Bumps [@sentry/browser](https://github.com/getsentry/sentry-javascript) from 5.25.0 to 5.26.0.
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/master/CHANGELOG.md)
- [Commits](https://github.com/getsentry/sentry-javascript/compare/5.25.0...5.26.0)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Bumps [focus-visible](https://github.com/WICG/focus-visible) from 5.1.0 to 5.2.0.
- [Release notes](https://github.com/WICG/focus-visible/releases)
- [Commits](https://github.com/WICG/focus-visible/compare/v5.1.0...v5.2.0)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Bumps [sinon](https://github.com/sinonjs/sinon) from 9.1.0 to 9.2.0.
- [Release notes](https://github.com/sinonjs/sinon/releases)
- [Changelog](https://github.com/sinonjs/sinon/blob/master/CHANGELOG.md)
- [Commits](https://github.com/sinonjs/sinon/compare/v9.1.0...v9.2.0)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.767.0 to 2.771.0.
- [Release notes](https://github.com/aws/aws-sdk-js/releases)
- [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js/compare/v2.767.0...v2.771.0)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Bumps [eslint-plugin-react](https://github.com/yannickcr/eslint-plugin-react) from 7.21.3 to 7.21.4.
- [Release notes](https://github.com/yannickcr/eslint-plugin-react/releases)
- [Changelog](https://github.com/yannickcr/eslint-plugin-react/blob/master/CHANGELOG.md)
- [Commits](https://github.com/yannickcr/eslint-plugin-react/compare/v7.21.3...v7.21.4)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Bumps [eslint](https://github.com/eslint/eslint) from 7.10.0 to 7.11.0.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/master/CHANGELOG.md)
- [Commits](https://github.com/eslint/eslint/compare/v7.10.0...v7.11.0)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Code reorganisation:

* Adder has a simplified API: added a public method display that internally calls private methods _target and _showAt
* Performance improvement in _target method by removing multiple calls to this._width() and this._height()
* More strict type for arrowDirection

resolves #2009

This makes it easier to use the dev server for testing Hypothesis on
mobile devices with smaller screens (ie. phones).

The issue is not specific to Chrome-based browsers on Android, although
it does cause much more of a problem in that browser than Safari on iOS.

Expand and revise several JSDoc comments following feedback from Lyza in
https://github.com/hypothesis/client/pull/2622.

Improves the documentation of parameter types and class and method
descriptions.

When selecting text on the android, it was possible to also highlight the text inside the buttons in the adder. When this happened, the range would grab everything from where you started to highlight to the very end of the dom because the adder is attached as the last node inside body.

The simple fix is to prohibit text selection inside the adder which prevents the selection from getting the adder itself.

Add a non-OCR'd PDF available to the local dev server to aid
developers

As one of the final parts of removing the client's jQuery dependency,
use DOM APIs to defer annotator initialization until the document has
loaded.

There is no CoffeeScript code left in the codebase so we don't need this
any more.

Make current set of tests pass

* Add tests for extracted code
* Skip a couple of `BucketBar` tests that are difficult to patch up
  during migration

Remove the logic that was intended to ignore Hypothesis UI when
generating range selectors.

We don't need this any more because all Hypothesis UI elements in the
host page which contain text have `user-select` set to prevent text
selection. This affects the bucket bar, vertical toolbar and adder.

In addition, the logic did not serve its intended purpose as it only applied to
range selector generation. If the user did somehow succeed in selecting text in
the bucket bar for example the client would still generate quote and position
selectors that referred to that content. What the client would need to
do instead is modify the range from which the annotation's selectors
were generated.

As a side effect this fixes a regression introduced in a5540581 which caused
range selector generation to fail in Chrome and Firefox due to use of
`:not(<inner selector>)` selector where `<inner selector>` is a
list of selectors (the `IGNORE_SELECTOR` value from `guest.js`).

The recently-added `button-hover` mixin, used by the base `button`
mixin and thus inherited by other button mixins, applied hover styling
to focused buttons, but other button mixins that adjust hover styling
were not applying hover styling to focused buttons.

Update mixins to consistently apply hovered styling to focused buttons

Fixes #2610

Handle scenarios flagged by type checking where `nodeFromXPath` may
return `null` or a non-Element node. Previously it could never return
`null` but would throw an exception if the node was not found. In the
new code a check is needed.

The case where `nodeFromXPath` returned a non-Element node would never
happen with XPaths generated by the client but could happen if an
annotation was created via the API with a non-simple XPath.

I don't believe this issue will ever occur in the real application, but
we currently have tests (in `html-test.js`) where the passed node comes from
a different iframe and therefore a different JS environment where globals including
`Text` and `Element` have different identities.

The expression `n.data.length` cannot be nullish. This was left over
from a previous version that read `n.nodeValue?.length`.

Rewrite an async test to use async/await syntax for readability and add
a missing `return` so that mocha correctly waits for the test to finish
before continuing.

In HTML documents that have been served with an XML mime type,
`document.evaluate` handles element names differently. In HTML documents
the XPath segments do not require prefixes on element names. In XHTML
documents however they do. Since the client always generates the same
un-prefixed XPaths regardless of document type, evaluation always
failed. There was a fallback path but it was only executed if
`document.evaluate` threw an error, not if it returned `null` as in this
case.

This commit resolves the issue by first attempting to evaluate the XPath
using custom logic that only handles simple XPaths and then using
`document.evaluate` only for more complex XPaths. The _simple XPath_
logic behaves the same in HTML and XML documents and ignores namespaces.
As a result it works with the XPaths that the client generates
regardless of document type and also regardless of whether the XPath
references only HTML elements or elements from other namespaces (eg.
MathML or SVG).

We could change the way that the client generates XPaths in future in
XML documents or SVG/MathML content within HTML documents, but the
client would still need to handle `RangeSelector` selectors on existing
annotations.

For more details, see https://github.com/hypothesis/client/pull/2590#issuecomment-702132563

Fixes #2592

The test case given in the comment no longer fails in modern versions of Safari
and I was unable to find any open or closed bug reports mentioning
`Node.contains`. Since the comment referenced a very old version of
Safari, I think it is reasonable to assume it has long been resolved.

`nodeValue` is an alias for `data` in text nodes, but `data` is never
null, which keeps TS happy.

As part of the removal of jQuery from the annotator, remove usage from
`range.js`:

 - Replace `parents()` method with a small helper function

 - Rewrite `getTextNodes` function to accept and return DOM nodes rather
   than jQuery collections

 - Use `Node.contains` instead of jQuery's `contains` method. Note that there
   is a semantic difference that `contains(nodeA, nodeA)` returns
   `false` whereas `nodeA.contains(nodeA)` returns `true`. This enabled
   simplifying a condition.

We use both terms to refer to an annotation in various places, but
`annotation` is more common in this module.

 - Remove an `callback: RpcCallback` argument which was unused

 - Document the type of annotation bodies and RPC messages

The `AnnotationSync` class was an ES5-style class that had a ton of
ES5-isms, odd constructions probably resulting from a historical
conversion from CoffeeScript and unnecessary abstractions. It was also
lacking in documentation.

This commit rewrites the class using modern syntax and removing unused
code and unnecessary abstractions (eg. the `_eventListeners` and
`_channelListeners` properties).

The API and behavior should be unchanged. An additional test was added
for the `sync` method.

Bumps [terser](https://github.com/terser/terser) from 5.3.3 to 5.3.4.
- [Release notes](https://github.com/terser/terser/releases)
- [Changelog](https://github.com/terser/terser/blob/master/CHANGELOG.md)
- [Commits](https://github.com/terser/terser/compare/v5.3.3...v5.3.4)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Bumps [preact](https://github.com/preactjs/preact) from 10.5.3 to 10.5.4.
- [Release notes](https://github.com/preactjs/preact/releases)
- [Commits](https://github.com/preactjs/preact/compare/10.5.3...10.5.4)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Bumps [codecov](https://github.com/codecov/codecov-node) from 3.7.2 to 3.8.0.
- [Release notes](https://github.com/codecov/codecov-node/releases)
- [Changelog](https://github.com/codecov/codecov-node/blob/master/CHANGELOG.md)
- [Commits](https://github.com/codecov/codecov-node/compare/v3.7.2...v3.8.0)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>