build(deps): bump @formkit/auto-animate from 0.9.0 to 0.10.0 - #2910
Conversation
Bumps [@formkit/auto-animate](https://github.com/formkit/auto-animate) from 0.9.0 to 0.10.0. - [Release notes](https://github.com/formkit/auto-animate/releases) - [Commits](formkit/auto-animate@0.9.0...v0.10.0) --- updated-dependencies: - dependency-name: "@formkit/auto-animate" dependency-version: 0.10.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Build Branch
Static preview entry points
QR codes (mobile preview)
Integration commandsnpm (Android / Extension): Swift Package Manager (Apple): .package(url: "https://github.com/duckduckgo/content-scope-scripts.git", branch: "pr-releases/dependabot/npm_and_yarn/main/formkit/auto-animate-0.10.0")git submodule (Windows): git -C submodules/content-scope-scripts fetch origin pr-releases/dependabot/npm_and_yarn/main/formkit/auto-animate-0.10.0
git -C submodules/content-scope-scripts checkout origin/pr-releases/dependabot/npm_and_yarn/main/formkit/auto-animate-0.10.0Pin to exact commitnpm (Android / Extension): Swift Package Manager (Apple): .package(url: "https://github.com/duckduckgo/content-scope-scripts.git", revision: "e39bc35b3184a4aa6093063664e7e0082a970852")git submodule (Windows): git -C submodules/content-scope-scripts fetch origin pr-releases/dependabot/npm_and_yarn/main/formkit/auto-animate-0.10.0
git -C submodules/content-scope-scripts checkout e39bc35b3184a4aa6093063664e7e0082a970852 |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Injected PR Evaluation: Web Compatibility & Security
PR: build(deps): bump @formkit/auto-animate from 0.9.0 to 0.10.0
Scope: 2 files — special-pages/package.json, package-lock.json (dependency version bump only)
Web Compatibility Assessment
| File | Lines | Severity | Finding |
|---|---|---|---|
special-pages/package.json |
41 | info | No injected/ changes. This dependency is not bundled into content-scope injection and has zero impact on third-party web page API fidelity, prototype chains, or third-party script compatibility. |
special-pages/package.json |
41 | info | @formkit/auto-animate is consumed only via @formkit/auto-animate/preact in onboarding Stack.js and List.js. Both gate animation with isReducedMotion (duration: 0 when reduced motion is preferred), which is good accessibility practice. |
special-pages/package.json |
41 | info | Upstream v0.10.0 adds a Marko v6 adapter (@formkit/auto-animate/marko) and CI/packaging changes. The Preact export and core animation engine are unchanged in this release; no breaking API changes affect current consumers. |
special-pages/package.json |
41 | info | The new-tab animation schema defines an auto-animate kind (animation.json), but no runtime code currently branches on kind === 'auto-animate' — only view-transitions is implemented in FavoritesCustomized.js. The version bump does not change NTP behavior today. |
special-pages/package.json |
41 | info | The library uses MutationObserver internally for DOM child-list animations. This is confined to embedded special pages (onboarding), not arbitrary host pages. Existing animate props default to false, so observers are only active when explicitly opted in. |
No warnings or errors identified.
Security Assessment
| File | Lines | Severity | Finding |
|---|---|---|---|
| (entire diff) | — | info | No changes to injected/, captured-globals.js, messaging transports, message bridge, or wrapper-utils.js. No new global captures, postMessage usage, or config-gated feature changes. |
special-pages/package.json |
41 | info | @formkit/auto-animate runs inside first-party embedded special pages with native messaging — not in the hostile third-party page context. The library performs local DOM observation/animation only; it does not construct external URLs, execute dynamic code, or interact with the message bridge. |
package-lock.json |
1607–1610 | info | Lockfile integrity hash updated for the new tarball. No supply-chain red flags beyond standard Dependabot version bump. v0.10.0 upstream also moved to npm OIDC trusted publishing, which is a positive supply-chain hardening. |
No warnings, errors, or critical findings identified.
Risk Level
Low Risk — This is a semver-minor dependency bump confined to the special-pages workspace with no injected code, API overrides, messaging, or security-sensitive infrastructure changes.
Recommendations
- (info) Merge is safe from an injected web-compat/security perspective. No code changes required.
- (info) Optional smoke test: exercise onboarding flows that use
animate={true}(e.g.SettingsStep.js) to confirm list/stack enter/leave animations still behave correctly under both normal and reduced-motion preferences. - (info) Ensure CI build passes for
special-pages— the lockfile-only change should be covered by existing build/test pipelines. - (info) No action needed for
injected/strict-core, captured-globals, or message-bridge review — out of scope for this PR.
Sent by Cursor Automation: Web compat and sec
There was a problem hiding this comment.
Dependency update review: @formkit/auto-animate 0.9.0 → 0.10.0
Verdict: Low risk — safe to merge. No code changes are required for this bump.
Changelog impact (confirmed)
Comparing v0.9.0...v0.10.0, the release is additive:
- Feature: Marko v6 integration (
@formkit/auto-animate/marko) - CI: npm OIDC trusted publishing
- Docs: Marko usage section
No changes to the Preact entrypoint (@formkit/auto-animate/preact) or its API. This repo only imports that Preact hook.
Usage in this repo
| File | Usage |
|---|---|
special-pages/pages/onboarding/app/shared/components/Stack.js |
useAutoAnimate({ duration: isReducedMotion ? 0 : 300 }) — active in onboarding v3 (SingleStep.js passes animate) |
special-pages/pages/onboarding/app/shared/components/List.js |
useAutoAnimate(...) on the List export — unused (List is never imported; only PlainList is) |
PlainList accepts animate={true} in SettingsStep.js but uses manual height refs, not @formkit/auto-animate.
The animation.kind: "auto-animate" option in special-pages/pages/new-tab/messages/types/animation.json is not implemented at runtime — new-tab code only handles view-transitions (e.g. FavoritesCustomized.js).
Onboarding v4 uses Web Animations API hooks (useAnimate, usePresence, useFlip) instead of this library.
Test coverage
- Build:
npm run buildpasses on 0.10.0. - Unit tests:
special-pagesunit suite passes (116 tests). - Integration: onboarding v3 suite passes (42 tests, windows project).
- Gap (advisory): All onboarding integration tests call
reducedMotion(), which setsduration: 0inStack.js/List.js. No automated test exercises actual auto-animate motion. Manual smoke of v3 step transitions with motion enabled would be the only validation path.
Is the dependency still needed?
Yes, for now — onboarding v3 is still shipped (app/index.js selects v3 vs v4 by orderName). The dependency could be removed once v3 is fully retired and Stack.js is migrated to the v4 WAAPI pattern.
Supply chain
| Check | Status |
|---|---|
| License | MIT |
| Maintainers | FormKit team (established org) |
| Dependencies | Zero runtime deps |
| Publishing | OIDC trusted publishing added in 0.10.0 (positive) |
| Integrity hash | Updated in lockfile as expected |
No npm audit findings specific to this package.
Separate fix PR
Not opened. No existing open PR targets this beyond #2910. The advisory items above (dead List import, unimplemented new-tab schema option, animation test gap) are pre-existing and unrelated to the version bump — not blockers for merging.
Recommended manual validation (optional)
If you want extra confidence beyond CI: load onboarding v3 with prefers-reduced-motion: no-preference and step through SingleStep transitions to confirm child enter/exit animations still look correct.
Sent by Cursor Automation: Review dependabot
1 participant
Bumps @formkit/auto-animate from 0.9.0 to 0.10.0.
Release notes
Sourced from @formkit/auto-animate's releases.
Commits
b6a6feeci: use bundled npm for trusted publishing00b8944ci: add trusted publishing and release workflows75ba14dchore: release v0.10.0a73b637test: scope framework demo selectors and cover Marko example01c5f5bMerge pull request #239 from defunkt-dev/mastere0a1b15docs support35ac0adfix some ts errors7f1d60ae2e ssr test suite for marko8b1ef37e2e test suite for marko304efabfeat: marko v6 auto-animate integrationMaintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for
@formkit/auto-animatesince your current version.Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Note
Low Risk
Dependency-only minor bump with no source edits; existing Preact integration should behave the same.
Overview
Bumps
@formkit/auto-animatefrom 0.9.0 to 0.10.0 inspecial-pages(package.jsonand lockfile). No application code changes.The extension still uses
useAutoAnimatefrom@formkit/auto-animate/preactin onboarding List and Stack components. v0.10.0 mainly adds Marko v6 support, docs, and CI; the Preact API path is unchanged.Reviewed by Cursor Bugbot for commit 7c88f9a. Bugbot is set up for automated code reviews on this repo. Configure here.