry-service.ts now uses await postHog.shutdown(), which returns Promise<void> in the v5 @posthog/core base class (it flushes all pending events and cleans up before resolving).

Updates since last revision

Replaced flush() + shutdown() two-step pattern with a single await postHog.shutdown(). In posthog-node v5, the underlying @posthog/core class declares shutdown(): Promise<void> as a public method that both flushes pending events and performs cleanup. This satisfies the @typescript-eslint/no-floating-promises lint rule and keeps the code simple.

⚠️ Items for human review

shutdown() return type discrepancy: The IPostHog interface in posthog-node/dist/types.d.ts declares shutdown(): void, but the actual PostHogCoreStateless base class in @posthog/core declares shutdown(): Promise<void>. TypeScript resolves to the class implementation so this compiles and lints cleanly, but the mismatch is worth being aware of — a future SDK restructuring could break this.
Node.js engine constraint: [email protected] requires node: "^20.20.0 || >=22.22.0". Verify production Dockerfiles satisfy this (currently pinned to node:20.20.0-trixie-slim).
New transitive dependencies: posthog-js v1.360 pulls in @opentelemetry/* packages (potential frontend bundle size increase). posthog-node v5 adds @posthog/core (with cross-spawn). Low risk but worth noting.
Runtime behavior: capture(), identify(), and groupIdentify() all type-checked cleanly, but worth a quick sanity check that telemetry events still reach PostHog after deploying to staging.

Steps to verify the change

Check that backend and frontend type checks pass (npm run type:check in both)
Verify Node.js version in production/CI meets posthog-node v5 engine requirements
Deploy to staging and confirm telemetry events still reach PostHog

Type

Checklist

Title follows the conventional commit format
Tested locally
Updated docs (if needed)
Updated CLAUDE.md files (if needed)
Read the contributing guide

Link to Devin Session: https://app.devin.ai/sessions/34f1346eea8b45e7b549d4a4cb2b1a2a
Requested by: @0xArshdeep

- Update posthog-node from ^3.6.2 to ^5.28.1 (backend) - Update posthog-js from ^1.198.0 to ^1.360.1 (frontend) - Fix breaking change: shutdownAsync() -> shutdown() in telemetry service Co-Authored-By: arsh <[email protected]>

devin-ai-integration · 2026-03-12T17:04:10Z

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

Disable automatic comment and CI monitoring

greptile-apps · 2026-03-12T17:07:07Z

Greptile Summary

This PR updates the PostHog SDKs to their latest versions: posthog-node from ^3.6.2 → ^5.28.1 (major bump) and posthog-js from ^1.198.0 → ^1.360.1. The only source-code change is in the telemetry shutdown path, replacing the removed shutdownAsync() with the v5 shutdown().

Key changes:

[email protected] replaces axios/rusha dependencies with @posthog/[email protected] (cross-spawn transitive).
[email protected] introduces @opentelemetry/* transitive packages — a minor frontend bundle size increase to be aware of.
All production Dockerfiles are pinned to node:20.20.0-trixie-slim, which satisfies the new engine constraint ^20.20.0 || >=22.22.0.
The await postHog.shutdown() call is valid: postHog is typed as the concrete PostHog class, which inherits shutdown(): Promise<void> from @posthog/core, so the await correctly waits for flush + cleanup.
CI workflows use node-version: "20", which should resolve to a recent 20.x release satisfying ^20.20.0. It is worth confirming the exact resolved version in CI does not fall below 20.20.0.

Confidence Score: 4/5

This PR is safe to merge after a staging smoke-test confirms telemetry events still reach PostHog.
The changes are a well-scoped dependency bump with one small source change. All engine constraints are satisfied by existing Dockerfiles. The await postHog.shutdown() pattern is correct given the concrete class typing. The main residual risk is the runtime behavior of the upgraded SDK, which the PR author recommends verifying on staging — a standard precaution for any SDK major-version bump.
backend/src/services/telemetry/telemetry-service.ts — verify shutdown flushes events correctly on staging before merging to production.

Important Files Changed

Filename	Overview
backend/src/services/telemetry/telemetry-service.ts	Replaces the removed `shutdownAsync()` with `shutdown()` from posthog-node v5. The `PostHog` instance is typed as the concrete class, so TypeScript resolves to `shutdown(): Promise<void>` from `@posthog/core`, making the `await` effective for graceful shutdown.
backend/package.json	Updates `posthog-node` from `^3.6.2` to `^5.28.1`, a major version bump. The new engine constraint (`^20.20.0
frontend/package.json	Updates `posthog-js` from `^1.198.0` to `^1.360.1`. New transitive `@opentelemetry/*` packages are pulled in and reflected in the lockfile; this may increase the frontend bundle size slightly.
backend/package-lock.json	Lockfile correctly updated: `posthog-node` resolves to `5.28.1`, `rusha` is dropped, and new `@posthog/[email protected]` (with `cross-spawn`) is added as a transitive dependency.
frontend/package-lock.json	Lockfile correctly updated for `[email protected]`; several `@opentelemetry/*` packages are newly introduced as transitive dependencies, and a number of peer-dependency markers are adjusted.

_{Last reviewed commit: 63b0e70}

Address Greptile review: shutdown() in v5 returns void (fire-and-forget), so use _shutdown() which returns Promise<void> to preserve awaitable graceful shutdown behavior. Co-Authored-By: arsh <[email protected]>

0xArshdeep · 2026-03-12T17:12:36Z

@greptileai

Address Greptile review: _shutdown() is an internal underscore-prefixed method with no public API stability guarantee. Use the public flush() (returns Promise) to await event delivery, then shutdown() for cleanup. Co-Authored-By: arsh <[email protected]>

devin-ai-integration

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 1 additional finding.

The underlying @posthog/core class returns Promise<void> from shutdown(), so await it directly. This both satisfies the linter and ensures graceful flush before process exit. Co-Authored-By: arsh <[email protected]>

0xArshdeep · 2026-03-12T17:36:43Z

@greptileai

maidul98 · 2026-03-12T19:12:26Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

devin-ai-integration

Devin Review found 1 potential issue.

View 4 additional findings in Devin Review.

backend/package.json

0xArshdeep · 2026-03-12T20:41:07Z

@greptileai

chore: update PostHog SDKs to latest versions

dba3951

- Update posthog-node from ^3.6.2 to ^5.28.1 (backend) - Update posthog-js from ^1.198.0 to ^1.360.1 (frontend) - Fix breaking change: shutdownAsync() -> shutdown() in telemetry service Co-Authored-By: arsh <[email protected]>

devin-ai-integration bot assigned 0xArshdeep Mar 12, 2026

This comment was marked as resolved.

Sign in to view

fix: use awaitable _shutdown() for graceful flush in posthog-node v5

9174c55

Address Greptile review: shutdown() in v5 returns void (fire-and-forget), so use _shutdown() which returns Promise<void> to preserve awaitable graceful shutdown behavior. Co-Authored-By: arsh <[email protected]>

This comment was marked as resolved.

Sign in to view

devin-ai-integration bot commented Mar 12, 2026

View reviewed changes

Merge branch 'main' into devin/1773334740-update-posthog-sdks

63b0e70

devin-ai-integration bot commented Mar 12, 2026

View reviewed changes

backend/package.json Show resolved Hide resolved

varonix0 approved these changes Mar 17, 2026

View reviewed changes

0xArshdeep merged commit 3d4712a into main Mar 17, 2026
11 of 12 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: update PostHog SDKs to latest versions#5673

chore: update PostHog SDKs to latest versions#5673
0xArshdeep merged 5 commits intomainfrom
devin/1773334740-update-posthog-sdks

devin-ai-integration bot commented Mar 12, 2026 •

edited

Loading

Uh oh!

devin-ai-integration bot commented Mar 12, 2026

Uh oh!

greptile-apps bot commented Mar 12, 2026 •

edited

Loading

Uh oh!

This comment was marked as resolved.

Uh oh!

0xArshdeep commented Mar 12, 2026

Uh oh!

This comment was marked as resolved.

Uh oh!

devin-ai-integration bot left a comment

Uh oh!

0xArshdeep commented Mar 12, 2026

Uh oh!

maidul98 commented Mar 12, 2026 •

edited

Loading

Uh oh!

devin-ai-integration bot left a comment

Uh oh!

Uh oh!

0xArshdeep commented Mar 12, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

devin-ai-integration bot commented Mar 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Context

Updates since last revision

⚠️ Items for human review

Steps to verify the change

Type

Checklist

Uh oh!

devin-ai-integration bot commented Mar 12, 2026

🤖 Devin AI Engineer

Uh oh!

greptile-apps bot commented Mar 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 4/5

Important Files Changed

Uh oh!

This comment was marked as resolved.

Uh oh!

0xArshdeep commented Mar 12, 2026

Uh oh!

This comment was marked as resolved.

Uh oh!

devin-ai-integration bot left a comment

Choose a reason for hiding this comment

✅ Devin Review: No Issues Found

Uh oh!

0xArshdeep commented Mar 12, 2026

Uh oh!

maidul98 commented Mar 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

devin-ai-integration bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

0xArshdeep commented Mar 12, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

devin-ai-integration bot commented Mar 12, 2026 •

edited

Loading

greptile-apps bot commented Mar 12, 2026 •

edited

Loading

maidul98 commented Mar 12, 2026 •

edited

Loading