build(deps): bump preact to 10.29.7 (skip 10.29.3) - #2855
Draft
cursor[bot] wants to merge 3 commits into
Draft
Conversation
Bumps [preact](https://github.com/preactjs/preact) from 10.29.2 to 10.29.3. - [Release notes](https://github.com/preactjs/preact/releases) - [Commits](preactjs/preact@10.29.2...10.29.3) --- updated-dependencies: - dependency-name: preact dependency-version: 10.29.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Skip 10.29.3 because it includes subtree-effect flushing (#5055) that was reverted in 10.29.6 due to incompatibility with useSignalEffect. This repo relies heavily on @preact/signals across new-tab, history, and customizer flows. 10.29.7 includes the retained bugfixes (error recovery, memory leaks, Suspense hydration) without the reverted changes.
Contributor
Build Branch
Static preview entry points
QR codes (mobile preview)
Integration commandsnpm (Android / Extension): Swift Package Manager (Apple): .package(url: "https://github.com/duckduckgo/content-scope-scripts.git", branch: "pr-releases/cursor/dependency-update-risk-review-0214")git submodule (Windows): git -C submodules/content-scope-scripts fetch origin pr-releases/cursor/dependency-update-risk-review-0214
git -C submodules/content-scope-scripts checkout origin/pr-releases/cursor/dependency-update-risk-review-0214Pin to exact commitnpm (Android / Extension): Swift Package Manager (Apple): .package(url: "https://github.com/duckduckgo/content-scope-scripts.git", revision: "b868df04ee0226937fa568d99692d17a8016e99d")git submodule (Windows): git -C submodules/content-scope-scripts fetch origin pr-releases/cursor/dependency-update-risk-review-0214
git -C submodules/content-scope-scripts checkout b868df04ee0226937fa568d99692d17a8016e99d |
Contributor
[Beta] Generated file diffTime updated: Fri, 10 Jul 2026 11:41:24 GMT AndroidFile has changed Apple
File has changed Integration
File has changed Windows
File has changed |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Contributor
Author
There was a problem hiding this comment.
Injected PR Evaluation: Web Compatibility & Security
PR: build(deps): bump preact to 10.29.7 (skip 10.29.3) (71b45d08 → 8cee8f57)
Web Compatibility Assessment
| File | Lines | Severity | Finding |
|---|---|---|---|
special-pages/package.json |
46 | info | Preact ^10.29.2 → ^10.29.7. Preact is a special-pages-only runtime dependency — it is not bundled into injected/ page-world scripts. Zero impact on third-party site API fidelity, prototype patching, or toString() masking. |
package-lock.json |
(lockfile) | info | Resolved preact 10.29.2 → 10.29.7. Numerous transitive lockfile updates (semver, brace-expansion, cacheable, etc.) are all dev: true — build/lint tooling only, not shipped to browsers. |
special-pages/ (usage) |
— | info | All special pages bootstrap via render(), not hydrate(). Upstream hydration/Suspense recovery fixes in 10.29.3–10.29.5 are low relevance for current usage. |
special-pages/ (usage) |
— | info | useId() is used extensively (NTP omnibar, drawers, tooltips, favorites, customizer). Skipping 10.29.3 is prudent: that release added async-Suspense useId stability, which was reverted in 10.29.4 due to regressions. Landing on 10.29.7 avoids the problematic intermediate. |
special-pages/ (usage) |
— | info | @preact/signals with useSignalEffect is heavily used (NTP customizer, history, protections). 10.29.6 reverted subtree-effects flushing (#5055) due to useSignalEffect incompatibility — this target version is the safer choice for current code. |
special-pages/pages/new-tab/app/activity/components/ActivityItemAnimationWrapper.js |
— | info | Uses lazy + Suspense from preact/compat. Client-side only; no SSR hydration path. Low breakage risk. |
No web compatibility errors or warnings for injected page-world code — this PR does not touch it.
Security Assessment
| File | Lines | Severity | Finding |
|---|---|---|---|
| (entire diff) | — | info | No changes to injected/src/, captured-globals.js, wrapper-utils.js, message-bridge.js, messaging transports, or origin/messageSecret validation. |
special-pages/package.json |
46 | info | Preact is not a dependency of the injected content-scope bundle. No global-capture hygiene, messaging trust-boundary, or prototype-attack surface changes. |
package-lock.json |
(lockfile) | info | Transitive dependency churn is dev-tooling only (dev: true). No new runtime network surfaces or postMessage usage. |
No security findings. Special pages run in native-controlled WebView contexts (NTP, history, onboarding, etc.), not arbitrary hostile third-party pages.
Risk Level
Low Risk — dependency-only change confined to special-pages/ with zero injected/ or messaging/ edits; upstream delta is patch-level bugfixes and a reverted experimental change, aligned with existing useId/useSignalEffect/Suspense usage.
Recommendations
- Merge after CI green — no injected compat/security blockers identified.
- Optional smoke QA (special-pages UX, not injected): NTP customizer theme drawer (
useSignalEffect), omnibar/drawer ARIA IDs (useId), activity lazy-load animation (Suspense). - Skipping 10.29.3 is correct — that release's
useIdasync-Suspense fix was reverted in 10.29.4; 10.29.7 includes the subsequent stabilization (10.29.6 subtree-effects revert benefitsuseSignalEffect).
Verified locally: npm run build --workspace=special-pages passes on PR head (8cee8f57).
Sent by Cursor Automation: Web compat and sec
This was referenced Jul 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Asana Task/Github Issue: N/A — dependency review follow-up to Dependabot PR #2854
Description
Bumps
preactfrom^10.29.2to^10.29.7instead of stopping at10.29.3.Preact
10.29.3includes subtree-effect flushing (#5055) that was reverted in10.29.6due to incompatibility withuseSignalEffect. This repo uses@preact/signals/useSignalEffectextensively in new-tab (customizer, burning, protections), history, and related providers.10.29.7retains the applicable bugfixes (error recovery, memory-leak guards, Suspense hydration fixes) without the reverted changes.Testing Steps
npm cinpm run buildnpm run test-unit(special-pages)npm run test-int -- pages/history/integration-tests/history.spec.js pages/new-tab/app/customizer/integration-tests/customizer.spec.js pages/new-tab/integration-tests/new-tab.spec.js pages/onboarding/integration-tests/onboarding.v4.spec.js --reporter listChecklist
Note
Medium Risk
Touches the core Preact runtime used by privileged special pages with heavy
useSignalEffectusage; wrong minor could cause subtle UI bugs, though 10.29.7 is chosen specifically to avoid the known 10.29.3 regression.Overview
Updates special-pages to
preact^10.29.7 (from ^10.29.2) and refreshespackage-lock.jsonfor that workspace, including resolved 10.29.7 and routine transitive version bumps from the install.The intent is to land fixes in the 10.29.x line while avoiding 10.29.3, which shipped subtree-effect flushing that broke
useSignalEffectusage (reverted in 10.29.6). This repo relies on@preact/signals/useSignalEffectacross history, new-tab, and related UI.Reviewed by Cursor Bugbot for commit 8cee8f5. Bugbot is set up for automated code reviews on this repo. Configure here.