chore: sync main into v1 (7.69.0–7.75.6)

.github/actions/setup-python-dev/action.yml

@@ -18,7 +18,7 @@ runs:
         - name: Install uv
           uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
           with:
-              version: "0.11.32"
+              version: "0.13.4"
               enable-cache: true
 
         - name: Install dev dependencies

.github/workflows/ci.yml

@@ -109,9 +109,9 @@ jobs:
                   python-version: 3.11.11
 
             - name: Install uv
-              uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+              uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
               with:
-                  version: "0.11.32"
+                  version: "0.13.4"
                   enable-cache: true
 
             - name: Build and verify distributions
@@ -137,9 +137,9 @@ jobs:
                   python-version: ${{ matrix.python-version }}
 
             - name: Install uv
-              uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+              uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
               with:
-                  version: "0.11.32"
+                  version: "0.13.4"
                   enable-cache: true
 
             - name: Install test dependencies
@@ -176,9 +176,9 @@ jobs:
                   python-version: ${{ matrix.python-version }}
 
             - name: Install uv
-              uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+              uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
               with:
-                  version: "0.11.32"
+                  version: "0.13.4"
                   enable-cache: true
 
             - name: Install test dependencies
@@ -242,9 +242,9 @@ jobs:
 
             - name: Install uv
               if: steps.changes.outputs.changed == 'true'
-              uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+              uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
               with:
-                  version: "0.11.32"
+                  version: "0.13.4"
                   enable-cache: true
 
             - name: Check utils CRAP score
@@ -323,9 +323,9 @@ jobs:
                   python-version: ${{ matrix.python-version }}
 
             - name: Install uv
-              uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+              uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
               with:
-                  version: "0.11.32"
+                  version: "0.13.4"
                   enable-cache: true
 
             # openfeature-provider-posthog is a uv workspace member (declared in
@@ -378,9 +378,9 @@ jobs:
                   python-version: 3.12
 
             - name: Install uv
-              uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+              uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
               with:
-                  version: "0.11.32"
+                  version: "0.13.4"
                   enable-cache: true
 
             - name: Install Django 5 test project dependencies

.github/workflows/codeql.yml

@@ -30,7 +30,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -40,6 +40,6 @@ jobs:
           trap-caching: false
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           category: '/language:${{matrix.language}}'

.github/workflows/posthog-upgrade.yml

@@ -42,9 +42,9 @@ jobs:
           token: ${{ steps.upgrader.outputs.token }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
-          version: "0.12.21"
+          version: "0.13.4"
 
       - name: Install new package version in main repo
         shell: bash

.github/workflows/release.yml

@@ -83,7 +83,7 @@ jobs:
 
       - name: Get GitHub App token
         id: releaser
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           client-id: ${{ secrets.GH_APP_POSTHOG_PYTHON_RELEASER_APP_ID }}
           private-key: ${{ secrets.GH_APP_POSTHOG_PYTHON_RELEASER_PRIVATE_KEY }}
@@ -101,13 +101,13 @@ jobs:
           python-version: 3.11.11
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
-          version: "0.11.32"
+          version: "0.13.4"
           enable-cache: true
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067
+        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8
         with:
           toolchain: 1.91.1
           components: cargo
@@ -306,9 +306,9 @@ jobs:
           python-version: 3.11.11
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
-          version: "0.11.32"
+          version: "0.13.4"
           enable-cache: true
 
       - name: Install dependencies
@@ -473,13 +473,13 @@ jobs:
           python-version: 3.11.11
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
-          version: "0.11.32"
+          version: "0.13.4"
           enable-cache: true
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067
+        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8
         with:
           toolchain: 1.91.1
           components: cargo

docs/migration-7.x-to-8.0.md

@@ -113,8 +113,9 @@ Capture rejects a whole batch when one event cannot be parsed.
 - An event whose name is missing, `None`, empty or not a string is dropped. The SDK logs one warning per reason per process. 7.x sent it.
 - An event whose `before_send` hook sets `distinct_id` to `None` or a non-string is dropped, with one warning per reason per process. The SDK does not convert the hook's value or make up an ID. 7.x sent it, and capture would reject the whole batch.
 - PostHog drops an event whose name is over 200 UTF-8 bytes (`event_name_too_long`), and `on_error` reports it. 7.x sent events to legacy capture, which had no event name limit.
-- An event that cannot be serialized to JSON is dropped and logged, for example one with `NaN` or `Infinity` in its properties. 7.x sent `NaN` as invalid JSON.
-- A property or option key that JSON cannot represent, such as a tuple, is dropped without a log, and the rest of the event is sent. 7.x dropped the event. `int`, finite `float`, `bool` and `None` keys are still converted to strings. A `NaN` or infinite `float` key drops the event, as a `NaN` value does.
+- A `NaN` or infinite `float` value is sent as `null`, as in 7.75 and later, and the event is kept. Earlier 7.x versions sent invalid JSON, which made capture reject the whole batch.
+- An event that cannot be serialized to JSON, for example one with a circular reference, is dropped and logged.
+- A property or option key that JSON cannot represent, such as a tuple, is dropped without a log, and the rest of the event is sent. 7.x dropped the event. `int`, finite `float`, `bool` and `None` keys are still converted to strings. A `NaN` or infinite `float` key still drops the event.
 
 ## Event uuids
 

examples/example-ai-anthropic/uv.toml

@@ -1 +1,3 @@
 exclude-newer = "7 days"
+# certifi 2026.10.19 drops the compromised eMudhra root and is newer than the 7-day cooldown.
+exclude-newer-package = { certifi = "1 day" }

examples/example-ai-autogen/uv.toml

@@ -1 +1,3 @@
 exclude-newer = "7 days"
+# certifi 2026.10.19 drops the compromised eMudhra root and is newer than the 7-day cooldown.
+exclude-newer-package = { certifi = "1 day" }