build(deps): bump posthog from 7.39.1 to 7.42.0 in the observability group across 1 directory

[dependabot]

Bumps the observability group with 1 update in the / directory: posthog.

Updates posthog from 7.39.1 to 7.42.0

Release notes

Sourced from posthog's releases.

posthog-v7.42.0

Minor changes

• f483bab feat(mcp): capture $mcp_client_user_agent and $mcp_vendor_client so MCP usage can be attributed to a product surface. clientInfo.name only says which client library is calling — Anthropic reports claude-code from the CLI, the Agent SDK, the VS Code extension and the desktop app alike — so $mcp_client_name collapses every surface into one bucket and the harness breakdown reads 100% "Other" for Python-backed servers. The distinguishing detail lives in the User-Agent parenthetical (claude-code/2.1.0 (cli) vs (sdk-ts)) and in vendor headers like x-anthropic-client. Both are captured raw and classified at query time, so labels can improve without an SDK release. HTTP transports only: stdio and in-memory servers carry no headers and their events are unchanged. Custom dispatchers pass their own via new client_user_agent / vendor_client arguments on every PostHogMCP.capture_* method. Parity with @posthog/mcp. — Thanks @​gesh!

posthog-v7.41.0

Minor changes

• 2863909 feat(mcp): emit $mcp_error_message and $mcp_error_type on failed MCP events. The reason a tool call failed previously lived only on the sibling $exception event, so PostHog's failures view — which reads the scalars off the primary event — showed empty error rows for every Python-backed MCP server, and switching off enable_exception_autocapture removed the reason entirely. Both values are read from the same $exception_list the sibling carries, so the two surfaces can never disagree, and the message inherits the existing 2048-character cap. PostHogMCP.capture_tool_call() and capture_tools_list() take a new optional error_type for custom dispatchers that want a coarse category ("validation", "timeout") instead of the thrown class name. Exception messages are also redacted before they leave — previously nothing sanitized the error payload, so the $exception sibling had been shipping them raw. Credential-looking words go through the SDK's own detector (entropy, known key formats, PEM markers), per word, so a message like auth failed for sk-... keeps its diagnostic text and loses only the key. Parity with @posthog/mcp, which sanitizes exception values the same way. — Thanks @​gesh!

posthog-v7.40.0

Minor changes

• b0ab12c feat(mcp): support MCP Python SDK v2 and bring posthog.mcp to parity with the TypeScript SDK (@posthog/mcp). Most of this reaches SDK 1.x servers too — the parity work is not v2-only.

  MCP SDK v2 / spec 2026-07-28. instrument() now wraps mcp.server.mcpserver.MCPServer (the renamed FastMCP) and the v2 low-level Server (constructor-injected handlers, string-keyed registry, late add_request_handler registrations included), capturing tool calls, tools/list, errors, intent, client identity, and $mcp_protocol_version on both protocol eras — the legacy handshake and the stateless 2026-07-28 envelope, decided per request. Previously instrument() raised ImportError on mcp>=2 and took the host application down with it; it now degrades to a logged no-op on any unsupported or unrecognized SDK.

  Cross-SDK parity (SDK 1.x and 2.x alike). Conversation-anchored sessions land as the cross-pod correlation the stateless era needs: with enable_conversation_id, $session_id derives deterministically from the agent-echoed conversation_id (new export derive_session_id_from_conversation, byte-compatible with @posthog/mcp). Only a handle the SDK could have minted (a uuidv7) anchors a session, so two callers inventing the same id can no longer be merged. The handle is delivered over both channels a tool result has — a content text block carrying it as plain JSON data on the minting response (an imperative server sentence inside a tool result is prompt-injection-shaped, and a client that strips it silently breaks the feature), and an _mcp_instructions key declared on the tool's output schema and mirrored into structuredContent on every response. That second channel is what makes the feature work at all for tools with structured output: clients that read structuredContent never render content, so the agent had no handle to echo (0% echo rate measured against Claude Code before the mirror). The prompt-back now rides errored results too, so a failure on a conversation's first call doesn't split the retry into a new session. The session is resolved only once the handle's fate is known, so the call that mints a handle joins the same session as the calls that echo it — while a handle that could not be delivered anchors nothing, rather than stranding events in a conversation nobody holds. Host callbacks (identify, intent_fallback, event_properties) receive the SDK's own per-request context as extra["ctx"] identically on both majors, with a new exported get_request_headers(extra) to read HTTP headers off it — the underlying shape differs per major, and a hand-rolled read that works on one silently returns nothing on the other, sending every event out anonymous.

  Fixes affecting existing SDK 1.x users. Analytics could break a tool call in three ways, each now fixed and regression-tested: the SDK's tool cache is rebuilt from an internal listing pass we skipped injecting on, so after any call to an unlisted tool name a strict schema rejected either the analytics parameters we advertise (Input validation error) or the conversation key we write (Output validation error); the conversation handle was written into the caller's result object in place, so a tool returning a shared or cached result served one conversation's handle to every later caller; and on jlowin's FastMCP the advertised schema marked context required while the adapter strips it before validation, failing every call under strict_input_validation=True. Two behavioural changes come with the parity work: an invented (non-uuidv7) conversation_id echo is replaced with a fresh handle rather than trusted, and minted prompt-backs are now appended to errored results. — Thanks @​gesh!

posthog-v7.39.2

Patch changes

• 1adf542 Drop events when before_send callbacks raise exceptions — Thanks @​marandaneto!

Commits

• 79c0cb5 chore: Release v7.42.0 [skip ci]
• f483bab feat(mcp): capture $mcp_client_user_agent and $mcp_vendor_client (#883)
• acdaae2 Update generated references
• 390f72c chore: Release v7.41.0 [skip ci]
• 2863909 feat(mcp): emit $mcp_error_message and $mcp_error_type (#882)
• 2228a18 Update generated references
• 627c4a6 chore: Release v7.40.0 [skip ci]
• b0ab12c feat(mcp): support MCP Python SDK v2 and cross-SDK parity with TS SDK (#881)
• a64ee77 Update generated references
• dd50f9f chore: Release v7.39.2 [skip ci]
• Additional commits viewable in compare view

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​posthog@​7.39.1 ⏵ 7.42.0

View full report

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.85%. Comparing base (8552625) to head (9d11bd8).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #682   +/-   ##
=======================================
  Coverage   93.85%   93.85%           
=======================================
  Files          59       59           
  Lines        3208     3208           
=======================================
  Hits         3011     3011           
  Misses        197      197           

Flag	Coverage Δ
backend	93.97% <ø> (ø)
client	91.30% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.