build(deps): bump @preact/signals from 2.9.0 to 2.9.1

[dependabot]

Bumps @preact/signals from 2.9.0 to 2.9.1.

Changelog

Sourced from @​preact/signals's changelog.

2.9.1

Patch Changes

• #924 ebcee90 Thanks @​JoviDeCroock! - Fix redundant DOM attribute writes when a parent rerenders with unchanged signal props. The DIFFED hook no longer writes Signal references back into vnode.props, which was causing Preact's prop diff to see a mismatch (old: Signal, new: peeked value) and re-apply every signal-bound attribute on every parent rerender.

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Note

Low Risk
Dependency-only patch with no repo code changes; upstream fix targets DOM update efficiency for signal props.

Overview
Bumps @preact/signals from 2.9.0 to 2.9.1 in special-pages (package.json and root package-lock.json). No application source changes.

The patch release fixes redundant DOM attribute writes when a parent rerenders with unchanged signal-bound props (library DIFFED hook behavior), which can reduce unnecessary DOM updates in Preact UIs that use signals (e.g. history and new-tab pages).

^{Reviewed by Cursor Bugbot for commit 039b9ad. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Suggested comment for Cursor review (copy and paste as a new comment):

@cursoragent can you review against the current code and outline potential impacts based on the changelogs of the update?

Can you check the test coverage and ensure that the new code is covered?
Can you think through if this dependency is still needed or if there's better practices used elsewhere.

Can you draft a separate PR with any fixes that might be needed?

Note: GitHub Actions bot cannot trigger Cursor agent directly. Please copy the above comment to invoke the review.

[cursor]

Web Compatibility Assessment

• special-pages/package.json:42, package-lock.json:1917-1919, package-lock.json:11335 - severity: info. No web-compat findings. This is a dependency-only bump for @preact/signals in special-pages; it does not touch injected/src, API wrappers/shims, DDGProxy, captured globals, platform entry points, DOM observer/timer patterns, or remote config.
• Upstream @preact/signals 2.9.1 is a narrow patch for signal-bound DOM prop handling: it avoids redundant unchanged attribute writes and restores signal refs on unmount/remount. That does not broaden page interaction surface and should reduce render-time DOM churn.

Security Assessment

• special-pages/package.json:42, package-lock.json:1917-1919, package-lock.json:11335 - severity: info. No security findings. The diff does not change native messaging schemas/transports, message bridge checks, origin validation, postMessage, network requests, dynamic code execution, iframe handling, or global capture hygiene.
• Package metadata is aligned: peer dependency remains preact >= 10.25.0 || >=11.0.0-0, dependency remains @preact/signals-core ^1.14.0, and the lockfile keeps @preact/signals-core at 1.14.0 with no unrelated churn.

Risk Level

Low Risk - special-pages dependency patch only; no injected runtime or security-sensitive infrastructure changes.

Recommendations

No code changes required from a web-compat/security perspective. Targeted verification run: npm run test-unit --workspace=special-pages passed locally (104 tests).

  

_{Sent by Cursor Automation: Web compat and sec}

[cursor]

No blocking concerns found for this dependency update.

Evidence reviewed:

• PR diff only bumps @preact/signals from 2.9.0 to 2.9.1 in special-pages/package.json and package-lock.json; the resolved transitive @preact/signals-core remains 1.14.0.
• The 2.9.1 package changelog/tarball maps to upstream PR preactjs/signals#924 / commit ebcee906, a patch for redundant signal-bound DOM attribute writes when parents rerender with unchanged signal props. The package diff changes the Preact adapter’s diffed/unmount handling, not public APIs used here.
• Local usage is still concentrated in special-pages/pages/new-tab state/rendering paths (useSignal, useComputed, useSignalEffect, batch, effect, signal). I did not find usage of @preact/signals/utils, <For>, or <Show>.
• Supply-chain checks: package maintainers/license/peer deps are unchanged, no new transitive package was introduced, npm audit --workspace special-pages --omit=dev reports 0 vulnerabilities, and npm audit signatures --workspace special-pages verifies registry signatures/attestations.

Validation run on a clean npm ci install resolving @preact/signals@2.9.1:

• npm ls @preact/signals @preact/signals-core --workspace special-pages
• npm run test-unit --workspace special-pages
• npm run build --workspace special-pages
• Focused new-tab/customizer/activity integrations passed when rerun serially: npm run test-int --workspace special-pages -- --reporter=list --workers=1 pages/new-tab/integration-tests/new-tab.spec.js pages/new-tab/app/customizer/integration-tests/customizer.spec.js pages/new-tab/app/activity/integration-tests/activity.spec.js

Non-blocking caveat: I could not find a GitHub Release object/tag for @preact/signals@2.9.1; the release evidence is from npm metadata/tarball changelog plus the merged upstream PR. Given the lockfile integrity, verified signatures/attestations, and small upstream diff, I do not see this as a blocker.

No separate fix PR was drafted because I did not identify a required fix.

  

_{Sent by Cursor Automation: Review dependabot}