Changed​

• Update web sdk to version 2.346.0

Added​

• Added support for capturing uncaught exceptions and rejections when console error capture is enabled
• HTML guides can now include a compact menu row (pendo-action-row) for lists of choices, such as a resource center. A row can go to a step, launch a guide, or open a link.
• Enabled guides to render inside and display above modal dialogs using native popover support

Changed​

• Enforced console log levels in the console-capture plugin to ensure only specified log levels are captured and sent

Fixed​

• Fixed an issue where the staging or unminified agent ignored a custom data-pendo-global-key and attached to window.pendo instead.
• Improved performance of the console-capture plugin to prevent browser instability when processing large logged objects
• Stop network log capture from delaying the app's fetch responses while response bodies are read

Security​

• Updated the shared UI components and uuid dependency in the debugger and preview bar to address reported security advisories
• Fixed a security issue in Live Preview: Pendo now checks where preview messages come from and ignores messages from untrusted pages.
• The SDK now rechecks the full guide link after each metadata pass and blanks it if it became javascript:.
• Removed the unsupported network tracking mode for AI agents in the Web SDK. Agents set to trackingMethod: 'network' are now ignored. DOM-based AI agent tracking and conversation capture are unaffected.

Changed​

• Updated the web SDK and designer agent plugins to the latest versions

Added​

• HTML guides can now have a maximum height.

Changed​

• Skip contentHost checks for partner analytics
• Updated the rrweb-record library in the Web SDK to improve performance and reduce bundle size

Fixed​

• Resolved an issue where Session Replay caused a redirect loop in certain application configurations
• Fixed an issue where the Resource Center badge displayed twice when Pendo ran in an iframe inside a shadow root

Security​

• Updated axios in the debugger and preview bar to 1.20.0 and upgraded build tooling dependencies to address reported security advisories
• Agent analytics DOM prompt capture no longer reads the value of password input fields.
• Fixed to use same url from page load for frame announcement.
• Improve validation of cross-frame messages

Fixed​

• Fixed an issue where the Resource Center badge displayed twice when Pendo ran in an iframe inside a shadow root

Fixed​

• Fixed an issue where the Resource Center badge displayed twice when Pendo ran in an iframe inside a shadow root

Changed​

• Allow for more silent idp checks while the still anonymous

Added​

• Support for future feature matching on subdomain hashes instead of requiring glob patterns for staging servers

Changed​

• Updated the backdrop behavior to use aria-hidden by default and only apply the inert attribute when the useInertForBackdrop configuration is enabled
• preferBroadcastChannel and preventUnloadListener now default to true when no agent config is provided

Fixed​

• Fix web SDK initialization and event collection in older Internet Explorer document modes
• Resolved an issue where certain WebSocket browser extensions could cause the application to hang by disabling live replay when non-native WebSocket methods are detected
• Prevented the mobile keyboard from closing unexpectedly when tapping into guide text fields in Cordova applications

Security​

• Check the origin of frames joining the cross-frame channel when enforceAllowedOriginServers is enabled
• Reject cross-frame connect messages from windows outside the page's own frame tree
• Only read legacy window.pendo_options configuration when it is a plain object
• Only load the staging/debug agent from a script tag served by the Pendo CDN
• Anchor regular-expression entries in the allowed origin server list so a look-alike origin is no longer trusted
• Properly escape all allowed origins used in regex

Changed​

• Updated @pendo/web-sdk to 2.343.0 and @pendo/designer-agent-plugins to 3.2.55

Fixed​

• Reduced the severity of benign storage access logs in the browser extension to prevent unnecessary error banners in host applications

Added​

• Added a snapshot callback to the live flag check when starting a visitor recording in the Web SDK
• Included guide and AI agent events in live replay event logs
• Add a badge option to keep the host app's focus when a badge is clicked

Changed​

• Updated guide components to prevent double-border rendering on buttons by ensuring the component host no longer paints background or border styles

Fixed​

• Fixed an issue where embedded guides intermittently failed to render when their target elements were re-triggered quickly