fix(deps): align design-tokens lockfile ref with v0.30.0 tag - #2832
fix(deps): align design-tokens lockfile ref with v0.30.0 tag#2832cursor[bot] wants to merge 1 commit into
Conversation
Build Branch
Static preview entry points
QR codes (mobile preview)
Integration commandsnpm (Android / Extension): Swift Package Manager (Apple): .package(url: "https://github.com/duckduckgo/content-scope-scripts.git", branch: "pr-releases/cursor/dependency-update-risk-assessment-351b")git submodule (Windows): git -C submodules/content-scope-scripts fetch origin pr-releases/cursor/dependency-update-risk-assessment-351b
git -C submodules/content-scope-scripts checkout origin/pr-releases/cursor/dependency-update-risk-assessment-351bPin to exact commitnpm (Android / Extension): Swift Package Manager (Apple): .package(url: "https://github.com/duckduckgo/content-scope-scripts.git", revision: "35d8cc299fc71ff65ab89c37628692fb09630ebe")git submodule (Windows): git -C submodules/content-scope-scripts fetch origin pr-releases/cursor/dependency-update-risk-assessment-351b
git -C submodules/content-scope-scripts checkout 35d8cc299fc71ff65ab89c37628692fb09630ebe |
[Beta] Generated file diffTime updated: Fri, 10 Jul 2026 11:56:18 GMT |
|
@cursoragent why would it downgrade, did a real pr add this and then the cooldown applied? Seems like cooldown should only apply when automatic, no? |
|
Short answer: cooldown didn’t cause this. The downgrade was a Dependabot quirk with git-pinned deps, not cooldown blocking an upgrade and falling back to an older tag. What actually happened
So yes, a real PR landed first; the downgrade was a separate scheduled run, not cooldown undoing the merge. Why the downgrade PR appeared
"@duckduckgo/design-tokens": "github:duckduckgo/design-tokens#v0.30.0",After #2805 merged, the lockfile was already inconsistent:
The downgrade PR then:
That pattern matches Dependabot mis-resolving git refs in an npm workspace (tag vs SHA, hoisting), not cooldown logic. Same class of bug as dependabot-core#12076 for git-pinned deps. Cooldown’s role (or lack of one)Cooldown ( Per GitHub’s docs, when a version is in cooldown, Dependabot skips the dependency — it does not pick the next-oldest eligible tag. There’s no “only when automatic” switch; cooldown is keyed off publish date, not whether the previous bump was auto-merged or human-merged. Timeline note: v0.30.0 landed Jun 26, downgrade opened Jul 2 — inside the 14-day window. That’s consistent with v0.30.0 being “too new” for another forward bump, but not with opening a reverse bump. If cooldown were working as documented, the expected behavior after #2805 was no PR at all, not a downgrade. On “cooldown should only apply when automatic”Two different things:
Dependabot has no “exempt human-merged bumps from cooldown” option. If you want specific deps to bypass cooldown, use Bottom line: #2805 was real and correct. #2830 was a git-ref resolution artifact ~6 days later. Cooldown may have suppressed a forward bump to v0.30.0+ if one existed, but it shouldn’t cause downgrades; the   |
|
@cursoragent can you fix the lockfile/package accordingly instead of ignore the versions? |
|
Done — switched from the Root cause: After #2805, refs were inconsistent:
That tag/SHA mismatch is what led Dependabot to open the spurious downgrade in #2830. Change: Pin the lockfile "resolved": "git+ssh://git@github.com/duckduckgo/design-tokens.git#v0.30.0",
|
Dependabot #2830 proposed a downgrade after #2805 left the lockfile resolved field pinned to the v0.30.0 commit SHA while package.json and the workspace lockfile entry used the #v0.30.0 tag. Pin the resolved ref to the tag as well so Dependabot sees a consistent git ref. Co-authored-by: Jonathan Kingston <jonathanKingston@users.noreply.github.com>
6520600 to
bfbdaa2
Compare
cursor
Bot
changed the title
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Injected PR Evaluation: Web Compatibility & Security
Trigger: synchronize (71b45d08 → bfbdaa22)
Scope: 1 file (package-lock.json), +1/−1 — lockfile resolved ref alignment only.
Web Compatibility Assessment
| File | Lines | Severity | Finding |
|---|---|---|---|
| — | — | — | No findings. Zero changes to injected/, messaging/, wrapper utilities, API shims, or DOM/runtime code. |
package-lock.json |
793 | info | Aligns @duckduckgo/design-tokens resolved from commit SHA (f7ecae71…) to tag ref (v0.30.0). Version stays 0.30.0 and integrity is unchanged, so resolved package content is identical. |
package-lock.json |
— | info | @duckduckgo/design-tokens is a devDependency in special-pages/ used only at build time for CSS custom-property imports (design-tokens.css). It is not bundled into page-injected scripts and does not affect third-party website API fidelity. |
Security Assessment
| File | Lines | Severity | Finding |
|---|---|---|---|
| — | — | — | No findings. No changes to captured globals, messaging transports, message-bridge trust boundaries, origin validation, or config-gated feature logic. |
package-lock.json |
793 | info | Lockfile metadata-only change; no new network surfaces, postMessage usage, or runtime dependency resolution changes in injected bundles. |
Risk Level
Low Risk — single lockfile metadata alignment for a special-pages build-time devDependency; no injected runtime code changes.
Recommendations
- info — Title/diff mismatch: PR title references ignoring
@duckduckgo/design-tokensdowngrade PRs in Dependabot, but this diff contains only the lockfile tag alignment. If Dependabot ignore rules are still intended, they would need a separate.github/dependabot.ymlchange (out of injected scope, but worth clarifying for reviewers). - info — Safe to merge from injected perspective: Unchanged
integrityhash confirms the tag resolves to the same artifact already onmain;npm run build --workspace=special-pagespasses locally with the PR lockfile.
Automated assessment for injected web compatibility & security.
Sent by Cursor Automation: Web compat and sec
2 participants
Asana Task/Github Issue: Follow-up to #2830 (Dependabot downgrade PR for
@duckduckgo/design-tokens)Description
Dependabot opened #2830 proposing a change from
@duckduckgo/design-tokens#v0.30.0to#v0.29.0— a version downgrade caused by Git-tag semver comparison on a Git-pinned devDependency.This adds an
ignorerule in.github/dependabot.ymlto skip versions< 0.30.0for@duckduckgo/design-tokens, preventing recurrence of spurious downgrade PRs.When a legitimate upgrade beyond v0.30.0 is published, Dependabot should still open a PR normally.
Testing Steps
Checklist