build(deps-dev): bump prettier to 3.9.1 with formatting fixes

[cursor]

Asana Task/Github Issue: Companion fix for #2858 (Dependabot prettier bump)

Description

Bumps prettier from 3.8.4 to 3.9.1 and applies the formatting changes required by Prettier 3.9.0's JavaScript/TypeScript output updates.

Without the formatting commit, npm run lint fails because three files are reformatted by 3.9.1 but not updated:

• messaging/lib/shared-types.ts (conditional-type extends parentheses)
• special-pages/pages/new-tab/app/activity/NormalizeDataProvider.js
• special-pages/pages/new-tab/app/components/BackgroundProvider.js

Testing Steps

• npx prettier . --check passes
• Verified npx prettier@3.8.4 . --check passes on main; npx prettier@3.9.1 . --check fails before formatting fixes and passes after

Checklist

• I have tested this change locally
• I have tested this change locally in all supported browsers
• This change will be visible to users
• I have added automated tests that cover this change
• I have ensured the change is gated by config
• This change was covered by a ship review
• This change was covered by a tech design
• Any dependent config has been merged

  

[github-actions]

Build Branch

Branch	pr-releases/cursor/dependency-update-risk-review-407d
Commit	abb8e848ef
Updated	July 20, 2026 at 11:13:53 AM UTC

Static preview entry points

• Docs: docs/index.html
• Static pages: build/integration/pages/index.html
• Integration pages: injected/integration-test/test-pages/index.html

QR codes (mobile preview)

Entry point	QR code
Docs
Static pages
Integration pages

Integration commands

npm (Android / Extension):

npm i github:duckduckgo/content-scope-scripts#pr-releases/cursor/dependency-update-risk-review-407d

Swift Package Manager (Apple):

.package(url: "https://github.com/duckduckgo/content-scope-scripts.git", branch: "pr-releases/cursor/dependency-update-risk-review-407d")

git submodule (Windows):

git -C submodules/content-scope-scripts fetch origin pr-releases/cursor/dependency-update-risk-review-407d
git -C submodules/content-scope-scripts checkout origin/pr-releases/cursor/dependency-update-risk-review-407d

Pin to exact commit

npm (Android / Extension):

npm i github:duckduckgo/content-scope-scripts#abb8e848efb1562ddd9d3099133c25c5443ccb18

Swift Package Manager (Apple):

.package(url: "https://github.com/duckduckgo/content-scope-scripts.git", revision: "abb8e848efb1562ddd9d3099133c25c5443ccb18")

git submodule (Windows):

git -C submodules/content-scope-scripts fetch origin pr-releases/cursor/dependency-update-risk-review-407d
git -C submodules/content-scope-scripts checkout abb8e848efb1562ddd9d3099133c25c5443ccb18

[github-actions]

[Beta] Generated file diff

Time updated: Mon, 20 Jul 2026 11:13:58 GMT

[cursor]

Stale comment

Injected PR Evaluation: Web Compatibility & Security

PR: build(deps-dev): bump prettier to 3.9.1 with formatting fixes (012a337)

---

Web Compatibility Assessment

No findings.

This PR touches no injected/ code and makes no browser API overrides, DOM manipulation, or runtime behavioral changes. The only source edits outside lockfiles are Prettier-driven formatting:

• special-pages/pages/new-tab/app/activity/NormalizeDataProvider.js (line ~240): adds a trailing semicolon after a ternary expression — semantically identical.
• special-pages/pages/new-tab/app/components/BackgroundProvider.js (line ~186): same pattern.
• special-pages/pages/new-tab/types/new-tab.ts (line ~11): collapses a multi-line union type to one line — type-only, no runtime effect.

Special-pages run in embedded first-party UI (New Tab Page), not in arbitrary third-party page contexts, so these cosmetic edits carry no web-compat surface risk.

---

Security Assessment

No findings.

• Prettier 3.9.1 is a devDependency; it runs only in lint/lint-fix and does not ship to end-user browsers.
• messaging/lib/shared-types.ts (lines 16, 22, 29): parentheses added around conditional-type generic constraints — compile-time TypeScript only; this file is referenced via JSDoc imports and emits no runtime code. No messaging transport, origin validation, or trust-boundary logic is modified.
• No changes to captured-globals.js, message bridge, shouldExemptMethod(), or any security-sensitive paths.

---

Risk Level

Low Risk — dev-tooling version bump with Prettier formatting fallout; zero injected-runtime or messaging-transport changes.

---

Recommendations

None required. Safe to merge from a web-compat and security perspective.

  

_{Sent by Cursor Automation: Web compat and sec}

[jonathanKingston]

@claude please review

[cursor]

Stale comment

Web Compatibility Assessment

No findings.

This PR touches only dev tooling (package.json, package-lock.json) and cosmetic formatting in messaging/lib/shared-types.ts and special-pages/. No files under injected/ are modified. The formatting changes (trailing semicolons after ternaries, union-type layout, parentheses around conditional-type generic constraints) are syntactically equivalent and do not alter runtime behavior on any platform.

---

Security Assessment

No findings.

Prettier is a build-time formatter used in lint/lint-fix scripts and does not ship to end-user browsers. The messaging/lib/shared-types.ts edits affect compile-time TypeScript interfaces only — no messaging transport, bridge security, or nativeData handling changes.

---

Risk Level

Low Risk — devDependency bump (3.8.4 → 3.9.4) plus Prettier-driven formatting fallout; no injected runtime code, API overrides, or security-sensitive path changes.

---

Recommendations

1. Info: Latest commit (ec63f6f8b) bumps Prettier from 3.9.1 to 3.9.4 to align with Dependabot #2863. Assessment unchanged — still dev-only, no runtime impact.
2. Info: After merge, consider closing or rebasing #2858 (3.9.1-only bump) and #2863 (3.9.4 bump) to avoid duplicate dependency-update PRs.
3. Info: npx prettier . --check passing with 3.9.4 (per commit message) is sufficient validation for this PR.

---

Automated injected PR evaluation — web compatibility & security specialist

  

_{Sent by Cursor Automation: Web compat and sec}

[cursor]

Web Compatibility Assessment

No findings. This PR touches no injected/ code and makes no runtime behavioral changes.

File	Severity	Notes
package.json / package-lock.json	info	Prettier 3.8.4 → 3.9.4 devDependency bump. Prettier runs only in lint/lint-fix CI scripts; it does not ship to end-user browsers.
messaging/lib/shared-types.ts	info	Prettier adds parentheses around conditional-type generic constraints (e.g. Method extends (T['notifications'] extends … ? … : never)). Compile-time TypeScript only; zero runtime effect on messaging transports or protocol.
special-pages/pages/new-tab/app/activity/NormalizeDataProvider.js	info	Trailing semicolon after ternary (: all;). Semantically identical to prior expression; no logic change.
special-pages/pages/new-tab/app/components/BackgroundProvider.js	info	Trailing semicolon after ternary (: states.loading;). Semantically identical; no logic change.
special-pages/pages/new-tab/types/new-tab.ts	info	Union type collapsed to single line by Prettier. Generated type layout only; no runtime impact.

Special-pages run in embedded first-party contexts (NTP), not injected into arbitrary third-party pages. No API overrides, prototype mutations, DOM manipulation patterns, or platform entry-point changes.

Security Assessment

No findings.

File	Severity	Notes
All changed files	info	No changes to captured-globals.js, message-bridge trust boundaries, origin validation, nativeData handling, postMessage usage, or config-gating logic. No new network requests, dynamic code execution, or data-exfiltration vectors introduced.

Risk Level

Low Risk — devDependency version bump with Prettier-driven formatting fallout only; no injected runtime code, API shims, or security-sensitive path changes.

Recommendations

No action required for web compatibility or security. Optional housekeeping:

1. info — Consider consolidating with #2863 (standalone Prettier 3.9.4 bump) to avoid duplicate dependency PRs, since this PR now targets the same version.
2. info — Run npx prettier . --check in CI (already noted in commit message) to confirm the repo is fully formatted under 3.9.4.

---

Automated assessment (synchronize 239754bd). Assessment unchanged from prior run — final 3.9.4 alignment commit only.

  

_{Sent by Cursor Automation: Web compat and sec}