You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Medium Risk
Broad NTP UI and styling changes across many widgets, but gated on the rebrand flag with extensive integration coverage; no auth or data-handling changes.
Overview Consolidates the NTP rebrand into one branch: new-tab visuals, icons, and behavior are updated when body[data-rebrand="true"] / useNewTabPageRebranding() is on; legacy UI stays unchanged when the flag is off.
Design system: Bumps @duckduckgo/design-tokens to v0.34.0 and imports NTP desktop token CSS. Adds shared theme vars (--ntp-card-shadow-rest, dismiss/favicon tokens) and macOS accent/secondary button overrides under rebrand.
Widgets (CSS + small JS hooks): Omnibar (radius, shadows, search/Duck.ai tab icons, suggestions accent-alt rows), favorites tiles, customizer drawer/theme sections, Protections (card chrome, sliding pill between Stats/Activity, tab ARIA), privacy stats, activity (favicon chrome; burn uses TrashIcon vs fire/cross), Next Steps / Next Steps List (rebrand illustrations, empty peek shell behind stacked cards), RMF, PIR/winback banners, shared dismiss and show-more pills.
Assets: New 96px step icons, TrashIcon, rebrand omnibar glyphs (AiChat, SearchFind), and icons/rebrand/* paths for messaging banners.
Tests & tooling: Integration tests for rebrand icons (activity burn/remove, dock vs taskbar, empty peek shell); protections_feed query param in mocks/specs; Next Steps List examples; .gitignore for local agent files.
Reviewed by Cursor Bugbot for commit 57dc562. Bugbot is set up for automated code reviews on this repo. Configure here.
Base .switcher rules (DS raised-backdrop token + backdrop-filter: blur(48px) on non-default backgrounds) are not gated behind body[data-rebrand="true"]. Pre-rebrand users on custom backgrounds will see the new blurred switcher chrome. Cosmetic only, but worth confirming intent.
role="tablist" / role="tab" / aria-selected added, but the tab pattern is incomplete: no aria-controls linking tabs to panels, no role="tabpanel" on feed content, no roving tabindex. Keyboard/AT users may not get full tab semantics.
--ntp-card-shadow-rest correctly scoped under [data-theme] (shadow tokens only resolve there). Dark veil for custom backgrounds correctly gated behind body[data-rebrand="true"] with compounded attribute selectors.
Icon src interpolates message.icon, but the value is typed as RMFIcon (closed enum in generated types). No path-traversal risk from page scripts — data is native-supplied and schema-validated.
Pre-existing convertMarkdownToHTMLForStrongTags → dangerouslySetInnerHTML for native message copy. Unchanged in this PR; trusted-boundary content only.
special-pages/package.json
31
info
@duckduckgo/design-tokens bumped v0.30.0 → v0.34.0. Collateral: onboarding ComparisonTable.module.css still references removed --ds-color-palette-red-50 (see #2902/#2904). Not an injected risk, but verify onboarding build.
(entire PR)
—
info
No changes to captured-globals.js, message bridge, origin validation, postMessage, or nativeData handling.
Risk Level
Low Risk — Special-pages NTP UI/CSS rebrand only; all visual changes are gated behind useNewTabPageRebranding() / body[data-rebrand="true"] (with the noted exception of base Protections switcher chrome). No injected script surface area touched.
Recommendations
(info) Confirm whether the ungated Protections switcher backdrop/blur change is intentional for pre-rebrand users; if not, move lines 33–40 under :global(body[data-rebrand="true"]).
(info) Complete the tablist ARIA pattern (aria-controls, role="tabpanel", roving tabindex) before shipping the rebrand tab switcher broadly.
(info) Verify onboarding ComparisonTable against design-tokens v0.34.0 (companion fix #2904) since this branch bumps the shared dependency.
(info) Follow up on dark+userImage favorites tile border/hover fallthrough noted in Tile.module.css comments.
(positive) Good integration-test coverage added for rebrand icon gating, peek-shell behavior, and activity burn/remove icon swaps.
Drawer typography, background-panel selection rings, and close-button styling are all under [data-rebrand="true"] — no legacy-path impact.
customizer/components/ThemeSection.module.css:87+
info
--theme-swatch-outer-radius: 10px is a hardcoded Figma value (no matching DS token); rebrand-gated. macOS segmented-control inset shadow scoped to [data-rebrand][data-platform-name="macos"].
styles/ntp-theme.css:44-47, 79-84
info
Rebrand drawer width (264px) and darker dark-mode veil (black-at-50) are compound-gated on body[data-rebrand] + background-kind — correct selector pattern (no descendant combinator on body attrs).
shared/components/Switch/Switch.module.css:100+
info
Windows medium switch sizing overrides gated on :global([data-rebrand="true"]).
onboarding/.../ComparisonTable.module.css:119
info
Hardcoded #de5833 replaces removed --ds-color-palette-red-50 token — onboarding collateral from design-tokens bump, not NTP runtime.
protections/components/Protections.js:102-127
info
Tablist adds role="tab" / aria-selected (improvement) but still lacks aria-controls + role="tabpanel" wiring — incomplete ARIA tab pattern.
Icon paths use ./icons/rebrand/${message.icon}-96.svg — message.icon comes from native RMF config (trusted), not page-controlled input.
(none)
—
No nativeData forwarding, message-bridge changes, postMessage, eval/Function, uncaptured globals, or origin-validation relaxations.
Risk Level
Low Risk — CSS/visual rebrand work and NTP component styling gated behind body[data-rebrand="true"] / useNewTabPageRebranding(); zero changes to injected privacy features or messaging security boundaries.
Recommendations
(info) Complete Protections tablist ARIA: add aria-controls on tabs and role="tabpanel" on the feed container.
(info) Manual QA: rebrand customize drawer on macOS + Windows (theme swatches, background panels, visibility toggles, drawer width).
(info) Optional: integration test with rebrand: 'enabled' for customize drawer open/close and theme selection.
(info) Track dark+userImage favorites tile border fallthrough for a follow-up when rebrand ships broadly.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Injected PR Evaluation: Web Compatibility & Security
Ready-for-review sign-off at 380dc6f66 (2026-08-05).
Scope note: This PR touches 97 files, all under special-pages/pages/new-tab/ and shared components. No injected/ or messaging/ changes. The injected-script threat model (API overrides, captured globals, message-bridge trust boundaries) does not apply.
Delta since last assessment (d1e150351):380dc6f66 — rebrand-only omnibar TabSwitcher CSS polish (disable hover pseudo on unselected tabs, label padding tweak, remove dark blob shadow). No new compat/security findings.
Web Compatibility Assessment
File
Lines
Severity
Finding
(entire PR)
—
info
No injected-script changes. NTP is a privileged embedded page, not page-world injection.
special-pages/.../useKeyboardFocusWithin.js
42–45
info
Keyboard-focus tracking is Tab-only; Shift+Tab and arrow-key navigation are not tracked. Acceptable for pill-ring affordance but differs from full :focus-visible semantics. Gated via enabled: false when rebrand is off.
special-pages/.../Protections.js
102–127
info
Stats/Activity switcher uses role="tablist" + aria-selected, but tabs lack aria-controls pointing to tabpanels and feed content lacks role="tabpanel". Pre-existing pattern extended with rebrand blob indicator.
special-pages/.../Protections.module.css
1–3, 39
info
Legacy .root / .switcher retain backdrop-filter: blur(48px) outside [data-rebrand]. Rebrand path removes blur on switcher; base rules unchanged for flag-off users.
special-pages/.../Tile.module.css
59–67
info
Dark + userImage background tile border/hover still falls through to light rule (acknowledged in comment). Pre-existing, not introduced by rebrand.
Collateral from design-tokens v0.30→v0.34 bump: --ds-color-palette-red-50 removed. Tracked separately in #2904.
Security Assessment
File
Lines
Severity
Finding
(entire PR)
—
info
No changes to captured globals, API shims, messaging transports, or message-bridge trust boundaries.
special-pages/.../RemoteMessagingFramework.js
72–73
info
Title/description rendered as text nodes (not innerHTML) — good. Icon paths switch between ./icons/ and ./icons/rebrand/ based on rebrand flag; both are static bundled assets.
Pre-existing dangerouslySetInnerHTML via convertMarkdownToHTMLForStrongTags() unchanged; PR only adds rebrand icon path switching. Native message content trust boundary unchanged.
special-pages/.../useKeyboardFocusWithin.js
52–61
info
Document-level capture listeners (keydown, pointerdown, etc.) are properly cleaned up on unmount and skipped when enabled: false. No leak when rebrand is off.
Risk Level
Low Risk — Special-pages NTP UI/CSS rebrand gated behind useNewTabPageRebranding() / body[data-rebrand="true"], with no injected-script, messaging, or browser API override changes.
Recommendations
(info) Before rebrand GA: add aria-controls / role="tabpanel" to the Protections stats/activity switcher for full tablist semantics.
(info) Coordinate native rollout so newTabPageRebranding flag and body[data-rebrand] stay in sync.
(info) Land #2904 (ComparisonTable palette token) before or with the design-tokens bump if onboarding builds are in scope.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Injected Web Compatibility & Security Review
Re-assessed on synchronize (cb372d9b8, 2026-08-05). Delta since e68f94550: subscription icon path correction (SubscriptionWinBackBanner now uses rebrand/Subscription-Clock-96.svg; new asset added). No other logic changes.
Scope note: This PR touches 98 files, all under special-pages/ — there are zero changes to injected/, messaging/, wrapper-utils.js, captured-globals.js, or message-bridge code. The injected compat/security threat model (API overrides on hostile third-party pages, captured globals, messaging trust boundaries) does not apply.
Web Compatibility Assessment
File
Severity
Finding
(none in injected/)
—
No browser API overrides, prototype patches, or DOM injection into arbitrary web pages.
special-pages/.../useKeyboardFocusWithin.js
info
Document-level keydown/pointerdown listeners gated via enabled: rebrand; cleaned up on unmount. Tab-only modality (arrow keys won't trigger keyboard-focus ring) — matches static-pages pattern, acceptable for launch.
special-pages/.../Protections.js
info
role="tablist" / role="tab" / aria-selected added; missing aria-controls / tabindex for full ARIA tabs pattern. NTP embedded surface only.
special-pages/.../Protections.module.css
info
backdrop-filter: blur(20px) on legacy .blockLegacy path — potential perf cost on low-end devices when rebrand off.
special-pages/.../Tile.module.css
info
Non-rebrand dark + userImage border/hover may fall through to rebrand rules (acknowledged in #2887).
Security Assessment
File
Severity
Finding
(none in injected/)
—
No captured-global bypass, messaging bridge, or postMessage changes.
special-pages/.../RemoteMessagingFramework.js
info
Icon path ./icons/rebrand/${message.icon}-96.svg — message.icon from native RMF config (trusted source), same interpolation pattern as pre-PR legacy path.
dangerouslySetInnerHTML with convertMarkdownToHTMLForStrongTags() (escapes HTML before ** → <strong>). Pre-existing pattern, not introduced here.
special-pages/.../settings.provider.js
info
Rebrand gated via settings.newTabPageRebranding.state === 'enabled' — remotely controllable by native, allows rollback without deploy.
No warning, error, or critical security findings.
Risk Level
Low Risk — special-pages NTP UI/CSS rebrand behind a native feature flag; no injected script changes, no API shims, no messaging transport modifications.
Recommendations
Resolved (cb372d9b8): Subscription win-back banner now uses rebrand/Subscription-Clock-96.svg per design feedback.
Resolved (ac99d7c27): Legacy ProtectionsBodyLegacy blob pill when rebrand on.
Info (open): Complete ARIA tabs pattern (aria-controls, tabindex) if keyboard nav between Stats/Activity tabs is prioritized.
Info (open): Consider rebrand screenshot baselines for omnibar, RMF, and customizer surfaces.
Info (open): Bugbot-flagged ungated CSS changes in Activity/Protections base rules are visual-scope concerns outside injected compat/security — track separately if legacy NTP parity is required.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Web Compatibility Assessment
Scope note: 98 files changed, all under special-pages/pages/new-tab/ (plus collateral onboarding screenshot rebaselines). No injected/ changes — third-party web-page API fidelity categories do not apply.
File
Severity
Finding
omnibar/components/useKeyboardFocusWithin.js
info
Keyboard focus ring is Tab-only (event.key === 'Tab'); Shift+Tab and arrow-key navigation won't set data-keyboard-focus-within. Matches static-pages pattern; hook is gated via enabled: rebrand.
protections/components/Protections.js
info
Rebrand adds role="tablist" / role="tab" / aria-selected but omits aria-controls and roving-tabindex arrow-key handling. Buttons still work via click; incomplete WAI-ARIA tabs pattern.
favorites/components/Favorites.js
info
ShowHideButtonPill does not pass variant="rebrand" while Privacy Stats does — minor visual inconsistency when rebrand is on.
favorites/components/Tile.module.css
info
Dark + userImage background still falls through to light border/hover rule (acknowledged in-file comment; pre-existing).
Resolved:useKeyboardFocusWithin removed. Focus chrome now relies on :has(input:focus:placeholder-shown) / :focus-visible CSS in Omnibar.module.css — no document-level capture listeners.
Icon path interpolates native message.icon into ./icons/rebrand/${message.icon}-96.svg. Pre-existing pattern; native should whitelist icon names (no XSS via <img>, but unexpected asset load if unvalidated).
Removing the rebrand background/backdrop-filter override lets the legacy
custom-bg rules (rgba glass fills) apply on color/gradient/userImage
backgrounds, matching the pre-rebrand behaviour in main.
Revert omnibar focus state to production behaviour: border + outline glow
via --ds-color-theme-accent-primary / accent-glow-primary, removing the
custom box-shadow focused override and keyboard-focus-ring mechanism.
Fix dynamicPickerIconColor in rebrand dark mode: use --color-black-at-96 /
--color-white-at-96 so the icon always contrasts against the swatch color,
independent of the app theme.
CSS consumers (--keyboard-focus-ring, popup[data-keyboard-focus-within])
were removed when reverting to the production focus ring. The hook is now
dead code — removing to avoid pointless document listeners on every rebrand
NTP load. Will be reintroduced in the follow-up omnibar project.
- TickPill: gate DS token color behind data-rebrand; fix light-mode icon
color by setting it on .iconWrapper (not path fill) so currentColor works
- Customizer CSS: align [data-rebrand] selectors to :global(body[data-rebrand])
for consistency and safe retirement-time grep
- FreemiumPIRBanner: use var(--ntp-card-shadow-rest) instead of inline copy
- ActivityItem: hoist useNewTabPageRebranding to memo'd parents, pass isRebrand
as prop to Controls (removes N context subscriptions for a boot-time constant)
- NextStepsGroup: add missing variant prop to ShowHideButtonPill (latent bug)
- Omnibar: scope --omnibar-radius to .root; inline border token per theme
directly on .popup instead of global custom properties on body
The reason will be displayed to describe this comment to others. Learn more.
Injected PR Evaluation — Web Compatibility & Security
SHA:4cf387c6d | Delta since last assessment: 1 commit (fix(privacy-stats): use body-md line-height token for rebrand count)
Web Compatibility Assessment
File
Lines
Severity
Finding
(full PR)
—
info
No injected/ or messaging/ changes. All 91 files are special-pages/ UI, CSS, icons, tests, and design-token bumps. No browser API overrides, prototype patches, or DOM timing risks.
PrivacyStats.module.css
317
info
Resolved: Rebrand .count line-height now uses var(--ds-font-body-md-line-height) instead of hardcoded 13px. Aligns with design-system typography after font-feature-settings removal.
TabSwitcher.js
31–45
info
Tablist uses role="tablist" / role="tab" / aria-selected but lacks aria-controls and associated role="tabpanel" panels. Visual-only switcher; minor SR gap.
Protections.js
102–125
info
Same tablist pattern for stats/activity feed switcher — no aria-controls/tabpanel pairing.
Tile.module.css
59–67
info
Pre-existing: dark+userImage background falls through to light border/hover rule (documented in comment). Cosmetic only.
RemoteMessagingFramework.js
62
info
Icon path ./icons/rebrand/${message.icon}-96.svg — message.icon is typed as RMFIcon union from native messaging; not page-controlled.
Security Assessment
File
Lines
Severity
Finding
(full PR)
—
info
No changes to captured-globals.js, message bridge, API shims, shouldExemptMethod(), or postMessage transports.
RemoteMessagingFramework.js
62
info
Icon filename from native-controlled RMFIcon typed union — no path traversal from page scripts.
Rebrand gating
—
info
All rebrand styles gated via useNewTabPageRebranding() / body[data-rebrand="true"]. Remote-config rollback path preserved.
Risk Level
Low Risk — Special-pages NTP rebrand UI/CSS only; zero injected-script surface. New commit is a single design-token substitution with no compat or security impact.
Recommendations
(info) Consider adding aria-controls + role="tabpanel" to TabSwitcher and Protections feed switchers for full ARIA tab pattern compliance.
(info) Add rebrand screenshot baselines for omnibar, favorites, protections, and RMF before ship.
(info) Optional: address Tile dark+userImage border/hover fallthrough in a follow-up.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
semver-minorNew feature — triggers minor version bump
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
vkraucunas
left a comment
github-actions
Bot
added
the
semver-minor
Feature branch consolidating NTP rebrand PRs for coordinated merge.
Includes
Test environment
https://mborgato.duckduckgo.com/ntp/preview-hub.html
Note
Medium Risk
Broad NTP UI and styling changes across many widgets, but gated on the rebrand flag with extensive integration coverage; no auth or data-handling changes.
Overview
Consolidates the NTP rebrand into one branch: new-tab visuals, icons, and behavior are updated when
body[data-rebrand="true"]/useNewTabPageRebranding()is on; legacy UI stays unchanged when the flag is off.Design system: Bumps
@duckduckgo/design-tokensto v0.34.0 and imports NTP desktop token CSS. Adds shared theme vars (--ntp-card-shadow-rest, dismiss/favicon tokens) and macOS accent/secondary button overrides under rebrand.Widgets (CSS + small JS hooks): Omnibar (radius, shadows, search/Duck.ai tab icons, suggestions accent-alt rows), favorites tiles, customizer drawer/theme sections, Protections (card chrome, sliding pill between Stats/Activity, tab ARIA), privacy stats, activity (favicon chrome; burn uses TrashIcon vs fire/cross), Next Steps / Next Steps List (rebrand illustrations, empty peek shell behind stacked cards), RMF, PIR/winback banners, shared dismiss and show-more pills.
Assets: New 96px step icons,
TrashIcon, rebrand omnibar glyphs (AiChat,SearchFind), andicons/rebrand/*paths for messaging banners.Tests & tooling: Integration tests for rebrand icons (activity burn/remove, dock vs taskbar, empty peek shell);
protections_feedquery param in mocks/specs; Next Steps List examples;.gitignorefor local agent files.Reviewed by Cursor Bugbot for commit 57dc562. Bugbot is set up for automated code reviews on this repo. Configure here.