Privacy Essentials

Recent Commits

• Dax Mobile(14 Oct 26)

  Update autoconsent to v16.52.0 (#3726) Co-authored-by: muodov <[email protected]>

• dependabot[bot](13 Oct 26)

  Bump i18next-icu from 2.4.3 to 2.5.0 (#3721) Bumps [i18next-icu](https://github.com/i18next/i18next-icu) from 2.4.3 to 2.5.0. - [Changelog](https://github.com/i18next/i18next-icu/blob/master/CHANGELOG.md) - [Commits](https://github.com/i18next/i18next-icu/compare/v2.4.3...v2.5.0) --- updated-dependencies: - dependency-name: i18next-icu dependency-version: 2.5.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• Dax Mobile(13 Oct 26)

  Update autofill to 19.2.1 (#3724) Co-authored-by: dbajpeyi <[email protected]>

• dependabot[bot](09 Oct 26)

  Bump globals from 17.12.0 to 17.13.0 (#3722) Bumps [globals](https://github.com/sindresorhus/globals) from 17.12.0 to 17.13.0. - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](https://github.com/sindresorhus/globals/compare/v17.12.0...v17.13.0) --- updated-dependencies: - dependency-name: globals dependency-version: 17.13.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• Sam Macbeth(09 Oct 26)

  Add Node build scripts alongside the Makefile (#3692) * Add Node build scripts alongside the Makefile Second step towards replacing the Makefile so the extension can be built natively on Windows. Adds scripts/build-tools/, a set of plain Node ES modules that produce the same output as `make dev` / `make release`: node scripts/build-tools/build.mjs --browser <chrome|firefox|embedded> --type <dev|release> [--watch] [--no-reloader] node scripts/build-tools/clean.mjs --browser <browser> --type <type> | --all also reachable as `npm run build -- --browser chrome --type dev`. The Makefile and the existing npm scripts are unchanged; switching them over is the next step. Until the Makefile is removed, a new build-parity CI job builds each browser's release with both and fails on any difference, and a build-windows job runs the Node build on windows-latest (which has no make). Design notes: - esbuild and the ddg2dnr ruleset generator are used through their JS APIs; sass through its CLI (run via the current node binary, no shell), because the CLI writes .css.map files that the JS API would not reproduce byte for byte. - Each JS bundle is built in its own esbuild build, as the Makefile does. Bundling them together changed rollouts.js: several modules require() tldts while others import it, and esbuild's choice between the package's `main` and `module` fields is made once per build. - Fonts and the Smarter Encryption list keep their existing on-disk caches (build/.intermediates, build/.smarter_encryption.txt). A linked content-scope-scripts checkout is rebuilt only when its sources are newer than its output, matching the Makefile's dependency rules. - Watch mode uses esbuild's incremental contexts for the bundles and a recursive fs.watch for everything else, replacing the one-second `make -q` polling loop. buildtime.txt is bumped after either rebuilds. - The directory is named build-tools rather than build because the root .gitignore and .prettierignore both match any directory named build. - Dev builds differ from Make's only in inline source map paths, which are now relative to the output file rather than the working directory. bundleLocales.mjs, bundleContentScopeScripts.mjs and generateListOfSurrogates.mjs become thin wrappers around functions in scripts/build-tools/lib/, so the Makefile keeps working from the same code. Verified locally: `make copy build` and build.mjs release output diffed identical for chrome (338 files), firefox (336) and embedded (4); dev bundles identical once inline source maps are stripped; watch mode rebuilds on SCSS and JS edits and updates buildtime.txt. Co-Authored-By: Claude Fable 5.1 <[email protected]> Claude-Session: https://claude.ai/code/session_01QZvSaPQsgnC5WKJ539U7Ja * Support the chromium-embedded build in the Node build scripts The Makefile gained a chromium-embedded browser target which the new scripts did not know about. Mirror its rules: - Only the bundles the remaining pages load: background, devtools-panel, list-editor, rollouts and content-scripts/cpm. base.js is not built, so locale-resources.js is regenerated only when a bundle imports it. - Only base.css is compiled, for the devtools pages. - background.html, feedback.html, fire.html, options.html and tracker-stats.html are not copied. - No autofill assets, in either embedded build. - Smarter Encryption rules are bundled, as for chrome. - The dashboard's settings cog is hidden by appending to popup.css. The per-browser choices now live on the resolved BuildConfig (jsBundles, scssBundles, htmlExcludes, autofill, smarterEncryption) rather than being tested by browser name in each step. Added to the build-parity and build-windows CI matrices. Verified locally: `make copy build browser=chromium-embedded type=release` and the Node build diffed identical (319 files), with chrome, firefox and embedded still identical. Co-Authored-By: Claude Fable 5.1 <[email protected]> Claude-Session: https://claude.ai/code/session_01QZvSaPQsgnC5WKJ539U7Ja * Simplify the Node build scripts Cleanup pass over scripts/build-tools/ with no change to build output (release builds for all four targets still diff identical to make). - Describe what differs between browser targets once, in a BROWSER_PROFILES table with semantic fields (ui, autofill, smarterEncryption, jsBundles, scssBundles, htmlExcludes, dashboardCss). Steps test those fields instead of decoding browser identity flags. - Derive output subdirectories from one outputPaths() object, shared by the mkdir list and every step, instead of repeating path strings. - One fetchCached() helper replaces the duplicated download-and-cache code for fonts and the Smarter Encryption list. Smarter Encryption rules go through the ddg2dnr CLI, so the output format lives in one place, and are only regenerated when the cached list changes. - One sass invocation compiles every stylesheet, asynchronously, so it overlaps with esbuild rather than blocking it. - Bundling and the static steps start together; locale resources are written first, explicitly, since base.js imports them. - Watch mode: esbuild contexts do the initial build (no double bundling), changes are mapped to the steps they affect (an SCSS edit reruns only sass, a JS edit nothing static), only the consumed dependency subtrees are watched, watcher errors are logged rather than fatal, and buildtime.txt writes are debounced. - clean.mjs validates its arguments before removing anything. - Dropped unused exports, over-general parameters, a Buffer branch, an fs.existsSync alias and a one-line readdir wrapper; shared touch() and listVisible() helpers replace inline copies. - checks.yml: the new jobs use actions/setup-node@v7 like the others. Co-Authored-By: Claude Fable 5.1 <[email protected]> Claude-Session: https://claude.ai/code/session_01QZvSaPQsgnC5WKJ539U7Ja * Watch mode: rebuild everything on any change Replace the step-mapped watch (esbuild contexts for the bundles plus a path-to-step table for everything else) with a debounced full build. Measured on a warm chrome dev build, a full rebuild takes about 0.7s (sass 0.5s, all ten esbuild bundles 0.4s, everything else near zero, all run concurrently), against about 0.08s for an incremental esbuild rebuild. The dev reloader polls buildtime.txt every 5s, so the difference is not visible to a developer, and the path-to-step table was a hidden dependency graph that would leave stale output on a wrong entry. Roughly 80 lines and one concept fewer; watch output can no longer differ from a normal build. Co-Authored-By: Claude Fable 5.1 <[email protected]> Claude-Session: https://claude.ai/code/session_01QZvSaPQsgnC5WKJ539U7Ja * Second cleanup pass over the Node build scripts No change to build output (release builds for all four targets still diff identical to make). - Write locale-resources.js before starting esbuild, as the comment already said; the previous commit had them the other way round. - Shared lib/cli.mjs owns the --browser/--type option definitions, usage text and target resolution for both entry points, so they validate and fail the same way. - content-scope-scripts package layout (package.json, injected/, build/, the prebuilt inject.js) is spelled once in contentScopeScripts.mjs, which also tells watch mode what to watch: a local checkout's sources only, since watching its build output as well queued a redundant rebuild after every rebuild of the checkout. - BUILD_ROOT constant; buildDir dropped in favour of out.root; the content-scope-scripts build name comes from a small platform table; htmlExcludes is optional like dashboardCss; BROWSER_PROFILES is no longer exported; TYPES.includes() replaces a hand-written check. - One isSkippedDir() for the node_modules/.git rule used by both the watcher and the mtime walk; ensureDir() used consistently; simpler exit handling in run.mjs; inert parseArgs defaults removed. Co-Authored-By: Claude Fable 5.1 <[email protected]> Claude-Session: https://claude.ai/code/session_01QZvSaPQsgnC5WKJ539U7Ja * Address review: watch mode fails fast, ignores only hidden/backup files - Watched directories are no longer filtered by existence. They are all part of a correct install, so a missing one should fail immediately rather than be silently left unwatched. - The watcher ignores hidden files (any path segment starting with a dot) and editor backup files, so editor and sync-tool temporaries do not trigger rebuilds. It no longer skips whole directory names such as node_modules; over-triggering there is harmless. - isLocalCheckout is now isContentScopeScriptsLinked, to make clear it is about node_modules/@duckduckgo/content-scope-scripts being npm-linked to a local checkout. Co-Authored-By: Claude Fable 5.1 <[email protected]> Claude-Session: https://claude.ai/code/session_01QZvSaPQsgnC5WKJ539U7Ja * Address review: make watch mode robust and complete Four problems in watch mode that `make watch` did not have, all found in review: - A failed build could crash the watcher. build() started esbuild and sass, then ran the synchronous steps; if one of those threw, the promises already in flight were never awaited and a second failure became an unhandled rejection. build() now waits for every started step (Promise.allSettled, and the same inside bundleJs) before it throws, so a failed build never overlaps with the next one, and a rejected build in watch mode is logged and watching continues. - Changes during a build each queued another full build. A running / pending pair now coalesces any number of changes that arrive during a build into exactly one more build. - Bundled @duckduckgo dependencies (autoconsent, jsbloom) were not watched, so an npm-linked checkout of one no longer triggered rebuilds as the Makefile's `find -L node_modules/@duckduckgo/` did. The esbuild builds now produce a metafile, and the directories of every @duckduckgo input they list are watched, resolving symlinks and dropping directories nested in ones already watched. The list derives from what the bundles import and cannot go stale. - The build's own write to shared/js/ui/base/locale-resources.js (on a locale file being added or removed) queued a second build. Files the build writes under watched directories are ignored, including the integration-test files a linked content-scope-scripts rebuild emits. The watchedPaths() comment that overclaimed is corrected. Verified: release output for all four targets still identical to make; in watch mode, touching autoconsent's dist rebuilds; adding and removing a locale file causes one build each and leaves locale-resources.js as committed; four changes during one build cause exactly one follow-up build; a JS syntax error plus a missing source directory in the same build are both reported and the watcher recovers once they are fixed. Co-Authored-By: Claude Fable 5.1 <[email protected]> Claude-Session: https://claude.ai/code/session_01QZvSaPQsgnC5WKJ539U7Ja * Simplify the watch-mode fixes Cleanup pass over the previous commit, no change to build output: - One settleAll() helper (wait for every promise, then throw the first rejection) replaces the two hand-written allSettled blocks in build() and bundleJs(); a synchronous failure in build() joins the same list instead of a second error channel. - Linked dependencies are derived from the bundle inputs by what they are rather than by package name: a directory whose real path lies outside node_modules is an npm-linked checkout and is watched; installed packages (which only change on npm install) are not. This also covers a linked fork of a non-@duckduckgo package. - A linked content-scope-scripts checkout is watched through the same source directories its rebuild depends on, so nothing the rebuild writes is under a watched path and the generated-paths list is gone. The one file this process writes into a watched tree, locale-resources.js, is handled in shouldIgnore(). - watchedDirectories() resolves each real path once and returns it with the directory as named; nesting uses a shared isWithin() built on path.relative. - Fixed while testing: the hidden-file check ran on the joined path, so a linked package reported by esbuild as ../../... was ignored because of its '..' segments. The check now runs on the event's filename, which is relative to the watched directory. - One constant for node_modules/@duckduckgo in config.mjs. Verified with a simulated npm link (jsbloom moved out of node_modules and symlinked back): a change in the linked package rebuilds, a change in an installed package does not, adding and removing a locale file builds once each, four changes during a build coalesce into one follow-up, and a syntax error plus a missing source directory are both reported with the watcher surviving. Release output for all four targets still identical to make. Co-Authored-By: Claude Fable 5.1 <[email protected]> Claude-Session: https://claude.ai/code/session_01QZvSaPQsgnC5WKJ539U7Ja --------- Co-authored-by: Claude <[email protected]>

• github-actions[bot](07 Oct 26)

  Prepare release 2026.10.6 (#3709) * Release 2026.10.6 [ci release] * Read extension version from the manifest of the platform under test The broken site report test always read the version from the Chrome manifest. The chromium-embedded target is versioned independently, so its reports carry a different extensionVersion and the test failed on the chromium-embedded job. Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01MAF471Zmi7cvLtvUvDo8sQ * Bump chromium-embedded extension version to 2026.10.6 Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01MAF471Zmi7cvLtvUvDo8sQ --------- Co-authored-by: sammacbeth <[email protected]> Co-authored-by: Sam Macbeth <[email protected]> Co-authored-by: Claude <[email protected]>

• Dax Mobile(07 Oct 26)

  Update autoconsent to v16.47.0 (#3711) Co-authored-by: muodov <[email protected]>

• dependabot[bot](06 Oct 26)

  Bump proxy-addr from 2.0.7 to 2.0.8 (#3706) Bumps [proxy-addr](https://github.com/jshttp/proxy-addr) from 2.0.7 to 2.0.8. - [Release notes](https://github.com/jshttp/proxy-addr/releases) - [Changelog](https://github.com/jshttp/proxy-addr/blob/master/HISTORY.md) - [Commits](https://github.com/jshttp/proxy-addr/compare/v2.0.7...v2.0.8) --- updated-dependencies: - dependency-name: proxy-addr dependency-version: 2.0.8 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot](06 Oct 26)

  Bump source-map-js from 1.2.1 to 1.2.2 (#3707) Bumps [source-map-js](https://github.com/7rulnik/source-map-js) from 1.2.1 to 1.2.2. - [Release notes](https://github.com/7rulnik/source-map-js/releases) - [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md) - [Commits](https://github.com/7rulnik/source-map-js/compare/v1.2.1...v1.2.2) --- updated-dependencies: - dependency-name: source-map-js dependency-version: 1.2.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot](06 Oct 26)

  Bump the build group with 2 updates (#3697) * Bump the build group with 2 updates Bumps the build group with 2 updates: [@duckduckgo/eslint-config](https://github.com/duckduckgo/eslint-config) and [sass](https://github.com/sass/dart-sass). Updates `@duckduckgo/eslint-config` from v0.2.1 to v0.3.1 - [Release notes](https://github.com/duckduckgo/eslint-config/releases) - [Changelog](https://github.com/duckduckgo/eslint-config/blob/main/CHANGELOG.md) - [Commits](https://github.com/duckduckgo/eslint-config/compare/1a2a3f071f76b51a9917df6476211a8f20eb81bd...7595ec6b9c662f67f4b38f8e98c0a69f79ddaec0) Updates `sass` from 1.104.1 to 1.105.0 - [Release notes](https://github.com/sass/dart-sass/releases) - [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md) - [Commits](https://github.com/sass/dart-sass/compare/1.104.1...1.105.0) --- updated-dependencies: - dependency-name: "@duckduckgo/eslint-config" dependency-version: 7595ec6b9c662f67f4b38f8e98c0a69f79ddaec0 dependency-type: direct:development dependency-group: build - dependency-name: sass dependency-version: 1.105.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: build ... Signed-off-by: dependabot[bot] <[email protected]> * Fix no-useless-assignment lint errors from eslint-config v0.3 Co-Authored-By: Claude Sonnet 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01GXucvn71KWr9qtfH36gQSa * Fix no-useless-assignment lint error in ddg2dnr Co-Authored-By: Claude Sonnet 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01GXucvn71KWr9qtfH36gQSa --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Claude <[email protected]>

• dependabot[bot](06 Oct 26)

  Bump @babel/core from 7.29.0 to 7.29.7 (#3705) Bumps [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) from 7.29.0 to 7.29.7. - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.7/packages/babel-core) --- updated-dependencies: - dependency-name: "@babel/core" dependency-version: 7.29.7 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• Sam Macbeth(06 Oct 26)

  Exclude incognito browsing from persisted tracker stats (#3693) * Exclude incognito browsing from persisted tracker stats Company tracker counts, page counts and new tab tracker stats are written to storage.local. Previously incognito tabs contributed to these like any other tab, leaving a persistent trace of incognito browsing on disk. Track an `incognito` flag in TabState, taken from tabs API objects (onCreated, onUpdated's tab argument, and the startup tab query) and carried across navigations, since webRequest/webNavigation events don't include it. Service worker requests count as incognito when any tab of the same origin is incognito. Blocking and the per-tab dashboard data are unchanged. Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_017eyFipQpJj59eg7eqXYCUo * Simplify incognito flag handling Make the Tab incognito setter sticky so the "once incognito, always incognito" rule lives in one place, carry the flag across navigations via persistentTabProperties, and pass it to createOrUpdateTab in the info object instead of a third parameter. Document that TrackerBlockedEvent isn't emitted for incognito tabs, and parameterize the near-duplicate stats tests. Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_017eyFipQpJj59eg7eqXYCUo * Skip per-page company counts for incognito tabs, add integration test Tab.addToTrackers also calls Companies.countCompanyOnPage the first time a tracker company is seen on a tab, which adds the company to the persisted company data. Skip it for incognito tabs too. Add an integration test that enables incognito access through chrome://extensions, loads the request blocking test page in an incognito window and checks the persisted stats are unchanged, then checks the same page in a normal tab does update them. Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_017eyFipQpJj59eg7eqXYCUo * Flush new tab stats in the incognito test instead of waiting The integration test waited a fixed 1.5s for the throttled new tab stats sync. That throttle is a setTimeout in the extension service worker, which Playwright's clock doesn't control, so add a dbg.ntts sync() that persists the stats immediately and have the test flush before reading storage. Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_017eyFipQpJj59eg7eqXYCUo --------- Co-authored-by: Claude <[email protected]>

• dependabot[bot](05 Oct 26)

  Bump fast-uri from 3.1.0 to 3.1.8 (#3691) Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.0 to 3.1.8. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](https://github.com/fastify/fast-uri/compare/v3.1.0...v3.1.8) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.8 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot](05 Oct 26)

  Bump actions/checkout from 6 to 7 (#3695) Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot](05 Oct 26)

  Bump the content-scope-scripts group with 2 updates (#3696) Bumps the content-scope-scripts group with 2 updates: [@duckduckgo/content-scope-scripts](https://github.com/duckduckgo/content-scope-scripts) and [@duckduckgo/privacy-configuration](https://github.com/duckduckgo/privacy-configuration). Updates `@duckduckgo/content-scope-scripts` from 17.11.0 to 17.13.0 - [Release notes](https://github.com/duckduckgo/content-scope-scripts/releases) - [Commits](https://github.com/duckduckgo/content-scope-scripts/compare/ed9d8ca5e3fc1cf55262abfb304edb5319c91a40...a214261ab72f7002242d5626ae5cb1b97b7968da) Updates `@duckduckgo/privacy-configuration` from `2ea55dc` to `ed07f0d` - [Release notes](https://github.com/duckduckgo/privacy-configuration/releases) - [Commits](https://github.com/duckduckgo/privacy-configuration/compare/2ea55dca1ca20e09e49c6b7294eb7db82c767273...ed07f0dc389fe052791a0e7fc9340c96efa86218) --- updated-dependencies: - dependency-name: "@duckduckgo/content-scope-scripts" dependency-version: a214261ab72f7002242d5626ae5cb1b97b7968da dependency-type: direct:production dependency-group: content-scope-scripts - dependency-name: "@duckduckgo/privacy-configuration" dependency-version: ed07f0dc389fe052791a0e7fc9340c96efa86218 dependency-type: direct:development dependency-group: content-scope-scripts ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot](05 Oct 26)

  Bump prettier from 3.9.8 to 3.9.9 (#3698) Bumps [prettier](https://github.com/prettier/prettier) from 3.9.8 to 3.9.9. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.9.8...3.9.9) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.9 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot](05 Oct 26)

  Bump tldts from 7.4.14 to 7.4.16 (#3699) Bumps [tldts](https://github.com/remusao/tldts) from 7.4.14 to 7.4.16. - [Release notes](https://github.com/remusao/tldts/releases) - [Changelog](https://github.com/remusao/tldts/blob/master/CHANGELOG.md) - [Commits](https://github.com/remusao/tldts/compare/v7.4.14...v7.4.16) --- updated-dependencies: - dependency-name: tldts dependency-version: 7.4.16 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot](05 Oct 26)

  Bump @duckduckgo/pixel-schema from v2.1.0 to v2.2.0 (#3700) Bumps [@duckduckgo/pixel-schema](https://github.com/duckduckgo/pixel-schema) from v2.1.0 to v2.2.0. - [Release notes](https://github.com/duckduckgo/pixel-schema/releases) - [Commits](https://github.com/duckduckgo/pixel-schema/compare/f0a4f2f7f4615cf55ea7b1772bc5213071399da4...2176db00502cc4a90e3eab7451dc4e6cdc5963b9) --- updated-dependencies: - dependency-name: "@duckduckgo/pixel-schema" dependency-version: 2176db00502cc4a90e3eab7451dc4e6cdc5963b9 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot](05 Oct 26)

  Bump serialize-javascript from 7.1.1 to 7.1.2 (#3701) Bumps [serialize-javascript](https://github.com/yahoo/serialize-javascript) from 7.1.1 to 7.1.2. - [Release notes](https://github.com/yahoo/serialize-javascript/releases) - [Commits](https://github.com/yahoo/serialize-javascript/compare/v7.1.1...v7.1.2) --- updated-dependencies: - dependency-name: serialize-javascript dependency-version: 7.1.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot](05 Oct 26)

  Bump brace-expansion from 1.1.12 to 1.1.21 (#3702) Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 1.1.12 to 1.1.21. - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](https://github.com/juliangruber/brace-expansion/compare/v1.1.12...v1.1.21) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 1.1.21 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot](05 Oct 26)

  Bump qs, express and body-parser (#3703) Bumps [qs](https://github.com/ljharb/qs), [express](https://github.com/expressjs/express) and [body-parser](https://github.com/expressjs/body-parser). These dependencies needed to be updated together. Updates `qs` from 6.15.3 to 6.16.0 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](https://github.com/ljharb/qs/compare/v6.15.3...v6.16.0) Updates `express` from 4.21.2 to 4.22.3 - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/v4.22.3/History.md) - [Commits](https://github.com/expressjs/express/compare/4.21.2...v4.22.3) Updates `body-parser` from 1.20.3 to 1.20.8 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/1.20.8/HISTORY.md) - [Commits](https://github.com/expressjs/body-parser/compare/1.20.3...1.20.8) --- updated-dependencies: - dependency-name: qs dependency-version: 6.16.0 dependency-type: indirect - dependency-name: express dependency-version: 4.22.3 dependency-type: indirect - dependency-name: body-parser dependency-version: 1.20.8 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• kris w(02 Oct 26)

  Workflow: sync DDG-Chromium build artifacts with relevant orphan branch (#3673) * Publish chromium-embedded builds to the build-artifacts branch * Carry LICENSE.md onto the build-artifacts branch * Point the workflow at build/chromium-embedded/release * Pass VERSION to the commit step through env * Deal with concurrency correctly * Queue every pending chromium-embedded release run

• Dax Mobile(29 Sept 26)

  Update autoconsent to v16.43.0 (#3690) Co-authored-by: muodov <[email protected]>

• dependabot[bot](28 Sept 26)

  Bump tldts from 7.4.13 to 7.4.14 (#3688) Bumps [tldts](https://github.com/remusao/tldts) from 7.4.13 to 7.4.14. - [Release notes](https://github.com/remusao/tldts/releases) - [Changelog](https://github.com/remusao/tldts/blob/master/CHANGELOG.md) - [Commits](https://github.com/remusao/tldts/compare/v7.4.13...v7.4.14) --- updated-dependencies: - dependency-name: tldts dependency-version: 7.4.14 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot](28 Sept 26)

  Bump the build group across 1 directory with 3 updates (#3689) * Bump the build group across 1 directory with 3 updates Bumps the build group with 3 updates in the / directory: [esbuild](https://github.com/evanw/esbuild), [eslint](https://github.com/eslint/eslint) and [sass](https://github.com/sass/dart-sass). Updates `esbuild` from 0.28.1 to 0.28.2 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md) - [Commits](https://github.com/evanw/esbuild/compare/v0.28.1...v0.28.2) Updates `eslint` from 9.39.4 to 10.11.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](https://github.com/eslint/eslint/compare/v9.39.4...v10.11.0) Updates `sass` from 1.102.0 to 1.104.1 - [Release notes](https://github.com/sass/dart-sass/releases) - [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md) - [Commits](https://github.com/sass/dart-sass/compare/1.102.0...1.104.1) --- updated-dependencies: - dependency-name: esbuild dependency-version: 0.28.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: build - dependency-name: eslint dependency-version: 10.11.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: build - dependency-name: sass dependency-version: 1.104.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: build ... Signed-off-by: dependabot[bot] <[email protected]> * Add missing globals devDependency after eslint 10 bump (PR #3689) eslint 9.x pulled in [email protected] transitively via @eslint/eslintrc (its legacy .eslintrc compatibility shim), which npm hoisted to the root node_modules/globals. eslint.config.mjs imports 'globals' directly but never declared it as a dependency, relying on that hoisting. eslint 10 drops @eslint/eslintrc, so globals is no longer pulled in at the root (only nested under eslint-plugin-n for its own use), and `npm run eslint` fails with ERR_MODULE_NOT_FOUND for 'globals'. This matches the "lint" job failures on PR #3689's dependabot build-group bump (esbuild 0.28.1->0.28.2, eslint 9.39.4->10.11.0, sass 1.102.0->1.104.1). Declaring globals explicitly as a devDependency fixes eslint.config.mjs resolution; verified `npm run lint` (eslint, prettier, tsc, check-lockfile) and `npm run test.node` pass locally with this change. Co-Authored-By: Claude Sonnet 5 <[email protected]> Claude-Session: https://claude.ai/code/session_019cuRycMWwzr7smwxqgNpM9 --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Claude <[email protected]>

• dependabot[bot](25 Sept 26)

  Bump the content-scope-scripts group across 1 directory with 2 updates (#3686) Bumps the content-scope-scripts group with 2 updates in the / directory: [@duckduckgo/content-scope-scripts](https://github.com/duckduckgo/content-scope-scripts) and [@duckduckgo/privacy-configuration](https://github.com/duckduckgo/privacy-configuration). Updates `@duckduckgo/content-scope-scripts` from 17.10.0 to 17.11.0 - [Release notes](https://github.com/duckduckgo/content-scope-scripts/releases) - [Commits](https://github.com/duckduckgo/content-scope-scripts/compare/4481961430070c52c29aeb9302a116353ec32db0...ed9d8ca5e3fc1cf55262abfb304edb5319c91a40) Updates `@duckduckgo/privacy-configuration` from `8d35468` to `2ea55dc` - [Release notes](https://github.com/duckduckgo/privacy-configuration/releases) - [Commits](https://github.com/duckduckgo/privacy-configuration/compare/8d35468eec7b467206c5c1385b6b39deb82b3f6d...2ea55dca1ca20e09e49c6b7294eb7db82c767273) --- updated-dependencies: - dependency-name: "@duckduckgo/content-scope-scripts" dependency-version: ed9d8ca5e3fc1cf55262abfb304edb5319c91a40 dependency-type: direct:production dependency-group: content-scope-scripts - dependency-name: "@duckduckgo/privacy-configuration" dependency-version: b4a3a767fe7972a37af4c629fdb8245962b29b0e dependency-type: direct:development dependency-group: content-scope-scripts ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot](25 Sept 26)

  Bump prettier from 3.6.2 to 3.9.8 (#3683) Bumps [prettier](https://github.com/prettier/prettier) from 3.6.2 to 3.9.8. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.6.2...3.9.8) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.8 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot](25 Sept 26)

  Bump mocha from 12.0.1 to 12.0.2 (#3680) Bumps [mocha](https://github.com/mochajs/mocha) from 12.0.1 to 12.0.2. - [Release notes](https://github.com/mochajs/mocha/releases) - [Changelog](https://github.com/mochajs/mocha/blob/main/CHANGELOG.md) - [Commits](https://github.com/mochajs/mocha/compare/v12.0.1...v12.0.2) --- updated-dependencies: - dependency-name: mocha dependency-version: 12.0.2 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot](25 Sept 26)

  Bump metcalfc/changelog-generator from 4.6.2 to 5.0.1 (#3685) Bumps [metcalfc/changelog-generator](https://github.com/metcalfc/changelog-generator) from 4.6.2 to 5.0.1. - [Release notes](https://github.com/metcalfc/changelog-generator/releases) - [Changelog](https://github.com/metcalfc/changelog-generator/blob/main/release-notes.png) - [Commits](https://github.com/metcalfc/changelog-generator/compare/3f82cef08fe5dcf57c591fe165e70e1d5032e15a...031a6408a9ad7fa6dcda49b7222ab2b54110a680) --- updated-dependencies: - dependency-name: metcalfc/changelog-generator dependency-version: 5.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot](25 Sept 26)

  Bump stefanzweifel/git-auto-commit-action from 6.0.1 to 7.2.0 (#3684) Bumps [stefanzweifel/git-auto-commit-action](https://github.com/stefanzweifel/git-auto-commit-action) from 6.0.1 to 7.2.0. - [Release notes](https://github.com/stefanzweifel/git-auto-commit-action/releases) - [Changelog](https://github.com/stefanzweifel/git-auto-commit-action/blob/master/CHANGELOG.md) - [Commits](https://github.com/stefanzweifel/git-auto-commit-action/compare/778341af668090896ca464160c2def5d1d1a3eb0...4a55954c782fc1ea30b9056cd3e7a2b40ca8887d) --- updated-dependencies: - dependency-name: stefanzweifel/git-auto-commit-action dependency-version: 7.2.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>