[dependabot]

Bumps countly-sdk-web from 26.1.3 to 26.8.0.

Release notes

Sourced from countly-sdk-web's releases.

Countly Web SDK 26.8.0

• ! Minor Breaking Change ! Form tracking (track_forms) and form data collection (collect_from_forms) now leave out sensitive data:

  • password fields (also ones revealed as text), fields whose autocomplete marks a payment card or one-time code, and card numbers are never recorded
  • fields named or labelled like secrets, payment card, bank or identity data are read only with the new cly_form_allow class in track_forms, or with a cly_user_{key} class in collect_from_forms
  • track_forms skips values shaped like a social security number unless the field has the cly_form_allow class
  • collect_from_forms reads hidden fields only with a cly_user_{key} class, takes an email or phone number only from a field holding one, and no longer takes a field named like number as the phone (use the cly_user_phone class)
  • the cly_user_ignore class now also works on an element containing fields

• ! Minor Breaking Change ! Added content consent for content zone. When consent is required, content now needs the new content consent; the content zone waits until it is given.

• ! Minor Breaking Change ! change_id and set_id without merge now start a session for the new device ID only with track_sessions; with manual session calls, call begin_session for the new user yourself.

• ! Minor Breaking Change ! While a page is open and sending works, its unsent events and requests are now kept in the tab's sessionStorage instead of localStorage (events instead of a cookie with storage: "cookie"). Requests that cannot be sent for now, such as in offline mode, and those of a page being left still wait in localStorage. This does not apply with storage: "none" or a custom storage object.

• Added track_form_values init option for turning off the field values in the events of track_forms (default true).

• Added web push notification support (requires a Countly server with web push support):

  • push consent feature for gating push notifications behind user consent
  • enable_push_notifications method for asking the visitor's permission and subscribing them to push notifications
  • disable_push_notifications method for unsubscribing the visitor from push notifications
  • set_push_notification_listener method and push_notification_listener init option for getting notified when a notification is received, clicked or closed
  • record_push_action method for recording a notification click manually
  • push_vapid_public_key init option for providing your application's VAPID public key (required)
  • push_service_worker_path init option for providing the path of the service worker file (default /countly_sw.js)
  • push_service_worker_scope init option for registering the service worker under a different scope (default countly-push/ next to the service worker file)
  • push_service_worker_registration init option for providing your own service worker registration that imports countly_sw.js, or the promise register() returns for it
  • push_auto_register init option for turning off the silent registration of visitors who already allowed notifications (default true)
  • push_subscribe_timeout init option for setting how long enable_push_notifications waits for the browser, in milliseconds (default 30000)
  • countly_sw.js service worker file, to be served from your site or imported into your own service worker
  • opt_out also unsubscribes the visitor from push notifications; after opt_in, call enable_push_notifications to subscribe them again

• Added support for server-initiated connection tests, which report which Countly endpoints the browser can reach (requires a Countly server with connection test support).

• Added support for server-requested SDK log gathering, which uploads the SDK's own log lines for the devices the server asks for (requires a Countly server with SDK log gathering support).

• Added content.setGlobalContentSegmentation method and global_content_segmentation init option for adding a segmentation to every content and feedback widget event, apart from the rating popups of presentRatingWidgetWithID, initializeRatingWidgets and enableRatingWidgets. Keys the server reads on these events, such as rating, closed or campaign_id, are left out.

• Added passing the site's light or dark theme (the color-scheme the page declares, otherwise the visitor's browser setting) to content and feedback widgets; content uses it when dark mode is enabled for it in the content builder:

  • content.setTheme method and content_theme init option for setting the theme instead: "dark", "light", false for none, or null to follow the site (default null)

• Added TypeScript definitions for attempt_to_send_stored_requests, check_any_consent, opt_in, opt_out, recordError, recordRatingWidgetWithID and track_view.

• Mitigated an issue where content could open links that run code on the site, such as javascript: links, and a page opened from content could redirect the site's tab. Content now opens only web, relative, contact (such as mailto: or tel:) and scheme:// app links.

• Mitigated an issue where, with debug enabled, methods such as add_event or user_details threw an error when given an object that cannot be turned into JSON.

• Mitigated an issue where the deprecated show_feedback_popup method threw an error instead of showing the widget.

• Mitigated an issue where withdrawing a consent with remove_consent was not reported to the server until another consent was given.

• Mitigated an issue where event and segmentation filters of the server configuration could affect the internal events.

• Mitigated an issue where content and feedback widgets on iPhones and iPads were laid out for a screen two to three times its size.

• Mitigated an issue where add_log froze the page when the breadcrumb limit (max_breadcrumb_count or the server configuration) was 0.

• Mitigated an issue where a device_id given as null or an empty string left the SDK without a device ID, so nothing was sent.

• Mitigated an issue where a device ID (cly_device_id), campaign or UTM value given in the page URL was not percent-decoded or was cut at an =, so for example john%40mail.com was recorded instead of john@mail.com.

• Mitigated an issue where a call in the Countly.q queue that threw an error stopped the SDK for the rest of the page.

• Mitigated an issue where sending did not resume on the same page after networking was switched back on in the server configuration.

• Mitigated an issue where a request that could not be made, for example because of an invalid custom header, was never treated as failed, so the callbacks waiting for it were not called and queued requests were not tried again for the rest of the page.

• Mitigated an issue where, with storage: "cookie", unsent requests were lost on every page change.

• Mitigated an issue where, with storage: "cookie", an event key or segmentation value containing ; could break event recording on the next page.

• Mitigated an issue where an NPS score of 0 reported with reportFeedbackWidgetManually was dropped.

• Mitigated an issue where a device ID, app version or segmentation holding characters such as +, & or # reached feedback widgets altered, so answers could be stored for another user.

• Mitigated an issue where uploadUserProfilePicture stored the picture for a different user when the device ID held characters such as @.

... (truncated)

Changelog

Sourced from countly-sdk-web's changelog.

26.8.0

• ! Minor Breaking Change ! Form tracking (track_forms) and form data collection (collect_from_forms) now leave out sensitive data:

  • password fields (also ones revealed as text), fields whose autocomplete marks a payment card or one-time code, and card numbers are never recorded
  • fields named or labelled like secrets, payment card, bank or identity data are read only with the new cly_form_allow class in track_forms, or with a cly_user_{key} class in collect_from_forms
  • track_forms skips values shaped like a social security number unless the field has the cly_form_allow class
  • collect_from_forms reads hidden fields only with a cly_user_{key} class, takes an email or phone number only from a field holding one, and no longer takes a field named like number as the phone (use the cly_user_phone class)
  • the cly_user_ignore class now also works on an element containing fields

• ! Minor Breaking Change ! Added content consent for content zone. When consent is required, content now needs the new content consent; the content zone waits until it is given.

• ! Minor Breaking Change ! change_id and set_id without merge now start a session for the new device ID only with track_sessions; with manual session calls, call begin_session for the new user yourself.

• ! Minor Breaking Change ! While a page is open and sending works, its unsent events and requests are now kept in the tab's sessionStorage instead of localStorage (events instead of a cookie with storage: "cookie"). Requests that cannot be sent for now, such as in offline mode, and those of a page being left still wait in localStorage. This does not apply with storage: "none" or a custom storage object.

• Added track_form_values init option for turning off the field values in the events of track_forms (default true).

• Added web push notification support (requires a Countly server with web push support):

  • push consent feature for gating push notifications behind user consent
  • enable_push_notifications method for asking the visitor's permission and subscribing them to push notifications
  • disable_push_notifications method for unsubscribing the visitor from push notifications
  • set_push_notification_listener method and push_notification_listener init option for getting notified when a notification is received, clicked or closed
  • record_push_action method for recording a notification click manually
  • push_vapid_public_key init option for providing your application's VAPID public key (required)
  • push_service_worker_path init option for providing the path of the service worker file (default /countly_sw.js)
  • push_service_worker_scope init option for registering the service worker under a different scope (default countly-push/ next to the service worker file)
  • push_service_worker_registration init option for providing your own service worker registration that imports countly_sw.js, or the promise register() returns for it
  • push_auto_register init option for turning off the silent registration of visitors who already allowed notifications (default true)
  • push_subscribe_timeout init option for setting how long enable_push_notifications waits for the browser, in milliseconds (default 30000)
  • countly_sw.js service worker file, to be served from your site or imported into your own service worker
  • opt_out also unsubscribes the visitor from push notifications; after opt_in, call enable_push_notifications to subscribe them again

• Added support for server-initiated connection tests, which report which Countly endpoints the browser can reach (requires a Countly server with connection test support).

• Added support for server-requested SDK log gathering, which uploads the SDK's own log lines for the devices the server asks for (requires a Countly server with SDK log gathering support).

• Added content.setGlobalContentSegmentation method and global_content_segmentation init option for adding a segmentation to every content and feedback widget event, apart from the rating popups of presentRatingWidgetWithID, initializeRatingWidgets and enableRatingWidgets. Keys the server reads on these events, such as rating, closed or campaign_id, are left out.

• Added passing the site's light or dark theme (the color-scheme the page declares, otherwise the visitor's browser setting) to content and feedback widgets; content uses it when dark mode is enabled for it in the content builder:

  • content.setTheme method and content_theme init option for setting the theme instead: "dark", "light", false for none, or null to follow the site (default null)

• Added TypeScript definitions for attempt_to_send_stored_requests, check_any_consent, opt_in, opt_out, recordError, recordRatingWidgetWithID and track_view.

• Mitigated an issue where content could open links that run code on the site, such as javascript: links, and a page opened from content could redirect the site's tab. Content now opens only web, relative, contact (such as mailto: or tel:) and scheme:// app links.

• Mitigated an issue where, with debug enabled, methods such as add_event or user_details threw an error when given an object that cannot be turned into JSON.

• Mitigated an issue where the deprecated show_feedback_popup method threw an error instead of showing the widget.

• Mitigated an issue where withdrawing a consent with remove_consent was not reported to the server until another consent was given.

• Mitigated an issue where event and segmentation filters of the server configuration could effect the internal events.

• Mitigated an issue where content and feedback widgets on iPhones and iPads were laid out for a screen two to three times its size.

• Mitigated an issue where add_log froze the page when the breadcrumb limit (max_breadcrumb_count or the server configuration) was 0.

• Mitigated an issue where a device_id given as null or an empty string left the SDK without a device ID, so nothing was sent.

• Mitigated an issue where a device ID (cly_device_id), campaign or UTM value given in the page URL was not percent-decoded or was cut at an =, so for example john%40mail.com was recorded instead of john@mail.com.

• Mitigated an issue where a call in the Countly.q queue that threw an error stopped the SDK for the rest of the page.

• Mitigated an issue where sending did not resume on the same page after networking was switched back on in the server configuration.

• Mitigated an issue where a request that could not be made, for example because of an invalid custom header, was never treated as failed, so the callbacks waiting for it were not called and queued requests were not tried again for the rest of the page.

• Mitigated an issue where, with storage: "cookie", unsent requests were lost on every page change.

• Mitigated an issue where, with storage: "cookie", an event key or segmentation value containing ; could break event recording on the next page.

• Mitigated an issue where an NPS score of 0 reported with reportFeedbackWidgetManually was dropped.

• Mitigated an issue where a device ID, app version or segmentation holding characters such as +, & or # reached feedback widgets altered, so answers could be stored for another user.

... (truncated)

Commits

• 9ed3f28 Merge pull request #663 from Countly/major-update-26.8
• ae9d170 New major update
• 75a0975 Merge pull request #650 from Countly/dependency-update
• 195c039 Dependency Update
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)