You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Low Risk
Routine patch dependency bump in special-pages UI code with no app logic or security surface changes in this diff.
Overview
Bumps the preact dependency in special-pages from 10.29.2 to 10.29.4, with matching updates in the root package-lock.json.
This patch release mainly brings renderer fixes (hydration/Suspense crashes, partial subtree error recovery, hydrate recovery with excess DOM children) and performance/memory improvements from 10.29.3, plus 10.29.4 fixes a hydration-Suspense crash and reverts an earlier useId + async Suspense change.
Reviewed by Cursor Bugbot for commit 2e4bdef. Bugbot is set up for automated code reviews on this repo. Configure here.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Injected PR Evaluation: Web Compatibility & Security
PR:build(deps): bump preact from 10.29.2 to 10.29.3 (4a7ec40f → a517058a)
Web Compatibility Assessment
File
Lines
Severity
Finding
special-pages/package.json
46
info
Dependency-only patch bump (^10.29.2 → ^10.29.3). No application source changes.
package-lock.json
8448–8451
info
Lockfile resolves preact@10.29.3. No runtime contract changes in this repo.
—
—
info
Zero changes to injected/src/, messaging/, wrapper-utils.js, captured-globals.js, or message-bridge code. Preact is not bundled into page-injected scripts.
—
—
info
Preact is used only in special-pages (embedded DDG browser UI: NTP, history, onboarding, duckplayer, etc.). Upstream 10.29.3 fixes are net-positive for this codebase: useId stability (used in NTP, duckplayer, onboarding), Suspense subtree effect flushing (ActivityItemAnimationWrapper.js), error recovery, and memory-leak guards. Special-pages use render() (not hydrate()), so hydrate-recovery fixes are low-impact but harmless.
No API surface fidelity, prototype-chain, DOM-timing, platform-specific injected, or third-party script compatibility concerns apply — this dependency does not run in the hostile third-party page context.
Security Assessment
File
Lines
Severity
Finding
—
—
info
No changes to captured globals, messaging transports, message-bridge trust boundaries, origin validation, postMessage, config gating, or iframe access patterns.
—
—
info
Preact runs in isolated embedded special-pages served by the native browser, not in arbitrary third-party page injection. No new data-exfiltration or dynamic-code-execution vectors introduced.
—
—
info
Upstream 10.29.3 is a patch release (bug fixes + perf); no published security advisories for this delta.
Risk Level
Low Risk — special-pages-only dependency patch with no injected runtime, messaging, or security-sensitive code changes.
Recommendations
Merge when CI is green — no blocking concerns for injected web compat or security.
Optional smoke test — NTP activity lazy-load (Suspense) and any useId-linked a11y attributes (tooltips, drawers, omnibar) if manual QA is desired; upstream fixes target exactly these patterns.
Note: newer Preact patch releases (10.29.4/10.29.5) exist upstream; this Dependabot PR is still safe to merge as-is.
Verified locally: npm run build --workspace=special-pages succeeds.
Verdict: Approve with recommendation to target 10.29.7 instead of 10.29.3.
This is a patch-level bump confined to special-pages/ (the only workspace that depends on Preact). No application source changes are required.
Scope & necessity
Confirmed: Preact is only consumed by special-pages/ (~200+ component files). injected/, messaging/, and types-generator/ do not use it.
Still needed: Preact is the core UI framework for embedded browser pages (new-tab, history, onboarding, duckplayer, etc.). There is no in-repo alternative; this dependency remains appropriate.
Changelog impact vs. this codebase
10.29.3 change
Relevance here
Error recovery for partially rendered subtrees
Medium — ErrorBoundary / InlineErrorBoundary used across new-tab, duckplayer, onboarding, release-notes, special-error
useId stability across async Suspense
Low — useId used in ~15 files, but only one Suspense usage (ActivityItemAnimationWrapper lazy-loads burn animation; no async Suspense). Fix was reverted in 10.29.4 anyway
Flush subtree effects (#5055)
High risk — reverted in 10.29.6 due to useSignalEffect incompatibility. Repo uses useSignalEffect in customizer, burning, protections, history providers
Hydrate recovery fixes
Low — pages use render(), not hydrate()
Memory leak / perf guards
Positive — low risk
Signalish input type
Low — type-only; signals already used via @preact/signals
Key concern (confirmed):10.29.6 release notes explicitly revert #5055 because of useSignalEffect breakage. This repo depends heavily on @preact/signals (CustomizerProvider, BurnProvider, BackgroundProvider, ProtectionsProvider, history hooks, etc.). While integration tests pass on 10.29.3 in CI-like runs, landing 10.29.3 means accepting a change the Preact team already rolled back.
Recommendation: Close or supersede this PR in favor of 10.29.7 (latest patch), which includes retained fixes without the reverted changes. Alternative PR opened: #2855.
History (history.spec.js) — covers useSignalEffect in search/selection providers
Onboarding v4 (onboarding.v4.spec.js) — covers useId in Bubble component
New-tab integration suite covers widget ErrorBoundary paths
Gap (uncertain): No dedicated unit/integration test asserts useSignalEffect ordering edge cases that motivated the 10.29.6 revert. Reliance is on Preact's own regression tests + broad integration coverage.
Validation run on 10.29.3:npm ci, npm run build, unit tests (116 pass), customizer + activity + history + new-tab + onboarding v4 integration tests pass.
Supply chain
Check
Status
Publisher
preactjs/preact on GitHub, npm maintainers include core team
The reason will be displayed to describe this comment to others. Learn more.
Version target concern:10.29.3 includes subtree-effect flushing (#5055) that Preact reverted in 10.29.6 because it broke useSignalEffect. This repo uses @preact/signals / useSignalEffect in customizer, burning, protections, and history providers. Recommend bumping to ^10.29.7 instead — see alternative PR #2855.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Injected PR Evaluation: Web Compatibility & Security
Re-assessed on synchronize (71b45d08 → 8b4b0d39); diff unchanged — dependency patch only (2 files: special-pages/package.json + lockfile).
Web Compatibility Assessment
No findings.
Scope: Preact is a special-pages runtime dependency only. Zero changes to injected/, messaging/, or page-injected scripts. Preact is not bundled into content-scope scripts that run on arbitrary third-party pages.
Upstream 10.29.3 fixes (useId stability across async Suspense, error recovery, effect flushing) align with existing NTP usage (useId in omnibar/favorites/customizer; Suspense + lazy in activity animations). Special-pages use render() exclusively — no hydrate() call sites, so hydrate-recovery fixes are low-impact.
API surface fidelity / prototype chain / DOM / timing: Not applicable — no browser API overrides, wrapper utilities, or injected lifecycle code in this diff.
Security Assessment
No findings.
No changes to captured-globals.js, message bridge, messaging transports, origin validation, or postMessage usage.
No new network requests, dynamic code execution, or config-trust surface.
Preact runs inside DDG-controlled special pages (NTP, onboarding, error pages), not in hostile third-party page context.
Risk Level
Low Risk — patch-level dependency bump confined to special-pages; no injected script, messaging, or security-sensitive code changes.
Recommendations
Info: Merge after CI passes. No additional compat/security gates required for this diff.
Info: Optional smoke-test NTP activity lazy-load section and any useId-dependent a11y wiring (omnibar, favorites, drawer) in a native preview — upstream fixes are targeted at these patterns.
Info: Verified locally: npm run build --workspace=special-pages passes on synchronize head.
Verdict: Request changes — do not merge this version.
This is a patch bump in special-pages only (package.json + lockfile). Preact remains the correct UI framework here (~200 imports across special-pages, paired with @preact/signals). Supply-chain risk is low (official preactjs maintainers, MIT, npm provenance/attestations, lockfile integrity updated).
Confirmed issue: useSignalEffect incompatibility in 10.29.3
Preact 10.29.3 includes Flush subtree effects (#5055), which changes effect scheduling during render. Preact maintainers reverted this in 10.29.6 with an explicit note:
"We had to revert #5055 due to an incompatibility with useSignalEffect" — 10.29.6 release
This repo uses useSignalEffect in 10 files across signal-heavy surfaces:
These are core to theme/background updates, protections stats, burn flow, and history search/selection — not edge cases.
Recommendation: Close or supersede this PR. Prefer draft PR #2855, which bumps to 10.29.7 (post-revert) instead of stopping at 10.29.3.
Changelog impact vs. this codebase
10.29.3 change
Relevance here
Flush subtree effects (#5055)
High risk — conflicts with @preact/signals usage above
useId stability across async Suspense (#5108)
Medium — useId used in NTP drawers/tooltips/favorites; Suspense in ActivityItemAnimationWrapper.js. Note: this fix was later reverted in 10.29.4
Error recovery for partially rendered subtrees (#5120)
Low–medium — ErrorBoundary used across pages
Hydrate recovery with null excess DOM children (#5112)
Low — pages use render(), not hydrate()
Memory-leak guards / perf (#5115, #5116)
Positive, retained in later versions
Signalish for input DOM types (#5096)
Low — type-only improvement
Test coverage
38 unit/integration test files under special-pages/ cover NTP customizer, history, protections, favorites, omnibar, etc.
useSignalEffect paths are exercised indirectly via integration tests, but there is no targeted test for the effect-flush + signal-effect interaction that caused the upstream revert.
Local validation on this branch: npm run build passes; --project=integration suite for customizer/history/new-tab/protections passes (78/78 on re-run). During an earlier parallel run, customizer.spec.js dark-mode theme-variant test failed once (background color rgb(28,28,28) vs expected rgb(30,48,66)); it passed on re-run and on 10.29.2 — treat as potentially flaky, not confirmed regression, but consistent with timing-sensitive signal/effect behavior.
Suggested validation before any preact bump:
npm ci && npm run build
npx playwright test --project=integration \
pages/new-tab/app/customizer/integration-tests/customizer.spec.js \
pages/history/integration-tests/history.spec.js \
pages/new-tab/integration-tests/new-tab.spec.js \
pages/new-tab/app/protections/integrations-tests/protections.spec.js \
--reporter list
Supply chain
Package: preact@10.29.3 from registry.npmjs.org
License: MIT; maintainers: preactjs org
npm provenance/attestations present
Diff is limited to version + integrity hash — no unexpected transitive changes
Follow-up PR
An alternative fix already exists: draft PR #2855 (preact → ^10.29.7). No additional fix PR opened from this review to avoid duplication.
The reason will be displayed to describe this comment to others. Learn more.
Stop at 10.29.3 is risky for this repo. This version ships the subtree-effect flush (#5055) that Preact reverted in 10.29.6 due to useSignalEffect incompatibility. special-pages uses useSignalEffect in customizer, protections, burning, and history providers. Recommend closing this bump and merging #2855 (10.29.7) instead.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Injected PR Evaluation: Web Compatibility & Security
PR: build(deps): bump preact from 10.29.2 to 10.29.3 (d60567b)
Web Compatibility Assessment
No findings.
This PR changes only special-pages/package.json and package-lock.json (version 10.29.2 → 10.29.3). There are no changes to injected/, wrapper-utils.js, captured-globals.js, or any browser API override code.
Preact is used exclusively in the special-pages/ workspace (new-tab, errorpage, duckplayer, etc.) and is bundled at build time into static HTML/CSS/JS served as embedded browser pages. It does not ship as injected content on arbitrary third-party web pages, so the injected-script compatibility criteria (API surface fidelity, prototype chain integrity, third-party script detection, stack-trace exemptions) do not apply to this diff.
Preact 10.29.3 is a patch release with stability and performance fixes (error recovery for partially rendered subtrees, useId stability across async Suspense, hydrate recovery, memory-leak guards). These are net-positive for special-page UI reliability.
Security Assessment
No findings.
No changes to captured-globals.js, messaging transports, message bridge, or origin validation.
No new postMessage, eval(), or dynamic code execution.
No nativeData forwarding risk — no messaging code touched.
Preact runs in a controlled, first-party embedded context with privileged native API access, not in the hostile page-injection environment.
Risk Level
Low Risk — dependency-only patch bump in special-pages/; no injected runtime code, API overrides, or security-sensitive subsystems are modified.
Recommendations
CI validation (info): Ensure standard npm run build and special-pages integration tests pass on this branch. No additional injected-specific testing is required.
Version note (info): Preact 10.29.4 and 10.29.5 are available upstream; this patch bump is still appropriate and low-risk. A follow-up dependabot PR may cover newer versions separately.
Verdict: Request changes — do not merge this version.
This is a patch bump confined to special-pages/ (package.json + lockfile). No application source changes. Preact remains the correct and necessary UI framework here (~200 imports across special-pages, paired with @preact/signals ^2.9.2). Supply-chain risk is low: official preactjs maintainers, MIT license, lockfile integrity matches npm registry (sha512-D9NL1GAnJZhc3RndVs4gDdxEeU9TcHgywMrhhOsnpdlvFjdbx0gAsLUnH6JEhlJH5giL7Tx5biWPUSEXE/HPzw==).
Confirmed issue: useSignalEffect incompatibility in 10.29.3
Preact 10.29.3 ships subtree-effect flushing (#5055), which changes when useEffect/useLayoutEffect callbacks run across the component tree. The Preact team reverted this in 10.29.6 with an explicit note: "We had to revert #5055 due to an incompatibility with useSignalEffect" (10.29.6 release).
This repo relies heavily on @preact/signals / useSignalEffect in production paths:
Merging 10.29.3 risks subtle timing bugs (stale UI, missed subscriptions, incorrect theme/background sync) that existing tests may not catch.
Changelog impact vs. this codebase
10.29.3 change
Relevance here
Subtree effect flushing (#5055)
High risk — conflicts with useSignalEffect (reverted in 10.29.6)
useId stability across async Suspense (#5108)
Low — useId is used (~15 files) but async Suspense is only in ActivityItemAnimationWrapper.js
Hydrate recovery fixes (#5112)
Not applicable — no hydrate() calls; client-side render() only
Error recovery for partially rendered subtrees (#5120)
Low — ErrorBoundary uses componentDidCatch; no SSR
Memory-leak guards / perf (#5115, #5116)
Beneficial — retained in 10.29.7
Signalish for input type (#5096)
Type-only; no runtime impact
Test coverage
Validated on this branch (d60567b):
npm run build — pass
npm run test-unit — 116/116 pass
npm run test-int (history, customizer, new-tab, activity) — 112/112 pass
Coverage is good for affected pages but does not exercise the useSignalEffect + subtree-flush interaction that upstream flagged. Passing CI does not negate the documented regression risk.
Recommendation
Close this PR and merge #2855 instead, which targets preact@^10.29.7 — the first 10.29.x release after the #5055 revert, retaining the applicable bugfixes without the useSignalEffect breakage.
No additional fix PR is needed; #2855 already exists as a draft from a prior review run.
The reason will be displayed to describe this comment to others. Learn more.
Do not stop at 10.29.3. This version includes subtree-effect flushing (#5055), reverted in 10.29.6 due to useSignalEffect incompatibility. This repo uses useSignalEffect in 12+ files across new-tab (customizer, burning, protections) and history. Target ^10.29.7 via #2855 instead.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Injected PR Evaluation: Web Compatibility & Security
PR:build(deps): bump preact from 10.29.2 to 10.29.3 (#2854) Trigger: synchronize — re-assessed at 358c7a09
Web Compatibility Assessment
File
Lines
Severity
Finding
special-pages/package.json
46
info
Dependency version bump only (^10.29.2 → ^10.29.3). No application source changes.
package-lock.json
8447–8450, 11330
info
Lockfile resolution update for preact@10.29.3. No runtime code changes.
—
—
info
Preact is confined to special-pages/ (embedded first-party UI: NTP, onboarding, duckplayer, etc.). No usage in injected/ — this dependency does not run in third-party page contexts and is outside the injected API-override / prototype-patching threat surface.
—
—
info
Preact 10.29.3 is a patch release (error recovery, useId/Suspense stability, memory-leak fixes, hydrate recovery). Special-pages uses useId (tooltips, drawers, omnibar) and Suspense (NTP activity animations); these fixes are stability improvements, not contract changes.
—
—
info
Special-pages entry points use render() (client-only), not hydrate(). Hydrate-recovery fixes in 10.29.3 are low direct impact but harmless.
—
—
info
No changes to browser API overrides, wrapper-utils.js, DDGProxy, DOM manipulation in injected features, platform entry points, or remote config.
No web compatibility warnings or errors identified.
Security Assessment
File
Lines
Severity
Finding
—
—
info
No changes to captured-globals.js, messaging transports, message-bridge trust boundaries, nativeData handling, or origin validation.
—
—
info
No new postMessage, eval/Function, dynamic code execution, or network request patterns introduced.
—
—
info
Preact renders trusted, bundled first-party UI inside browser-controlled special-page origins — not hostile third-party page content. Dependency bump does not expand the attack surface.
No security warnings, errors, or critical findings identified.
Risk Level
Low Risk — Dependency-only patch bump in special-pages/ with no injected/, messaging, or security-sensitive code changes; Preact does not ship into third-party page injection contexts.
Recommendations
Merge when CI passes — No injected-scope concerns; standard dependabot hygiene.
Optional: Run special-pages integration tests (npm run test-int in special-pages/) as a sanity check for NTP useId/Suspense paths, though no behavioral regressions are expected from this patch.
Future note (info): Preact 10.29.4 reverted the useId async-Suspense fix from 10.29.3. If a future dependabot PR targets 10.29.4+, re-evaluate NTP Suspense/useId usage; not applicable to this bump.
Verdict: Request changes — do not merge this version.
This is a patch bump in special-pages only (special-pages/package.json + root package-lock.json). Preact is the UI runtime for all embedded special pages (new-tab, history, duckplayer, onboarding, etc.); it is still required and there is no in-repo alternative.
Landing 10.29.3 would change passive-effect flush ordering globally. That is exactly the behavior Preact maintainers rolled back one patch later. Merge risk is real and upstream-validated.
Test coverage assessment
Existing coverage (adequate for a safe bump, not for catching this regression):
116 special-pages unit tests pass locally (npm run test-unit)
Key Preact features in use are partially exercised: ErrorBoundary (duckplayer exception test), Suspense/lazy (activity burn path), useId (drawer/customizer/omnibar a11y IDs)
Gap (uncertain — would need targeted repro):
No integration test asserts useSignalEffect timing or ordering under concurrent re-renders. A regression from #5055 could manifest as stale UI, missed side-effects, or animation glitches in customizer/history/burn flows without failing CI.
Supply chain
Check
Result
Package source
Official preactjs/preact on npm
License
MIT
Lockfile integrity
Updated SRI hash for preact-10.29.3.tgz (expected for Dependabot)
No supply-chain red flags; the blocker is runtime compatibility, not provenance.
Recommendation
Close or skip this PR — do not merge 10.29.3.
Use the existing follow-up PR instead:#2855 — bump preact to 10.29.7 (skip 10.29.3) is already open and targets a version that includes applicable fixes without the reverted #5055 change.
No additional fix PR needed from this review — #2855 covers the remediation.
Tests passing on 10.29.3 does not disprove the upstream useSignalEffect revert rationale; effect-order regressions are often subtle and path-dependent.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Injected PR Evaluation: Web Compatibility & Security
PR: build(deps): bump preact from 10.29.2 to 10.29.3 (47c7e67) Scope:special-pages/package.json, package-lock.json only (5 lines)
Web Compatibility Assessment
File
Lines
Severity
Finding
special-pages/package.json
46
info
Preact is a special-pages runtime dependency only. It is not used in injected/ and does not participate in third-party page API shimming, toString() masking, or prototype overrides. Web-compat evaluation categories for injected API fidelity do not apply.
package-lock.json
8408–8410
info
Patch release 10.29.3 includes fixes for error recovery, useId stability across async Suspense, subtree effect flushing, and memory-leak hotspots. Special-pages uses both useId (NTP omnibar, tooltips, drawers, etc.) and Suspense (ActivityItemAnimationWrapper); these fixes are stability improvements, not regressions.
—
—
info
Special-pages entry points use render() (not hydrate()), so the hydrate-recovery fix is low-impact here but harmless.
No warnings or errors identified.
Security Assessment
File
Lines
Severity
Finding
—
—
info
No changes to injected/, messaging/, captured-globals.js, message bridge, or native messaging transports. No new postMessage, eval, or uncaptured-global usage.
—
—
info
Preact renders first-party embedded browser pages (NTP, onboarding, error pages, etc.) inside the native WebView sandbox — not arbitrary hostile page content. Dependency supply-chain risk is unchanged from the prior 10.29.2 pin (same registry, patch-level bump).
No warnings, errors, or critical findings identified.
Risk Level
Low Risk — Dependency-only patch bump confined to special-pages; no injected runtime, API override, or security-boundary changes.
Recommendations
Merge after CI green — No additional web-compat or security gates required for this diff.
Optional smoke test — NTP pages exercising useId + Suspense (omnibar, activity animations) are the highest-signal manual check if integration coverage is thin.
Future dependabot note — Preact 10.29.4 reverted the useId/async-Suspense fix; flag for extra scrutiny if a subsequent bump targets 10.29.4+.
Verdict: Request changes — do not merge this version.
This is a patch bump confined to special-pages/ (package.json + package-lock.json). Preact is the core UI runtime for all embedded special pages (new-tab, history, onboarding, duckplayer, etc.). The update is low supply-chain risk, but 10.29.3 ships a runtime change that upstream explicitly reverted due to incompatibility with @preact/signals.
Preact 10.29.3 includes "Flush subtree effects when rendering a pending node" (#5055). This changes effect-flush timing from per-component to flushing the entire pending-effects queue before re-render.
Upstream reverted this in 10.29.6 with the explicit note: "We had to revert #5055 due to an incompatibility with useSignalEffect" (#5147).
This repo is directly affected.useSignalEffect from @preact/signals is used in 10 files across high-traffic surfaces:
Gap: No test exercises the useSignalEffect + subtree-effect-flush interaction. Passing CI does not disprove subtle timing bugs (stale theme state, missed protections counter updates, burn-animation race conditions). Upstream caught this via their own regression tests, not ours.
Supply chain risk
Low. Official preact package from npm registry; lockfile integrity hash updated correctly.
Maintainer: established Preact team; release published via GitHub Actions with trusted publishing and staged publishing (reduces takeover blast radius).
No new transitive dependencies introduced.
Is Preact still needed?
Yes. It is the sole UI framework for special-pages/ (~150+ component files). No viable in-repo alternative; @preact/signals is tightly coupled. Staying on 10.29.x is appropriate.
Recommended action
Close this PR and merge #2855 instead, which bumps directly to ^10.29.7 — skipping the 10.29.3–10.29.5 window that contains the reverted subtree-effect flush, while retaining the applicable bugfixes from the 10.29.x line.
No additional fix PR is needed; #2855 already exists as a draft with the correct target version.
The reason will be displayed to describe this comment to others. Learn more.
Do not stop at 10.29.3. This version includes subtree-effect flushing (#5055) that Preact reverted in 10.29.6 due to useSignalEffect incompatibility. This repo uses useSignalEffect in 10 files across new-tab and history (customizer, protections, burn, search). Target ^10.29.7 via #2855 instead.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Injected PR Evaluation: Web Compatibility & Security
Re-assessed on synchronize (493d865) — assessment unchanged from prior run.
Web Compatibility Assessment
File
Lines
Severity
Finding
special-pages/package.json
46
info
Dependency version bump only (preact^10.29.2 → ^10.29.3). No changes to injected/ runtime code, API overrides, or browser shims.
package-lock.json
8408–8410, 11263
info
Lockfile resolution update for preact@10.29.3. No behavioral code changes in this repo.
(runtime context)
—
info
Preact is used exclusively in special-pages/ (first-party embedded UI: NTP, Duck Player, onboarding, etc.). It does not ship in the injected/ bundle that runs on arbitrary third-party pages, so none of the API-surface-fidelity, prototype-chain, or third-party-script-detection concerns apply.
(preact 10.29.3 changelog)
—
info
Patch release fixes: error recovery for partially rendered subtrees, useId stability across async Suspense, subtree effect flushing, hydrate recovery with null excess DOM children, memory-leak hotspots. Special-pages uses useId (NTP omnibar, favorites, drawer, etc.) and Suspense (ActivityItemAnimationWrapper); all entry points use render() not hydrate(). These fixes are net-positive for special-pages stability.
No web compatibility regressions identified.
Security Assessment
File
Lines
Severity
Finding
special-pages/package.json
46
info
Dev/runtime dependency bump in isolated special-pages workspace. No impact on captured-globals.js, message bridge, messaging transports, or injected/ trust boundaries.
package-lock.json
8408–8410
info
Integrity hash updated for preact-10.29.3.tgz. Standard lockfile maintenance.
(scope boundary)
—
info
Special-pages run as first-party duck:// / chrome-extension:// embedded pages inside WebViews — not in the hostile third-party page context. Messaging, nativeData leakage, and prototype-attack vectors evaluated in the injected trust model do not apply.
No security vulnerabilities identified.
Risk Level
Low Risk — Dependency-only patch bump confined to special-pages/; no changes to injected privacy features, API overrides, messaging, or security-critical paths.
Recommendations
Merge when CI green — no blockers from a web-compat or security perspective.
(info) Standard Dependabot hygiene: confirm npm run build and special-pages integration tests pass in CI.
(info) Future watch: Preact 10.29.4 reportedly reverted the useId/async-Suspense fix — if Dependabot proposes 10.29.4+, re-evaluate NTP useId + Suspense usage before merging.
Verdict: Do not merge — close in favor of #2855 (preact@^10.29.7).
This is a patch bump confined to special-pages/package.json and package-lock.json. Preact is the correct and necessary UI runtime for all special pages; there is no viable in-repo replacement without a full rewrite.
Confirmed risk: subtree effect flushing shipped in 10.29.3, later reverted
Preact 10.29.3 includes preactjs/preact#5055 (“Flush subtree effects”), which changes options._render to call flushAfterPaintEffects() and flush all pending useEffect callbacks before a re-render proceeds, instead of only the re-rendering component’s effects.
That change was reverted in 10.29.6 via preactjs/preact#5148 after downstream breakage. The 10.29.3 line is therefore a known-bad intermediate release.
Why this repo is exposed:special-pages relies heavily on @preact/signals and useSignalEffect (10 files across new-tab and history), including:
These code paths combine signal-driven synchronous updates with useEffect / useSignalEffect side effects. The 10.29.3 effect-flush timing change can alter when sibling effects run (tree order vs per-component), which is exactly the class of regression #5055 targeted and why maintainers reverted it.
A follow-up fix PR already exists: #2855 bumps to ^10.29.7, which retains applicable fixes while skipping the reverted subtree-flush behavior.
Changelog impact vs current code
10.29.3 change
Repo exposure
Assessment
Flush subtree effects (#5055)
High — useSignalEffect across NTP/history
Avoid (reverted in 10.29.6)
useId stability across async Suspense (#5108)
Medium — useId in Tooltip, Popover, Drawer, omnibar, favorites, etc.; Suspense+lazy in ActivityItemAnimationWrapper
Fix also reverted in 10.29.4; low practical risk here (client render(), not SSR/hydrate)
Error recovery for partially rendered subtrees (#5120)
Low — ErrorBoundary used on several pages
Likely beneficial; available in 10.29.7
Hydrate recovery with null excess DOM children (#5112)
None — pages use render(), not hydrate()
No impact
Memory-leak guards / SCU perf (#5115, #5116)
General runtime
Likely beneficial; available in 10.29.7
Signalish input types (#5096)
Type-only
No runtime impact
Test coverage
Unit tests:npm run test-unit in special-pages passes (116/116) on this branch.
Integration tests: Good Playwright coverage exists for affected surfaces (customizer.spec.js, activity.spec.js including burn/Suspense path, history.spec.js, new-tab.spec.js). These exercise signal-driven UI but do not assert useSignalEffect flush ordering — a regression from #5055 could slip through green CI.
Gap: No targeted test for signal-effect timing interactions. Recommend running the NTP customizer + history + activity burn suites when landing #2855.
Supply chain
Package: official preact on npm, MIT, maintained by preactjs org.
Lockfile integrity sha512-D9NL1GAnJZhc3RndVs4gDdxEeU9TcHgywMrhhOsnpdlvFjdbx0gAsLUnH6JEhlJH5giL7Tx5biWPUSEXE/HPzw== matches registry metadata for 10.29.3.
npm publish attestations / provenance present for this version.
No supply-chain red flags for this bump; the concern is behavioral regression, not provenance.
This repo uses useSignalEffect in 10+ files (CustomizerProvider, BurnProvider, HistoryServiceProvider, etc.). That effect-scheduling change is a confirmed regression vector for signal-driven UI here.
Please close this Dependabot PR and land #2855 (^10.29.7) instead.
This is a patch bump confined to special-pages (package.json + lockfile). Preact is the sole UI runtime for all special pages and is still the right choice here — there is no in-repo alternative.
However, 10.29.3 ships a confirmed regression for this codebase: subtree-effect flushing (#5055), which Preact reverted in 10.29.6 citing incompatibility with useSignalEffect (release notes).
Confirmed risk: useSignalEffect incompatibility
special-pages relies heavily on @preact/signals / useSignalEffect across core UI:
10.29.3's effect-flushing change can cause signals to trigger synchronous renders that corrupt component execution context — exactly the failure mode Preact documented when reverting #5055.
Changelog impacts (lower concern on their own)
Other 10.29.3 changes are generally beneficial but overlap areas this repo uses:
Change
Repo usage
Risk
useId stability across async Suspense
useId in ~15 components (NTP, duckplayer, onboarding)
Low — fix is desirable
Error recovery for partially rendered subtrees
ErrorBoundary / componentDidCatch on every page
Low — fix is desirable
Hydrate recovery with null DOM children
No hydrate() calls; pages use render() only
Negligible
Suspense fixes
Single usage in ActivityItemAnimationWrapper.js
Low
Memory-leak / perf hooks changes
Widespread hooks usage
Low
Signalish input types
Type-only; no runtime impact
None
These fixes are retained in 10.29.7 without the reverted #5055 change.
Test coverage
Unit tests (npm run test-unit): 116/116 pass, but they do not exercise Preact runtime + useSignalEffect interaction.
Integration tests: Good coverage exists for signal-heavy flows (customizer.spec.js, history.spec.js, new-tab.spec.js, protections.spec.js), but there are no tests specifically targeting the #5055 regression.
Gap: No automated guard against landing a useSignalEffect-incompatible Preact minor. Recommend closing this PR and merging the skip-ahead instead.
Supply chain
Low risk. Package is the official preactjs/preact npm artifact (MIT), published by known maintainers. Lockfile integrity hash matches registry (sha512-D9NL1GAnJZhc3RndVs4gDdxEeU9TcHgywMrhhOsnpdlvFjdbx0gAsLUnH6JEhlJH5giL7Tx5biWPUSEXE/HPzw==). No suspicious install scripts. Scoped to special-pages only — injected/ is unaffected.
Recommended action
Close this Dependabot PR and merge #2855 (preact → ^10.29.7, skipping 10.29.3–10.29.5) instead. That draft PR already exists and targets the same dependency with the regression avoided.
The reason will be displayed to describe this comment to others. Learn more.
Blocker:10.29.3 includes subtree-effect flushing (#5055), reverted in 10.29.6 due to useSignalEffect incompatibility. This workspace uses useSignalEffect in 10 files across new-tab customizer/burning/protections and history providers. Recommend targeting ^10.29.7 instead — see draft PR #2855.
The reason will be displayed to describe this comment to others. Learn more.
Injected PR Evaluation: Web Compatibility & Security
PR: build(deps): bump preact from 10.29.2 to 10.29.4 Scope:special-pages/package.json + package-lock.json only (dependency bump)
Web Compatibility Assessment
File
Lines
Severity
Finding
special-pages/package.json
46
info
Preact is consumed only by special-pages (embedded first-party UI: NTP, onboarding, duckplayer, etc.). It is not bundled into injected/ and does not run on arbitrary third-party web pages, so typical API-fidelity / prototype-patching concerns for injected code do not apply.
special-pages/package.json
46
warning
10.29.4 reverts the 10.29.3 fix for useId stability across async Suspense (#5135). NTP uses useId extensively (omnibar, favorites, protections, drawers, tooltips) and has one Suspense boundary for lazy-loaded burn animation (ActivityItemAnimationWrapper.js). Mitigating factors: all entry points use render() (no hydrate()), and the Suspense boundary is scoped to the burn-animation lazy import — useId consumers are largely outside that async path. Residual risk is low but non-zero (e.g., unstable aria-* ID refs if a future component combines useId inside an async Suspense subtree).
package-lock.json
—
info
10.29.4 also includes a hydration+Suspense crash fix (#5134). Not directly relevant today because special-pages do not call hydrate().
No changes to browser API overrides, DOM manipulation in injected features, platform entry points, or third-party script interaction surfaces.
Security Assessment
No findings.
No changes to injected/, messaging/, captured-globals.js, message bridge, or native transport code.
No new network requests, postMessage, dynamic code execution, or config-trust surface.
Preact runs in first-party embedded pages with native messaging — outside the hostile third-party page trust model this review targets for injected code.
Risk Level
Low Risk — dependency-only patch bump confined to special-pages; no injected runtime, API shims, or security-boundary changes.
Recommendations
(info) Merge is reasonable from a web-compat/security standpoint for injected code (no injected impact).
(warning) After merge, smoke-test NTP activity burn animation (triggers the lone Suspense + lazy() path) and spot-check omnibar/favorites accessibility (aria-labelledby / aria-describedby tied to useId) on at least one platform.
(info) If a future bump re-introduces the useId/async-Suspense fix, re-validate any component that places useId inside or above async Suspense boundaries.
No additional security hardening required for this diff.
This PR bumps preact in special-pages from ^10.29.2 to ^10.29.4. While the diff is minimal and CI passes, 10.29.4 still includes the subtree-effect flushing change from 10.29.3 (preactjs/preact#5055) that Preact reverted in 10.29.6 due to incompatibility with useSignalEffect. This repo relies heavily on @preact/signals / useSignalEffect across new-tab and history.
An alternative PR (#2855) already exists to bump to ^10.29.7, skipping the affected range.
Changelog impact (10.29.2 → 10.29.4)
Version
Change
Relevance to this repo
10.29.3
Flush subtree effects when rendering pending node (#5055)
High risk — reverted in 10.29.6 for useSignalEffect incompatibility
10.29.3
Fix error recovery for partially rendered subtrees (#5120)
Medium — ErrorBoundary used across all major pages
Preact 10.29.6 release: "We had to revert #5055 due to an incompatibility with useSignalEffect"
This repo uses useSignalEffect in 11 files across new-tab (customizer, burning, protections, background) and history (search, URL reflection, service provider)
@preact/signals@^2.9.2 is a direct dependency alongside preact
Why CI still passes: The subtree-effect flushing change alters effect timing in ways that may not surface in existing Playwright integration tests. This is a runtime correctness risk, not a build/test failure.
Recommended action: Close this PR and merge #2855 (^10.29.7) instead, which retains applicable bugfixes without the reverted change.
Test coverage assessment
Layer
Coverage
Gap
Unit tests
116 tests — mostly pure logic, minimal component rendering
Pass on 10.29.4 locally but won't catch subtle effect-order bugs
Uncertain concern: Error-boundary recovery improvements in 10.29.3 could change behavior in edge cases. Low priority given the useSignalEffect blocker.
Dependency necessity
preact remains required — it is the sole UI framework for all 8 Preact-based special pages (~313 source files). No alternative framework is used elsewhere in this workspace. @preact/signals is deeply integrated and is the reason the 10.29.3–10.29.5 range is problematic.
Supply chain risk
Check
Status
Publisher
preactjs org on npm — established maintainers (developit, marvinhagemeister, jdecroock)
The reason will be displayed to describe this comment to others. Learn more.
Blocker:^10.29.4 includes the subtree-effect flushing change from 10.29.3 (preactjs/preact#5055), which Preact reverted in 10.29.6 because it breaks useSignalEffect.
This repo uses useSignalEffect in 11 files (customizer, burning, protections, history search/URL reflection). Please close this PR in favor of #2855, which bumps to ^10.29.7 and skips the affected range.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dependenciesUpdate one or more dependencies versionpatchIncrement the patch version when merged
0 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
dependabot
Bot
added
dependencies
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Bumps preact from 10.29.2 to 10.29.4.
Release notes
Sourced from preact's releases.
Commits
707884cMerge pull request #5136 from preactjs/10.29.40e6a25310.29.4174d345Merge pull request #5135 from preactjs/fix-preact-suspense8d20635Revert "Fix useId stability across async Suspense (#5108)"893845aMerge pull request #5134 from preactjs/patch-crashing-at-suspense-bailc3b4f0fFix hydration-suspense crash due to sCU bailout65b32cb10.29.3 (#5121)1a3b8b5Fix error recovery for partially rendered subtrees (#5120)67f0290Fix useId stability across async Suspense (#5108)d9e8984Flush subtree effects (#5055)Note
Low Risk
Routine patch dependency bump in special-pages UI code with no app logic or security surface changes in this diff.
Overview
Bumps the preact dependency in
special-pagesfrom 10.29.2 to 10.29.4, with matching updates in the root package-lock.json.This patch release mainly brings renderer fixes (hydration/Suspense crashes, partial subtree error recovery, hydrate recovery with excess DOM children) and performance/memory improvements from 10.29.3, plus 10.29.4 fixes a hydration-Suspense crash and reverts an earlier
useId+ async Suspense change.Reviewed by Cursor Bugbot for commit 2e4bdef. Bugbot is set up for automated code reviews on this repo. Configure here.