You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Note
Low Risk
Dependency-only minor bump for drag-and-drop hitbox utilities; possible dual major versions of the core Atlaskit package in the lockfile, but no direct code changes.
Overview
Bumps @atlaskit/pragmatic-drag-and-drop-hitbox from 2.0.0 to 2.1.0 in special-pages/package.json, with the root package-lock.json updated accordingly.
The lockfile also records that hitbox 2.1.0 depends on @atlaskit/pragmatic-drag-and-drop ^3.0.0 (nested 3.0.0), while special-pages still declares the core package at ^2.0.2—so runtime may resolve two major versions unless hoisting aligns them. No app source changes; new-tab favorites DnD (PragmaticDND.js) continues to import the same hitbox APIs.
Reviewed by Cursor Bugbot for commit 1682db2. Bugbot is set up for automated code reviews on this repo. Configure here.
The reason will be displayed to describe this comment to others. Learn more.
Injected PR Evaluation: Web Compatibility & Security
Scope note: This Dependabot PR only updates special-pages/package.json and package-lock.json. There are zero changes to injected/, messaging/, or any runtime injected feature code.
Web Compatibility Assessment
File
Lines
Severity
Finding
—
—
info
No injected/src/ changes. API surface fidelity, prototype patching, DOM interaction safety, timing/race patterns, platform-specific injected behavior, and third-party script compatibility categories are not applicable to this diff.
package-lock.json
155–170
info
@atlaskit/pragmatic-drag-and-drop-hitbox@2.1.0 now depends on @atlaskit/pragmatic-drag-and-drop@^3.0.0, while special-pages/package.json still declares @atlaskit/pragmatic-drag-and-drop@^2.0.2. npm resolves both (v2 top-level, v3 nested under hitbox). This is a special-pages NTP favorites concern only — not third-party web compatibility. Favorites DnD integration tests pass locally (re-orders items, support drop on placeholders, accepts external drag/drop).
Security Assessment
File
Lines
Severity
Finding
—
—
info
No changes to captured-globals.js, wrapper-utils.js, message-bridge.js, messaging transports, or shouldExemptMethod(). Global capture hygiene, messaging trust boundaries, prototype attacks, and iframe security categories are not applicable.
—
—
info
Dependency-only bump in special-pages (embedded NTP page, not injected into hostile third-party pages). No new postMessage, eval, dynamic code execution, or config-gated feature surface introduced.
Risk Level
Low Risk — dependency-only change with no injected runtime code; special-pages favorites DnD tests green.
Recommendations
Optional follow-up: Consider bumping @atlaskit/pragmatic-drag-and-drop to ^3.x in special-pages/package.json to align with hitbox 2.1.0's peer dependency and avoid dual-version bundling (not blocking — tests pass today).
The reason will be displayed to describe this comment to others. Learn more.
info (special-pages only, not injected): Hitbox 2.1.0 pulls in @atlaskit/pragmatic-drag-and-drop@^3.0.0 (nested v3.0.0 below), while the app still imports adapters from v2 (^2.0.2 in special-pages/package.json). Favorites DnD integration tests pass with this layout, but consolidating to a single major version would reduce bundle size and avoid future cross-version drag-state edge cases.
PragmaticDND.js imports adapters, monitors, and previews from the v2 instance, while hitbox utilities (attachClosestEdge, extractClosestEdge, reorderWithEdge) run against the v3 instance. Pragmatic DND relies on shared internal state across these modules — two copies can cause subtle runtime failures (drag monitors not firing, edge detection mismatches) even when tests pass.
Recommendation: Close this PR and merge the combined fix in # (or merge alongside Dependabot PR #3000).
DND behavior is covered by 3 Playwright integration tests in favorites.spec.js:
re-orders items
support drop on placeholders
accepts external drag/drop
These pass on this branch (3/3), but they do not exercise every adapter path (e.g. custom drag preview, canMonitor filtering). No unit tests exist for PragmaticDND.js.
Validation needed after combined bump: manual smoke test of favorites drag-reorder on macOS Safari and Windows (native drag preview behavior was the original reason for the v2.0.1 bump in PR #2826).
Is this dependency still needed?
Yes.@atlaskit/pragmatic-drag-and-drop + hitbox are the sole DND implementation for new-tab favorites (PragmaticDND.js). No alternative DND library is used elsewhere in the repo. The Atlassian library remains the right choice for native HTML5 drag-and-drop with edge-based reordering.
Note: hitbox 2.2.0 is now latest (published after this PR); a combined bump to ^2.1.0 / ^3.0.0 resolves to 2.2.0 / 3.1.0 automatically
Fix PR
Opened # combining both bumps so npm dedupes to a single core instance. Dependabot PR #3000 (core v3 only) also exists but has the inverse problem — it leaves hitbox at ^2.0.0.
The reason will be displayed to describe this comment to others. Learn more.
⚠️Blocking: hitbox ^2.1.0 pulls in @atlaskit/pragmatic-drag-and-drop@^3.0.0 as a nested dependency, but this line still pins the direct dependency to ^2.0.2. That installs two versions of the core package side-by-side.
Bump this to ^3.0.0 in the same PR (see combined fix PR).
PragmaticDND.js imports adapters, monitors, and previews from the v2 instance, while hitbox utilities (attachClosestEdge, extractClosestEdge, reorderWithEdge) run against the v3 instance. Pragmatic DND relies on shared internal state across these modules — two copies can cause subtle runtime failures (drag monitors not firing, edge detection mismatches) even when tests pass.
Recommendation: Close this PR and merge the combined fix in #3003 (or merge alongside Dependabot PR #3000).
DND behavior is covered by 3 Playwright integration tests in favorites.spec.js:
re-orders items
support drop on placeholders
accepts external drag/drop
These pass on this branch (3/3), but they do not exercise every adapter path (e.g. custom drag preview, canMonitor filtering). No unit tests exist for PragmaticDND.js.
Validation needed after combined bump: manual smoke test of favorites drag-reorder on macOS Safari and Windows (native drag preview behavior was the original reason for the v2.0.1 bump in PR #2826).
Is this dependency still needed?
Yes.@atlaskit/pragmatic-drag-and-drop + hitbox are the sole DND implementation for new-tab favorites (PragmaticDND.js). No alternative DND library is used elsewhere in the repo. The Atlassian library remains the right choice for native HTML5 drag-and-drop with edge-based reordering.
Note: hitbox 2.2.0 is now latest (published after this PR); a combined bump to ^2.1.0 / ^3.0.0 resolves to 2.2.0 / 3.1.0 automatically
Fix PR
Opened #3003 combining both bumps so npm dedupes to a single core instance. Dependabot PR #3000 (core v3 only) also has the inverse problem — it leaves hitbox at ^2.0.0.
The reason will be displayed to describe this comment to others. Learn more.
⚠️Blocking: hitbox ^2.1.0 pulls in @atlaskit/pragmatic-drag-and-drop@^3.0.0 as a nested dependency, but this line still pins the direct dependency to ^2.0.2. That installs two versions of the core package side-by-side.
Bump this to ^3.0.0 in the same PR (see combined fix PR #3003).
Verdict: Do not merge in isolation. The hitbox bump is safe functionally, but it implicitly upgrades the core pragmatic-drag-and-drop peer to v3 while the app still depends on v2 — leaving two copies of the core library installed.
Confirmed issues
1. Dual core versions installed (blocking)
hitbox@2.1.0 depends on @atlaskit/pragmatic-drag-and-drop@^3.0.0, but special-pages/package.json still pins the direct dependency at ^2.0.2.
PragmaticDND.js imports adapters from the direct v2 instance (element/adapter, external/adapter, combine, etc.) while hitbox utilities (attachClosestEdge, extractClosestEdge, reorderWithEdge) run against the nested v3 instance. Pragmatic DnD relies on shared drag state across these modules — two major versions side-by-side is an unsupported layout.
Impact: ~4.4 MB of duplicated node_modules on disk; potential subtle drag-and-drop breakage in production browsers even when headless tests pass.
Fix: Bump @atlaskit/pragmatic-drag-and-drop to ^3.0.0 in the same change. Draft PRs already exist: #3003 and #3004 (combined core + hitbox bump). Recommend closing this PR in favor of one of those.
Deprecates package-root imports in favor of dedicated entry points — no impact; PragmaticDND.js already uses @atlaskit/pragmatic-drag-and-drop-hitbox/closest-edge and util/* paths.
Updated dependencies → pulls in core ^3.0.0 (the root cause of issue #1).
Adds new direct export paths; legacy paths (element/adapter, external/adapter, etc.) preserved as deprecated compatibility shims.
No breaking API changes for the import paths used in PragmaticDND.js.
Test coverage
Area
Coverage
Unit tests for PragmaticDND.js
None
Integration: reorder (re-orders items)
✅ favorites.spec.js
Integration: placeholder drop
✅ favorites.spec.js
Integration: external drag/drop
✅ favorites.spec.js
Cross-browser manual DnD
Not covered
Ran locally with the dual-version layout: 3/3 DnD integration tests passed. Passing tests do not eliminate the dual-version risk.
Is this dependency still needed?
Yes.@atlaskit/pragmatic-drag-and-drop + hitbox is the only DnD solution in the repo, used exclusively for new-tab favorites reordering (PragmaticDND.js → FavoritesCustomized.js). No lighter in-repo alternative exists; the library is the right tool for grid reordering with external drop support.
The reason will be displayed to describe this comment to others. Learn more.
⚠️Blocking:hitbox@2.1.0 depends on @atlaskit/pragmatic-drag-and-drop@^3.0.0, but this line still pins the direct dependency to ^2.0.2. After install, npm resolves two major versions of the core package:
@atlaskit/pragmatic-drag-and-drop@2.0.2 (direct — used by PragmaticDND adapters)
@atlaskit/pragmatic-drag-and-drop@3.0.0 (nested under hitbox — used by closest-edge utils)
Bump this to ^3.0.0 in the same PR. Draft fix already open: #3003.
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.
If you change your mind, just re-open this PR and I'll resolve any conflicts on it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dependenciesUpdate one or more dependencies versionminorIncrement the minor version when merged
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
dependabot
Bot
added
dependencies
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Bumps @atlaskit/pragmatic-drag-and-drop-hitbox from 2.0.0 to 2.1.0.
Commits
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Note
Low Risk
Dependency-only minor bump for drag-and-drop hitbox utilities; possible dual major versions of the core Atlaskit package in the lockfile, but no direct code changes.
Overview
Bumps
@atlaskit/pragmatic-drag-and-drop-hitboxfrom2.0.0to2.1.0inspecial-pages/package.json, with the rootpackage-lock.jsonupdated accordingly.The lockfile also records that hitbox 2.1.0 depends on
@atlaskit/pragmatic-drag-and-drop^3.0.0 (nested 3.0.0), whilespecial-pagesstill declares the core package at^2.0.2—so runtime may resolve two major versions unless hoisting aligns them. No app source changes; new-tab favorites DnD (PragmaticDND.js) continues to import the same hitbox APIs.Reviewed by Cursor Bugbot for commit 1682db2. Bugbot is set up for automated code reviews on this repo. Configure here.