build(deps): bump @atlaskit/pragmatic-drag-and-drop from 3.0.0 to 3.1.0

[dependabot]

Bumps @atlaskit/pragmatic-drag-and-drop from 3.0.0 to 3.1.0.

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Note

Low Risk
Dependency-only minor version bump with no source changes; drag-and-drop behavior may shift slightly per upstream 3.1.0 release notes.

Overview
Bumps @atlaskit/pragmatic-drag-and-drop from 3.0.0 to 3.1.0 in special-pages/package.json and refreshes the root package-lock.json entry for that package.

There are no application code changes; consumers such as new-tab favorites PragmaticDND.js keep the same imports and APIs. This is a minor patch upgrade of the drag-and-drop library only.

^{Reviewed by Cursor Bugbot for commit ccc61d6. Bugbot is set up for automated code reviews on this repo. Configure here.}

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.

_{Tip: disable this comment in your organization's Code Review settings.}

[cursor]

Injected PR Evaluation: Web Compatibility & Security

PR: build(deps): bump @atlaskit/pragmatic-drag-and-drop from 3.0.0 → 3.1.0

Web Compatibility Assessment

No findings.

• Scope: Changes are limited to special-pages/package.json and package-lock.json. Zero changes under injected/src/, messaging/, or any platform entry points.
• Runtime surface: @atlaskit/pragmatic-drag-and-drop is consumed only by the New Tab Page favorites widget (special-pages/pages/new-tab/app/favorites/components/PragmaticDND.js). Special pages run in a privileged, first-party embedded context — not injected into arbitrary third-party web pages — so injected-script web-compat categories (API shimming, prototype overrides, toString() masking, stack-trace exemptions, etc.) do not apply.
• Upstream delta: Compared published tarballs for 3.0.0 vs 3.1.0 — all runtime JS/TS artifacts are byte-identical. The only upstream changes are a changelog entry and removal of a stale report.api.md packaging artifact. No behavioral or API changes.
• Transitive deps: Runtime dependencies unchanged (@babel/runtime, bind-event-listener, raf-schd at same semver ranges).

Security Assessment

No findings.

• No changes to captured-globals.js, message bridge, messaging transports, origin validation, or nativeData handling.
• No new network requests, postMessage, eval(), or dynamic code execution introduced.
• No known security advisories on @atlaskit/pragmatic-drag-and-drop@3.1.0 (deps.dev).
• Existing favorites DND code validates drop payloads (typeof target.data.url === 'string', idFromPayload guards) — unchanged by this bump.

Risk Level

Low Risk — dependency-only version bump in special-pages with no runtime code changes in the published package and no touched injected-script or messaging code.

Recommendations

1. Info — Safe to merge: No web-compat or security blockers from an injected-script perspective.
2. Info — Optional smoke test: Manually verify NTP favorites drag-and-drop reorder on one platform (iOS or macOS) if CI does not cover DND interaction. Existing favorites screenshot integration tests cover layout but not drag gestures.
3. Info — Future migration (out of scope): Upstream 3.0.0 introduced new direct export paths (e.g. adapter/monitor-for-external) while preserving legacy shims. PragmaticDND.js still uses legacy paths (external/adapter, element/adapter) — fine for now, but consider migrating before shims are removed in a future major.

  

_{Sent by Cursor Automation: Web compat and sec}

[cursor]

Dependency update review: @atlaskit/pragmatic-drag-and-drop 3.0.0 → 3.1.0

Verdict: Low risk — safe to merge. No code changes or follow-up fix PR are needed.

---

Changelog impact (confirmed)

The 3.1.0 changelog contains a single minor change:

Remove stale API report artifacts from published Platform packages.

I verified this by comparing the published tarballs: the only file difference between 3.0.0 and 3.1.0 is the removal of package/report.api.md. All runtime entry points (element/adapter, external/adapter, combine, set-custom-native-drag-preview, etc.) are unchanged.

Confirmed: No runtime behavior change in this release.

---

Usage in this repo

This package is used exclusively in new-tab favorites drag-and-drop:

• special-pages/pages/new-tab/app/favorites/components/PragmaticDND.js
• Consumed by FavoritesCustomized.js and Tile.js

APIs in use: draggable, dropTargetForElements, monitorForElements, monitorForExternal, dropTargetForExternal, combine, getHTML, setCustomNativeDragPreview, centerUnderPointer — all via the legacy entry-point paths introduced in 3.0.0 (still supported as compatibility shims).

---

Test coverage

Area	Coverage	Notes
Internal reorder	✅ Integration	re-orders items
Placeholder drops	✅ Integration	support drop on placeholders
External drag/drop	✅ Integration	accepts external drag/drop
Custom drag preview	⚠️ No direct test	Relies on upstream + manual QA
Unit tests	❌ None	PragmaticDND.js has no unit tests

I ran the three DND integration tests locally on this branch — all passed.

Uncertain (low priority): Custom native drag preview behavior (setCustomNativeDragPreview + centerUnderPointer) is not exercised by automated tests. This is pre-existing gap, not introduced by this bump.

---

Is this dependency still needed?

Yes. The favorites widget needs capabilities beyond native HTML5 DnD:

• External drops from native bookmarks (custom MIME type + HTML meta parsing)
• Closest-edge hit detection for horizontal grid reordering
• Custom drag preview rendering

No simpler in-repo alternative exists; this is the right tool for the job.

Future cleanup (not blocking): Both core 3.0.0 and hitbox 2.1.0 deprecated the legacy import paths this code uses. Migration to the new Volt-style entry points would reduce future upgrade friction but is unrelated to this patch.

---

Supply chain

Check	Status
Publisher	Atlassian Pty Ltd (official @atlaskit scope)
License	Apache-2.0
Registry	npm (registry.npmjs.org)
Lockfile integrity	Present (sha512-VU+2Oh6…)
Transitive deps	@babel/runtime, bind-event-listener, raf-schd — unchanged
Weekly downloads	~1M

No known advisories for this package version. Standard trusted upstream.

---

Related PRs (informational)

• #3039 bumps @atlaskit/pragmatic-drag-and-drop-hitbox 2.1.0 → 2.2.0 (also packaging-only; requires core ^3.1.0). If both merge, lockfile stays consistent. Merging this PR alone is fine — hitbox 2.1.0 accepts core ^3.0.0.
• Draft PRs #3003 / #3004 appear to be stale v3 migration attempts; no action needed.

---

Fix PR

Not needed. No application code changes required for this bump. I did not open a separate fix PR (and confirmed no existing open fix PR targets this specific 3.0.0 → 3.1.0 gap).

  

_{Sent by Cursor Automation: Review dependabot}