build(deps): bump @atlaskit/pragmatic-drag-and-drop from 2.0.2 to 3.0.0

[dependabot]

Bumps @atlaskit/pragmatic-drag-and-drop from 2.0.2 to 3.0.0.

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Note

Medium Risk
Major-version bump of a UI library with no accompanying code changes; favorites drag-and-drop could break if v3 introduces breaking API or behavior changes.

Overview
Upgrades special-pages drag-and-drop dependencies: @atlaskit/pragmatic-drag-and-drop 2.0.2 → 3.0.0 and @atlaskit/pragmatic-drag-and-drop-hitbox 2.0.0 → 2.1.0, with matching package-lock.json updates.

There are no application source changes in this PR—only manifest/lockfile. The libraries are used for new-tab favorites reordering in PragmaticDND.js, so behavior should be validated via existing integration tests (especially drag-and-drop on the new tab).

^{Reviewed by Cursor Bugbot for commit 175c8b4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Stale comment

Injected PR Evaluation: Web Compatibility & Security

Scope note: This PR touches only special-pages/package.json and package-lock.json. There are no changes to injected/ — the primary blast-radius surface for content-script injection on third-party sites is unaffected.

The bumped dependency is consumed exclusively by the New Tab favorites drag-and-drop UI (special-pages/pages/new-tab/app/favorites/components/PragmaticDND.js), which runs in an embedded special page, not in arbitrary web page contexts.

---

Web Compatibility Assessment

File	Lines	Severity	Finding
special-pages/package.json	39	info	No injected API overrides, prototype patches, or wrapper utilities are modified. Web-compat evaluation categories (toString masking, descriptor fidelity, cross-frame leakage, etc.) do not apply to this dependency-only bump.
special-pages/package.json	39–40	info	@atlaskit/pragmatic-drag-and-drop v3.0.0 preserves legacy import paths (/element/adapter, /external/adapter, /combine, etc.) as deprecated compatibility shims. Existing imports in PragmaticDND.js remain valid without source changes.
package-lock.json	nested special-pages/node_modules	warning	npm resolves two major versions simultaneously: v3.0.0 (direct) and v2.0.2 (via @atlaskit/pragmatic-drag-and-drop-hitbox@2.0.0). Hitbox utilities (attachClosestEdge, extractClosestEdge) feed data into v3 adapters at runtime. Build succeeds locally, but dual-version trees are a common source of subtle DnD regressions. Consider bumping hitbox to a release that declares ^3.x peer compatibility (e.g. hitbox ≥2.2.0) in a follow-up.
special-pages/pages/new-tab/ (unchanged)	—	info	No integration tests exercise favorites drag-and-drop reordering or external bookmark drops. Screenshot tests cover static favorites layouts only. A manual or Playwright smoke test of reorder + external drop is advisable before merge.

---

Security Assessment

File	Lines	Severity	Finding
Entire diff	—	info	No changes to captured-globals.js, messaging transports, message-bridge trust boundaries, origin validation, postMessage, or shouldExemptMethod(). All injected security categories are unaffected.
special-pages/pages/new-tab/app/favorites/components/PragmaticDND.js (unchanged)	290–307	info	Pre-existing: idFromPayload() parses text/html drag payloads via createContextualFragment(). This is scoped to the embedded New Tab page (native bookmark drag), not third-party injection. Not introduced or worsened by this PR, but worth noting that only name/content attributes are read — no fragment is appended to the live document.
Entire diff	—	info	No new network requests, dynamic code execution, or messaging surface area. Dependency is Apache-2.0 licensed with no known supply-chain flags in the lockfile delta.

---

Risk Level

Low Risk — dependency-only bump confined to the special-pages workspace with no injected code changes; v3 preserves backward-compatible import paths and the build passes.

---

Recommendations

1. (warning) Align @atlaskit/pragmatic-drag-and-drop-hitbox to a v3-compatible release to eliminate the dual v2/v3 npm tree.
2. (info) Manually smoke-test favorites drag-and-drop on at least one platform (reorder within grid + drop external bookmark) before merge — no automated coverage exists.
3. (info, optional) Migrate imports in PragmaticDND.js to v3 direct export paths (/adapter/monitor-for-external, etc.) to avoid reliance on deprecated shims in a future major release.

  

_{Sent by Cursor Automation: Web compat and sec}

[cursor]

Stale comment

Dependency update review: @atlaskit/pragmatic-drag-and-drop 2.0.2 → 3.0.0

Scope: Only special-pages/package.json / lockfile. All runtime usage is in special-pages/pages/new-tab/app/favorites/components/PragmaticDND.js (favorites tile reorder + external bookmark drop on the New Tab Page).

---

Confirmed issues

1. Dual core versions installed (merge blocker)

This PR bumps the direct dependency to ^3.0.0, but @atlaskit/pragmatic-drag-and-drop-hitbox remains at 2.0.0, which depends on core ^2.0.0. After install:

special-pages
├── @atlaskit/pragmatic-drag-and-drop@3.0.0
└── @atlaskit/pragmatic-drag-and-drop-hitbox@2.0.0
    └── @atlaskit/pragmatic-drag-and-drop@2.0.2

PragmaticDND.js imports adapters from core and hitbox utilities (attachClosestEdge, reorderWithEdge, etc.). Running two major core versions in the same bundle is fragile even when tests pass.

Fix: Also bump hitbox to ^2.1.0 (Dependabot PR #3002) or use companion PR fix/pragmatic-dnd-v3-with-hitbox which bumps both together.

---

Changelog impact (low API risk)

Per the v3.0.0 changelog, the major change is export-path realignment — legacy paths like @atlaskit/pragmatic-drag-and-drop/element/adapter are preserved as deprecated compatibility shims. All imports in PragmaticDND.js use those legacy paths, so no source changes are required for this bump.

---

Test coverage

Covered (automated): Favorites integration suite (favorites.spec.js) exercises:

• Internal reorder (re-orders items)
• Placeholder drop (support drop on placeholders)
• External HTML/MIME drop (accepts external drag/drop)

All 18/18 tests pass on the Dependabot branch (Chromium/Playwright).

Gaps (manual validation recommended):

• No unit tests for PragmaticDND.js itself
• setCustomNativeDragPreview + centerUnderPointer drag-preview path is not covered by integration tests
• Playwright runs Chromium — Safari/WebKit drag-preview behavior (historically sensitive in this library, fixed in core 2.0.1) should be smoke-tested on macOS/iOS native builds

---

Dependency necessity

@atlaskit/pragmatic-drag-and-drop remains the right choice here. It is the only dependency used for NTP favorites DnD and provides element + external adapters, closest-edge hitbox integration, and custom native drag previews — capabilities that would be costly to replicate with raw HTML5 DnD.

---

Supply chain

Check	Assessment
Maintainer	Atlassian Design System (atlassianartifactteam)
License	Apache-2.0
Source	atlassian/pragmatic-drag-and-drop
Registry integrity	Lockfile pins sha512-EEKBELv757wrvhMHBAoFcXjfzGZ4Y2FJ2xnSsWovsOKywkN1Q4IWRH52hQpPmJnATLcmO9viVhoXWSXFBLKSLQ==
Known CVEs	None reported for this package in npm audit

Risk: Low. Well-known, actively maintained Atlassian package. No typosquatting or suspicious postinstall scripts.

---

Recommendation

1. Do not merge in isolation — pair with hitbox ^2.1.0+ bump (PR #3002 or companion fix PR).
2. Run favorites DnD smoke test on Safari/WebKit before release.
3. (Optional follow-up) Migrate imports to v3 canonical paths before deprecated shims are removed in a future major.

---

Automated review by Cursor dependency update automation.

  

_{Sent by Cursor Automation: Review dependabot}

[jonathanKingston]

·@·d·ependabot r·ebase

---

Generated by Claude Code

[github-actions]

[Beta] Generated file diff

Time updated: Fri, 11 Sep 2026 11:22:17 GMT

Apple

    - apple/pages/new-tab/dist/index.js

File has changed

Integration

    - integration/pages/new-tab/dist/index.js

File has changed

Windows

    - windows/pages/new-tab/dist/index.js

File has changed

[cursor]

Stale comment

Dependency update review: @atlaskit/pragmatic-drag-and-drop 2.0.2 → 3.0.0

Verdict: do not merge this PR alone. The version bump is directionally correct, but leaving @atlaskit/pragmatic-drag-and-drop-hitbox at ^2.0.0 installs two major versions of the core package side-by-side. Prefer a combined bump (see existing fix PRs below).

---

Scope & usage

This dependency is used in a single place: special-pages/pages/new-tab/app/favorites/components/PragmaticDND.js, which powers favorites drag-and-drop on the New Tab Page (internal reorder, placeholder drops, and external bookmark drops). No other workspace imports it.

The library is still the right fit here — it wraps native HTML5 DnD with the custom preview / external MIME handling this feature needs. There is no in-repo alternative.

---

Changelog impact (v3.0.0)

Per the v3.0.0 changelog, the major change is entry-point restructuring (Volt standards). Legacy import paths are kept as deprecated compatibility shims.

Our imports (element/adapter, external/adapter, combine, external/html, set-custom-native-drag-preview, center-under-pointer) match the pre-v3 paths that remain supported via shims — no application code changes are required for v3 itself.

Future follow-up (non-blocking): migrate to canonical v3 paths and hitbox 2.1+ granular imports before shims are removed.

---

Confirmed issue: dual core installation

After npm ci on this branch:

└─┬ special-pages
  ├─┬ @atlaskit/pragmatic-drag-and-drop-hitbox@2.0.0
  │ └── @atlaskit/pragmatic-drag-and-drop@2.0.2
  └── @atlaskit/pragmatic-drag-and-drop@3.0.0

• hitbox@2.0.0 depends on core ^2.0.0 → resolves to 2.0.2 at the workspace root.
• special-pages now directly depends on core ^3.0.0 → npm nests 3.0.0 under special-pages/node_modules/.

Why this matters: PragmaticDND.js imports core APIs from v3 while hitbox utilities (attachClosestEdge, reorderWithEdge, etc.) run against core v2 internals. Pragmatic DnD relies on shared runtime state (instance IDs, drop-target registration). Two major versions can cause subtle breakage that unit/integration tests may not catch until real-browser manual QA.

Fix: bump @atlaskit/pragmatic-drag-and-drop-hitbox to ^2.1.0 (requires core ^3.0.0) so npm dedupes to a single core instance.

Existing fix PRs (no new PR opened by this review):

• #3003 — combined core v3 + hitbox v2.1+ bump
• #3004 — same intent, pairs core and hitbox together

Also related: Dependabot #3002 (hitbox 2.0.0 → 2.1.0) should be merged together with this core bump, not independently.

---

Test coverage

Integration tests in favorites.spec.js cover the DnD surface area:

• re-orders items
• support drop on placeholders
• accepts external drag/drop

Locally on this branch: build succeeded; 3/3 targeted DnD integration tests passed.

Gaps / validation still needed:

• Tests use Playwright dragTo and synthetic DataTransfer events — they verify messaging side-effects (favorites_move) but do not fully exercise native drag previews or cross-browser DnD edge cases (Safari popover preview fixes landed in core 2.0.1).
• No unit tests for PragmaticDND.js itself.
• Recommend manual QA on macOS/iOS WebKit after deduping versions.

---

Supply chain

Check	Assessment
Publisher	Atlassian (@atlaskit/*), official atlassian/pragmatic-drag-and-drop monorepo
License	Apache-2.0
Popularity	~1.2M weekly npm downloads, 195 dependents
Transitive deps	@babel/runtime, bind-event-listener, raf-schd — all well-known, low-risk
Integrity	Lockfile records SRI hash for 3.0.0 tarball

No supply-chain red flags identified.

---

Recommendation

1. Close or supersede this PR in favor of a combined core + hitbox bump (#3003 or #3004).
2. After merging the combined fix, run full favorites.spec.js integration suite and spot-check native drag previews on Safari/WebKit.
3. Optionally schedule a follow-up to migrate import paths off deprecated v3 shims (and hitbox root imports deprecated in 2.1.0).

  

_{Sent by Cursor Automation: Review dependabot}

[cursor]

Stale comment

Injected PR Evaluation: Web Compatibility & Security

PR: build(deps): bump @atlaskit/pragmatic-drag-and-drop from 2.0.2 to 3.0.0

Web Compatibility Assessment

File	Lines	Severity	Finding
special-pages/package.json	39	info	Dependency-only bump; no injected/ source changes. Zero impact on API overrides, prototype patching, or third-party page script compatibility.
special-pages/pages/new-tab/app/favorites/components/PragmaticDND.js	(unchanged)	info	Consumer still uses legacy v2 import paths (element/adapter, external/adapter, etc.). v3.0.0 preserves these as deprecated compatibility shims per upstream changelog — no source migration required.
package-lock.json	11515–11525	info	Nested install: special-pages resolves @atlaskit/pragmatic-drag-and-drop@3.0.0 while root node_modules retains v2.0.2 for @atlaskit/pragmatic-drag-and-drop-hitbox@2.0.0 peer. Dual-version tree is expected npm workspace behavior; drag-and-drop integration tests pass.
special-pages/ (runtime)	—	info	Library is bundled only into the New Tab Page favorites widget (isolated special-pages app), not injected into arbitrary third-party web pages. DOM interaction is scoped to NTP favorites reordering.

No web compatibility errors or warnings.

Security Assessment

File	Lines	Severity	Finding
(entire diff)	—	info	No changes to injected/src/, captured-globals.js, messaging transports, message bridge, or wrapper-utils.js.
special-pages/package.json	39	info	Third-party UI library bump only. No new postMessage, eval(), uncaptured globals, or nativeData forwarding. NTP messaging schemas unchanged.
PragmaticDND.js	(unchanged)	info	External drag/drop accepts bookmark HTML via getHTML() with DDG-specific MIME filtering (DDG_MIME_TYPE) — pre-existing, unchanged behavior.

No security errors, warnings, or critical findings.

Risk Level

Low Risk — special-pages-scoped dependency bump with no injected runtime, messaging, or API-override changes; v3.0.0 is an export-path restructure with legacy shim compatibility.

Recommendations

1. Merge after CI green — no injected-runtime concerns.
2. (Optional, info) Consider migrating PragmaticDND.js imports to v3 direct paths (adapter/monitor-for-external, etc.) in a follow-up to silence deprecation warnings.
3. (Optional, info) Consider bumping @atlaskit/pragmatic-drag-and-drop-hitbox to ^2.1.0 (declared compatible with core ^3.0.0 upstream) to dedupe the nested v2/v3 lockfile split.

Local Validation

• npm run build -w special-pages — pass
• npm run test-int -- pages/new-tab/app/favorites/integration-tests/favorites.spec.js — 18/18 pass (includes re-order, placeholder drop, external drag/drop)

  

_{Sent by Cursor Automation: Web compat and sec}

[cursor]

Dependency update review: @atlaskit/pragmatic-drag-and-drop 2.0.2 → 3.0.0

Verdict: Low risk — safe to merge after CI completes, with follow-up items noted below.

This PR bumps the core package and (via the Align drag-and-drop hitbox with core v3 commit) @atlaskit/pragmatic-drag-and-drop-hitbox to ^2.1.0. npm ls resolves a single deduped core instance (3.0.0), which avoids the dual-version tree that would occur if only the core were bumped.

---

Changelog impact vs current usage

Confirmed (v3.0.0): The major change is a reorganization of export paths. Legacy entry points (element/adapter, external/adapter, combine, etc.) are preserved as deprecated compatibility shims — our only consumer (special-pages/pages/new-tab/app/favorites/components/PragmaticDND.js) uses exclusively these legacy paths and continues to build and run without code changes.

Confirmed (hitbox 2.1.0): Requires core ^3.0.0. Also deprecates root-level hitbox imports (closest-edge); our imports (closest-edge, util/reorder-with-edge, util/get-reorder-destination-index) remain valid.

Uncertain: No runtime behavior changes are documented beyond export-path deprecation. Residual risk is limited to subtle drag/drop edge cases (native drag preview rendering, external bookmark drops) that automated tests do not fully exercise.

---

Test coverage

Confirmed: Three integration tests in favorites.spec.js cover the DND surface area:

• re-orders items — internal reorder via Playwright dragTo
• support drop on placeholders — drop onto placeholder tiles
• accepts external drag/drop — external payload handling

All three passed locally on this branch.

Gaps (uncertain / manual validation recommended):

• No unit tests for PragmaticDND.js itself.
• accepts external drag/drop dispatches synthetic DragEvents rather than exercising a real native external drag (e.g. from the bookmarks bar).
• setCustomNativeDragPreview / Safari popover rendering (fixed in core 2.0.1, inherited by v3) has no dedicated automated test. Recommend spot-checking favorites drag on WebKit/Safari in native app builds.

---

Is this dependency still needed?

Yes. It is the sole DND library, used only for NTP favorites reordering (internal + external bookmark drops + custom drag preview). There is no equivalent native-only implementation elsewhere in the repo, and the library is a reasonable fit for this use case.

---

Supply chain

Low risk: Official Atlassian package (@atlaskit), Apache-2.0, published to npm by atlassianartifactteam. Transitive deps are minimal (@babel/runtime, bind-event-listener, raf-schd). Source repo: atlassian/pragmatic-drag-and-drop.

---

Related PRs / fix branch

No separate fix PR is needed from this review:

• The hitbox pairing concern is already addressed on this branch.
• Draft PRs #3003 and #3004 appear redundant now and can be closed.
• Dependabot PR #3002 (hitbox-only) should not be merged separately — it is superseded by this PR.

---

Recommended follow-ups (non-blocking)

1. Migrate PragmaticDND.js import paths to v3 direct entry points before the deprecated shims are removed (tracked upstream as VOLTC-139).
2. Close redundant draft/superseded PRs (#3002, #3003, #3004).
3. Manual QA on Safari/WebKit for drag preview appearance during favorites reorder.

  

_{Sent by Cursor Automation: Review dependabot}

[cursor]

Injected PR Evaluation: Web Compatibility & Security

Assessed on synchronize (175c8b4, 2026-09-11). Sync delta vs prior (cac35de): this revision also co-bumps @atlaskit/pragmatic-drag-and-drop-hitbox 2.0.0 → 2.1.0, aligning hitbox with core v3 and eliminating the prior dual-version lockfile nesting.

Web Compatibility Assessment

No findings in injected/ — this PR touches only special-pages/package.json and package-lock.json.

File	Severity	Notes
special-pages/package.json (L39–40)	info	Dependency-only bump. @atlaskit/pragmatic-drag-and-drop 2.0.2 → 3.0.0 and hitbox 2.0.0 → 2.1.0. v3.0.0 restructures export paths (Volt entry-point standard) but preserves legacy import paths as deprecated shims. Existing imports in PragmaticDND.js (element/adapter, external/adapter, combine, etc.) remain valid without source changes.
special-pages/pages/new-tab/app/favorites/components/PragmaticDND.js	info	Unchanged consumer. Library is confined to the privileged New Tab Page favorites grid (HTML5 drag-and-drop within about: context). Does not inject into third-party pages; no browser API overrides, toString() masking, or prototype-chain concerns from C-S-S code.
Lockfile	info	Single resolved @atlaskit/pragmatic-drag-and-drop@3.0.0 — no dual v2/v3 bundling.

Local validation: npm run build -w special-pages passes; favorites integration suite 18/18 pass (re-order, placeholder drop, external drag/drop, keyboard nav).

Security Assessment

No findings.

Area	Severity	Notes
injected/src/	—	Zero changes. No captured-globals, messaging, message-bridge, or postMessage surface affected.
Special-pages scope	info	DnD library runs in a trusted embedded page, not a hostile third-party origin. External bookmark drop handling (DDG_MIME_TYPE, getHTML) is pre-existing behavior in PragmaticDND.js; this PR does not alter it.
Supply chain	info	Apache-2.0 Atlassian package; lockfile integrity hashes updated. No new runtime dependencies beyond version bumps.

Risk Level

Low Risk — manifest/lockfile-only dependency bump in special-pages/ with no changes to injected runtime, messaging transports, or browser API shims.

Recommendations

1. Merge when CI green — no web-compat or security blockers identified.
2. (Optional, non-blocking) Migrate PragmaticDND.js imports to v3 direct paths (e.g. adapter/monitor-for-external instead of external/adapter) to clear deprecation warnings and reduce shim bundle weight.

  

_{Sent by Cursor Automation: Web compat and sec}