build(deps-dev): bump prettier from 3.8.4 to 3.9.1

[dependabot]

Bumps prettier from 3.8.4 to 3.9.1.

Release notes

Sourced from prettier's releases.

3.9.1

• CLI: Fix ignored file has been cached incorrectly (#19483 by @​kovsu)

🔗 Changelog

3.9.0

diff

🔗 Prettier 3.9: Major parser upgrades and Formatting improvements

3.8.5

• Fix Flow variance annotation print (#19022 by @​marcoww6)

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.1

diff

CLI: Fix ignored file has been cached incorrectly (#19483 by @​kovsu)

Bug details prettier/prettier#18016

3.9.0

diff

🔗 Release Notes

3.8.5

diff

Flow: Support readonly as a variance annotation (#19022 by @​marcoww6)

Flow now accepts readonly as a property variance annotation, equivalent to + (covariant/read-only).

// Input
type T = {
  readonly foo: string,
};
// Prettier 3.8.4
SyntaxError
// Prettier 3.8.5
type T = {
readonly foo: string,
};

Commits

• c47654c Release 3.9.1
• 06159aa Fix bug in release script
• 4bc5ab4 Update file-entry-cache to 11.1.5 (#19483)
• b7fd58b Release @prettier/plugin-oxc@0.2.0 and @prettier/plugin-hermes@0.2.0
• 3006400 Revert changes in release script
• 7bef7db Git blame ignore 3.9.0
• bb817b1 Bump Prettier dependency to 3.9.0
• 05cf896 Clean changelog_unreleased
• 79f6cdf Disable finished steps
• 3613b1e Add blog post for v3.9 (#19414)
• Additional commits viewable in compare view

---

Note

Low Risk
Dev-only tooling bump with no production code changes; main review surface is possible formatting diffs if CI re-runs Prettier.

Overview
Bumps the devDependency prettier from 3.8.4 to 3.9.1 in the root package.json, with the matching lockfile entry in package-lock.json.

Formatting behavior for npm run lint / lint-fix, CI auto-format, and hooks still goes through the same Prettier CLI; only the installed formatter version changes (including upstream fixes such as CLI ignore-cache behavior in 3.9.1 and broader 3.9.x parser/formatting updates). No application or runtime dependency changes.

^{Reviewed by Cursor Bugbot for commit 221531d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Stale comment

Injected PR Evaluation: Web Compatibility & Security

PR: build(deps-dev): bump prettier from 3.8.4 to 3.9.1
Scope: package.json, package-lock.json only (5 lines changed)

---

Web Compatibility Assessment

No findings.

This PR updates Prettier from 3.8.4 to 3.9.1 in root devDependencies only. There are no changes to injected/, messaging/, platform entry points, wrapper utilities, feature code, or any runtime bundle. Prettier is invoked exclusively via CI/local lint scripts (npx prettier . --check / --write in lint and lint-fix) and does not ship to end-user browsers.

None of the web compatibility evaluation categories apply:

• No API surface overrides or shims
• No prototype chain modifications
• No DOM interaction changes
• No timing/lifecycle changes in injected features
• No platform-specific runtime behavior changes
• No third-party script interaction surface changes

---

Security Assessment

No findings.

Prettier is a build-time formatting tool. It is not bundled into content-scope scripts, not executed in page context, and does not affect:

• Global capture hygiene
• Messaging trust boundaries
• Prototype/scope attack surface
• Data exfiltration vectors
• Remote configuration trust
• Iframe security

The version bump does not introduce new runtime dependencies or alter the shipped JavaScript surface.

---

Risk Level

Low Risk — devDependency-only version bump with no changes to injected runtime code, messaging, or browser-facing bundles.

---

Recommendations

1. (Info) Verify CI passes — npm run lint (which includes npx prettier . --check) should confirm the new Prettier version is compatible with existing formatting rules. No injected-specific testing is required.
2. (Info) Safe to merge once CI is green. No rollback mechanism via remote config is needed since this does not affect shipped browser code.

  

_{Sent by Cursor Automation: Web compat and sec}

[github-actions]

Build Branch

Branch	pr-releases/dependabot/npm_and_yarn/main/prettier-3.9.1
Commit	65658cb4b0
Updated	July 13, 2026 at 11:18:09 AM UTC

Static preview entry points

• Docs: docs/index.html
• Static pages: build/integration/pages/index.html
• Integration pages: injected/integration-test/test-pages/index.html

QR codes (mobile preview)

Entry point	QR code
Docs
Static pages
Integration pages

Integration commands

npm (Android / Extension):

npm i github:duckduckgo/content-scope-scripts#pr-releases/dependabot/npm_and_yarn/main/prettier-3.9.1

Swift Package Manager (Apple):

.package(url: "https://github.com/duckduckgo/content-scope-scripts.git", branch: "pr-releases/dependabot/npm_and_yarn/main/prettier-3.9.1")

git submodule (Windows):

git -C submodules/content-scope-scripts fetch origin pr-releases/dependabot/npm_and_yarn/main/prettier-3.9.1
git -C submodules/content-scope-scripts checkout origin/pr-releases/dependabot/npm_and_yarn/main/prettier-3.9.1

Pin to exact commit

npm (Android / Extension):

npm i github:duckduckgo/content-scope-scripts#65658cb4b0e26fbb5ea7c420954c78ba0c029b06

Swift Package Manager (Apple):

.package(url: "https://github.com/duckduckgo/content-scope-scripts.git", revision: "65658cb4b0e26fbb5ea7c420954c78ba0c029b06")

git submodule (Windows):

git -C submodules/content-scope-scripts fetch origin pr-releases/dependabot/npm_and_yarn/main/prettier-3.9.1
git -C submodules/content-scope-scripts checkout 65658cb4b0e26fbb5ea7c420954c78ba0c029b06

[cursor]

Stale comment

Dependency update risk review: prettier 3.8.4 → 3.9.1

Verdict: Approve with required follow-up — merge is safe after formatting fixes land

---

Confirmed issue: CI lint will fail without companion formatting changes

Validated locally:

• npx prettier@3.8.4 . --check → passes on current main
• npx prettier@3.9.1 . --check → fails on 3 files

npm run lint includes npx prettier . --check, so merging this PR alone will break CI.

Affected files and 3.9.0 changelog drivers:

File	Change	Changelog area
messaging/lib/shared-types.ts	Adds parentheses around conditional types in extends clauses	TypeScript formatting improvements (3.9.0)
special-pages/pages/new-tab/app/activity/NormalizeDataProvider.js	Adds trailing ; on ternary branch	JavaScript comment/semicolon stabilization (3.9.0)
special-pages/pages/new-tab/app/components/BackgroundProvider.js	Adds trailing ; on ternary branch	JavaScript comment/semicolon stabilization (3.9.0)

These are output-only formatting changes — no runtime behavior impact.

Fix PR opened: A companion PR on cursor/dependency-update-risk-review-407d includes this bump plus prettier --write on the three files. Recommend merging that instead of (or immediately after) this Dependabot PR.

---

Supply chain risk: Low

• Package: official prettier/prettier on npm
• License: MIT
• Version is exact-pinned ("prettier": "3.9.1") — matches Prettier's own recommendation
• Lockfile integrity hash updated in package-lock.json
• No new transitive dependencies introduced by this bump

---

Dependency necessity: Still required

Prettier is actively used:

• npm run lint / npm run lint-fix at repo root
• .github/workflows/bot-format.yml auto-formats cursor bot branches
• Documented in CODING_STYLE.md; eslint-config-prettier disables conflicting ESLint rules

No better alternative in-repo — this is the standard formatter.

---

Test coverage: Adequate via lint gate

There are no dedicated Prettier unit tests (expected for a formatter). Coverage comes from:

• npx prettier . --check in npm run lint (CI)
• .prettierignore limits scope to JS/TS (most .md, .json, .css, .html ignored)

Note: 3.9.0 includes major Markdown/YAML/Flow/GraphQL parser upgrades, but those file types are largely excluded by .prettierignore, so impact on this repo is minimal.

---

Uncertain / low-priority notes

1. Newer patches available: 3.9.5 exists with additional bugfixes (e.g. Markdown/HTML edge cases). Not blocking — 3.9.1 is fine; consider a follow-up patch bump.
2. Dropped import ... assert syntax: Prettier 3.9.0 removed support for deprecated import assertions. Grep found no usage in this repo — no risk.
3. // prettier-ignore on two JS files: The ignore directives remain, but 3.9.1 still reformats semicolons on the ternary branches. Cosmetic only; the companion fix PR resolves this.

---

Recommendation

Close or hold this Dependabot PR and merge the companion fix PR that bundles the version bump with formatting updates. Alternatively, run npx prettier . --write on this branch before merge.

  

_{Sent by Cursor Automation: Review dependabot}

[cursor]

Injected PR Evaluation: Web Compatibility & Security

PR: build(deps-dev): bump prettier from 3.8.4 to 3.9.1 (#2858)
Trigger: synchronize — re-assessed at 221531d

---

Web Compatibility Assessment

No findings.

This PR changes only package.json and package-lock.json, bumping prettier from 3.8.4 to 3.9.1 in devDependencies. No files under injected/, messaging/, special-pages/, or platform entry points are modified. Prettier is invoked only via lint / lint-fix scripts (npx prettier . --check / --write) and does not ship in any browser bundle. There is no impact on API surface fidelity, prototype chains, DOM interaction, timing, platform behavior, or third-party script compatibility.

---

Security Assessment

No findings.

Prettier is build-time formatting tooling only. It does not run in page context, does not touch captured-globals.js, messaging transports, the message bridge, remote config, or any trust boundary evaluated in the injected security model.

---

Risk Level

Low Risk — devDependency version bump with no runtime or injected-code changes.

---

Recommendations

1. Info: Merge after CI passes. No injected-specific testing required.
2. Info (optional): If lint fails due to formatting deltas from Prettier 3.9.x, run npm run lint-fix in a follow-up commit — this would be a developer-workflow change only, not a web-compat or security concern.

  

_{Sent by Cursor Automation: Web compat and sec}

[cursor]

Dependency update review: prettier 3.8.4 → 3.9.1

Summary

This is a semver-minor devDependency bump with a small, confirmed CI impact. The version pin and lockfile integrity look correct, and supply-chain risk is low. Do not merge as-is — companion PR #2859 (now updated) includes the required formatting/regeneration follow-ups.

---

Confirmed issues

1. npm run lint fails after the bump (blocks unit CI)

Verified locally and in CI run 29245727677:

• npx prettier@3.8.4 . --check passes on main
• npx prettier@3.9.1 . --check fails on 3 source files:
  • messaging/lib/shared-types.ts
  • special-pages/pages/new-tab/app/activity/NormalizeDataProvider.js
  • special-pages/pages/new-tab/app/components/BackgroundProvider.js

Cause (changelog-backed): Prettier 3.9.0 changes TypeScript conditional-type extends parentheses and several JS formatting rules (ternary/semicolon handling, comment placement). This repo uses default semicolons (semi: true implicit) and formats JS/TS via npm run lint.

2. test-clean-tree / snapshots CI fails (generated types drift)

CI run 29245727619 shows special-pages/pages/new-tab/types/new-tab.ts changes after npm run build.

Cause: json-schema-to-typescript@15.0.4 (used by types-generator) depends on workspace prettier to format generated types. Prettier 3.9.0 collapses some union types onto one line, so regenerated output no longer matches committed files.

Fix: Regenerate and commit the updated new-tab.ts (included in the latest commit on #2859).

---

Changelog impact for this repo (lower risk areas)

Prettier 3.9.0 includes major parser upgrades (Markdown/micromark, YAML v2, Flow oxidized parser, GraphQL.js v17, Angular). Most are low impact here because .prettierignore excludes **/*.md, **/*.json, **/*.html, **/*.css, and generated special-pages/pages/**/types from npx prettier . --check. The repo also has no Flow/GraphQL sources.

Relevant JS/TS changes for this codebase:

• Conditional-type extends wrapping (hits messaging/lib/shared-types.ts)
• Ternary/semicolon stabilization (hits the two NTP files, including blocks marked // prettier-ignore — the ignore still preserves layout but 3.9 adjusts trailing semicolons)
• Dropping deprecated import ... assert { } syntax — not used in this repo

3.9.1 is a patch fixing CLI cache behavior for ignored files (#19483); beneficial but not the source of formatting diffs.

---

Test coverage

• No dedicated Prettier unit tests (expected for a formatter devDependency).
• Coverage is CI-based: npm run lint runs npx prettier . --check (.github/workflows/tests.yml).
• Functional/runtime tests are unaffected — changes are formatting-only.

---

Is Prettier still needed?

Yes. It is the project's standard formatter (CODING_STYLE.md, npm run lint-fix, bot-format workflow). eslint-config-prettier is already integrated. No better alternative is used elsewhere in the monorepo.

---

Supply chain risk

Check	Assessment
Package source	Official prettier on registry.npmjs.org
Version pinning	Exact pin "prettier": "3.9.1" (matches Prettier's own recommendation)
Lockfile integrity	sha512-ppiDo2CSwexck1eyZUwJHg/N3nf1+6IRCv7W/VJ5vaLnVCmB7+3CdRfMwoCHBBX6xTrREDTksZ4OZl5SSf4zXA==
Runtime exposure	devDependency only — not shipped to end users
Maintainer trust	Established OSS project (Prettier team)

Low supply-chain concern for this bump.

---

Uncertain / follow-up (non-blocking)

• Patch level: npm latest is 3.9.5 while this PR targets 3.9.1. Consider whether Dependabot should pick up 3.9.5 for additional patch fixes (needs separate validation).
• Skipped 3.8.5: Jump goes 3.8.4 → 3.9.1; 3.8.5 only added Flow readonly variance support — irrelevant here.
• prettier-ignore semantics: The two NTP ternaries still pick up a trailing-semicolon change under 3.9 despite // prettier-ignore. Worth a quick maintainer glance, but behavior is unchanged.

---

Recommended merge path

1. Merge #2859 (companion PR with formatting + regenerated types) instead of this Dependabot-only PR, or
2. Cherry-pick/apply #2859's commits onto this branch before merge.

I pushed an additional commit to #2859 (012a33741) to fix the missing new-tab.ts regeneration that was still failing snapshots / test-clean-tree.

  

_{Sent by Cursor Automation: Review dependabot}

[cursor]

Confirmed CI blocker: bumping only this line causes npx prettier . --check to fail on 3 files and npm run build to drift special-pages/pages/new-tab/types/new-tab.ts (via json-schema-to-typescript → Prettier). See companion PR #2859 for the required follow-up commits.

[dependabot]

Superseded by #2863.