build(deps): bump the minor group in /ui with 4 updates

[dependabot]

Bumps the minor group in /ui with 4 updates: pdfjs-dist, posthog-js, globals and lint-staged.

Updates pdfjs-dist from 5.4.624 to 5.5.207

Release notes

Sourced from pdfjs-dist's releases.

v5.5.207

This release contains improvements for accessibility, font conversion, image conversion, performance, text selection and the viewer.

Changes since v5.4.624

• Bump the stable version in pdfjs.config by @​timvandermeij in mozilla/pdf.js#20617
• Replace the various interfaces in web/interfaces.js with proper classes by @​Snuffleupagus in mozilla/pdf.js#20607
• Add support for Brotli decompression by @​calixteman in mozilla/pdf.js#20610
• Change all relevant BasePDFStream implementations to take an actual URL instance by @​Snuffleupagus in mozilla/pdf.js#20614
• Report loading progress "automatically" when using the PDFDataTransportStream class, and remove the PDFDataRangeTransport.prototype.onDataProgress method by @​Snuffleupagus in mozilla/pdf.js#20615
• Use the ccittfax decoder from pdfium by @​calixteman in mozilla/pdf.js#20613
• Avoid to have to download the model when toggling the button in the alt-text image settings dialog (bug 2013899) by @​calixteman in mozilla/pdf.js#20621
• Let the toggle button in the alt-text dialog downloading (resp. delete) the model and enabling (resp. disabling) alt-text guessing (bug 2014167) by @​calixteman in mozilla/pdf.js#20622
• Flush the text content chunk only on real font changes (bug 2013793) by @​calixteman in mozilla/pdf.js#20624
• Improve progress reporting in ChunkedStreamManager, and prevent unnecessary data copy in ChunkedStream.prototype.onReceiveData by @​Snuffleupagus in mozilla/pdf.js#20627
• Cap the max canvas dimensions in order to avoid to downscale large images in the worker (bug 2014399) by @​calixteman in mozilla/pdf.js#20628
• Fix Worker was terminated error when loading is cancelled by @​andriivitiv in mozilla/pdf.js#20503
• In tagged pdfs, TH can be either a column header or a row header (bug 2014080) by @​calixteman in mozilla/pdf.js#20623
• [api-minor] Update the supported Node.js "patch" versions by @​Snuffleupagus in mozilla/pdf.js#20635
• Ensure that pending requests are resolved when calling PDFDataTransportStreamReader.prototype.progressiveDone by @​Snuffleupagus in mozilla/pdf.js#20634
• Normalize the font name in getBaseFontMetrics (issue 20246) by @​Snuffleupagus in mozilla/pdf.js#20637
• Avoid branching in convertBlackAndWhiteToRGBA by @​calixteman in mozilla/pdf.js#20638
• Set a pages mapper per loaded document by @​calixteman in mozilla/pdf.js#20640
• Bump library version to 5.5 by @​Snuffleupagus in mozilla/pdf.js#20642
• [api-minor] Update the minimum supported Google Chrome version to 118 by @​Snuffleupagus in mozilla/pdf.js#20645
• Update dependencies and translations to the most recent versions by @​timvandermeij in mozilla/pdf.js#20639
• Fix a 'FreeText accessibility' integration test by @​calixteman in mozilla/pdf.js#20643
• Add firefox-devtools-mcp to let AI agents test and debug in Firefox by @​marco-c in mozilla/pdf.js#20644
• Convert PDFPageProxy.prototype.getTextContent to an asynchronous method by @​Snuffleupagus in mozilla/pdf.js#20648
• Ends the current drawing session when closing the tab (bug 2015385) by @​calixteman in mozilla/pdf.js#20649
• Start using Response.prototype.bytes() in the code-base by @​Snuffleupagus in mozilla/pdf.js#20651
• Move and re-use the stripPath helper function more by @​Snuffleupagus in mozilla/pdf.js#20656
• Update jbig2 decoder (pdfium@0455e822ded1a5537d826703988e986a33d2d4a1) by @​calixteman in mozilla/pdf.js#20655
• Enable a couple of additional eslint-plugin-unicorn rules by @​Snuffleupagus in mozilla/pdf.js#20654
• Fix types to make "gulp typestest" succeeding by @​calixteman in mozilla/pdf.js#20641
• Avoid parsing skipped range requests in ChunkedStreamManager (PR 10694 follow-up) by @​Snuffleupagus in mozilla/pdf.js#20652
• Enable the unicorn/prefer-class-fields ESLint plugin rule by @​Snuffleupagus in mozilla/pdf.js#20657
• Add code coverage for unit tests running in node by @​calixteman in mozilla/pdf.js#20658
• Add a Codecov badge by @​calixteman in mozilla/pdf.js#20659
• Remove Object.hasOwn usage from the src/core/xref.js file by @​Snuffleupagus in mozilla/pdf.js#20663
• Truncate too long /Decode map entries (issue 20668) by @​Snuffleupagus in mozilla/pdf.js#20669
• Convert the PDFObjects class to use a Map internally by @​Snuffleupagus in mozilla/pdf.js#20673
• Fix the keyboard accessibility of the manage button in the thumbnails view (bug 2015916) by @​calixteman in mozilla/pdf.js#20675
• fix: support text selection under search highlights by @​matt-atticus in mozilla/pdf.js#20463
• Fix code coverage line mapping by @​calixteman in mozilla/pdf.js#20665
• Remove unused CanvasGraphics properties (PR 700 follow-up) by @​Snuffleupagus in mozilla/pdf.js#20682
• Add an aria-label to the checkboxes in the thumbnails view (bug 2016136) by @​calixteman in mozilla/pdf.js#20678
• Correctly handle tab/page down when on a menu (bug 2016212) by @​calixteman in mozilla/pdf.js#20681
• Add an aria-label to the sidebar resizer (bug 2016142) by @​calixteman in mozilla/pdf.js#20679
• Add support for deleting, cutting, copying and pasting pages (bug 2010830, 2010831) by @​calixteman in mozilla/pdf.js#20670
• Add the possibility to navigate with the keyboard to go from a checkbox to an other in the thumbnail view (bug 2016007) by @​calixteman in mozilla/pdf.js#20677

... (truncated)

Commits

• 5279646 Merge pull request #20751 from calixteman/bug2016693
• 98d0332 Merge pull request #20767 from calixteman/followup_20742
• c1fe547 Add an integration test for the issue fixed in #20742
• 62ceac6 Merge pull request #20769 from timvandermeij/updates
• 3d2d145 Fix vulnerabilities in dependency versions
• ced9b47 Upgrade c8 to version 11.0.0
• 4cb0d50 Update dependencies to the most recent versions
• 5cbb841 Merge pull request #20768 from calixteman/rm_yargs
• 1861a4c Merge pull request #20756 from Snuffleupagus/PDFDataRangeTransport-tests
• f32b9d2 Merge pull request #20738 from Snuffleupagus/function-shorten
• Additional commits viewable in compare view

Updates posthog-js from 1.354.3 to 1.356.2

Release notes

Sourced from posthog-js's releases.

posthog-js@1.356.2

1.356.2

Patch Changes

• #3174 e9127d8 Thanks @​TueHaulund! - Detect and report when rrweb fails to initialize. rrweb's record() silently swallows startup errors and returns undefined, which previously left the SDK reporting an active recording status while capturing zero data. The SDK now checks the return value and reports a new rrweb_error status, making the failure visible in debug properties. (2026-03-02)

• #3175 6ee5f12 Thanks @​TueHaulund! - Fix memory leak in canvas recording on Safari < 16.4 where ImageBitmaps were never closed when OffscreenCanvas was unavailable in the web worker. (2026-03-02)

• #3178 186871a Thanks @​TueHaulund! - Skip canvas FPS recording entirely on browsers without OffscreenCanvas support (Safari < 16.4) instead of running a wasteful requestAnimationFrame loop that can never produce data. Also includes displayWidth/displayHeight in canvas mutation data for correct replay sizing. (2026-03-02)

• #3176 87bae20 Thanks @​dustinbyrne! - fix: Drop explicit exports (2026-03-02)

• #3172 2e46959 Thanks @​dustinbyrne! - fix: Compressed requests use ArrayBuffer (2026-03-02)

• Updated dependencies []:

  • @​posthog/types@​1.356.2

posthog-js@1.356.1

1.356.1

Patch Changes

• #3128 a500d14 Thanks @​ksvat! - wait for fresh config before recording start decision, add new recorder status, output recording started event (2026-02-27)
• Updated dependencies []:
  • @​posthog/types@​1.356.1

posthog-js@1.356.0

1.356.0

Minor Changes

• #3142 ec54fd8 Thanks @​dmarticus! - Add feature_flag_cache_ttl_ms config to prevent stale flag values (2026-02-26)

Patch Changes

• #3154 a47179c Thanks @​slshults! - fix: Improve tablet device type detection when Chrome sends desktop-like UA strings

  Chrome on Android tablets defaults to "request desktop site" mode, sending a UA string indistinguishable from desktop Linux. This uses the Client Hints API (navigator.userAgentData.platform) and touch capability (navigator.maxTouchPoints) to correctly classify these devices as Tablet or Mobile when UA-based detection falls through to the Desktop default. (2026-02-26)

• #3145 d741668 Thanks @​dmarticus! - Adds a remote_config_refresh_interval_ms config option to control how often feature flags are automatically refreshed in long-running sessions.

... (truncated)

Commits

• f149eb9 chore: update versions and lockfile [version bump]
• 2e46959 fix(browser): Send gzipped request body as ArrayBuffer (#3172)
• 186871a chore(deps): bump @​posthog/rrweb-* to 0.0.44 (#3178)
• 87bae20 fix(browser): Drop explicit exports in package.json (#3176)
• e9127d8 fix(replay): detect and report rrweb silent initialization failure (#3174)
• 6ee5f12 chore(deps): bump @​posthog/rrweb-* to 0.0.43 (#3175)
• 0dc03b0 feat(node): Add timestamp tracking for debugging local feature flag evaluatio...
• 18dfcc1 docs: add backwards compatibility warnings to recorder entrypoints (#3167)
• 7ba6a27 chore: update versions and lockfile [version bump]
• a500d14 fix(replay): wait for new config before recording decision (#3128)
• Additional commits viewable in compare view

Updates globals from 17.3.0 to 17.4.0

Release notes

Sourced from globals's releases.

v17.4.0

• Update globals (2026-03-01) (#338) d43a051

---

sindresorhus/globals@v17.3.0...v17.4.0

Commits

• a9cfd74 17.4.0
• d43a051 Update globals (2026-03-01) (#338)
• See full diff in compare view

Updates lint-staged from 16.2.7 to 16.3.1

Release notes

Sourced from lint-staged's releases.

v16.3.1

Patch Changes

• #1729 cd5d762 Thanks @​iiroj! - Remove nano-spawn as a dependency from package.json as it was replaced with tinyexec and is no longer used.

v16.3.0

Minor Changes

• #1698 feda37a Thanks @​iiroj! - Run external processes with tinyexec instead of nano-spawn. nano-spawn replaced execa in lint-staged version 16 to limit the amount of npm dependencies required, but caused some unknown issues related to spawning tasks. Let's hope tinyexec improves the situation.

• #1699 1346d16 Thanks @​iiroj! - Remove pidtree as a dependency. When a task fails, its sub-processes are killed more efficiently via the process group on Unix systems, and the taskkill command on Windows.

Patch Changes

• #1726 87467aa Thanks @​iiroj! - Incorrect brace expansions like *.{js} (nothing to expand) are detected exhaustively, instead of just a single pass.

Changelog

Sourced from lint-staged's changelog.

16.3.1

Patch Changes

• #1729 cd5d762 Thanks @​iiroj! - Remove nano-spawn as a dependency from package.json as it was replaced with tinyexec and is no longer used.

16.3.0

Minor Changes

• #1698 feda37a Thanks @​iiroj! - Run external processes with tinyexec instead of nano-spawn. nano-spawn replaced execa in lint-staged version 16 to limit the amount of npm dependencies required, but caused some unknown issues related to spawning tasks. Let's hope tinyexec improves the situation.

• #1699 1346d16 Thanks @​iiroj! - Remove pidtree as a dependency. When a task fails, its sub-processes are killed more efficiently via the process group on Unix systems, and the taskkill command on Windows.

Patch Changes

• #1726 87467aa Thanks @​iiroj! - Incorrect brace expansions like *.{js} (nothing to expand) are detected exhaustively, instead of just a single pass.

Commits

• 2a74cd2 chore(changeset): release
• cd5d762 refactor: remove nano-spawn dependency completely
• e342cab build(deps): move nano-spawn to dev
• 9aa2cd7 chore(changeset): release
• 0c387bc test: make long-running task longer because of GitHub Actions slowness
• 87467aa refactor: detect incorrect brace expansion exhaustively
• dceabc6 ci: run npm audit in GitHub Actions
• d0e4c2a build(deps): update dependencies
• 93cf144 docs: add tip about lint-staged.sh
• 9809fee test: adjust integration test logging setup for concurrency
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[MilosPaunovic]

@dependabot recreate