Bumps [rollup](https://github.com/rollup/rollup) from 2.60.1 to 2.60.2.
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rollup/rollup/compare/v2.60.1...v2.60.2)

---
updated-dependencies:
- dependency-name: rollup
  dependency-type: direct:development
  update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [eslint](https://github.com/eslint/eslint) from 8.3.0 to 8.4.0.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md)
- [Commits](https://github.com/eslint/eslint/compare/v8.3.0...v8.4.0)

---
updated-dependencies:
- dependency-name: eslint
  dependency-type: direct:development
  update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [prettier](https://github.com/prettier/prettier) from 2.5.0 to 2.5.1.
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prettier/prettier/compare/2.5.0...2.5.1)

---
updated-dependencies:
- dependency-name: prettier
  dependency-type: direct:development
  update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>

Follow up of #3983, see:

* https://github.com/hypothesis/client/pull/3983#discussion_r760445342

* https://github.com/hypothesis/client/pull/3983#discussion_r760445894

Co-authored-by: Robert Knight <robertknight@gmail.com>

Following the removal of `AnnotationSync` from `Guest` we correct the
tests.

AnnotationSync utility didn't have a clear purpose, except for assigning a
temporarily `$tag` to newly created annotations. For that, it used an
internal cache of annotation objects from the Guest, that were mutated
in-place. `AnnotationSync` used a very indirect method of communication
to the `Guest`, using an event emitter, even though their mutual
relationship was quite straightforward.

In this PR, we have:

* Simplified the messages that are sent between the host and the
  sidebar. We have assumed that a `$tag` value is always present if it
  comes from the `sidebar`, and a temporarily `$tag` is assigned in the
  `Guest` class for newly created annotations. Therefore, the type of
  the message sent between these two frames can be simplified to always
  be of the shape of `AnnotationData`, a safe version of `Annotation`.

* Added a few missing types.

* Changed the RPC method `deleteAnnotation` to send astring tag, similar
  to other RPC methods, like `focusAnnotations` or `scrollToAnnoation`.
  As a consequence of that we changed the `Guest#detach` method
  signature.

Currently only Chrome supports performing a structured clone of Errors.
Implement a fallback so that we can get information about annotator-side
errors in other browsers.

Also improve handling if a non-Error value is passed to `sendError`.

The `crossorigin="anonymous"` attribute was added to `<link
rel="preload">` elements created by the boot script because it was
needed when preloading API responses, so that the response can be read.

We don't need to use cross-origin requests when preloading stylesheets
however, and we were seeing occassional errors in Chrome due to this
(see https://github.com/hypothesis/client/issues/3987).

Previously `sendError` was tested indirectly via captureErrors. However
since this is exported as an API from the module, it makes sense to test
it directly.

Capture errors that happen while handling port requests in `PortProvider#listen`
and forward them to the sidebar, so we can gain visibility into them.

Add infrastructure that will allow us to gain visibility into errors
happening in the host frame, in specifically wrapped blocks of code, by
capturing the errors and forwarding them to the sidebar.

The initial implementation requires that the browser is able to clone
errors in `window.postMessage` calls, and currently only Chrome supports
that. In other browsers forwarding errors will fail with a warning.

 - Add `shared/frame-error-capture.js` module with functions for
   capturing errors, registering a target frame to receive them and
   forwarding errors to the frame.

 - Register sidebar application as handler for errors in host frame in
   `Sidebar` constructor and de-register it in the destructor.

 - Call `handleErrorsInFrames` in `sidebar/util/sentry.js` to handle
   errors from host frame by sending them to Sentry.

There is so much modification of the `menu-arrow` mixin that it's
not worthwhile abstracting it out (and we're moving away from mixins).

Update menu-arrow styling rules to accommodate.

Use `LabeledButton` instead of a `<button>` element in AdderToolbar
buttons, and extract pattern to `frontend-shared` SASS module.

Move the `frontend-shared` module up a level so it can be used by
annotator styles.

In `Ref<T>` the `current` property is now a readonly field. The correct
type (`MutableRef<T>`) is inferred automatically, so we don't need to
specify it.

Bumps [preact](https://github.com/preactjs/preact) from 10.5.15 to 10.6.1.
- [Release notes](https://github.com/preactjs/preact/releases)
- [Commits](https://github.com/preactjs/preact/compare/10.5.15...10.6.1)

---
updated-dependencies:
- dependency-name: preact
  dependency-type: direct:development
  update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>

Call `listen` immediately after creating the PortProvider, before
creating the sidebar.

This will allow us to rule out the possibility that the sidebar sometimes fails
to connect to the PortProvider because an error occurred in the annotator code
after creating the sidebar iframe but before calling `PortProvider.listen`,
resulting in the PortProvider listener not being created.

This has been replaced by the `hostURL` value in the `host_config`
metadata, which comes from the `#config` fragment. The `hostURL` value
should always contain the full URL, whereas `document_url` gets
truncated to the origin in many browsers. Also the term `hostURL` more
accurately reflects what the value is, since it may be different than
the document for which the client is displaying annotations.

 - Add the client version to the config so that we can rule out problems
   in the sidebar app because caused by a mismatch between the version
   of the client used in the annotator and the version used in the
   sidebar app.

 - Add the host URL to the config so that we can tell in Sentry reports
   which page embedded the client. Sentry reports currently have
   `document_url` metadata that is set using `document.referrer` in the
   sidebar app, but this gets truncated to the origin in some browsers.

These are ignored by the sidebar app anyway, and they add noise to
Sentry reports and logs.

Rename the function that prepares configuration to be passed from the
annotator to the sidebar and notebook apps, since it is no longer used
exclusively by the sidebar, and add tests.

Fix a regression after e7cdcc0d, which
added the client's standard CSS reset to the annotator CSS bundle.

The font-family used by the adder buttons was changed from the user agent's
default for `<button>` elements to `inherit` by this reset. The result
was that the font family would vary depending on the web page.

Fix this by adding a `:host > *` selector which sets style properties for all
shadow roots created by the annotator. This is the equivalent of the `body`
selector in sidebar.scss.

Bumps [prettier](https://github.com/prettier/prettier) from 2.4.1 to 2.5.0.
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prettier/prettier/compare/2.4.1...2.5.0)

---
updated-dependencies:
- dependency-name: prettier
  dependency-type: direct:development
  update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>

For debugging purposes having a prefix to indicate whether the annotation was created locally ('a:' for the annotator, 's:' for the sidebar) or fetched from the server may be useful.

Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.1034.0 to 2.1038.0.
- [Release notes](https://github.com/aws/aws-sdk-js/releases)
- [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js/compare/v2.1034.0...v2.1038.0)

---
updated-dependencies:
- dependency-name: aws-sdk
  dependency-type: direct:development
  update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [postcss](https://github.com/postcss/postcss) from 8.3.11 to 8.4.4.
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/postcss/postcss/compare/8.3.11...8.4.4)

---
updated-dependencies:
- dependency-name: postcss
  dependency-type: direct:development
  update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [reselect](https://github.com/reduxjs/reselect) from 4.1.4 to 4.1.5.
- [Release notes](https://github.com/reduxjs/reselect/releases)
- [Changelog](https://github.com/reduxjs/reselect/blob/master/CHANGELOG.md)
- [Commits](https://github.com/reduxjs/reselect/compare/v4.1.4...v4.1.5)

---
updated-dependencies:
- dependency-name: reselect
  dependency-type: direct:development
  update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [puppeteer](https://github.com/puppeteer/puppeteer) from 11.0.0 to 12.0.0.
- [Release notes](https://github.com/puppeteer/puppeteer/releases)
- [Changelog](https://github.com/puppeteer/puppeteer/blob/main/CHANGELOG.md)
- [Commits](https://github.com/puppeteer/puppeteer/compare/v11.0.0...v12.0.0)

---
updated-dependencies:
- dependency-name: puppeteer
  dependency-type: direct:development
  update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [redux-thunk](https://github.com/reduxjs/redux-thunk) from 2.4.0 to 2.4.1.
- [Release notes](https://github.com/reduxjs/redux-thunk/releases)
- [Commits](https://github.com/reduxjs/redux-thunk/compare/v2.4.0...v2.4.1)

---
updated-dependencies:
- dependency-name: redux-thunk
  dependency-type: direct:development
  update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [sass](https://github.com/sass/dart-sass) from 1.43.4 to 1.43.5.
- [Release notes](https://github.com/sass/dart-sass/releases)
- [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md)
- [Commits](https://github.com/sass/dart-sass/compare/1.43.4...1.43.5)

---
updated-dependencies:
- dependency-name: sass
  dependency-type: direct:development
  update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>

Add the parsed app configuration from the `#config=<JSON blob>` URL fragment
to Sentry reports. This makes it easier to read that the URL-encoded,
JSON-stringified form in which it currently appears.