Changed
- HTML guide button clicks now report guide activity with the clicked element's id, one event per click
- HTML guides now display through the standard guide lifecycle, so they honor control groups, display delay and guide content validation like other guides
Fixed
- Keep the newest unsent events instead of dropping all of them when localStorage is full
- Fixed HTML guide tooltips disappearing, or never showing, when their target is temporarily out of view
- Fix embedded guides set to replace the same element swapping in a loop and streaming guideSeen events
- Fixed a rendering issue where task list guide items were incorrectly displayed across multiple rows
Added
- HTML guide NPS surveys can show different follow-up questions and buttons by score band, and submit skips hidden polls.
Changed
- Guide and segment flag requests now use POST when sendEventsWithPostOnly is enabled
- Web SDK Performance API metrics now send once per page load on page close, not every 10 minutes.
Fixed
- Improve spacing for action rows
- Fixed an issue where Session Replay still serialized and observed iframes excluded with a block selector
- Record NPS poll responses from HTML guides with a real duration, once per submit
Security
- HTML guide content can no longer run scripts on the page.
Added
- Added support for capturing uncaught exceptions and rejections when console error capture is enabled
- HTML guides can now include a compact menu row (pendo-action-row) for lists of choices, such as a resource center. A row can go to a step, launch a guide, or open a link.
- Enabled guides to render inside and display above modal dialogs using native popover support
Changed
- Enforced console log levels in the console-capture plugin to ensure only specified log levels are captured and sent
Fixed
- Fixed an issue where the staging or unminified agent ignored a custom data-pendo-global-key and attached to window.pendo instead.
- Improved performance of the console-capture plugin to prevent browser instability when processing large logged objects
- Stop network log capture from delaying the app's fetch responses while response bodies are read
Security
- Updated the shared UI components and uuid dependency in the debugger and preview bar to address reported security advisories
- Fixed a security issue in Live Preview: Pendo now checks where preview messages come from and ignores messages from untrusted pages.
- The SDK now rechecks the full guide link after each metadata pass and blanks it if it became javascript:.
- Removed the unsupported network tracking mode for AI agents in the Web SDK. Agents set to trackingMethod: 'network' are now ignored. DOM-based AI agent tracking and conversation capture are unaffected.
Added
- HTML guides can now have a maximum height.
Changed
- Skip contentHost checks for partner analytics
- Updated the rrweb-record library in the Web SDK to improve performance and reduce bundle size
Fixed
- Resolved an issue where Session Replay caused a redirect loop in certain application configurations
- Fixed an issue where the Resource Center badge displayed twice when Pendo ran in an iframe inside a shadow root
Security
- Updated axios in the debugger and preview bar to 1.20.0 and upgraded build tooling dependencies to address reported security advisories
- Agent analytics DOM prompt capture no longer reads the value of password input fields.
- Fixed to use same url from page load for frame announcement.
- Improve validation of cross-frame messages
Fixed
- Fixed an issue where the Resource Center badge displayed twice when Pendo ran in an iframe inside a shadow root
Fixed
- Fixed an issue where the Resource Center badge displayed twice when Pendo ran in an iframe inside a shadow root
Added
- Support for future feature matching on subdomain hashes instead of requiring glob patterns for staging servers
Changed
- Updated the backdrop behavior to use aria-hidden by default and only apply the inert attribute when the useInertForBackdrop configuration is enabled
- preferBroadcastChannel and preventUnloadListener now default to true when no agent config is provided
Fixed
- Fix web SDK initialization and event collection in older Internet Explorer document modes
- Resolved an issue where certain WebSocket browser extensions could cause the application to hang by disabling live replay when non-native WebSocket methods are detected
- Prevented the mobile keyboard from closing unexpectedly when tapping into guide text fields in Cordova applications
Security
- Check the origin of frames joining the cross-frame channel when enforceAllowedOriginServers is enabled
- Reject cross-frame connect messages from windows outside the page's own frame tree
- Only read legacy window.pendo_options configuration when it is a plain object
- Only load the staging/debug agent from a script tag served by the Pendo CDN
- Anchor regular-expression entries in the allowed origin server list so a look-alike origin is no longer trusted
- Properly escape all allowed origins used in regex
Added
- Added a snapshot callback to the live flag check when starting a visitor recording in the Web SDK
- Included guide and AI agent events in live replay event logs
- Add a badge option to keep the host app's focus when a badge is clicked
Changed
- Updated guide components to prevent double-border rendering on buttons by ensuring the component host no longer paints background or border styles
Fixed
- Fixed an issue where embedded guides intermittently failed to render when their target elements were re-triggered quickly
Added
- HTML guides can now conditionally render elements based on the visitor's eligible guides, and can opt out of the step progress indicator.
Fixed
- HTML guide themes now apply their secondary button background, border, and font color
- Guide content and image URLs now honor a content CNAME configured in app settings, not just one set in the install snippet.
- Fixed an issue where a guide backdrop could impact page performance on sites using their own inert polyfill
- Fixed inline badges not rendering when the target is a custom element inside a shadow host with named slots
Fixed
- Fixed a bug where dismissing a guide could leave the host page unresponsive to clicks until reload, in apps that reinitialize Pendo more than once without a full page reload.
- Fixed guide content URL rewrite behavior when combined with self-hosted assets.
- Fixed guide content validation requesting content files from the default host instead of the configured contentHost, blocking guides.
- Ensure that global css is tied to the specific public app id to prevent removing accidentally
Security
- Reject cross-frame connect messages from windows outside the page's own frame tree