You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Markdown: Cap ordered list mark at 999,999,999 (#19351 by @tats-u)
CommonMark parsers only support ordered list item numbers up to 999,999,999.
With this change, Prettier now caps the ordered list item number at 999,999,999 to ensure that the output is correctly parsed as an ordered list by CommonMark parsers. Numbers larger than 999,999,999 are not parsed as list item numbers and are left unchanged in the output:
<!-- Input -->999999998. text
999999998. text
999999998. text
999999998. text
1234567890123456789012) text
<!-- Prettier 3.9.4 -->999999998. text
999999999. text
1000000000. text
1000000001. text
1234567890123456789012) text
<!-- Prettier 3.9.5 -->999999998. text
999999999. text
999999999. text
999999999. text
1234567890123456789012) text
Markdown: Avoid corrupting empty link with title (#19487 by @andersk)
Do not remove <> from an inline link or image with an empty URL and a title, as this removal would change its interpretation.
Low Risk
Dependency-only bump of a dev formatting tool with no runtime or security impact; no secrets or credentials in the diff.
Overview
Bumps the devDependencyprettier from 3.8.4 to 3.9.5 in package.json, with the matching lockfile update for node_modules/prettier.
This only changes the formatter version used by npm run lint / lint-fix, CI bot formatting, and editor hooks—no application or injected script code is modified in this PR.
Reviewed by Cursor Bugbot for commit dbc784e. Bugbot is set up for automated code reviews on this repo. Configure here.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Injected PR Evaluation: Web Compatibility & Security
PR: build(deps-dev): bump prettier from 3.8.4 to 3.9.5 (b6cfca1)
Web Compatibility Assessment
No findings.
This PR only updates the root devDependency version in package.json and package-lock.json. Prettier is used exclusively in npm run lint / lint-fix (npx prettier . --check / --write) and is not bundled into the content-scope injection runtime (injected/), messaging transports, or special-pages production bundles.
No changes to API overrides, wrapper utilities, DOM interaction, platform entry points, or third-party script compatibility surfaces.
Security Assessment
No findings.
No changes to captured-globals.js, message bridge trust boundaries, nativeData handling, origin validation, postMessage usage, config gating, or any runtime code executed in third-party page contexts.
Risk Level
Low Risk — devDependency-only version bump with no application source changes; zero impact on code injected into web pages.
Recommendations
Warning (CI, not runtime): Verified locally with Prettier 3.9.5 — npx prettier . --check fails on 3 files:
These are formatting-only diffs introduced by the 3.9.x formatter (parentheses around conditional-type generic constraints; trailing semicolons after ternaries). Related open PR #2859 includes the formatting fallout. Merge #2859 first, or run npm run lint-fix on this branch before merge, to avoid npm run lint CI failure.
Info: Prettier 3.9.5 is a patch release (3.9.4 → 3.9.5) with formatter bug fixes for Markdown, CSS type(), Less, TypeScript comments, and JavaScript SwitchStatement handling — all lint-time only.
No injected-workspace integration tests or API fidelity checks are required for this dependency bump.
Verdict: Do not merge as-is — CI will fail without companion formatting fixes.
This is a semver-minor bump spanning Prettier 3.9.0 (major parser/formatting changes) plus patch releases through 3.9.5 (bug fixes only vs 3.9.4). Supply-chain risk is low; functional/runtime risk is none (devDependency); the real risk is lint / clean-tree CI breakage from formatting output changes.
special-pages/pages/new-tab/app/components/BackgroundProvider.js — ternary/semicolon handling changes in 3.9.0 JS output
3.9.4 and 3.9.5 produce identical output for these files; the breakage is introduced at 3.9.0, not by the 3.9.4→3.9.5 patch delta.
2. npm run test-clean-tree will fail (generated types drift)
After applying only this version bump, npm run build regenerates:
special-pages/pages/new-tab/types/new-tab.ts — BackgroundVariant union collapses to a single line (Prettier 3.9.0 "Don't break union type when it can fit" change)
json-schema-to-typescript formats generated output with the workspace Prettier version, so the bump changes committed generated artifacts.
.github/workflows/*.yml already pass prettier --check on 3.9.5
CSS/Less formatting fixes
None
**/*.css is in .prettierignore
Flow / GraphQL parsers
None
No .flow / .graphql sources in prettier scope
Dropped import … assert { } syntax
None
Grep found no import … assert { usage in JS/TS sources
--no-semi changes
Low
Repo uses semicolons; no --no-semi config found
3.9.5-specific fixes (markdown list capping, empty-link preservation, TS comment-on-shorthand-type fixes) are correctness improvements with no additional formatting delta beyond 3.9.4 for this codebase.
Test coverage
No dedicated Prettier unit tests — coverage is indirect via CI:
npm run lint → npx prettier . --check
npm run test-clean-tree → catches generated-artifact drift after build
These gates are sufficient once formatting fixes are included, but this PR alone does not satisfy them.
Is Prettier still needed?
Yes. It is wired into root lint / lint-fix, eslint-config-prettier integration, and .github/workflows/bot-format.yml. No better alternative is used elsewhere in the monorepo.
Supply chain
Package:prettier@3.9.5 from registry.npmjs.org (MIT)
Version pinning: exact "prettier": "3.9.5" (matches Prettier's own recommendation)
Maintainers: established Prettier core team / prettier-bot
Risk: low for a widely used, official npm package with no new transitive dependencies introduced by this bump
Companion PR already exists — no new fix PR needed
#2859 (build(deps-dev): bump prettier to 3.9.1 with formatting fixes, currently targeting 3.9.4) already includes the required formatting commits for the same 3 files plus regenerated new-tab.ts.
The reason will be displayed to describe this comment to others. Learn more.
CI blocker: Bumping to 3.9.5 without the companion formatting commits will fail npm run lint (npx prettier . --check) on 3 files, and npm run test-clean-tree will flag regenerated special-pages/pages/new-tab/types/new-tab.ts.
These fixes already exist in #2859. Recommend updating that PR to 3.9.5 rather than merging this Dependabot PR alone.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Injected PR Evaluation: Web Compatibility & Security
Re-assessed on synchronize (a966955) — assessment unchanged from opened review.
Web Compatibility Assessment
No findings. This PR only bumps the prettier devDependency in root package.json and package-lock.json. Prettier is invoked exclusively via npm run lint / lint-fix (npx prettier . --check / --write) and is not bundled into content-scope injection runtime. No changes to injected/, messaging/, special-pages/, API overrides, wrapper utilities, or platform entry points.
Security Assessment
No findings. No runtime code, messaging transports, captured-globals.js, message-bridge trust boundaries, or configuration paths are modified.
Risk Level
Low Risk — devDependency-only version bump with zero injection-runtime surface area.
Recommendations
Warning (CI, not runtime): Verified locally — npx prettier . --check fails on 3 files with Prettier 3.9.5:
This is the same 3.9.x formatting fallout noted in #2863. Related open PR #2859 includes the formatting fixes. Consider merging #2859 first, or cherry-picking its formatting commits, to keep npm run lint green.
Info: Prettier 3.9.5 is a patch release (3.9.4→3.9.5) with formatter bug fixes for Markdown, CSS/Less, TypeScript, and JavaScript — no behavioral impact on injected scripts.
No web-compatibility or security blockers for merge from an injection-runtime perspective.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Dependency update review: Prettier 3.8.4 → 3.9.5
Verdict: Do not merge as-is. The version bump is low supply-chain risk, but this PR only updates package.json / package-lock.json and will break CI until companion formatting changes land.
Confirmed issues
npm run lint fails after this bump — npx prettier . --check reports 3 files that need reformatting under 3.9.x:
messaging/lib/shared-types.ts — Prettier 3.9 adds parentheses around conditional types in extends clauses (TypeScript formatting change from 3.9.0).
special-pages/pages/new-tab/app/components/BackgroundProvider.js — both have // prettier-ignore ternaries where 3.9 now emits a trailing semicolon on the else branch.
test-clean-tree / snapshots CI fails — npm run build regenerates special-pages/pages/new-tab/types/new-tab.ts with different union formatting (BackgroundVariant collapses to a single line). This happens because json-schema-to-typescript (used by types-generator) depends on prettier and picks up the hoisted root version during type generation. The committed generated file was produced with 3.8.4 formatting.
CI already red — snapshots failed on the clean-tree check; unit (ubuntu-latest) / unit (windows-latest) also failed on this PR run.
Changelog impact (3.8.4 → 3.9.5)
This is a minor semver bump with meaningful formatter output changes, not just bug fixes:
Low — .md files are in .prettierignore except injected/docs/**
YAML v2 parser
Low — no YAML in prettier-checked paths
CSS
Low — **/*.css is in .prettierignore (stylelint handles CSS)
Dropped import … assert { } syntax
None found — no import … assert usage in the codebase
3.9.1–3.9.5 patches
Mostly Markdown/Less/CSS/Angular fixes; no additional diffs vs 3.9.4 on the affected JS/TS files (verified locally)
Test coverage
Formatting is gated by CI: npm run lint runs npx prettier . --check; test-clean-tree runs npm run build then git diff-index --quiet.
There are no dedicated Prettier unit tests — coverage is entirely integration via lint + clean-tree. That is adequate for a formatter bump, but it means formatting diffs must be committed alongside the version bump.
Re-validated locally: applying prettier --write on the 3 hand-written files + running npm run build -w special-pages (to refresh new-tab.ts) makes both prettier . --check and test-clean-tree pass.
Is Prettier still needed?
Yes. It is the project's documented formatter (CODING_STYLE.md), runs in lint / lint-fix, and is used by the bot-format.yml workflow. eslint-config-prettier (via @duckduckgo/eslint-config) disables conflicting ESLint rules. No alternative formatter is used elsewhere.
Supply chain risk
Factor
Assessment
Package
prettier on npm, MIT, ~50M weekly downloads, maintained by the Prettier core team
Source
Dependabot PR from 3.8.4 → 3.9.5 with updated lockfile integrity hash
Runtime exposure
Dev-only — not bundled into injected scripts or special-pages production output
Version pinning
Correctly pinned as "prettier": "3.9.5" (exact, not caret) — matches Prettier's own recommendation
Provenance
Standard npm registry; no new postinstall scripts introduced
Risk level: Low for supply chain; medium for merge friction due to formatting churn.
Companion fix PR
An open draft PR already covers the required formatting changes: #2859 (cursor/dependency-update-risk-review-407d — bumps to 3.9.4 with all 4 file fixes). No new fix PR created to avoid duplication.
Recommendation: Update #2859 to 3.9.5 (patch delta from 3.9.4 produces identical formatting on the affected files), mark it ready for review, and merge it instead of or before this Dependabot PR. Alternatively, cherry-pick the formatting commit onto this branch.
Uncertain / low-priority
Whether any injected/docs/**/*.md files would reformat differently under the new micromark parser — excluded from routine lint by .prettierignore but not from prettier . --check negation. Worth a one-time prettier --check injected/docs if docs formatting consistency matters.
// prettier-ignore directives may need revisiting over time as Prettier's ignore semantics evolve (3.9.5 restored comment.placement for plugin compatibility per changelog).
The reason will be displayed to describe this comment to others. Learn more.
This version bump alone is insufficient: Prettier 3.9.x changes JS/TS output enough that 4 files need updating before CI passes — 3 hand-written source files plus the generated special-pages/pages/new-tab/types/new-tab.ts (via json-schema-to-typescript's prettier dependency). See companion draft #2859 for the required formatting commit.
The reason will be displayed to describe this comment to others. Learn more.
Injected PR Evaluation: Web Compatibility & Security
Re-assessed on synchronize (dbc784e71c1a34e8fef45b877d066bf533e27311)
Web Compatibility Assessment
No findings.
This PR only bumps prettier from 3.8.4 to 3.9.5 in root package.json and package-lock.json (2 files). There are no changes under injected/, messaging/ runtime code, special-pages/ source, platform entry points, wrapper utilities, or any shipped bundle artifacts. Prettier is a root devDependency used exclusively by lint / lint-fix scripts (npx prettier . --check / --write); it is not included in workspace files or native distribution outputs.
Security Assessment
No findings.
No runtime code, messaging transports, message-bridge logic, captured-globals.js, API overrides, or configuration paths are modified. The version bump does not affect code executed in page context.
Risk Level
Low Risk — dev-only formatting tool version bump with no injected/runtime code changes.
Recommendations
CI (info): After installing Prettier 3.9.5 locally, npx prettier . --check reports formatting drift in 3 files not included in this PR:
messaging/lib/shared-types.ts (parentheses around conditional type constraints in generics)
special-pages/pages/new-tab/app/activity/NormalizeDataProvider.js (semicolon in ternary under prettier-ignore)
These are whitespace-only changes from Prettier 3.9.x JS/TS formatting improvements. Merge will likely fail the root lint script until a companion prettier --write commit is added. No web-compat or security impact from applying those fixes.
Process (info): Consider bundling the formatting fixes in this PR (or a follow-up on the same branch) so Dependabot PRs stay green without manual intervention.
The reason will be displayed to describe this comment to others. Learn more.
Dependency update review: prettier 3.8.4 → 3.9.5
Verdict: Approve with required companion changes. The version bump itself is low supply-chain risk, but merging this PR alone will fail CI until formatting output is reconciled.
Confirmed issues
CI will fail without formatting fixes (blocking)
npx prettier . --check fails on this branch with 3 files needing reformat.
The snapshots test-clean-tree job also fails because regenerated special-pages/pages/new-tab/types/new-tab.ts output changes.
Prettier is enforced via npm run lint → npx prettier . --check (see package.json).
Generated artifact drift is caught by npm run test-clean-tree in the snapshots workflow.
No dedicated prettier unit tests exist; CI lint + clean-tree are the correct gates. This is adequate for a dev-tooling bump once formatting is applied.
Dependency necessity
Prettier remains appropriate here:
Used in lint / lint-fix scripts
Used in .github/workflows/bot-format.yml for cursor bot auto-formatting
Pinned to an exact version (good practice; Prettier recommends this)
No @prettier/plugin-* packages in use
No alternative tooling migration is warranted for this bump.
Supply chain risk
Low.
Official prettier package from the Prettier org on npm
Exact version pin with lockfile integrity hash (sha512-/FVl766LpUfB5vXgCYOYa0MeV/441Ia99AeICQIQFTY/Nw0roZwULcXpku5i1/m5kt/baz+s4Zogspd839HSMg==)
MIT license, widely used, no new transitive dependencies introduced by this bump
Note: latest on npm is 3.9.6; 3.9.5 is one patch behind but still current minor line
Companion fix PR
An existing companion PR #2859 targets 3.9.4 with the same formatting fixes. I opened an updated companion PR at 3.9.5 with all required formatting + regenerated types:
Recommended merge path: Close #2859 in favor of the new companion PR, then merge the companion PR (or cherry-pick its formatting commit) before/alongside this Dependabot PR.
Uncertain / low-priority notes
Runtime behavior: Formatting-only changes; no functional code changes expected. The prettier-ignore ternary semicolon additions are stylistic.
Developer churn: Anyone on 3.8.4 locally will see the same diffs after npm install + lint-fix. Consider a brief team heads-up.
3.9.6 available: Dependabot may open another bump soon; formatting fixes from 3.9.0 should carry forward without additional changes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dependenciesUpdate one or more dependencies versionminorIncrement the minor version when merged
0 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
dependabot
Bot
added
dependencies
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Bumps prettier from 3.8.4 to 3.9.5.
Release notes
Sourced from prettier's releases.
Changelog
Sourced from prettier's changelog.
... (truncated)
Commits
b6c7d18Release 3.9.5cd54cccAvoid corrupting empty Markdown link with title (#19487)2bb67cePreserving comments'placementproperty (#19567)91bcac8Add more tests for comment-only object type (#19587)cbee737Remove space in empty object type (#19583)6394c73Align empty module declaration with TS (#19568)a4e6f7aPrevent the addition of space intype()with+(#19516)3d063b5Ignore dangling comments when checking type parameter comments (#19572)908503eHandle dangling comments inSwitchStatement(#19581)943a475Angular: Support expression for exhaustive typechecking (#19571)Note
Low Risk
Dependency-only bump of a dev formatting tool with no runtime or security impact; no secrets or credentials in the diff.
Overview
Bumps the devDependency
prettierfrom 3.8.4 to 3.9.5 inpackage.json, with the matching lockfile update fornode_modules/prettier.This only changes the formatter version used by
npm run lint/lint-fix, CI bot formatting, and editor hooks—no application or injected script code is modified in this PR.Reviewed by Cursor Bugbot for commit dbc784e. Bugbot is set up for automated code reviews on this repo. Configure here.