build(deps): bump @preact/signals from 2.9.2 to 2.9.3 - #2884
Conversation
Bumps [@preact/signals](https://github.com/preactjs/signals/tree/HEAD/packages/preact) from 2.9.2 to 2.9.3. - [Release notes](https://github.com/preactjs/signals/releases) - [Changelog](https://github.com/preactjs/signals/blob/main/packages/preact/CHANGELOG.md) - [Commits](https://github.com/preactjs/signals/commits/@preact/signals@2.9.3/packages/preact) --- updated-dependencies: - dependency-name: "@preact/signals" dependency-version: 2.9.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Build Branch
Static preview entry points
QR codes (mobile preview)
Integration commandsnpm (Android / Extension): Swift Package Manager (Apple): .package(url: "https://github.com/duckduckgo/content-scope-scripts.git", branch: "pr-releases/dependabot/npm_and_yarn/main/preact/signals-2.9.3")git submodule (Windows): git -C submodules/content-scope-scripts fetch origin pr-releases/dependabot/npm_and_yarn/main/preact/signals-2.9.3
git -C submodules/content-scope-scripts checkout origin/pr-releases/dependabot/npm_and_yarn/main/preact/signals-2.9.3Pin to exact commitnpm (Android / Extension): Swift Package Manager (Apple): .package(url: "https://github.com/duckduckgo/content-scope-scripts.git", revision: "75c2c0b8720f7ef07af50317526e258e00821697")git submodule (Windows): git -C submodules/content-scope-scripts fetch origin pr-releases/dependabot/npm_and_yarn/main/preact/signals-2.9.3
git -C submodules/content-scope-scripts checkout 75c2c0b8720f7ef07af50317526e258e00821697 |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Injected PR Evaluation: Web Compatibility & Security
Scope note: This PR is a dependency-only bump (@preact/signals 2.9.2 → 2.9.3, @preact/signals-core 1.14.3 → 1.14.4) in special-pages/package.json and package-lock.json. It does not modify injected/, messaging/, wrapper utilities, captured globals, or any runtime source files.
Web Compatibility Assessment
| File | Lines | Severity | Finding |
|---|---|---|---|
special-pages/package.json |
42 | info | @preact/signals is consumed only by embedded special-pages (New Tab Page, History). It is not bundled into content-scope injection and does not override browser APIs on third-party pages. |
package-lock.json |
1928–1946 | info | Transitive bump to @preact/signals-core@1.14.4. Release notes include a bug fix that disposes signal prop updaters when a component re-renders with no signal-bound props, preventing stale signal subscriptions from overwriting DOM values. This is a compatibility improvement for NTP/History components that toggle signal vs. plain props (e.g., customizer drawer, widget config, protections). |
package-lock.json |
1928–1946 | info | Also adds readonly-array typing support for <For> — compile-time only; no runtime API surface change. |
No findings in API surface fidelity, prototype chain integrity, DOM safety, timing/race conditions, platform-specific injected breakage, or third-party script compatibility categories — none of that code is touched.
Security Assessment
| File | Lines | Severity | Finding |
|---|---|---|---|
| (entire diff) | — | info | No changes to global capture hygiene, messaging transports, message bridge trust boundaries, origin validation, config gating, or iframe security. |
special-pages/package.json |
42 | info | Signals run inside first-party embedded pages with mocked/native messaging only. A malicious third-party page cannot reach this dependency. |
package-lock.json |
1928–1946 | info | The signal-prop disposal fix reduces risk of stale effect subscriptions writing unexpected values into the DOM after prop transitions — a minor hardening for special-pages UI state. |
No findings at warning, error, or critical severity.
Risk Level
Low Risk — Patch-version dependency bump confined to special-pages; zero changes to injected content-scope features, API overrides, or security-sensitive infrastructure.
Recommendations
- (Info) Merge after CI passes. No injected-specific blockers.
- (Info) Optional smoke-test: NTP customizer open/close and History search/filter flows — heaviest
@preact/signalsconsumers and most likely to benefit from the signal-prop disposal fix. - (Info)
npm run build --workspace=special-pagessucceeds locally with 2.9.3.
Sent by Cursor Automation: Web compat and sec
There was a problem hiding this comment.
Dependency update review: @preact/signals 2.9.2 → 2.9.3
Verdict: Low risk — recommend merging. No follow-up fix PR is needed.
Changelog impact (mapped to this repo)
This bump also pulls in @preact/signals-core@1.14.4. All changes are patch-level bug fixes.
| Change | Relevance here |
|---|---|
| Dispose signal prop updaters when an element re-renders without signal props (#948) | Confirmed relevant. special-pages passes signal/computed objects directly as JSX props in several places — e.g. aria-hidden={hidden}, tabindex={tabIndex}, data-animating={animating} in App.js, and isOpen={isOpen} on drawer controls. This fix prevents stale DOM writes when signal props are replaced by plain values. |
| Fix computeds returning stale values after a batch reverts a signal (#947) | Confirmed relevant. batch() is used in Drawer.js, BurnProvider.js, NormalizeDataProvider.js, and CustomizerDrawerInner.js, alongside widespread useComputed usage. This is a correctness fix for an edge case in batched updates. |
<For> accepts readonly arrays (#950) |
Not used — no For import from @preact/signals in this repo. |
createModel / untracked() / action() effect capture (#945) |
Not used — no createModel, untracked, or signals action usage in special-pages. |
Overall, the fixes align with patterns already present in new-tab and history; this update is more likely to fix latent bugs than introduce regressions.
Test coverage
Indirect but broad coverage:
- 40+ files import from
@preact/signals, concentrated innew-tabandhistory. - Integration suites exercise signal-driven flows:
new-tab.spec.js,history.spec.js,history-selections.spec.js,customizer.spec.js,activity.spec.js,protections.spec.js,favorites.spec.js, etc. - Unit tests: 116 passed (
npm run test-unitinspecial-pages). - Build: passes (
npm run build).
Gap (uncertain, not blocking): There are no dedicated unit tests for signal-as-prop binding or batch() + useComputed revert edge cases. Coverage is integration-level only. If regressions were to appear, they would most likely surface in drawer/customizer/activity integration tests.
Validation run: Signal-heavy integration tests (133 passed). Two customizer theme-variant tests failed once in a larger parallel batch but passed on isolated re-run — likely pre-existing timing flakiness, not attributable to this bump.
Is this dependency still needed?
Yes. @preact/signals is the established reactive-state layer for Preact in special-pages (providers, drawers, history selection, customizer, activity, protections, etc.). No alternative pattern is used elsewhere in this workspace, and replacing it would be a large unrelated refactor.
Supply chain risk
| Check | Result |
|---|---|
| Publisher | Official preactjs/signals monorepo |
| License | MIT |
| Version type | Patch (2.9.2 → 2.9.3) |
npm audit |
No advisories for @preact/signals or @preact/signals-core |
| Lockfile integrity | SHA-512 hashes present for both packages |
| Maintainers | Known Preact contributors (JoviDeCroock, andrewiggins, joeyTedeschi) |
No supply-chain red flags identified.
Follow-up PR
None required. No open PR exists to address signals-related issues, and no code changes are warranted for this update. A separate fix PR was not drafted.
Reviewed by Cursor dependency-update automation.
Sent by Cursor Automation: Review dependabot
1 participant
Bumps @preact/signals from 2.9.2 to 2.9.3.
Release notes
Sourced from @preact/signals's releases.
Changelog
Sourced from @preact/signals's changelog.
Commits
f6437f7Version Packages (#946)76f9155Allow For to accept readonly arrays (#950)6b0a76cfix(preact): dispose prop updaters when an element loses all signal props (#948)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Note
Low Risk
Lockfile-only dependency patch bump with no repo code changes; upstream fixes are localized to Preact signals behavior.
Overview
Bumps
@preact/signalsinspecial-pagesfrom 2.9.2 to 2.9.3, withpackage-lock.jsonupdated accordingly (including@preact/signals-core1.14.3 → 1.14.4).No application source changes—only the dependency range and lockfile. Upstream 2.9.3 is a patch release (e.g.
<For>readonly-array typing, fix for signal prop updaters when props stop using signals).Reviewed by Cursor Bugbot for commit 05ae707. Bugbot is set up for automated code reviews on this repo. Configure here.