You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Low Risk
Lockfile-only dependency upgrade for UI drag-and-drop; behavior could shift slightly with the minor library release but no repo logic was modified.
Overview
Bumps @atlaskit/pragmatic-drag-and-drop in the special-pages workspace from 1.7.9 to 1.8.1, with matching package-lock.json updates. No application source changes; consumers such as new-tab favorites drag-and-drop (PragmaticDND.js) pick up the new library version at install/build time.
Reviewed by Cursor Bugbot for commit 25bce15. Bugbot is set up for automated code reviews on this repo. Configure here.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Web Compatibility Assessment
File
Severity
Finding
(none in diff)
info
No injected-runtime changes. Diff is limited to special-pages/package.json and package-lock.json; injected/src/, wrapper-utils.js, captured-globals.js, and message-bridge code are untouched. Third-party page compatibility risk from this PR is effectively zero.
special-pages/package.json (dependency)
info
Consumer is NTP favorites DND (PragmaticDND.js → setCustomNativeDragPreview, centerUnderPointer, element/external adapters). Scope is the privileged New Tab special page, not hostile page-world injection.
1.8.0 switches honey-pot and custom native drag-preview overlays from z-index: 2147483647 to popover="manual" (Popover API), with automatic fallback to the prior z-index path when HTMLElement.prototype.showPopover is absent. DDG browser baselines (Chrome/Edge 114+, Firefox 125+, Safari 17+) align with the Popover path; older WebViews should hit the fallback.
1.8.1 is test-coverage only (a11y Playwright); no additional runtime behavior change beyond 1.8.0.
Transitive dependencies
info
dependencies unchanged across 1.7.9 → 1.8.1 (@babel/runtime, bind-event-listener, raf-schd). No new transitive surface.
package-lock.json
info
Lockfile churn is scoped to @atlaskit/pragmatic-drag-and-drop only — no unrelated ref/version drift.
Validation:pages/new-tab/app/favorites/integration-tests/favorites.spec.js — 18/18 passed, including re-orders items, support drop on placeholders, and accepts external drag/drop.
Security Assessment
File
Severity
Finding
(none in diff)
info
No changes to captured-globals.js, messaging transports, message-bridge trust boundaries, nativeData handling, or postMessage usage.
(none in diff)
info
No new eval/Function, network requests, or config-gated feature changes.
idFromPayload() still parses external drag HTML via createContextualFragment(). That is a pre-existing special-pages trust-boundary pattern (external bookmark drops), not introduced or worsened by this bump.
Risk Level
Low Risk — dependency-only bump confined to the NTP favorites drag-and-drop library inside special-pages, with no injected page-world surface and no lockfile scope expansion.
Recommendations
Merge after CI gate passes — targeted favorites integration coverage already exercises the DND paths affected by 1.8.x.
Optional manual smoke (low priority): drag a favorite on iOS/Android NTP and confirm the custom drag preview renders correctly; this is the main user-visible delta from the 1.8.0 Popover API switch, though the library retains a z-index fallback.
No injected-runtime follow-up required for this PR.
Verdict: Low risk — approve with manual drag-preview QA on Safari/iOS.
Against current main, this PR is a clean, single-purpose bump (special-pages/package.json + lockfile). I ran the favorites integration suite on 1.8.1: 18/18 passed, including internal reorder, placeholder drops, and external HTML drag/drop.
Scope & blast radius
Item
Detail
Consumer
Single integration point: NTP favorites grid in special-pages/pages/new-tab/app/favorites/components/PragmaticDND.js
@atlaskit/pragmatic-drag-and-drop-hitbox@^1.1.0 unchanged; declares ^1.6.0 peer on core — compatible with 1.8.x
The dependency remains appropriate. This is the only DnD library in the repo and it handles edge-based horizontal reordering + native bookmark drops that raw HTML5 DnD would not cover cleanly.
Changelog impact (1.7.9 → 1.8.1)
1.8.0 (minor — primary risk): Honey-pot fix and custom native drag previews now use popover="manual" (browser top layer) when supported, with fallback to position:fixed + max z-index.
Directly affects our code:setCustomNativeDragPreview + centerUnderPointer in useItemState (favorites tile drag ghost), and the automatic honey-pot fix used by all adapters.
Minimum engines for the new path: Chrome/Edge 114+, Firefox 125+, Safari 17+. DDG desktop browsers should be fine; validate on iOS WebKit where drag-preview behavior has historically been fragile (Atlassian also called out iOS-specific preview quirks in 1.7.x).
1.8.1 (patch): Internal a11y Playwright coverage only — no runtime API changes.
No breaking API changes between 1.7.9 and 1.8.1 for the imports we use.
Test coverage
Area
Coverage
Internal reorder + favorites_move payload
✅ re-orders items, support drop on placeholders
External bookmark HTML drop
✅ accepts external drag/drop
Custom drag preview rendering
❌ Not covered (Playwright dragTo doesn't assert ghost image)
Honey-pot / :hover suppression during drag
❌ Not covered
iOS / Safari WebKit
❌ Not in CI matrix for favorites DnD
Automated tests validate reorder semantics and messaging contracts, but not visual drag-preview behavior — the main surface touched by 1.8.0.
Risk level: Low. First-party Atlassian OSS, not a random transitive; no install scripts
Confirmed issues
None blocking merge.
Uncertain / needs validation
Drag preview on iOS Safari — popover top-layer path is new; fallback exists but preview offset/centering should be smoke-tested manually on iOS NTP favorites.
Honey-pot during drag — if users report spurious :hover states or missed drop targets after upgrade, suspect 1.8.0 popover rendering (unlikely given fallback, but untested here).
Recommended manual QA (pre/post merge)
macOS: drag a favorite tile — ghost preview centered under pointer, drop indicators correct
iOS: same flow; confirm preview doesn't flash/jump and drop still fires favorites_move
Drag a bookmark from native UI onto favorites grid (external drop path)
Separate fixes PR
Not needed. No code changes required for compatibility. If iOS preview regresses, fix would be upstream or a targeted workaround in PragmaticDND.js, not a lockfile-only bump.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Web Compatibility Assessment
File
Lines
Severity
Finding
special-pages/package.json
39
info
Dependency-only bump (^1.7.9 → ^1.8.1). No application source changes.
package-lock.json
137–145, 11324
info
Lockfile resolves only @atlaskit/pragmatic-drag-and-drop to 1.8.1; no unrelated git-dependency or transitive churn.
(injected runtime)
—
info
Diff does not touch injected/, wrapper-utils.js, captured-globals.js, or message-bridge code. This PR has zero impact on page-injected privacy features or third-party site compatibility.
Sole consumer of this library. It wraps native HTML5 drag-and-drop for the New Tab favorites grid (reorder, placeholder drop, external bookmark drop). Runs in the trusted special-page context, not on arbitrary web pages.
Transitive dependencies
—
info
1.7.9 and 1.8.1 share identical direct deps (@babel/runtime, bind-event-listener, raf-schd). No new transitive surface.
Validation: Ran special-pages favorites integration suite (18 tests) against 1.8.1 — all passed, including re-orders items, support drop on placeholders, and accepts external drag/drop.
Security Assessment
File
Lines
Severity
Finding
(entire diff)
—
info
No changes to messaging schemas, native transports, nativeData handling, or message-bridge trust boundaries.
(injected runtime)
—
info
No captured-global, postMessage, eval/Function, or prototype-override changes. Hostile-page threat model does not apply to this diff.
PragmaticDND.js consumer (unchanged)
—
info
External-drop path parses bookmark IDs from drag payloads via getHTML() and a DDG-specific MIME type — pre-existing behavior, unchanged by this bump.
Risk Level
Low Risk — A scoped special-pages dependency bump with no injected-runtime changes, identical transitive dependencies, and passing favorites drag-and-drop integration tests.
Recommendations
None required for merge from a web-compat/security perspective.
Optional (info): If manual QA is desired beyond CI, smoke-test favorites drag-and-drop on iOS/Android WebViews — the integration suite covers reorder and external-drop flows but platform-specific DnD quirks are always possible with native drag APIs.
Optional (info):@atlaskit/pragmatic-drag-and-drop-hitbox remains at ^1.1.0 (peer range ^1.6.0); no action needed unless a future hitbox release tightens its peer constraint.
Companion package:@atlaskit/pragmatic-drag-and-drop-hitbox remains at ^1.1.0 (peer range ^1.6.0 — compatible). Latest hitbox is 1.2.0 but that release is docs-only; no action required in this PR.
On browsers with Popover API support (Chrome 114+, Safari 17+, Firefox 125+), drag-preview containers are promoted to the top layer via popover="manual". Older engines keep the prior position:fixed + max-z-index fallback.
Reorder/drop logic is covered by CI.
Visual drag-preview behavior on iOS/Android/macOS/Windows WebViews is not — recommend a quick manual smoke: drag a favorite tile, confirm preview renders correctly and drop targets still highlight.
No code changes required preemptively; the library includes an explicit fallback.
Fix PR
Not needed. No blocking issues found; no companion PR drafted.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Web Compatibility Assessment
File
Lines
Severity
Finding
special-pages/package.json
39
info
Version-only bump (^1.7.9 → ^1.8.1). No application source changes.
package-lock.json
137–141, 11340–11343
info
Lockfile resolves to 1.8.1. No transitive dependency changes beyond the target package.
(scope)
—
info
This dependency is not used by injected/. It is consumed only by the New Tab Page favorites UI (special-pages/pages/new-tab/app/favorites/components/PragmaticDND.js). It does not run on arbitrary third-party web pages and does not override browser APIs via wrapper-utils / DDGProxy.
(upstream 1.8.0)
—
info
Upstream minor change: honey-pot fix and setCustomNativeDragPreview overlays now use popover="manual" (Popover API top layer) with fallback to z-index: 2147483647 when unsupported. Minimum versions with native popover support: Chrome/Edge 114+, Firefox 125+, Safari 17+. Our consumer uses setCustomNativeDragPreview + centerUnderPointer.
(validation)
—
info
Favorites DnD integration tests pass on this branch: re-orders items, support drop on placeholders, accepts external drag/drop.
No injected web-compatibility findings (API fidelity, prototype patching, DOM timing, platform API shims, third-party script detection).
Security Assessment
File
Lines
Severity
Finding
(scope)
—
info
No changes to captured-globals.js, message bridge, messaging transports, postMessage, remote config, or load()-time initialization.
special-pages/pages/new-tab/.../PragmaticDND.js
(unchanged)
info
Existing consumer validates drop-target payload shape (target.data.url string check) before reorder. No new trust-boundary changes introduced by this bump.
package-lock.json
—
info
Integrity hash updated for 1.8.1 tarball. No known CVEs reported for this package version.
No security findings in injected threat model categories.
Risk Level
Low Risk — lockfile-only dependency bump confined to the New Tab Page special-page bundle; no injected feature, API shim, or messaging code is modified.
Recommendations
Merge after CI green — no injected compat/security blockers identified.
Manual smoke on older WebViews (optional, low priority): Because 1.8.0 changes drag-preview/honey-pot rendering to prefer the Popover API, spot-check favorites drag-and-drop on any minimum-supported iOS/Android WebView builds if those are below Safari 17 / Chromium 114. Upstream provides z-index fallback, and Playwright integration tests pass.
No injected-specific tests required — this package does not ship in the content-scope injection bundle.
Verdict: Low risk — safe to merge after optional manual smoke-test on Safari/macOS.
Scope & usage
This PR only bumps special-pages/package.json and package-lock.json. The sole consumer is special-pages/pages/new-tab/app/favorites/components/PragmaticDND.js, which wraps NTP favorites drag-and-drop (internal reorder, placeholder drops, and external bookmark drops from native).
Honey-pot fix and custom native drag preview now use popover="manual" (browser top layer) instead of z-index: 2147483647. Falls back to the old z-index path when HTMLElement.prototype.showPopover is unavailable.
Directly affects our setCustomNativeDragPreview usage in useItemState. Reorder/drop logic is unchanged.
1.8.1 (patch)
Internal a11y Playwright test coverage only
No runtime impact
1.7.10 (skipped)
Internal @atlaskit/theme cleanup
No runtime impact
Popover API minimum versions per upstream changelog: Chrome/Edge 114+, Firefox 125+, Safari 17+. Unsupported browsers use the existing z-index fallback.
Test coverage (confirmed)
Integration tests in favorites.spec.js cover the three DND paths:
re-orders items — internal element drag
support drop on placeholders — edge/placeholder handling
accepts external drag/drop — external HTML payload parsing
All three pass against 1.8.1 in CI (npm run test-int -- pages/new-tab/app/favorites/integration-tests/favorites.spec.js --grep "re-orders|placeholder|external drag").
Gap (uncertain): tests assert favorites_move messaging and MIME payloads, but do not verify drag-preview rendering (the code path changed in 1.8.0). Recommend a quick manual smoke-test dragging a favorite on macOS Safari/Chrome to confirm the preview appears above NTP UI.
Dependency necessity (confirmed)
Still needed. Pragmatic DND is the right abstraction here — it provides element + external adapters, closest-edge hit detection, and custom native drag previews. No equivalent exists elsewhere in the monorepo; rolling our own HTML5 DnD would be a regression.
Pre-existing concern (not introduced by this bump)
PragmaticDND.js parses externally dragged text/html via createContextualFragment in idFromPayload. This predates the bump and is outside Dependabot scope, but is worth a follow-up hardening PR (e.g. DOMParser + strict <meta> extraction) if we want defense-in-depth against malicious drag payloads. No fix PR drafted for this dependency update — not a blocker for merging.
Recommendation
Merge after CI green. Optional: manual drag-preview check on Safari/macOS given the 1.8.0 rendering change.
Scope note: This bump does not touch injected/, wrapper-utils.js, captured-globals.js, messaging transports, or the message bridge. The dependency is consumed only by the NTP favorites drag-and-drop UI in special-pages/pages/new-tab/app/favorites/components/PragmaticDND.js.
Validated: npm ci succeeded; favorites integration suite (18 tests, including re-orders items, support drop on placeholders, accepts external drag/drop) passed on @atlaskit/pragmatic-drag-and-drop@1.8.1.
Web Compatibility Assessment
File
Severity
Finding
special-pages/package.json
info
Version-only bump (^1.7.9 → ^1.8.1). No application source changes; injected page-world API fidelity rules do not apply.
Upstream 1.8.0 (transitive)
info
Minor release switches honey-pot fix and custom native drag-preview rendering to popover="manual" (top layer), with documented fallback to prior z-index: 2147483647 when Popover API is unavailable (Chrome/Edge 114+, Firefox 125+, Safari 17+).
PragmaticDND.js (consumer, unchanged)
info
Uses setCustomNativeDragPreview + centerUnderPointer — directly in the code path affected by 1.8.0 rendering change. Playwright DND tests passed; manual smoke on iOS/Android WebViews remains the residual check for preview layering on engines without Popover support.
Transitive deps (npm view)
info
Runtime dependencies unchanged between 1.7.9 and 1.8.1 (@babel/runtime, bind-event-listener, raf-schd).
No warning or error-level web-compat findings for injected runtime or third-party site breakage.
Security Assessment
File
Severity
Finding
Entire diff
info
No changes to global capture hygiene, messaging schemas, origin validation, nativeData handling, or message-bridge trust boundaries.
special-pages/ context
info
Library runs inside the privileged NTP special page (first-party, embedded WebView), not in hostile third-party page injection. DOM drag-and-drop manipulation is scoped to favorites reordering; no new postMessage, eval, or external URL construction introduced by this PR.
Lockfile
info
No unrelated lockfile churn outside the stated package; no version downgrades.
No warning, error, or critical security findings.
Risk Level
Low Risk — dependency-only bump confined to special-pages; no injected runtime surface area; upstream 1.8.0 rendering change has a documented fallback and is covered by passing favorites DND integration tests.
Recommendations
Merge if CI green — no code changes required for injected compat/security.
Optional manual QA — quick favorites drag-reorder smoke on iOS/Android after merge, focusing on custom drag-preview visibility during drag (Popover API vs z-index fallback).
No action needed on injected/ strict-core, captured-globals, or remote-config gating for this PR.
Verdict: Low risk — approve with manual QA on drag preview (especially iOS/WebKit).
Scope
Lockfile-only bump in special-pages/; no application source changes.
Sole consumer: special-pages/pages/new-tab/app/favorites/components/PragmaticDND.js (NTP favorites reorder + external bookmark drops).
Changelog impact (1.7.9 → 1.8.1)
Version
Change
Relevance to this repo
1.8.0 (minor)
Honey-pot fix + setCustomNativeDragPreview now use popover="manual" + showPopover() when supported; fallback to z-index: 2147483647 otherwise
Direct — we call setCustomNativeDragPreview / centerUnderPointer in onGenerateDragPreview
1.8.1 (patch)
Internal a11y Playwright test coverage
None for runtime
Skipped 1.7.10 (internal theme token cleanup).
Confirmed
API compatibility: Imports in PragmaticDND.js are unchanged; no breaking API removals in this range.
Transitive deps: Runtime deps unchanged (@babel/runtime, bind-event-listener, raf-schd). No new runtime packages.
Integration tests (1.8.1):re-orders items, support drop on placeholders, and accepts external drag/drop all pass locally.
Supply chain: Official Atlassian package (@atlaskit/*), Apache-2.0, ~896k weekly npm downloads, lockfile integrity hash present. No signs of typosquatting or unexpected publisher change.
Test coverage gaps (not blockers)
No unit tests for PragmaticDND.js; coverage is integration-only.
Playwright tests assert reorder messaging and external HTML drops, but do not validate custom drag preview rendering (onGenerateDragPreview → setCustomNativeDragPreview). The 1.8.0 popover change is the main regression surface CI won't catch.
External drop test synthesizes DragEvents in JS rather than OS-level drags from another app.
Uncertain — validate on native clients
Popover top-layer on embedded WebViews: 1.8.0 promotes drag-preview and honey-pot elements to the browser top layer. If a WebView has incomplete Popover API support or odd stacking with NTP chrome, preview positioning/visibility could regress. Fallback path exists but is untested here.
iOS drag preview: Prior 1.7.x releases changed iOS preview centering behavior; 1.8.0 layering change may interact with that. Worth a quick manual drag on iOS NTP favorites.
Dependency necessity
Still justified. Favorites DnD needs element + external adapters, closest-edge hitbox, custom native preview, and external MIME parsing — a bespoke implementation would be higher risk than keeping Pragmatic DnD.
@atlaskit/pragmatic-drag-and-drop-hitbox remains at ^1.1.0 (compatible via ^1.6.0 peer). Optional follow-up: bump hitbox to 1.2.0 for alignment (docs-only change in 1.2.0; no runtime fix required).
Recommended manual QA (post-merge)
Drag-reorder favorites on macOS + iOS (verify preview follows pointer, drop targets highlight).
Drag a bookmark from browser chrome/bookmarks bar onto NTP favorites (external drop).
Drag onto placeholder slots at end of grid.
No separate fix PR drafted — no code changes required; risk is behavioral and best covered by manual QA above.
The reason will be displayed to describe this comment to others. Learn more.
Injected PR Evaluation: Web Compatibility & Security
Scope note: This PR only bumps @atlaskit/pragmatic-drag-and-drop in special-pages/package.json and package-lock.json. It does not modify injected/ or any page-world injection code. The library is consumed exclusively by the New Tab Page favorites widget (special-pages/pages/new-tab/app/favorites/components/PragmaticDND.js).
Web Compatibility Assessment
File
Lines
Severity
Finding
special-pages/package.json
39
info
Dependency-only bump; no application source changes. No browser API shimming, prototype patching, or toString() masking concerns apply to this diff.
Minor release switches honey-pot fix and custom native drag preview containers to popover="manual" (Popover API top layer), with fallback to z-index: 2147483647 when Popover API is unavailable. NTP favorites uses setCustomNativeDragPreview + centerUnderPointer, so drag-preview layering behavior may change on supported WebViews but should remain functional via fallback.
Existing integration tests in favorites.spec.js cover internal reorder (drags) and external drop (acceptsExternalDrop). These exercise the adapters we import but do not assert custom drag-preview rendering.
No warnings or errors for injected web-compat categories (API fidelity, prototype chain, cross-frame leakage, third-party script detection) — this code never runs in hostile third-party page context.
Security Assessment
File
Lines
Severity
Finding
Entire diff
—
info
No changes to captured-globals.js, wrapper-utils.js, message-bridge.js, messaging transports, or shouldExemptMethod().
special-pages/ (runtime context)
—
info
Special pages are privileged, first-party embedded UIs — not injected into arbitrary web pages. The DND library operates within our own DOM boundary on the NTP.
PragmaticDND.jsidFromPayload() (unchanged)
284–307
info
External drop path parses text/html via createContextualFragment — pre-existing, not introduced by this bump. Payload is validated against DDG_MIME_TYPE before use.
No warnings, errors, or critical findings.
Risk Level
Low Risk — lockfile-only dependency bump confined to special-pages; zero injected code changes and no messaging or API-override surface area.
Recommendations
(info) Merge after CI passes. Existing favorites.spec.js drag/drop tests provide adequate regression signal for the adapters we use.
(info, optional) If manual QA is desired, smoke-test favorites drag-reorder and external bookmark drop on iOS and Android NTP — 1.8.0's Popover API path is most likely to surface visual differences in custom drag preview positioning on older WebViews (fallback should preserve prior behavior).
Verdict: Low risk — approve with light manual QA on drag preview.
Scope of change
The diff is a version-only bump in special-pages/package.json and package-lock.json. No application code changes.
Single consumer:special-pages/pages/new-tab/app/favorites/components/PragmaticDND.js, used by the New Tab favorites grid (FavoritesCustomized.js → Tile.js).
APIs in use:
Element adapter: draggable, dropTargetForElements, monitorForElements
Primary behavioral change. Honey-pot fix and custom native drag previews now use popover="manual" (top layer) instead of z-index: 2147483647. Falls back to the old z-index approach when HTMLElement.prototype.showPopover is unavailable.
1.8.1
Patch
Internal a11y Playwright test coverage only — no runtime behavior change.
Confirmed: Runtime dependencies are unchanged between 1.7.9 and 1.8.1 (@babel/runtime, bind-event-listener, raf-schd). No new transitive deps.
Directly affected code path:PragmaticDND.js calls setCustomNativeDragPreview with centerUnderPointer in onGenerateDragPreview — this is the code path 1.8.0 modifies.
support drop on placeholders — drop onto trailing placeholder tiles ✅
accepts external drag/drop — bookmark HTML payload from native ✅
All three passed locally against 1.8.1.
Gaps (pre-existing, not introduced by this PR):
No unit tests for PragmaticDND.js
No assertion on drag-preview visuals or popover top-layer behavior
Favorites DnD tests run only on the integration (Desktop Chrome) project — not WebKit/iOS
Playwright dragTo validates reorder semantics and native messaging, but does not fully exercise native drag-image rendering
Dependency necessity
The package remains appropriate. Favorites DnD requires:
Internal grid reorder with closest-edge hit detection
External drops from native bookmarks (custom MIME + HTML meta parsing)
Custom native drag preview cloning
No alternative DnD library is used elsewhere in the repo. Replacing it would be a large, unrelated effort.
Companion @atlaskit/pragmatic-drag-and-drop-hitbox stays at ^1.1.0 (peer range ^1.6.0 on core) — compatible, no bump required.
Supply chain
Check
Result
Publisher
Atlassian (atlassianartifactteam) — established maintainer
License
Apache-2.0
Weekly downloads
~900k
npm audit
No known vulnerabilities for this package
Provenance
Standard Dependabot semver bump with updated integrity hash
Low supply-chain concern.
Concerns requiring manual validation
Drag preview appearance (1.8.0 popover change) — On browsers with Popover API support (Chrome 114+, Safari 17+, Firefox 125+), the favorites drag ghost image now renders via popover="manual". Verify visually on macOS and iOS that the preview appears correctly above other NTP widgets during drag. Fallback path on older WebViews should behave as before, but is untested here.
iOS drag preview positioning — Changelog 1.7.3+ documents iOS-specific preview centering behavior. Combined with 1.8.0 popover rendering, a quick smoke test on iOS is prudent even though reorder logic is covered by integration tests.
Fix PR
Not required. No application code changes needed for this bump. Test coverage gaps are pre-existing; addressing them (e.g. WebKit project for favorites DnD, drag-preview screenshot test) would be a separate enhancement, not a blocker for this dependency update.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dependenciesUpdate one or more dependencies versionminorIncrement the minor version when merged
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
dependabot
Bot
added
dependencies
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Bumps @atlaskit/pragmatic-drag-and-drop from 1.7.9 to 1.8.1.
Commits
Note
Low Risk
Lockfile-only dependency upgrade for UI drag-and-drop; behavior could shift slightly with the minor library release but no repo logic was modified.
Overview
Bumps
@atlaskit/pragmatic-drag-and-dropin thespecial-pagesworkspace from 1.7.9 to 1.8.1, with matchingpackage-lock.jsonupdates. No application source changes; consumers such as new-tab favorites drag-and-drop (PragmaticDND.js) pick up the new library version at install/build time.Reviewed by Cursor Bugbot for commit 25bce15. Bugbot is set up for automated code reviews on this repo. Configure here.