build(deps): bump preact from 10.29.2 to 10.29.5

[dependabot]

Bumps preact from 10.29.2 to 10.29.5.

Release notes

Sourced from preact's releases.

10.29.5

Fixes

• Compat Suspense hydration children recovery (#5144, thanks @​JoviDeCroock)

10.29.4

Fixes

• Fix hydration-suspense crashing due to sCU bail (#5134, thanks @​JoviDeCroock)
• Revert "Fix useId stability across async Suspense (#5108)" (#5135, thanks @​JoviDeCroock)

10.29.3

Fixes

• Fix error recovery for partially rendered subtrees (#5120, thanks @​JoviDeCroock)
• Fix useId stability across async Suspense (#5108, thanks @​JoviDeCroock)
• Flush subtree effects when rendering a pending node (#5055, thanks @​JoviDeCroock)
• Fix hydrate recovery with null excess DOM children (#5112, thanks @​JoviDeCroock)

Performance

• Address and guard memory leak hotspots (#5116, thanks @​JoviDeCroock)
• Avoid redundant allocations and writes (#5115, thanks @​JoviDeCroock)

Types

• Accept Signalish for input DOM-type (#5096, thanks @​JoviDeCroock)

Maintenance

• Use npm staged publishing (#5101, thanks @​JoviDeCroock)
• Add tier 3 sponsor logos (#5098, thanks @​JoviDeCroock)

Commits

• 9110881 Merge pull request #5145 from preactjs/10.29.5
• dc81cf3 10.29.5
• 8394c04 Merge pull request #5144 from preactjs/fix-compat-suspense-hydration-children
• ebcac86 Fix compat Suspense hydration children recovery
• 707884c Merge pull request #5136 from preactjs/10.29.4
• 0e6a253 10.29.4
• 174d345 Merge pull request #5135 from preactjs/fix-preact-suspense
• 8d20635 Revert "Fix useId stability across async Suspense (#5108)"
• 893845a Merge pull request #5134 from preactjs/patch-crashing-at-suspense-bail
• c3b4f0f Fix hydration-suspense crash due to sCU bailout
• Additional commits viewable in compare view

---

Note

Low Risk
Dependency-only patch bump with no repository code changes; typical low risk, though Preact runtime changes could affect Suspense/hydration paths in special pages.

Overview
Bumps the preact dependency for special-pages from 10.29.2 to 10.29.5, with the lockfile updated to match.

This is a patch-level framework upgrade (no app source changes). Upstream fixes in 10.29.3–10.29.5 focus on Suspense/hydration edge cases, partial subtree error recovery, and related compat behavior, plus minor performance and typing tweaks.

^{Reviewed by Cursor Bugbot for commit 18145f4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Build Branch

Branch	pr-releases/dependabot/npm_and_yarn/main/preact-10.29.5
Commit	d67b7b150d
Updated	July 21, 2026 at 11:39:52 AM UTC

Static preview entry points

• Docs: docs/index.html
• Static pages: build/integration/pages/index.html
• Integration pages: injected/integration-test/test-pages/index.html

QR codes (mobile preview)

Entry point	QR code
Docs
Static pages
Integration pages

Integration commands

npm (Android / Extension):

npm i github:duckduckgo/content-scope-scripts#pr-releases/dependabot/npm_and_yarn/main/preact-10.29.5

Swift Package Manager (Apple):

.package(url: "https://github.com/duckduckgo/content-scope-scripts.git", branch: "pr-releases/dependabot/npm_and_yarn/main/preact-10.29.5")

git submodule (Windows):

git -C submodules/content-scope-scripts fetch origin pr-releases/dependabot/npm_and_yarn/main/preact-10.29.5
git -C submodules/content-scope-scripts checkout origin/pr-releases/dependabot/npm_and_yarn/main/preact-10.29.5

Pin to exact commit

npm (Android / Extension):

npm i github:duckduckgo/content-scope-scripts#d67b7b150d6a52da289690876e4540e6f5f38305

Swift Package Manager (Apple):

.package(url: "https://github.com/duckduckgo/content-scope-scripts.git", revision: "d67b7b150d6a52da289690876e4540e6f5f38305")

git submodule (Windows):

git -C submodules/content-scope-scripts fetch origin pr-releases/dependabot/npm_and_yarn/main/preact-10.29.5
git -C submodules/content-scope-scripts checkout d67b7b150d6a52da289690876e4540e6f5f38305

[cursor]

Stale comment

Injected PR Evaluation: Web Compatibility & Security

PR: build(deps): bump preact from 10.29.2 to 10.29.5
Scope: Dependency-only bump in special-pages/package.json + package-lock.json (2 files, 5 insertions / 5 deletions). No runtime source changes.

---

Web Compatibility Assessment

File	Lines	Severity	Finding
special-pages/package.json	46	info	Preact is consumed exclusively by special-pages (embedded first-party UI: NTP, history, onboarding, duckplayer, etc.). It is not bundled into injected/ and does not run on arbitrary third-party web pages, so API-surface-fidelity concerns (toString masking, prototype chain, DDGProxy, etc.) do not apply to this diff.
—	—	info	Preact 10.29.5 (2026-07-07) contains a single upstream fix: compat Suspense hydration children recovery (#5144). This also picks up 10.29.3–10.29.4 fixes (hydration-suspense crash #5134; useId stability revert across async Suspense #5135).
special-pages/pages/new-tab/app/activity/components/ActivityItemAnimationWrapper.js	71–73	info	The only Suspense boundary in special-pages (lazy burn animation). All entry points use render() from preact, not hydrate() — the hydration-specific fixes are unlikely to affect current behavior but are harmless.
NTP components (multiple)	—	warning	NTP uses useId() extensively for a11y (aria-labelledby, tooltip IDs, drawer IDs). The 10.29.4 revert of useId stability across async Suspense could theoretically cause duplicate IDs if a useId() call sits inside an async Suspense child. Current Suspense usage does not wrap useId() consumers, so residual risk is low. Recommend smoke-testing burn animation + omnibar/drawer a11y on merge.

No findings for: API surface fidelity, prototype chain integrity, DOM interaction safety, timing/race conditions in injected features, platform-specific injected breakage, or third-party script compatibility — none of that code changed.

---

Security Assessment

File	Lines	Severity	Finding
—	—	info	No changes to injected/, captured-globals.js, wrapper-utils.js, messaging transports, message-bridge trust boundaries, or origin validation.
—	—	info	No new postMessage, eval/Function, dynamic code execution, CSS injection, or nativeData forwarding paths introduced.
—	—	info	Special-pages run in a first-party embedded context with schema-validated native messaging; this dependency bump does not alter those schemas or validation.

No security findings.

---

Risk Level

Low Risk — Dependency version bump confined to special-pages with no injected runtime, messaging, or API-override changes.

---

Recommendations

1. Merge after CI green — no code changes required for web-compat or security.
2. Smoke-test (optional, low priority): NTP activity burn animation (Suspense + lazy) and a11y IDs on omnibar popovers/drawers after deploy.
3. Build verified locally: npm run build --workspace=special-pages succeeds with 10.29.5.

  

_{Sent by Cursor Automation: Web compat and sec}

[cursor]

Stale comment

Dependency update review: preact 10.29.2 → 10.29.5

Verdict: Do not merge as-is. This patch range includes a Preact change that upstream reverted one release later due to incompatibility with @preact/signals / useSignalEffect, which this repo uses extensively. Prefer closing this PR in favor of #2855, which bumps to 10.29.7.

---

Scope of change

• Only special-pages/package.json and package-lock.json change.
• preact is the sole consumer in this monorepo (injected/ and messaging/ do not depend on it).
• Preact powers all embedded special pages (new-tab, history, duckplayer, onboarding, etc.) via preact, preact/hooks, and preact/compat (memo, lazy, Suspense, createPortal).

---

Changelog impact (10.29.2 → 10.29.5)

Version	Notable changes	Relevance to this repo
10.29.3	Flush subtree effects (#5055); error recovery; memory-leak guards; hydrate recovery; useId async Suspense fix (later reverted)	High risk — see below
10.29.4	Hydration+Suspense crash fix; reverts useId async Suspense fix	Low–medium — no hydrate() usage; useId used in ~15 components
10.29.5	Compat Suspense hydration children recovery (#5144)	Low — only one Suspense usage (ActivityItemAnimationWrapper), client-side render() only

---

Confirmed concern: useSignalEffect incompatibility in 10.29.3–10.29.5

Preact 10.29.3 shipped "Flush subtree effects" (#5055), which changes when useEffect callbacks run relative to re-renders. Preact 10.29.6 reverted that change explicitly:

"We had to revert #5055 due to an incompatibility with useSignalEffect" — 10.29.6 release notes

Because 10.29.5 still includes #5055, merging this PR would land the reverted behavior.

This repo uses useSignalEffect in 10 files across critical UI paths:

• new-tab: CustomizerProvider, BackgroundProvider, BurnProvider, ProtectionsProvider, themes.js
• history: HistoryServiceProvider, SearchForm, useURLReflection, useSearchCommit, useResetSelectionsOnQueryChange

Potential symptoms (timing-dependent, may not surface in CI): stale UI state, missed signal→DOM sync, or incorrect URL/search/selection behavior under rapid updates.

---

Test coverage assessment

What was validated locally on this branch:

• npm run build — pass
• npm run test-unit (special-pages) — 116/116 pass
• Targeted integration tests (114 pass, 1 skipped):
  • history.spec.js, customizer.spec.js, new-tab.spec.js, activity.spec.js

Gaps:

• No unit or integration tests specifically exercise useSignalEffect timing edge cases (re-render before useEffect flush).
• Passing CI does not disprove the upstream-reported useSignalEffect regression; the failure mode is subtle and race-dependent.
• useId is used in accessibility wiring (tooltips, drawers, favorites) but async-Suspense useId stability was reverted in 10.29.4 — low risk here since there is no SSR/hydration and no async Suspense.

---

Dependency still needed?

Yes. Preact is the foundational UI framework for all special-pages/ apps. There is no viable in-repo alternative, and usage patterns (@preact/signals, preact/compat) are consistent and appropriate.

---

Supply chain risk

Low.

• Dependabot-authored bump from the official preactjs/preact package (MIT, ~39k GitHub stars).
• Lockfile integrity hash updated for preact-10.29.5.tgz.
• No new transitive dependencies introduced.
• Preact adopted npm staged publishing in 10.29.3 (#5101) — a supply-chain hardening, not a concern.

---

Recommendation

1. Close this PR (or update it) to target preact@^10.29.7 instead of 10.29.5.
2. Use #2855 — an existing open PR that already bumps to 10.29.7 for exactly this reason. No additional fix PR is needed from this review.
3. If 10.29.7 is merged, consider also merging the companion Dependabot PR for @preact/signals (#2884).

---

Uncertain / lower-priority notes

• Positive fixes in this range (error recovery, memory leaks, Suspense hydration) are desirable and are retained in 10.29.7.
• useId stability across async Suspense was attempted in 10.29.3 and reverted in 10.29.4; unlikely to affect this codebase given client-only render() and no async Suspense boundaries.

  

_{Sent by Cursor Automation: Review dependabot}

[cursor]

Blocker: ^10.29.5 includes the subtree-effect flushing change from 10.29.3 (#5055), which Preact reverted in 10.29.6 due to useSignalEffect incompatibility.

This repo uses useSignalEffect in 10 files (customizer, burning, protections, history search/URL sync). Please target ^10.29.7 instead — see #2855.

[cursor]

Web Compatibility Assessment

File	Lines	Severity	Finding
special-pages/package.json	46	info	Dependency-only bump: preact ^10.29.2 → ^10.29.5. No runtime source changes.
package-lock.json	8480–8483	info	Lockfile resolves preact@10.29.5. No other transitive dependency changes.
(scope)	—	info	Preact is consumed only by special-pages/ (embedded first-party UI: NTP, History, Onboarding, etc.). Not bundled into injected/ content-scope scripts that run on arbitrary third-party pages. No API surface fidelity, prototype chain, DOM timing, or third-party script compatibility concerns apply.
special-pages/pages/*/src/index.js	—	info	All page entry points use render() (client-side mount), not hydrate(). The 10.29.5 fix for Compat Suspense hydration children recovery (#5144) is therefore not exercised in current usage.
special-pages/pages/new-tab/app/activity/components/ActivityItemAnimationWrapper.js	71–73	info	Single Suspense boundary (lazy-loaded burn animation). 10.29.5 improves Suspense hydration recovery; 10.29.4 reverted useId stability across async Suspense (#5135). Residual low risk for a11y IDs if useId is called inside async Suspense children.
special-pages/pages/new-tab/app/**	—	warning	NTP uses useId() extensively (omnibar, favorites, protections, drawers, tooltips). Recommend smoke-testing omnibar a11y attributes and activity burn animation after merge.

No web compatibility errors identified.

---

Security Assessment

File	Lines	Severity	Finding
(entire diff)	—	info	No changes to injected/, messaging/, captured-globals.js, message bridge, wrapper utilities, or origin validation.
(scope)	—	info	Preact runs in isolated first-party special pages with native messaging — not in the hostile third-party page injection context. No new postMessage, eval, messaging schema, or config-trust surface introduced.

No security findings.

---

Risk Level

Low Risk — Patch-level dependency bump confined to special-pages/ with no changes to content-scope injection, API overrides, or messaging security boundaries.

---

Recommendations

1. (info) Merge when CI is green. No injected-runtime risk.
2. (warning) Smoke-test NTP activity burn animation (Suspense + lazy load) and omnibar/tooltip a11y IDs (aria-labelledby, aria-describedby) on at least one platform.
3. (info) npm run build --workspace=special-pages succeeds with 10.29.5.

---

Automated assessment — Injected PR Evaluation: Web Compatibility & Security (synchronize)

  

_{Sent by Cursor Automation: Web compat and sec}

[cursor]

Dependency update review: preact 10.29.2 → 10.29.5

Verdict: Do not merge as-is. Target ^10.29.7 instead (see #2855).

---

Changelog impact (10.29.3 → 10.29.5)

This PR lands three patch releases. Key changes relevant to this repo:

Version	Change	Impact here
10.29.3	Flush subtree effects (#5055)	Blocker — reverted in 10.29.6 due to useSignalEffect incompatibility
10.29.3	Error recovery, memory-leak guards (#5120, #5116)	Beneficial
10.29.3	useId stability across async Suspense (#5108)	Reverted in 10.29.4 — no net change vs 10.29.2
10.29.4	Hydration + Suspense shouldComponentUpdate crash fix (#5134)	Low — no hydrate() usage in special-pages
10.29.5	Compat Suspense hydration children recovery (#5144)	Low — client-side render() only; one Suspense+lazy site in activity burn animation

Confirmed blocker: 10.29.5 still contains the subtree-effect flushing from 10.29.3. Preact maintainers explicitly reverted it in 10.29.6: "We had to revert #5055 due to an incompatibility with useSignalEffect".

This repo uses useSignalEffect in 10 files across new-tab (customizer, burning, protections, background) and history (search, URL sync, selection reset). That is a direct overlap with the known regression.

---

Test coverage

• 38 integration/unit test files under special-pages/; unit tests and signal-heavy integration suites (customizer, activity, history, new-tab) pass locally on 10.29.5.
• Gap: no tests assert useSignalEffect timing/ordering under cascading re-renders — the #5055 regression is subtle and may not surface in CI even when present.
• useId is used in ~15 components (accessibility IDs for drawers, tooltips, omnibar). No async-Suspense useId tests exist; the 10.29.3 fix was reverted in 10.29.4 so behavior should match 10.29.2.

---

Dependency necessity

Preact remains the correct choice — it is the sole UI runtime for all special-pages/ apps, paired with @preact/signals. No lighter or better-maintained alternative exists in this monorepo without a full rewrite.

---

Supply chain

• Official preactjs/preact package, MIT license, published via npm with lockfile integrity hash.
• npm audit reports no preact-specific vulnerabilities.
• Low supply-chain risk for this update; concern is runtime compatibility, not package provenance.

---

Recommended action

1. Close or supersede this PR in favor of #2855 (^10.29.7), which skips the reverted 10.29.3 change while keeping applicable fixes.
2. No separate fix PR needed — #2855 already exists as a draft from a prior review.
3. If merging #2855, consider marking it ready and rebasing onto main before approval.

  

_{Sent by Cursor Automation: Review dependabot}

[cursor]

Blocker: ^10.29.5 resolves to a version that still includes subtree-effect flushing from 10.29.3 (#5055), reverted in 10.29.6 for useSignalEffect incompatibility.

This repo uses useSignalEffect in 10 files (e.g. CustomizerProvider.js, BurnProvider.js, ProtectionsProvider.js, HistoryServiceProvider.js). Please bump to ^10.29.7 via #2855 instead.

[dependabot]

Superseded by #2889.