You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Low Risk
Dependency-only patch bump with no local code changes; risk is limited to upstream Preact rendering/Suspense behavior in special-pages UI.
Overview
Bumps preact in special-pages from 10.29.2 to 10.29.4, with matching updates in the root package-lock.json.
This is a patch-level runtime upgrade (no app code changes). Notable upstream fixes include hydration/Suspense crash fixes, error recovery for partial renders, hydrate recovery with excess DOM children, and memory/perf improvements; 10.29.4 also reverts the async Suspense useId stability change from 10.29.3. special-pages uses Suspense (e.g. lazy burn animation on the new-tab activity UI), so those fixes are the main practical impact.
Reviewed by Cursor Bugbot for commit e7b1e60. Bugbot is set up for automated code reviews on this repo. Configure here.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Injected PR Evaluation: Web Compatibility & Security
PR: build(deps): bump preact from 10.29.2 to 10.29.4 Scope: 2 files — special-pages/package.json, package-lock.json (dependency version bump only)
Web Compatibility Assessment
File
Lines
Severity
Finding
special-pages/package.json
46
info
Preact is a special-pages runtime dependency only. No injected/ workspace references Preact. This bump does not affect API overrides, prototype shimming, or third-party page injection — the primary web-compat risk surface for C-S-S.
— (upstream 10.29.4)
—
info
10.29.4 fixes a hydration+Suspense crash (#5134) and reverts useId stability across async Suspense (#5135). All special-pages entry points use render() (no hydrate() calls found), so the hydration fix is not directly exercised.
The only Suspense boundary lazy-loads the burn animation (BurnAnimationLottieWeb). Neither that component nor its lazy child uses useId. Extensive useId usage elsewhere (omnibar, favorites, drawers, protections, etc.) sits outside this async Suspense subtree.
— (upstream 10.29.4)
—
warning
The useId stability revert means IDs may change across async Suspense boundaries. Current code avoids this pattern, but a future component combining useId + async Suspense could cause transient aria-* mismatches. Low residual risk for this PR.
No web compatibility regressions identified in injected runtime code or third-party page behavior.
Security Assessment
File
Lines
Severity
Finding
special-pages/package.json
46
info
Dependency bump only. No changes to captured-globals.js, messaging transports, message-bridge trust boundaries, origin validation, or postMessage usage.
—
—
info
Preact renders first-party embedded browser pages (NTP, history, onboarding, etc.) loaded from native WebViews — not arbitrary hostile third-party DOM. The hostile-environment threat model (prototype tampering, global capture bypass, bridge spoofing) does not apply to this dependency update.
No security vulnerabilities identified.
Risk Level
Low Risk — dependency-only patch bump confined to special-pages; no injected/, messaging/, or API-override changes.
Recommendations
(info) Safe to merge from a web-compat/security perspective. No injected-runtime concerns.
(warning) Optional smoke-test: NTP activity burn animation (lazy Suspense path) and omnibar/favorites aria-* associations after merge — validates the useId/Suspense interaction surface.
(info) If a duplicate Dependabot PR exists for the same bump (e.g. #2854), close one to avoid merge conflicts.
Verdict: Recommend closing this PR in favor of #2855 (bump to 10.29.7).
This is a lockfile-only bump in special-pages/. Preact is the correct and necessary UI runtime for all special pages; there is no alternative to adopt here.
Confirmed concern: 10.29.4 still includes a reverted Preact regression
10.29.3 introduced “Flush subtree effects when rendering a pending node” (#5055).
10.29.6 reverted that change because it was incompatible with useSignalEffect (#5147).
10.29.4 does not include that revert — it only adds hydration/Suspense crash fixes and rolls back the useId stability change from 10.29.3 (#5134, #5135).
This repo uses @preact/signals / useSignalEffect in multiple hot paths:
special-pages/pages/history/app/global/Providers/HistoryServiceProvider.js (+ related hooks)
Stopping at 10.29.4 therefore lands the known-bad subtree-effect flushing behavior that Preact maintainers themselves reverted two releases later.
Uncertain / lower-impact items
Area
Assessment
useId + async Suspense
10.29.4 reverts the 10.29.3 useId stability fix. We use both (ActivityItemAnimationWrapper has Suspense+lazy; many components use useId), but all pages client-render via render() — no hydrate() or SSR. Impact is likely low, but unvalidated in native embed contexts.
Hydration fixes in 10.29.4
Not applicable — no hydrate() usage anywhere under special-pages/.
Beneficial 10.29.3 fixes retained
Memory-leak guards, error-recovery improvements, and hydrate-recovery fixes from 10.29.3 are included and are desirable.
Test coverage
Ran locally on this branch (npm ci, then special-pages tests):
Gap: no test exercises the useSignalEffect + subtree-effect-flushing interaction that motivated the 10.29.6 revert. Passing CI does not disprove subtle UI regressions in customizer/burn/protections flows.
Supply chain
Package resolves to official registry.npmjs.org/preact tarball with updated SRI hash in package-lock.json.
MIT-licensed, published by the established preactjs/preact project; 10.29.3+ uses npm staged publishing.
No signs of typosquatting or unexpected publisher change.
The reason will be displayed to describe this comment to others. Learn more.
⚠️Stopping at ^10.29.4 is risky for this repo.
10.29.3 shipped subtree-effect flushing (#5055) that Preact reverted in 10.29.6 due to useSignalEffect incompatibility (#5147). 10.29.4 still includes that change.
We rely on useSignalEffect across new-tab (customizer, burning, protections) and history. Recommend targeting ^10.29.7 via existing PR #2855 instead.
The reason will be displayed to describe this comment to others. Learn more.
Injected PR Evaluation: Web Compatibility & Security
Re-assessed on synchronize (e7b1e60b) — assessment unchanged; single Dependabot commit only.
Web Compatibility Assessment
File
Lines
Severity
Finding
special-pages/package.json
46
info
Dependency-only bump (preact^10.29.2 → ^10.29.4). No injected/ source changes; no browser API overrides, prototype patches, or DOM manipulation.
—
—
info
Preact is used exclusively in special-pages/ (embedded first-party UI: NTP, onboarding, duckplayer, etc.). It is not bundled into the content-scope injection script that runs on arbitrary third-party pages, so third-party script compatibility concerns (.toString() detection, polyfill ordering, stack-trace exemptions) do not apply.
—
—
info
Preact 10.29.4 fixes a hydration+Suspense crash (#5134) and reverts the 10.29.3 useId stability change across async Suspense (#5135). All special-pages entry points use render() (not hydrate()), so the hydration fix is not exercised in current builds.
The only Suspense boundary in the codebase lazy-loads the burn animation. NTP uses useId() extensively for a11y (aria-labelledby, htmlFor). The 10.29.3→10.29.4 revert means useId values inside async Suspense may shift if boundary resolution order changes — low residual risk for duplicate/mismatched IDs, but worth a quick smoke-test of the activity burn animation and omnibar a11y attributes.
No findings at error severity.
Security Assessment
File
Lines
Severity
Finding
package-lock.json
—
info
Lockfile integrity hash update only. No changes to captured-globals.js, messaging transports, message-bridge trust boundaries, or origin validation.
—
—
info
Preact renders trusted first-party UI inside native WebViews with controlled messaging schemas. The hostile-page threat model (prototype tampering, nativeData leakage, uncaptured globals) does not apply to this dependency bump.
No findings at warning, error, or critical severity.
Risk Level
Low Risk — patch-level dependency bump confined to special-pages/ with no changes to injected privacy features, API shims, or messaging security.
Recommendations
(info) Merge is safe from a web-compat/security perspective for the injected runtime.
(warning) Before release, smoke-test NTP activity burn animation (lazy Suspense path) and verify omnibar/drawer a11y IDs remain stable after interaction.
(info)npm run build in special-pages/ succeeds with 10.29.4.
Recommendation: do not merge as-is — prefer closing in favor of #2855 (jump to 10.29.7).
Scope of change
This PR only bumps preact in special-pages/package.json and package-lock.json. Preact is the sole UI runtime for all special pages (new-tab, history, onboarding, duckplayer, etc.) — ~200+ source files import from preact / preact/hooks / preact/compat.
HistoryServiceProvider.js, SearchForm.js, useURLReflection.js, etc. (history)
Preact 10.29.6 states: "We had to revert #5055 due to an incompatibility with useSignalEffect". Since 10.29.4 includes that change, merging this PR risks subtle signal/effect ordering bugs in customizer, burning, protections, and history search.
Validation run: targeted integration tests for the highest-risk areas passed on 10.29.4:
activity.spec.js (Suspense + lazy burn animation)
customizer.spec.js (heavy useSignalEffect)
new-tab.spec.js
Unit tests (116 tests) also passed. This does not eliminate the risk — the Preact revert exists because the incompatibility was real in upstream.
2. Existing fix PR already open
Draft PR #2855 (build(deps): bump preact to 10.29.7 (skip 10.29.3)) was opened specifically to avoid landing 10.29.3–10.29.5 with the #5055 regression. No separate fix PR needed from this review.
Uncertain / lower-risk items
Area
Assessment
Hydration fixes (#5112, #5134)
Low impact — special pages use render(), not hydrate(). Only one Suspense usage (ActivityItemAnimationWrapper.js for lazy burn animation), covered by burns item integration test.
useId revert (#5135)
Low impact — useId is used in ~15 components (tooltips, drawers, aria IDs) but not inside Suspense boundaries.
memo / shouldComponentUpdate
Low impact — used in activity/favorites/history list items; 10.29.4 fixes an sCU bailout crash in hydration+Suspense, which doesn't apply here.
Onboarding v3 integration failures
Inconclusive — shows v3 flow failed intermittently across 10.29.2–10.29.7 in this environment; onboarding does not use useSignalEffect. Treat as flaky, not a confirmed regression.
Test coverage gaps
No unit tests for useSignalEffect behavior or signal-driven side effects.
useId usage has no dedicated tests (relies on integration coverage of tooltips/drawers).
Suspense/lazy path is only exercised by activity burn animation test.
Error-boundary recovery changes in 10.29.3 (#5120) are not explicitly tested.
These gaps mean the #5055 risk cannot be fully ruled out by existing tests even though targeted suites pass.
Dependency necessity
Preact remains the correct choice — it is the foundational UI library for all special pages. Removing or replacing it is out of scope; the question is which patch version to land.
Supply chain
Check
Result
Package
preact@10.29.4 from registry.npmjs.org (official preactjs/preact)
License
MIT (unchanged)
Integrity
New SRI hash in lockfile; no unexpected transitive deps added
Publisher
Established open-source project; no ownership or typosquatting concerns
Audit
npm audit reports pre-existing vulns in other packages, none introduced by this bump
No supply-chain red flags.
Suggested action
Close this Dependabot PR without merging.
Finalize #2855 to land preact@^10.29.7, which includes applicable fixes without the reverted #5055 change.
If merging any 10.29.x bump, add a short CI note or targeted test around useSignalEffect + customizer/burning flows as a regression guard.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dependenciesUpdate one or more dependencies versionpatchIncrement the patch version when merged
0 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
dependabot
Bot
added
dependencies
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Bumps preact from 10.29.2 to 10.29.4.
Release notes
Sourced from preact's releases.
Commits
707884cMerge pull request #5136 from preactjs/10.29.40e6a25310.29.4174d345Merge pull request #5135 from preactjs/fix-preact-suspense8d20635Revert "Fix useId stability across async Suspense (#5108)"893845aMerge pull request #5134 from preactjs/patch-crashing-at-suspense-bailc3b4f0fFix hydration-suspense crash due to sCU bailout65b32cb10.29.3 (#5121)1a3b8b5Fix error recovery for partially rendered subtrees (#5120)67f0290Fix useId stability across async Suspense (#5108)d9e8984Flush subtree effects (#5055)Note
Low Risk
Dependency-only patch bump with no local code changes; risk is limited to upstream Preact rendering/Suspense behavior in special-pages UI.
Overview
Bumps
preactinspecial-pagesfrom 10.29.2 to 10.29.4, with matching updates in the rootpackage-lock.json.This is a patch-level runtime upgrade (no app code changes). Notable upstream fixes include hydration/Suspense crash fixes, error recovery for partial renders, hydrate recovery with excess DOM children, and memory/perf improvements; 10.29.4 also reverts the async Suspense
useIdstability change from 10.29.3.special-pagesusesSuspense(e.g. lazy burn animation on the new-tab activity UI), so those fixes are the main practical impact.Reviewed by Cursor Bugbot for commit e7b1e60. Bugbot is set up for automated code reviews on this repo. Configure here.