build(deps-dev): bump @duckduckgo/design-tokens from v0.30.0 to v0.31.0

[dependabot]

Bumps @duckduckgo/design-tokens from v0.30.0 to v0.31.0.

Release notes

Sourced from @​duckduckgo/design-tokens's releases.

v0.31.0

• Update desktop-browser outputs (#31)

Commits

• 2c1a2da v0.31.0
• See full diff in compare view

---

Note

Low Risk
Routine dependency bump with styling/token output changes only; no application logic or security-sensitive code is modified in this repo.

Overview
Bumps the dev dependency @duckduckgo/design-tokens from v0.30.0 to v0.31.0 in special-pages/package.json, with matching lockfile resolution and integrity updates.

v0.31.0 brings updated desktop-browser token outputs (per upstream release notes), which flow into shared imports like design-tokens.css and onboarding styles that pull from @duckduckgo/design-tokens/build/desktop-browsers/.

^{Reviewed by Cursor Bugbot for commit 1bf8e01. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Build Branch

Branch	pr-releases/dependabot/npm_and_yarn/main/duckduckgo/design-tokens-v0.31.0
Commit	4e29eedb9c
Updated	July 27, 2026 at 11:15:57 AM UTC

Static preview entry points

• Docs: docs/index.html
• Static pages: build/integration/pages/index.html
• Integration pages: injected/integration-test/test-pages/index.html

QR codes (mobile preview)

Entry point	QR code
Docs
Static pages
Integration pages

Integration commands

npm (Android / Extension):

npm i github:duckduckgo/content-scope-scripts#pr-releases/dependabot/npm_and_yarn/main/duckduckgo/design-tokens-v0.31.0

Swift Package Manager (Apple):

.package(url: "https://github.com/duckduckgo/content-scope-scripts.git", branch: "pr-releases/dependabot/npm_and_yarn/main/duckduckgo/design-tokens-v0.31.0")

git submodule (Windows):

git -C submodules/content-scope-scripts fetch origin pr-releases/dependabot/npm_and_yarn/main/duckduckgo/design-tokens-v0.31.0
git -C submodules/content-scope-scripts checkout origin/pr-releases/dependabot/npm_and_yarn/main/duckduckgo/design-tokens-v0.31.0

Pin to exact commit

npm (Android / Extension):

npm i github:duckduckgo/content-scope-scripts#4e29eedb9cba1cb319055c6665e08681678bbd83

Swift Package Manager (Apple):

.package(url: "https://github.com/duckduckgo/content-scope-scripts.git", revision: "4e29eedb9cba1cb319055c6665e08681678bbd83")

git submodule (Windows):

git -C submodules/content-scope-scripts fetch origin pr-releases/dependabot/npm_and_yarn/main/duckduckgo/design-tokens-v0.31.0
git -C submodules/content-scope-scripts checkout 4e29eedb9cba1cb319055c6665e08681678bbd83

[cursor]

Stale comment

Injected PR Evaluation: Web Compatibility & Security

PR: build(deps-dev): bump @duckduckgo/design-tokens from v0.30.0 to v0.31.0 (7b3984e)

Web Compatibility Assessment

No findings.

This PR changes only special-pages/package.json and package-lock.json. There are no changes under injected/, messaging/, or any browser API override / wrapper code.

@duckduckgo/design-tokens is a devDependency consumed at build time for CSS custom properties in special-pages (NTP, History, Onboarding, error pages). It is not bundled into the content-scope injection runtime and does not execute on third-party web pages.

Verified locally:

• npm run build --workspace=special-pages succeeds with v0.31.0
• All 698 underlying --ds-* tokens referenced by theme-mappings.css resolve in the v0.31.0 package (2,604 tokens available across build/)
• Key semantic color values (e.g. --ds-color-theme-default-light-surface-primary, accent-primary, text-primary) are unchanged between v0.30.0 and v0.31.0

Info: v0.31.0 restructures build/desktop-browsers/tokens.css — adds font/spacing tokens at :root and reorganizes palette sourcing (Figma extraction pipeline). This is a build-time CSS output change only; no JavaScript runtime behavior is affected.

Security Assessment

No findings.

• No changes to captured-globals.js, message bridge, messaging transports, or origin validation
• No new postMessage, eval(), or dynamic code execution
• No nativeData leakage vectors
• Package is dev: true — not shipped to end-user injection bundles

Risk Level

Low Risk — devDependency-only version bump with no injected runtime, messaging, or API override changes; verified build passes and all referenced design tokens resolve.

Recommendations

1. Optional (info): Smoke-test special-pages UI (NTP, History, Onboarding) on a Netlify preview to confirm no unintended visual shifts from the tokens.css restructure. Semantic theme values appear unchanged, so risk is low.
2. No injected-runtime or security actions required.

  

_{Sent by Cursor Automation: Web compat and sec}

[cursor]

This version bump triggers a breaking palette-token removal in the resolved package. v0.31.0 drops all 133 --ds-color-palette-* variables from build/desktop-browsers/tokens.css (design-tokens#31).

The only usage in this repo is onboarding v4 ComparisonTable.module.css. Please merge companion fix #2904 alongside this PR.

[cursor]

Stale comment

Injected PR Evaluation: Web Compatibility & Security

Re-assessed on synchronize (2a9331e) — assessment updated with one special-pages visual regression finding.

Web Compatibility Assessment

File	Lines	Severity	Finding
—	—	—	No injected-runtime findings. Diff touches only special-pages/package.json and package-lock.json. No changes to injected/src/, messaging/, wrapper-utils.js, captured-globals.js, or API overrides. @duckduckgo/design-tokens is a build-time CSS devDependency for special-pages only — not bundled into content-scope injection.
special-pages/pages/onboarding/app/v4/components/ComparisonTable.module.css	119	info	v0.31.0 removes the entire --ds-color-palette-* token family (133 tokens removed). This repo references --ds-color-palette-red-50 for the DDG browser icon background in onboarding. After this bump, that background-color resolves to an undefined CSS variable (transparent). Scope: first-party onboarding UI only — no third-party web compatibility impact.

Verified: all 716 other package-level token references (including all theme-mappings.css base tokens) resolve in v0.31.0. npm run build --workspace=special-pages succeeds.

Security Assessment

File	Lines	Severity	Finding
—	—	—	No findings. No messaging, captured-globals, message-bridge, postMessage, eval(), or runtime code changes.

Risk Level

Low Risk — devDependency-only version bump with no injected-runtime or security-surface changes. One minor special-pages visual regression (onboarding icon background) from a removed palette token.

Recommendations

1. info — Replace var(--ds-color-palette-red-50) in ComparisonTable.module.css with an equivalent semantic token (e.g. --ds-color-theme-accent-primary or a new design-token alias) before or alongside this bump. Value was #de5833 in v0.30.0.
2. Smoke-test onboarding v4 comparison table in light/dark themes after merge to confirm DDG icon background renders correctly.

  

_{Sent by Cursor Automation: Web compat and sec}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1bf8e01. Configure here.}

[cursor]

Lockfile out of sync

Medium Severity

special-pages/package.json pins @duckduckgo/design-tokens to #v0.31.0, but the matching special-pages entry in package-lock.json now records the resolved commit SHA instead. Other tagged git deps in this repo keep the tag in that packages section and only put the commit under node_modules/...resolved. That mismatch can make npm ci treat the lockfile as out of sync and fail installs.

---

_{Please tell me if this was useful or not with a 👍 or 👎.}

Additional Locations (1)

• special-pages/package.json#L30-L31

 

^{Reviewed by Cursor Bugbot for commit 1bf8e01. Configure here.}

[cursor]

Dependency update review: @duckduckgo/design-tokens v0.30.0 → v0.31.0

Verdict: Approve with companion fix required before merge.

This bump is low supply-chain risk but carries a confirmed visual regression in onboarding v4. A companion fix PR already exists.

---

Changelog / impact analysis

v0.31.0 (release) ships duckduckgo/design-tokens#31, which regenerates desktop-browsers CSS from updated Style Dictionary sources (drops SERP legacy SDS colors, adds Figma base exports).

Compared tokens.css between v0.30.0 and v0.31.0:

Change	Count
Removed --ds-color-palette-* tokens	133 (all palette tokens)
Added font tokens (--ds-font-*)	163
Changed values for surviving tokens	0
onboarding.css diff	none

Confirmed breakage in this repo: the only direct reference to a removed token is in onboarding v4:

/* special-pages/pages/onboarding/app/v4/components/ComparisonTable.module.css */
background-color: var(--ds-color-palette-red-50); /* removed in v0.31.0 */

Without a fix, the DuckDuckGo browser icon background becomes transparent. Onboarding v3 already uses the hardcoded brand color #de5833 for the same element.

Scanned all 19 --ds-* references under special-pages/pages/onboarding/ against v0.31.0 — only --ds-color-palette-red-50 is missing. New-tab/history pages use semantic aliases from theme-mappings.css (locally defined), so they are unaffected.

---

Test coverage

• Screenshot coverage exists: onboarding.screenshots.spec.js → v4-3-makeDefaultSingle exercises the affected ComparisonTable step.
• Gap: screenshot snapshots are platform-specific (macOS); this regression would not be caught on Linux CI without macOS screenshot runs. No unit test asserts token resolution.
• Build and unit tests pass on this PR; integration tests were still pending at review time.

---

Dependency necessity

@duckduckgo/design-tokens remains appropriate here — it is the canonical design-system source for special-pages CSS (design-tokens.css, onboarding tokens). The local variables.css legacy palette is separate and unaffected. No better alternative in-repo.

---

Supply chain risk

Low. First-party DuckDuckGo package installed via pinned git ref (github:duckduckgo/design-tokens#v0.31.0 + commit SHA in lockfile). devDependency only (special-pages build). No new transitive dependencies. No npm registry surface.

Minor lockfile inconsistency: package.json pins #v0.31.0 but package-lock.json resolves to commit 2c1a2daf… — expected for git deps, but worth noting the tag and SHA should stay aligned.

---

Companion fix PR (already open)

Do not merge this bump alone. Companion fix already drafted:

• #2904 — fix(onboarding): replace removed design-tokens palette variable
• Replaces var(--ds-color-palette-red-50) with #de5833, matching v3.

Recommended merge order: #2902 → #2904 (or merge both together).

---

Uncertain / residual risk

• Visual drift on theme-mapped pages: v0.31.0 changes token sources (not values for surviving tokens), but pages using theme-mappings.css could see subtle shifts if base theme tokens change in future releases. No diff detected for currently referenced tokens.
• Rebrand PRs in flight (#2887, #2877) may be layering on top of this bump — coordinate to avoid snapshot churn.

  

_{Sent by Cursor Automation: Review dependabot}

[cursor]

Confirmed downstream breakage: v0.31.0 removes all 133 --ds-color-palette-* tokens from build/desktop-browsers/tokens.css. This repo still references --ds-color-palette-red-50 in pages/onboarding/app/v4/components/ComparisonTable.module.css (DuckDuckGo icon background → transparent without a fix).

Companion fix is ready in #2904 (replaces with #de5833, matching v3). Please merge that before or alongside this bump.

[cursor]

Injected PR Evaluation: Web Compatibility & Security

Re-assessed on synchronize (1bf8e01) — diff unchanged (2 files: special-pages/package.json, package-lock.json).

Web Compatibility Assessment

File	Lines	Severity	Finding
—	—	info	No injected-runtime findings. Diff touches only special-pages/package.json and package-lock.json. No changes under injected/, messaging/, wrapper-utils.js, captured-globals.js, or message-bridge code. Third-party site compatibility is unaffected.
special-pages/pages/onboarding/app/v4/components/ComparisonTable.module.css	119	warning	background-color: var(--ds-color-palette-red-50) references a token removed in design-tokens v0.31.0 (all 133 --ds-color-palette-* tokens dropped; replaced by semantic --ds-color-theme-* tokens). Unresolved CSS custom property → invalid background-color → transparent DuckDuckGo browser icon background on the v4 comparison table. Onboarding v3 already hardcodes #de5833 for the same element.
special-pages/shared/styles/design-tokens.css	12	info	@import of tokens.css now resolves to v0.31.0 output: +163 font tokens, palette tokens removed. Pages using semantic aliases via theme-mappings.css (NTP, history, errorpage) are unaffected — scanned references resolve.
special-pages/pages/onboarding/app/v4/App.module.css	2	info	@import of onboarding.css is unchanged between v0.30.0 and v0.31.0.

Security Assessment

File	Lines	Severity	Finding
—	—	—	No findings. @duckduckgo/design-tokens is a devDependency providing static CSS custom properties at build time. No runtime JavaScript, no messaging, no nativeData exposure, no postMessage, no API overrides, no captured-global usage, and no page-world execution surface.

Risk Level

Low Risk — dependency-only bump confined to special-pages build tooling with no injected code changes; one isolated special-pages visual regression (not a third-party site breakage or security issue).

Recommendations

1. (warning) Do not merge alone — companion fix #2904 (fix(onboarding): replace removed design-tokens palette variable) replaces var(--ds-color-palette-red-50) with #de5833. Merge #2902 + #2904 together.
2. (info) Screenshot suite passes locally on Linux (234/234, including onboarding v4 v4-3-makeDefaultSingle), but the transparent-background regression is subtle and may not fail macOS snapshot comparisons — manual visual check of the comparison-table step on macOS is prudent.
3. (info) Prefer semantic onboarding tokens (e.g. --ds-accent-button-primary from onboarding.css) over raw palette or hardcoded hex for future-proofing against further palette removals.

  

_{Sent by Cursor Automation: Web compat and sec}