You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Injected PR Evaluation: Web Compatibility & Security
PR:#2887 — NTP Favorites tile rebrand styles Scope: 1 file, +23 lines — special-pages/pages/new-tab/app/favorites/components/Tile.module.css only. No injected/, messaging/, or runtime API changes.
Web Compatibility Assessment
File
Lines
Severity
Finding
Tile.module.css
150–171
info
CSS-only visual refresh for first-party NTP favorites tiles. Does not run in third-party page injection context; standard injected web-compat criteria (API fidelity, prototype chain, DOM timing) do not apply.
Tile.module.css
151
info
Rebrand styles are correctly gated behind :global(body[data-rebrand="true"]), matching the established NTP rebrand pattern (newTabPageRebranding → document.body.dataset.rebrand in app/index.js). Default-off flag limits rollout risk.
Tile.module.css
156–169
info
Rebrand .draggable overrides display, padding, border-radius, and box-shadow but does not unset base backdrop-filter: blur(48px). If the design intent is a flat card (per new shadow tokens), consider adding backdrop-filter: none in the rebrand block to avoid unintended blur stacking.
Tile.module.css
—
info
Favorites screenshot tests (new-tab.screenshots.spec.js) run with rebrand disabled by default. No regression signal for rebrand-on visuals; consider a rebrand-enabled screenshot case if native enables the flag broadly.
No warnings or errors.
Security Assessment
File
Lines
Severity
Finding
—
—
info
No changes to captured-globals.js, messaging transports, message bridge, or API overrides.
—
—
info
No user-controlled values in CSS — only static design tokens (--ds-space-x02-5, --ds-color-theme-shadow-*, etc.). No CSS injection or data-exfiltration vectors.
—
—
info
Feature remains remotely disableable via native newTabPageRebranding setting; no new un-gated behavior.
—
—
info
No new notify()/request() schemas, nativeData forwarding, or postMessage usage.
No warnings, errors, or critical findings.
Risk Level
Low Risk — Special-pages CSS-only change behind an existing remote-config rebrand flag; zero injected-runtime, messaging, or security-sensitive surface area.
Recommendations
(info) Verify rebrand-on favorites tiles visually on macOS/Windows with newTabPageRebranding enabled — confirm whether backdrop-filter should be removed in the rebrand block.
(info) Optional: add a rebrand-enabled favorites screenshot integration test to catch future CSS regressions when the flag ships broadly.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Injected PR Evaluation: Web Compatibility & Security
PR:#2887 — NTP Favorites tile rebrand styles Scope: 3 files, +27/−5 lines — Tile.module.css rebrand block + @duckduckgo/design-tokens v0.30.0 → v0.32.0 (devDependency). No injected/, messaging/, or runtime API changes.
Delta since prior review: commit 64529d367 bumps design-tokens to v0.32.0 so the new --ds-space-x02-5, --ds-space-x04, and --ds-radius-x04 tokens resolve at build time.
Web Compatibility Assessment
File
Lines
Severity
Finding
Tile.module.css
150–171
info
CSS-only visual refresh for first-party NTP favorites tiles. Does not run in third-party page injection context; standard injected web-compat criteria (API fidelity, prototype chain, DOM timing) do not apply.
Tile.module.css
151
info
Rebrand styles are correctly gated behind :global(body[data-rebrand="true"]), matching the established NTP rebrand pattern (newTabPageRebranding → document.body.dataset.rebrand in app/index.js). Default-off flag limits rollout risk.
Tile.module.css
156–169
info
Rebrand .draggable overrides display, padding, border-radius, and box-shadow but does not unset base backdrop-filter: blur(48px). If the design intent is a flat card (per new shadow tokens), consider adding backdrop-filter: none in the rebrand block to avoid unintended blur stacking.
package.json / package-lock.json
—
info
@duckduckgo/design-tokens bumped v0.30.0 → v0.32.0 (devDependency). Build-time token import only via shared/styles/design-tokens.css; not bundled into content-scope injection runtime.
Tile.module.css
—
info
Favorites integration/screenshot tests run with rebrand disabled by default. No regression signal for rebrand-on visuals.
No warnings or errors.
Security Assessment
File
Lines
Severity
Finding
—
—
info
No changes to captured-globals.js, messaging transports, message bridge, or API overrides.
—
—
info
No user-controlled values in CSS — only static design tokens (--ds-space-x02-5, --ds-color-theme-shadow-*, etc.). No CSS injection or data-exfiltration vectors.
—
—
info
Feature remains remotely disableable via native newTabPageRebranding setting; no new un-gated behavior.
—
—
info
No new notify()/request() schemas, nativeData forwarding, or postMessage usage.
No warnings, errors, or critical findings.
Risk Level
Low Risk — Special-pages CSS-only change behind an existing remote-config rebrand flag, plus a devDependency design-tokens bump; zero injected-runtime, messaging, or security-sensitive surface area.
Recommendations
(info) Verify rebrand-on favorites tiles visually on macOS/Windows with newTabPageRebranding enabled — confirm whether backdrop-filter should be removed in the rebrand block.
(info) Optional: add a rebrand-enabled favorites screenshot integration test to catch future CSS regressions when the flag ships broadly.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Injected PR Evaluation: Web Compatibility & Security
Re-assessed at ae5b99d1 (synchronize). Scope note: this PR touches special-pages/ only — no injected/, messaging/, wrapper-utils.js, or captured-globals.js changes. The injected threat model does not apply to runtime behavior here; findings below are scoped accordingly.
Resolved (ae5b99d1): rebrand .draggable now sets backdrop-filter: none, overriding the base blur(48px). Prevents stacked blur/perf artifacts in rebrand mode.
Rebrand block changes layout (display: flex, padding, tokenized radius/shadow) but does not alter DOM structure or JS event handling — low regression risk within first-party NTP.
special-pages/package.json
31
info
@duckduckgo/design-tokens bumped v0.30.0 → v0.32.0 (devDependency). Supplies --ds-space-x02-5, --ds-space-x04, --ds-radius-x04, and shadow tokens used by the rebrand block. Build-time only for this PR's CSS.
Favorites screenshot tests run with rebrand off (default). No rebrand-on visual regression coverage for the new tile styles.
No API surface fidelity, prototype chain, DOM timing, platform API, or third-party script compatibility concerns — this code does not run in arbitrary page contexts.
Security Assessment
File
Lines
Severity
Finding
(none)
—
—
No messaging schema changes, no nativeData forwarding, no bridge/origin validation changes, no captured-global usage, no postMessage, no dynamic code execution, no iframe access.
Low Risk — CSS-only, feature-flag-gated visual refresh in the embedded New Tab Page; zero injected-runtime or messaging surface changes.
Recommendations
(Optional, info) Add a rebrand-on favorites screenshot test (e.g. ?rebrand=enabled mock transport flag) to lock in tile padding, radius, and shadow tokens.
(Done)backdrop-filter: none in rebrand mode — good fix for the prior stacked-blur note.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Injected PR Evaluation: Web Compatibility & Security
Re-assessed at 4d90259c (synchronize). Scope:special-pages/ only — no injected/, messaging/, wrapper-utils.js, or captured-globals.js changes. The injected threat model does not apply to runtime behavior here.
Delta since ae5b99d1:@duckduckgo/design-tokens bumped v0.32.0 → v0.33.0 and 28 onboarding screenshot baselines updated (collateral from the tokens bump). No further CSS or JS changes to the NTP favorites tile rebrand block.
Rebrand block changes layout (display: flex, padding, tokenized radius/shadow) but does not alter DOM structure or JS event handling — low regression risk within first-party NTP.
special-pages/package.json
31
info
@duckduckgo/design-tokens bumped v0.30.0 → v0.33.0 (devDependency). Supplies --ds-space-x02-5, --ds-space-x04, --ds-radius-x04, and shadow tokens. Build-time only for this PR's CSS.
Favorites screenshot tests run with rebrand off (default). No rebrand-on visual regression coverage for the new tile styles.
No API surface fidelity, prototype chain, DOM timing, platform API, or third-party script compatibility concerns — this code does not run in arbitrary page contexts.
Security Assessment
File
Lines
Severity
Finding
(none)
—
—
No messaging schema changes, no nativeData forwarding, no bridge/origin validation changes, no captured-global usage, no postMessage, no dynamic code execution, no iframe access.
Low Risk — CSS-only, feature-flag-gated visual refresh in the embedded New Tab Page; zero injected-runtime or messaging surface changes.
Recommendations
(Optional, info) Add a rebrand-on favorites screenshot test (e.g. ?rebrand=enabled mock transport flag) to lock in tile padding, radius, and shadow tokens.
(Done)backdrop-filter: none in rebrand mode — good fix for stacked-blur artifacts.
The reason will be displayed to describe this comment to others. Learn more.
Injected PR Evaluation: Web Compatibility & Security
PR:#2887 — NTP Favorites tile rebrand styles HEAD:bcbe69936 (workflow snapshot rebaseline; no code changes since 4d90259c) Scope: 23 files — special-pages/ only; zero injected/ changes
Web Compatibility Assessment
File
Lines
Severity
Finding
(none)
—
—
No injected code, browser API overrides, prototype patches, or third-party page interactions. Standard injected web-compat categories are not applicable.
Rebrand styles are correctly gated behind :global(body[data-rebrand="true"]), set by native config (settings.newTabPageRebranding) in app/index.js. Legacy layout is unchanged when the flag is off.
Tile.module.css
156–171
info
Rebrand block switches .draggable from display: grid → flex, removes backdrop-filter: blur(48px), and applies tokenized shadows/radius/spacing. Visual-only; no DOM API or timing changes.
Favorites screenshot tests do not pass rebrand: 'enabled', so the new tile styles are not covered by visual regression tests. Unit test in new-tab.spec.js (L113–118) only asserts the data-rebrand attribute.
No changes to captured-globals.js, messaging transports, message bridge, wrapper-utils.js, DDGProxy, or any injected feature code.
Tile.module.css
150–172
info
Static CSS using design-system tokens; no page-derived values, no eval/Function, no postMessage, no network requests.
NTP context
—
info
Special-pages run in a privileged embedded browser context (DDG NTP), not in hostile third-party pages. Messaging trust-boundary categories are unchanged.
Risk Level
Low Risk — Special-pages-only CSS behind a native feature flag; no injected runtime, API shimming, or messaging changes.
Recommendations
(info) Add favorites screenshot tests with rebrand: 'enabled' (e.g. favorites-single.png rebrand variant) to lock in the new tile layout, shadows, and backdrop-filter: none behavior.
(info) When the rebrand flag graduates, fold the @todo block (L150) into base rules and remove the :global(body[data-rebrand="true"]) wrapper per the existing comment.
(info) Confirm onboarding screenshot rebaselines from the design-tokens v0.33.0 bump are intentional collateral (no favorites-specific action needed).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
semver-patchBug fix / internal — no release needed
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
github-actions
Bot
added
the
semver-minor
Asana Task/Github Issue: https://app.asana.com/1/137249556945/project/72649045549333/task/1216270925937867?focus=true
Description
Gates favorites tile rebrand styles behind
newTabPageRebranding(body[data-rebrand="true"]): updated radius, surface shadow, layout, and tile-to-label spacing.Testing Steps
?rebrand=enabled→ favorites tiles use the new chrome (16px radius, 2026 shadow, 10px gap to label)?rebrand=disabled(or omit) → live/legacy tile stylesScreenshots
Checklist
Please tick all that apply:
Made with Cursor