fix: strip workspace:* refs from lib/package.json after build

.changeset/quiet-pens-kneel.md

@@ -0,0 +1,5 @@
+---
+'posthog-js': patch
+---
+
+Strip workspace:* references from lib/package.json after build

packages/browser/package.json

@@ -12,6 +12,7 @@
         "start": "pnpm build-react && NODE_OPTIONS=\"--max-old-space-size=8192\" pnpm build-rollup -w",
         "dev": "tsc -b && NODE_OPTIONS=\"--max-old-space-size=8192\" rollup -cw",
         "build": "tsc -b && rollup -c",
+        "postbuild": "node scripts/strip-lib-package-json.js",
         "package": "pnpm pack --out $PACKAGE_DEST/%s.tgz",
         "lint": "eslint src && eslint playwright",
         "lint:fix": "eslint src --fix && eslint playwright --fix",

packages/browser/scripts/strip-lib-package-json.js

@@ -0,0 +1,19 @@
+// TypeScript copies package.json into lib/ (due to resolveJsonModule + the import in src/config.ts).
+// The copy retains unresolved workspace:* references which break npm audit fix for consumers.
+// This script strips dependencies and devDependencies from the build artifact.
+// See: https://github.com/PostHog/posthog-js/issues/3290
+
+const fs = require('fs')
+const path = require('path')
+
+const filePath = path.resolve(__dirname, '..', 'lib', 'package.json')
+
+if (!fs.existsSync(filePath)) {
+    console.warn('warn: lib/package.json no longer exists — this postbuild script can be removed')
+    process.exit(0)
+}
+
+const pkg = JSON.parse(fs.readFileSync(filePath, 'utf8'))
+delete pkg.dependencies
+delete pkg.devDependencies
+fs.writeFileSync(filePath, JSON.stringify(pkg, null, 4) + '\n')