For debugging purposes having a prefix to indicate whether the annotation was created locally ('a:' for the annotator, 's:' for the sidebar) or fetched from the server may be useful.

Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.1034.0 to 2.1038.0.
- [Release notes](https://github.com/aws/aws-sdk-js/releases)
- [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js/compare/v2.1034.0...v2.1038.0)

---
updated-dependencies:
- dependency-name: aws-sdk
  dependency-type: direct:development
  update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [postcss](https://github.com/postcss/postcss) from 8.3.11 to 8.4.4.
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/postcss/postcss/compare/8.3.11...8.4.4)

---
updated-dependencies:
- dependency-name: postcss
  dependency-type: direct:development
  update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [reselect](https://github.com/reduxjs/reselect) from 4.1.4 to 4.1.5.
- [Release notes](https://github.com/reduxjs/reselect/releases)
- [Changelog](https://github.com/reduxjs/reselect/blob/master/CHANGELOG.md)
- [Commits](https://github.com/reduxjs/reselect/compare/v4.1.4...v4.1.5)

---
updated-dependencies:
- dependency-name: reselect
  dependency-type: direct:development
  update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [puppeteer](https://github.com/puppeteer/puppeteer) from 11.0.0 to 12.0.0.
- [Release notes](https://github.com/puppeteer/puppeteer/releases)
- [Changelog](https://github.com/puppeteer/puppeteer/blob/main/CHANGELOG.md)
- [Commits](https://github.com/puppeteer/puppeteer/compare/v11.0.0...v12.0.0)

---
updated-dependencies:
- dependency-name: puppeteer
  dependency-type: direct:development
  update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [redux-thunk](https://github.com/reduxjs/redux-thunk) from 2.4.0 to 2.4.1.
- [Release notes](https://github.com/reduxjs/redux-thunk/releases)
- [Commits](https://github.com/reduxjs/redux-thunk/compare/v2.4.0...v2.4.1)

---
updated-dependencies:
- dependency-name: redux-thunk
  dependency-type: direct:development
  update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [sass](https://github.com/sass/dart-sass) from 1.43.4 to 1.43.5.
- [Release notes](https://github.com/sass/dart-sass/releases)
- [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md)
- [Commits](https://github.com/sass/dart-sass/compare/1.43.4...1.43.5)

---
updated-dependencies:
- dependency-name: sass
  dependency-type: direct:development
  update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>

Add the parsed app configuration from the `#config=<JSON blob>` URL fragment
to Sentry reports. This makes it easier to read that the URL-encoded,
JSON-stringified form in which it currently appears.

Adopt `generateHexString` instead of varios `Math.random()` in various
places.

`Math#random` maybe faster than `window#crypto#getRadomValues` but there is value on having a centralised way to generate random hex strings.

* import only the `generateHexString` function
* declare the `typdef` on one common JSDoc comment after the imports
* remove unnecessary helper function

This file will be useful for components in `src/annotator` so it will be
better to move it to common path for both the sidebar and annotator.

Replace the scoped CSS reset in the annotator CSS bundle with the same
un-scoped reset that the sidebar uses, as well as associated specificity
hacks in other modules.

The scoped reset was needed when the annotator CSS was loaded directly
into the host page. It is no longer needed as annotator UI elements now always
use Shadow DOM for style isolation from the host page.

The logic for generating the `#config=<URI-encoded JSON blob>` fragment,
that is used to pass configuration from the annotator to the sidebar
application, was duplicated in several places in the code.

Add a shared module in `shared/config-fragment.js` with functions for
adding configuration to and extracting it from the URL.

In an earlier iteration of the code it was called in multiple places.

A call to `updateBoxSizes` was scheduled on every `resize` event after a
delay, instead of being debounced as intended. Fix this by using the
lodash debounce utility.

When reading the code top to bottom, the `expectedBoxOffsetAndSize`
function will make more sense after reading `createCharBoxes`.

This makes it easier to see what arguments are expected reading the
code.

Mapping each line in the text data in the test to a line in the
generated bounding boxes is more natural and also lets us test multiple
words on a single line.

Use fractions instead of percentages for the character and line metrics
in ImageTextLayer tests, for consistency with the ImageTextLayer API.

Support VitalSource books which are created from PDFs rather than EPUBs.
These books have the same frame structure as EPUBs, but use one HTML
page per PDF page in the inner frame, rather than one HTML page per
chapter as is more common for EPUBs.

VS PDFs do not contain a selectable text layer. Instead they consist of
a high-resolution rendered image of the current page plus data about the
content and location of text characters embedded in a script tag in the
page which sets a `window.innerPageData` variable.

To support this in Hypothesis, we generate a hidden text layer from the
`innerPageData` data and overlay it on top of the rendered image. This
hidden text layer is similar to what PDF.js creates for us in our
standard PDF viewer.

Implement a class that creates a transparent text layer on top of an
image containing text. This is useful for supporting annotation in
documents which are rendered images or canvases that don't have
browser-accessible text in them, such as VitalSource.

It is the caller's responsibility to determine the location and
character value of text in the image.

This class is used by elements created by placeholder.js in the host
page, not a shadow root.

With the exception of highlight styles, the styles in annotator.css are
now only used by UI elements contained within shadow roots. As a result,
we can stop loading annotator.css as a stylesheet into the host page,
preventing these styles from affecting the host page.

 - Stop loading annotator.css into the host page as a stylesheet.
   Instead add it as a preload link instead, ready for use by shadow
   roots.

 - Move highlights styles into a separate bundle and load that in the
   host page.

Fixes https://github.com/hypothesis/client/issues/2979

All of our target browsers now support shadow DOM [1]. Make it mandatory so it
is clear that all annotator UI elements can rely on Shadow DOM and thus don't
need to worry about their internal styles affecting or being affected by the
host page.

[1] https://caniuse.com/?search=shadow%20dom

Co-authored-by: Robert Knight <robertknight@gmail.com>

There are two methods to get the host port from `PortProvider`:

- `#hostPortFrom` which returns the host port exclusively from the
  `sidebar-host` channel.

- `#on` allows to register a listener that is fired upon requests
  of host frames for channels other than the `sidebar-host`.

This is an attempt to simplify the API of `PortProvider` and merge both
methods into one.

Advantages:

- simplifies the `Sidebar` constructor signature (no need to pass the
  host port)

- avoids the pitfall of creating host-sidebar RPC channel before
  registering the RPC methods

- prepares for future guest-host channel see https://github.com/hypothesis/client/blob/ad93317debdac0d2c3abec83eb9d690934632ef3/src/annotator/index.js#L64-L66 (where the `#on` method is use to create the guest-host channel).

Co-authored-by: Robert Knight <robertknight@gmail.com>

1. I converted `_setupSyncToGuest` and `_setupSyncFromGuests` into
   conventional class methods.

2. Added a new method, `_setupHostEvents` for sidebar-host
   communication.

3. Invoke these three methods above, from the constructor.

The `PortProvider._channels` map was used only to keep track of which
channel requests have been handled for a particular frame. The
`WeakMap<Window, MessageChannel>` was in fact used as a set rather than
a map. Only the presence of entries affected behavior, not the stored
MessageChannel values.

Change the data structure and comments to make its purpose clearer.

This comment provides general information about how MessagePorts work,
but isn't directly related to any of the surrounding code.

Of the two comments here, the second one is the most useful information
to consumers of the PortProvider and PortFinder interfaces, but it is
well covered by eg. MDN's documentation on MessagePort.

Rework the code to make the code path for the sidebar-host channel more
similar to other channels. As a result the `_sendPorts` helper was only
called in one place and can be inlined where it is called to make the
overall logic easier to follow.

Update the `MarkdownEditor` component to use `Icon`, `IconButton`,
`LabeledButton` and `Link` where relevant. Reduce complexity of
local component CSS and use utility styles where possible. Extract
button and link style overrides to `frontend_shared` SASS module.

Part of https://github.com/hypothesis/client/issues/3876
Part of https://github.com/hypothesis/frontend-shared/issues/232

Bumps [eslint](https://github.com/eslint/eslint) from 7.32.0 to 8.3.0.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md)
- [Commits](https://github.com/eslint/eslint/compare/v7.32.0...v8.3.0)

---
updated-dependencies:
- dependency-name: eslint
  dependency-type: direct:development
  update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [rollup](https://github.com/rollup/rollup) from 2.60.0 to 2.60.1.
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rollup/rollup/compare/v2.60.0...v2.60.1)

---
updated-dependencies:
- dependency-name: rollup
  dependency-type: direct:development
  update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>