build(deps): bump preact from 10.29.7 to 10.29.8 - #2959
Conversation
Bumps [preact](https://github.com/preactjs/preact) from 10.29.7 to 10.29.8. - [Release notes](https://github.com/preactjs/preact/releases) - [Commits](preactjs/preact@10.29.7...10.29.8) --- updated-dependencies: - dependency-name: preact dependency-version: 10.29.8 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Build Branch
Static preview entry points
QR codes (mobile preview)
Integration commandsnpm (Android / Extension): Swift Package Manager (Apple): .package(url: "https://github.com/duckduckgo/content-scope-scripts.git", branch: "pr-releases/dependabot/npm_and_yarn/main/preact-10.29.8")git submodule (Windows): git -C submodules/content-scope-scripts fetch origin pr-releases/dependabot/npm_and_yarn/main/preact-10.29.8
git -C submodules/content-scope-scripts checkout origin/pr-releases/dependabot/npm_and_yarn/main/preact-10.29.8Pin to exact commitnpm (Android / Extension): Swift Package Manager (Apple): .package(url: "https://github.com/duckduckgo/content-scope-scripts.git", revision: "31f81b7f5c562c90dfc0c7ac130285119ceda3ae")git submodule (Windows): git -C submodules/content-scope-scripts fetch origin pr-releases/dependabot/npm_and_yarn/main/preact-10.29.8
git -C submodules/content-scope-scripts checkout 31f81b7f5c562c90dfc0c7ac130285119ceda3ae |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Web Compatibility Assessment
No findings.
This PR only bumps preact 10.29.7 → 10.29.8 in special-pages/package.json and package-lock.json. There are no changes to injected/, wrapper utilities, feature code, or platform entry points.
Scope note (info): Preact is consumed exclusively by the special-pages workspace (embedded browser pages such as NTP, onboarding, error pages). It is not bundled into content-scope injected scripts that run on third-party websites. Web-compat categories (API surface fidelity, prototype chain integrity, third-party script detection, stack-trace exemptions, etc.) therefore do not apply to this diff.
Preact 10.29.8 is a patch release with performance-only changes (batch updates in flushSync, avoid traversing retained subtrees). No behavioral contract changes are documented.
Security Assessment
No findings.
No changes to captured-globals.js, messaging transports, message bridge, shouldExemptMethod(), origin validation, postMessage usage, or any security-sensitive injected infrastructure. The dependency bump does not alter the trust boundary between page scripts and native messaging.
Risk Level
Low Risk — dependency-only version bump confined to special-pages; zero injected-code surface area.
Recommendations
- (Info) Merge after CI passes; no injected-specific testing required.
- (Info) If special-pages integration tests cover affected pages (onboarding, NTP), their existing CI run is sufficient validation for this patch-level Preact update.
Sent by Cursor Automation: Web compat and sec
There was a problem hiding this comment.
Dependency update review: preact 10.29.7 → 10.29.8
Verdict: Low risk — approve. This is a patch-only performance release with no API or behavioral contract changes relevant to this repo. No follow-up fix PR is needed.
Changelog impact (confirmed)
Preact 10.29.8 contains only performance changes:
- Batch updates in
flushSync(#5173) —preact/compatonly; multiple state updates inside aflushSynccallback now batch into one synchronous commit (React-aligned). - Avoid traversing retained subtrees (#5182) — after
memo/shouldComponentUpdatebailouts, DOM sibling lookup usesgetDomSibling()instead of recursively walking retained child trees.
No bug fixes, no breaking changes, and no signal/subtree-effect flushing changes (the regression that required skipping 10.29.3 in #2855).
Impact on this codebase
| Area | Usage | 10.29.8 relevance |
|---|---|---|
| Scope | preact is a direct dependency of special-pages/ only (package.json + lockfile) |
Diff is limited to those two files ✓ |
preact/hooks |
Used across all special pages | Unaffected by 10.29.8 changes |
preact/compat |
memo (new-tab activity/favorites/history virtualization), lazy/Suspense (burn animation), createPortal (omnibar tooltip) |
#5182 touches the memo bailout path; #5173 only matters if flushSync is called |
flushSync |
Not used anywhere in special-pages/ |
#5173 is effectively a no-op here |
@preact/signals / useSignalEffect |
Heavy usage in new-tab (customizer, burning, protections), history providers | No changes in 10.29.8 affecting signal effect flushing |
Confirmed: The memo-heavy surfaces most likely to exercise #5182 (activity feed, history virtualized list, favorites tiles) have Playwright integration coverage.
Uncertain (low severity): #5182 changes internal DOM placement logic after memo bailouts. In theory this could affect edge cases with deeply nested memoized trees and dynamic reordering. Upstream benchmarks showed no functional regressions, and local integration tests for history, activity, customizer, and new-tab passed on 10.29.8 after npm run build. Manual smoke of lazy-loaded burn animation on NTP activity would further de-risk, but is not a merge blocker.
Test coverage
- Unit:
npm run test-unitinspecial-pages/— 127/127 passed on 10.29.8. - Integration:
history.spec.js,activity.spec.js,customizer.spec.js,new-tab.spec.js(integration project) — all passed after build. - Gap (acceptable): No
flushSyncusage, so #5173 is untestable here.memobailout path is covered indirectly via integration tests, not unit-isolated.
Is preact still the right choice?
Yes. Preact is the established UI framework for all embedded special pages in this monorepo. There is no in-repo alternative, and the lightweight bundle size is appropriate for privileged about: pages. No action recommended.
Supply chain
| Check | Result |
|---|---|
| Package | Official preact on npm registry |
| Version published | 2026-08-01 |
| Maintainers | Established Preact core team (preactjs, developit, marvinhagemeister, etc.) |
| Lockfile integrity | sha512-ej2aVZ+… matches npm registry for 10.29.8 |
| Known CVEs | None reported for preact in npm audit |
| Release type | Patch within same minor line already in use (10.29.7) |
Supply chain risk: Low. Standard Dependabot patch bump from a well-known open-source project.
Fix PR
None required. Checked for existing open PRs addressing this bump — only #2959 (this PR) and the now-superseded draft #2855 (10.29.7 skip-10.29.3 guidance, already landed on main).
Recommendation
Merge after CI green. No code changes needed beyond this version bump.
Sent by Cursor Automation: Review dependabot
1 participant
Bumps preact from 10.29.7 to 10.29.8.
Release notes
Sourced from preact's releases.
Commits
389c7bcMerge pull request #5189 from preactjs/10.29.839edabf10.29.8f27f3ecMerge pull request #5173 from preactjs/flush-sync-batch84778ceMerge pull request #5182 from preactjs/perf/v10-retained-subtree-bailout8623721Golf retained-subtree bailout1ab8135Optimize retained subtree bailouts3393c0bBatch updates in flushSyncDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Note
Low Risk
Routine dependency patch with no app code changes; risk is limited to subtle behavior differences in Preact’s update/reconciliation internals.
Overview
Bumps preact from 10.29.7 to 10.29.8 in
special-pages/package.json, with the matching lockfile entry inpackage-lock.json.The new release is a patch focused on rendering performance (batching updates in
flushSyncand avoiding traversal of retained subtrees). No API or dependency changes beyond the version bump.Reviewed by Cursor Bugbot for commit 4e9d9a2. Bugbot is set up for automated code reviews on this repo. Configure here.