You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I have tested this change locally in all supported browsers
This change will be visible to users
I have added automated tests that cover this change
I have ensured the change is gated by config
This change was covered by a ship review
This change was covered by a tech design
Any dependent config has been merged
Note
Low Risk
UI-only NTP changes gated by existing rebrand config; no auth, messaging protocol, or data-handling changes beyond new static assets and CSS.
Overview
Adds NTP rebrand styling for Remote Messaging Framework (RMF) banners when newTabPageRebranding is on (body[data-rebrand="true"]): design-token spacing, shadows, typography, and a restyled dismiss control.
RMF now picks icon assets from ./icons/rebrand/*-96.svg under rebrand vs legacy ./icons/*-96.svg, and only shows the icon block for non-small messages that include an icon.
Bumps @duckduckgo/design-tokens to v0.33.0, imports NTP token CSS in App.module.css, adds a full rebrand icon set, registers PrivacyPro in the RMF schema/types, and updates the PrivacyPro SVG asset.
Reviewed by Cursor Bugbot for commit a51c7eb. Bugbot is set up for automated code reviews on this repo. Configure here.
The reason will be displayed to describe this comment to others. Learn more.
info — message.icon is schema-validated (enum in rmf-message.json), so path interpolation here is safe. 79c321c6f correctly preserves the legacy ./icons/ path when rebrand is off.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Web Compatibility Assessment
File
Lines
Severity
Finding
(scope)
—
info
No injected/ changes. All 15 changed files are in special-pages/pages/new-tab/ — first-party embedded NTP UI, not injected into third-party pages. Injected web-compat categories (API shimming, prototype integrity, cross-frame leakage) do not apply.
special-pages/.../RemoteMessagingFramework.js
22–30
info
RMF icon path correctly switches between ./icons/${icon}-96.svg (legacy) and ./icons/rebrand/${icon}-96.svg based on useNewTabPageRebranding(). showIcon logic unchanged (messageType !== 'small' && message.icon).
Scope note: PR now contains only RMF changes vs main (15 files). Prior warnings about ungated Privacy Stats / Protections / ActivityItem changes are out of scope for this PR (likely split to other rebrand PRs).
Security Assessment
File
Lines
Severity
Finding
(scope)
—
info
No changes to injected/, messaging/, captured-globals.js, message-bridge, or API overrides. No new security surface for hostile third-party pages.
special-pages/.../RemoteMessagingFramework.js
24
info
Icon src built from native-supplied message.icon into static relative paths. RMFIcon is enum-constrained in rmf-message.json; no page-controlled input, no postMessage/nativeData leakage.
special-pages/.../settings.provider.js
42–44
info
Rebrand flag read from native settings (newTabPageRebranding.state === 'enabled'). Remote-disable path exists; no new messaging schemas introduced.
Risk Level
Low Risk — special-pages NTP RMF visual rebrand only (gated CSS + icon asset swap). No injected runtime, browser API overrides, or messaging security-boundary changes.
Recommendations
(info) Ensure native clients ship the newTabPageRebranding setting before enabling rebrand assets in production.
(info) 4/4 RMF integration tests pass locally; consider adding rebrand-on coverage to assert ./icons/rebrand/ paths render when data-rebrand="true".
Re-assessed at 9d486e1b (synchronize). PR scope vs main is now RMF-only (15 files); RMF file content unchanged from prior 0a24b8c01 assessment (rebase). Prior cross-component warnings removed as those files are no longer in this PR.
Replace DuckAi, PIR, and Subscription rebrand SVGs with the final vector assets, and add PrivacyPro-96 so Windows PrivacyShield messages resolve under the shared -96 path.
Co-authored-by: Cursor <cursoragent@cursor.com>
…tokens
Restore the pre-regression Privacy Pro shield (plus) for FF-off paths, bump design-tokens to v0.33.0 with ntp.css, and replace NTP/local aliases in RMF rebrand styles with DS font and dismiss-border tokens.
Co-authored-by: Cursor <cursoragent@cursor.com>
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Injected PR Evaluation: Web Compatibility & Security
Re-assessed at a51c7eb36 (synchronize). Scope: 23 files, special-pages NTP RMF rebrand only — no injected/ changes.
Web Compatibility Assessment
File
Lines
Severity
Finding
(scope)
—
info
No injected/ changes. This PR does not touch browser API overrides, wrapper utilities, captured globals, or message-bridge code — zero third-party web page compatibility surface.
RemoteMessagingFramework.js
22–24
info
Rebrand icon switching is correctly gated via useNewTabPageRebranding(); legacy ./icons/${message.icon}-96.svg path preserved when rebrand is off. Refactor to showIcon/iconSrc is behavior-neutral.
RemoteMessagingFramework.module.css
77–118
info
Rebrand styles scoped under :global(body[data-rebrand="true"]) — remotely rollback-able via native newTabPageRebranding setting. Uses DS NTP tokens (--ds-ntp-dismiss-btn-*).
App.module.css
3
info
New @import of ntp.css from design-tokens v0.33.0 loads NTP token definitions page-wide. Non-rebrand users inherit any token value shifts from the 0.30→0.33 bump; monitor for collateral layout changes outside RMF.
public/icons/
—
info
All 14 RMFIcon enum values have matching assets in both ./icons/ and ./icons/rebrand/. PrivacyPro-96.svg is now distinct from Subscription-96.svg (fixed in a51c7eb36).
integration-tests/
—
warning
RMF screenshot tests (8 variants: 4 message types × light/dark) fail locally — visual diffs from rebrand CSS + design-tokens bump, but no snapshot rebaselines included in this PR. CI screenshot job will fail until baselines are updated.
integration-tests/
—
info
Existing RMF screenshot tests run with default data-rebrand="false"; no coverage for rebrand-on icon path (./icons/rebrand/) or rebrand CSS block.
Security Assessment
File
Lines
Severity
Finding
(scope)
—
info
No changes to messaging transports, message-bridge trust boundary, captured-globals.js, or nativeData handling.
RemoteMessagingFramework.js
24
info
message.icon interpolated into <img src> — safe because value is schema-validated enum (rmf-message.json / RMFIcon type), not page-controlled input. Paths are static relative URLs within the NTP origin.
settings.provider.js
42–44
info
Rebrand feature gated via native-injected settings.newTabPageRebranding.state — supports remote kill-switch without code deploy.
rmf-message.json
145
info
PrivacyPro added to icon enum — expands native-allowed icon set; no security regression (still closed enum).
Risk Level
Low Risk — Special-pages UI-only changes (CSS, SVG assets, icon path toggle) with no injected runtime, API shimming, or messaging security surface.
The reason will be displayed to describe this comment to others. Learn more.
Injected PR Evaluation: Web Compatibility & Security
PR:#2882 — NTP RMF rebrand styles and icons (a51c7eb) Scope: 23 files, all under special-pages/ — zero injected/ changes
Web Compatibility Assessment
File
Lines
Severity
Finding
(entire PR)
—
info
No injected/ changes. This PR does not touch browser API overrides, wrapper-utils, DDGProxy, captured-globals, or content-script injection. Injected-specific compatibility criteria (toString masking, prototype chain integrity, stack-trace exemptions, etc.) do not apply.
Adds @import of @duckduckgo/design-tokensntp.css (tokens bumped v0.30.0 → v0.33.0). Collateral styling changes to other NTP surfaces are possible via shared design-token variables — not third-party site breakage, but worth visual QA beyond RMF.
RemoteMessagingFramework.js
22–24
info
Rebrand icon path (./icons/rebrand/${message.icon}-96.svg) is selected via useNewTabPageRebranding(), gated by native newTabPageRebranding settings. When rebrand is off, legacy paths are unchanged. All 14 RMFIcon enum values have matching assets in both icons/ and icons/rebrand/ (verified locally).
RemoteMessagingFramework.js
24
info
message.icon is interpolated into a relative asset path. The JSON schema enum constrains values to known icon names (no / or ..), so path-traversal into arbitrary files is not a realistic vector. A native-side schema violation would produce a 404 image — UX degradation only within the privileged NTP page.
RemoteMessagingFramework.module.css
77–119
info
Rebrand styles scoped under body[data-rebrand="true"], consistent with existing NTP rebrand pattern (App.module.css, settings.provider.js). No viewport/meta manipulation or global prototype changes.
rmf-message.json / new-tab.ts
145 / 192
info
PrivacyPro added to RMFIcon enum with dedicated legacy + rebrand SVG assets. Latest commit (a51c7eb) restores a distinct legacy PrivacyPro-96.svg (no longer duplicates Subscription-96.svg).
integration-tests/rmf.spec.js
—
info
4/4 RMF integration tests pass. No test covers rebrand-on icon path switching (?rebrand=enabled); optional coverage gap, not a compatibility regression.
No warnings or errors for web compatibility.
Security Assessment
File
Lines
Severity
Finding
(entire PR)
—
info
No changes to messaging transports, message bridge, captured-globals, origin validation, postMessage, or shouldExemptMethod().
RemoteMessagingFramework.js
34–35, 70–71
info
titleText and descriptionText rendered as Preact text children — auto-escaped, no dangerouslySetInnerHTML. Pre-existing pattern, unchanged.
RemoteMessagingFramework.js
24, 30
info
Icon src built from schema-enumerated message.icon into a relative path under ./icons/. No user-controlled URL construction or external fetches.
rmf.service.js
—
info
Unchanged. Outbound notify() calls pass only { id } — no nativeData leakage risk introduced.
RemoteMessagingFramework.js
27
info
id from native used as DOM id attribute — pre-existing; not introduced by this PR.
No warnings, errors, or critical findings for security.
Risk Level
Low Risk — Special-pages-only NTP RMF visual rebrand (CSS, SVG assets, design-token bump). No injected runtime, API shims, messaging security, or captured-globals changes.
Recommendations
(info) Visual QA with ?rebrand=enabled across RMF message variants (medium, big_single_action, big_two_action) to confirm rebrand icons and dismiss-button styling.
(info) Spot-check collateral NTP styling from design-tokens v0.33.0 import in App.module.css (Favorites, omnibar, etc.).
(info, optional) Add a rebrand-on RMF integration or screenshot test (openPage({ rmf: 'medium', additional: { rebrand: 'enabled' } })) to lock in icon path switching.
Assessed at a51c7eb. 4/4 RMF integration tests pass locally.
The reason will be displayed to describe this comment to others. Learn more.
Title line-height mistakenly uses font-size token
Medium Severity
The rebrand .title rule sets line-height to var(--ds-font-body-md-size) — the font-size token — instead of a line-height token. The sibling .description rule correctly uses var(--ds-font-body-md-line-height) for its line-height. This looks like a copy-paste slip that results in a line-height equal to the font-size (ratio of 1), causing cramped or overlapping text if the title wraps to multiple lines.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
semver-minorNew feature — triggers minor version bump
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
github-actions
Bot
added
the
semver-minor
Asana Task/Github Issue: https://app.asana.com/1/137249556945/project/72649045549333/task/1216270925937867?focus=true
Description
Gates RMF rebrand styles behind
newTabPageRebrandingand shows the message icon.Testing Steps
?rebrand=enabledand an RMF message that has an icon → rebrand styles +icons/rebrand/*-96.svgicons/*-96.svgicon→ no icon blockTest all rmf.*:
small,medium,big_single_action,big_two_action,big_two_action_overflow,big_single_action_announce,big_single_action_app_update,big_single_action_critical_update,big_single_action_very_critical_update,big_single_action_pir,big_single_action_radar,big_single_action_radar_check_purple,big_single_action_subscription,big_single_action_preview,big_single_action_youtube_newScreen recording
Screen.Recording.2026-07-20.at.23.41.03.mov
Checklist
Please tick all that apply:
Note
Low Risk
UI-only NTP changes gated by existing rebrand config; no auth, messaging protocol, or data-handling changes beyond new static assets and CSS.
Overview
Adds NTP rebrand styling for Remote Messaging Framework (RMF) banners when
newTabPageRebrandingis on (body[data-rebrand="true"]): design-token spacing, shadows, typography, and a restyled dismiss control.RMF now picks icon assets from
./icons/rebrand/*-96.svgunder rebrand vs legacy./icons/*-96.svg, and only shows the icon block for non-smallmessages that include anicon.Bumps
@duckduckgo/design-tokensto v0.33.0, imports NTP token CSS inApp.module.css, adds a full rebrand icon set, registersPrivacyProin the RMF schema/types, and updates thePrivacyProSVG asset.Reviewed by Cursor Bugbot for commit a51c7eb. Bugbot is set up for automated code reviews on this repo. Configure here.