chore(deps): bump patch-level dependencies - #41653
Conversation
|
Looks like this PR is not ready to merge, because of the following issues:
Please fix the issues and try again If you have any trouble, please check the PR guidelines |
🦋 Changeset detectedLatest commit: dc86b56 The changes in this PR will be included in the next version bump. This PR includes changesets to release 10 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
/jira ARCH-2200 |
WalkthroughThe pull request updates Yarn to 4.18.0 and applies patch-level dependency upgrades across application and workspace manifests. It adds a Changeset for eight affected packages. No public entities or application behavior change. ChangesDependency upgrades
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Warning Review ran into problems🔥 ProblemsErrors were encountered while retrieving linked issues. Errors (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## develop #41653 +/- ##
===========================================
- Coverage 68.93% 68.92% -0.01%
===========================================
Files 4219 4219
Lines 165857 165857
Branches 29503 29503
===========================================
- Hits 114330 114316 -14
- Misses 46358 46378 +20
+ Partials 5169 5163 -6
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
179be6c to
3d4c837
Compare
Bumps react/react-dom/react-is to 19.2.8, ws to 8.21.3, nodemailer to 9.0.5, mailparser to 3.9.15, google-libphonenumber to 3.2.46, twitter-api-v2 to 1.29.1, ip-range-check to 0.2.1, esbuild to 0.28.2, @octokit/core to 7.0.7 and @octokit/plugin-throttling to 11.0.5, plus build and test tooling (@swc/core, ts-jest, rollup, html-webpack-plugin, @vitejs/plugin-react, @testing-library/user-event, @types/*). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
packages/release-action/package.json (1)
29-29: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winAlign the package manager version with the repository toolchain.
packages/release-action/package.jsondeclaresyarn@4.12.0, while both the root manifest and.yarnrc.ymluse Yarn4.18.0. Change the nested declaration toyarn@4.18.0, or remove it if the root manifest is canonical. Then runyarn install --immutable.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/release-action/package.json` at line 29, Update the packageManager declaration in packages/release-action/package.json to align with the repository’s Yarn 4.18.0 toolchain, or remove the nested declaration if the root manifest is canonical. Then run yarn install --immutable to validate the dependency state.Source: Learnings
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@packages/release-action/package.json`:
- Line 29: Update the packageManager declaration in
packages/release-action/package.json to align with the repository’s Yarn 4.18.0
toolchain, or remove the nested declaration if the root manifest is canonical.
Then run yarn install --immutable to validate the dependency state.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 001d8be9-6816-497b-9697-8d45eef896a3
⛔ Files ignored due to path filters (3)
.yarn/releases/yarn-4.17.1.cjsis excluded by!**/.yarn/**.yarn/releases/yarn-4.18.0.cjsis excluded by!**/.yarn/**yarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (29)
.changeset/deps-patch-bump-dependencies.md.yarnrc.ymlapps/meteor/ee/server/services/package.jsonapps/meteor/package.jsonapps/uikit-playground/package.jsonee/apps/ddp-streamer/package.jsonee/apps/omnichannel-transcript/package.jsonee/packages/pdf-worker/package.jsonpackage.jsonpackages/apps/package.jsonpackages/ddp-client/package.jsonpackages/fuselage-ui-kit/package.jsonpackages/gazzodown/package.jsonpackages/http-router/package.jsonpackages/jest-presets/package.jsonpackages/livechat/package.jsonpackages/mock-providers/package.jsonpackages/mp3-encoder/package.jsonpackages/release-action/package.jsonpackages/storybook-config/package.jsonpackages/tracing/package.jsonpackages/ui-avatar/package.jsonpackages/ui-client/package.jsonpackages/ui-composer/package.jsonpackages/ui-contexts/package.jsonpackages/ui-kit/package.jsonpackages/ui-video-conf/package.jsonpackages/ui-voip/package.jsonpackages/web-ui-registration/package.json
🚧 Files skipped from review as they are similar to previous changes (22)
- packages/ui-voip/package.json
- apps/meteor/ee/server/services/package.json
- .yarnrc.yml
- packages/web-ui-registration/package.json
- packages/storybook-config/package.json
- package.json
- packages/jest-presets/package.json
- ee/apps/omnichannel-transcript/package.json
- ee/packages/pdf-worker/package.json
- ee/apps/ddp-streamer/package.json
- packages/fuselage-ui-kit/package.json
- packages/ui-video-conf/package.json
- packages/gazzodown/package.json
- packages/ui-kit/package.json
- packages/ui-avatar/package.json
- packages/ui-contexts/package.json
- apps/uikit-playground/package.json
- packages/tracing/package.json
- packages/ddp-client/package.json
- packages/ui-composer/package.json
- packages/ui-client/package.json
- packages/mock-providers/package.json
📜 Review details
⏰ Context from checks skipped due to timeout. (4)
- GitHub Check: 📦 Build Packages
- GitHub Check: CodeQL-Build
- GitHub Check: Hacktron Security Check
- GitHub Check: CodeQL-Build
🧰 Additional context used
📓 Path-based instructions (2)
packages/**
📄 CodeRabbit inference engine (CLAUDE.md)
Shared libraries belong in
packages/, while other services belong inapps/andee/.
Files:
packages/apps/package.jsonpackages/mp3-encoder/package.jsonpackages/livechat/package.jsonpackages/release-action/package.jsonpackages/http-router/package.json
apps/meteor/**
📄 CodeRabbit inference engine (CLAUDE.md)
The main Rocket.Chat Meteor application resides in
apps/meteor/; place its application code there rather than in other monorepo areas.
Files:
apps/meteor/package.json
🧠 Learnings (16)
📓 Common learnings
Learnt from: ahmed-n-abdeltwab
Repo: RocketChat/Rocket.Chat PR: 0
File: :0-0
Timestamp: 2026-02-24T19:05:56.710Z
Learning: In Rocket.Chat PRs, keep feature PRs free of unrelated lockfile-only dependency bumps; prefer reverting lockfile drift or isolating such bumps into a separate "chore" commit/PR, and always use yarn install --immutable with the Yarn version pinned in package.json via Corepack.
Learnt from: ahmed-n-abdeltwab
Repo: RocketChat/Rocket.Chat PR: 0
File: :0-0
Timestamp: 2026-02-24T19:05:56.710Z
Learning: Rocket.Chat repo context: When a workspace manifest on develop already pins a dependency version (e.g., packages/web-ui-registration → "rocket.chat/ui-contexts": "27.0.1"), a lockfile change in a feature PR that upgrades only that dependency’s resolution is considered a manifest-driven sync and can be kept, preferably as a small "chore: sync yarn.lock with manifests" commit.
Learnt from: yasnagat
Repo: RocketChat/Rocket.Chat PR: 40950
File: package.json:167-168
Timestamp: 2026-06-15T19:19:01.325Z
Learning: In the RocketChat/Rocket.Chat monorepo's root `package.json`, the Yarn v4 resolution `"uuidnpm:13": "13.0.1"` is intentional. The lockfile resolves four uuid major versions simultaneously (8.3.2, 9.0.1, 11.1.1, 13.0.0) from different dependency chains. Using a bare `"uuid": "13.0.1"` would collapse all of them to v13, breaking packages that depend on ^8.x, ^9.x, and ~11.x. The descriptor-specific `npm:13` key syntax is required to pin only the v13 range without affecting other major version ranges.
Learnt from: yasnagat
Repo: RocketChat/Rocket.Chat PR: 41427
File: package.json:105-106
Timestamp: 2026-07-16T20:32:30.340Z
Learning: In Rocket.Chat’s Yarn dependency management, keep `yarn.lock` entries’ `version:` fields aligned with `package.json` resolution overrides when possible: third-party security tools may parse the lockfile as plain text rather than evaluate Yarn’s resolution engine, causing false unresolved-CVE findings otherwise.
📚 Learning: 2026-06-15T19:19:01.325Z
Learnt from: yasnagat
Repo: RocketChat/Rocket.Chat PR: 40950
File: package.json:167-168
Timestamp: 2026-06-15T19:19:01.325Z
Learning: In the RocketChat/Rocket.Chat monorepo's root `package.json`, the Yarn v4 resolution `"uuidnpm:13": "13.0.1"` is intentional. The lockfile resolves four uuid major versions simultaneously (8.3.2, 9.0.1, 11.1.1, 13.0.0) from different dependency chains. Using a bare `"uuid": "13.0.1"` would collapse all of them to v13, breaking packages that depend on ^8.x, ^9.x, and ~11.x. The descriptor-specific `npm:13` key syntax is required to pin only the v13 range without affecting other major version ranges.
Applied to files:
packages/apps/package.json.changeset/deps-patch-bump-dependencies.mdapps/meteor/package.json
📚 Learning: 2026-06-16T14:13:34.463Z
Learnt from: ricardogarim
Repo: RocketChat/Rocket.Chat PR: 40974
File: packages/web-ui-registration/package.json:31-31
Timestamp: 2026-06-16T14:13:34.463Z
Learning: In Rocket.Chat’s monorepo, when reviewing a dependency entry and flagging that a specific version “does not exist” (e.g., in package.json), first verify the exact package/version directly against the npm registry (use URLs like https://registry.npmjs.org/<package>/<version> or https://www.npmjs.com/package/<package>/v/<version>). Do not rely on web search results for this check, since they may be stale or cached and may not reflect the latest published versions.
Applied to files:
packages/apps/package.jsonpackages/mp3-encoder/package.jsonpackages/livechat/package.jsonpackages/release-action/package.jsonpackages/http-router/package.json
📚 Learning: 2026-06-16T14:13:49.795Z
Learnt from: ricardogarim
Repo: RocketChat/Rocket.Chat PR: 40974
File: packages/web-ui-registration/package.json:26-26
Timestamp: 2026-06-16T14:13:49.795Z
Learning: During code reviews that check whether a dependency version exists in package.json (especially for Rocket.Chat’s rocket.chat/fuselage and related rocket.chat/fuselage-* packages), don’t rely on web search results. Instead, verify the version directly against the npm registry (e.g., via the npm registry API or the canonical package URL https://www.npmjs.com/package/<package>/v/<version>) before deciding that a version bump is invalid. If the version is present in the npm registry, do not flag it as invalid.
Applied to files:
packages/apps/package.jsonpackages/mp3-encoder/package.jsonpackages/livechat/package.jsonpackages/release-action/package.jsonpackages/http-router/package.json
📚 Learning: 2026-06-16T14:13:59.986Z
Learnt from: ricardogarim
Repo: RocketChat/Rocket.Chat PR: 40974
File: packages/ui-video-conf/package.json:25-25
Timestamp: 2026-06-16T14:13:59.986Z
Learning: In the Rocket.Chat monorepo, when reviewing a dependency version bump for rocket.chat/fuselage in a package.json, do not flag the new version constraint as “non-existent” or invalid unless you verify the published versions directly from the npm registry (https://www.npmjs.com/package/rocket.chat/fuselage). Don’t rely on search/web results for available versions since they can be stale.
Applied to files:
packages/apps/package.jsonpackages/mp3-encoder/package.jsonpackages/livechat/package.jsonpackages/release-action/package.jsonpackages/http-router/package.json
📚 Learning: 2026-06-19T20:51:30.340Z
Learnt from: gabriellsh
Repo: RocketChat/Rocket.Chat PR: 40202
File: packages/ui-voip/package.json:12-12
Timestamp: 2026-06-19T20:51:30.340Z
Learning: In the `rocket.chat/ui-voip` package (`packages/ui-voip`), the `build:post` script runs `node --no-warnings dist/generate-landing-view.js`. Despite the TypeScript compiler being configured with `"module": "esnext"`, the `generate-landing-view.tsx` source uses CJS-compatible Node patterns (such as `createRequire`) rather than ESM-only constructs like `import.meta.url`. As a result, Node can execute the compiled output without requiring `"type": "module"` in `package.json`. Do not flag this as a module format mismatch — the build has been verified to work correctly.
Applied to files:
packages/mp3-encoder/package.json.changeset/deps-patch-bump-dependencies.mdpackages/livechat/package.jsonpackages/release-action/package.jsonapps/meteor/package.json
📚 Learning: 2025-11-24T17:08:17.065Z
Learnt from: CR
Repo: RocketChat/Rocket.Chat PR: 0
File: .cursor/rules/playwright.mdc:0-0
Timestamp: 2025-11-24T17:08:17.065Z
Learning: Applies to **/*.{ts,tsx,js} : Write concise, technical TypeScript/JavaScript with accurate typing in Playwright tests
Applied to files:
packages/mp3-encoder/package.jsonpackages/http-router/package.json
📚 Learning: 2026-02-24T19:05:56.710Z
Learnt from: ahmed-n-abdeltwab
Repo: RocketChat/Rocket.Chat PR: 0
File: :0-0
Timestamp: 2026-02-24T19:05:56.710Z
Learning: Rocket.Chat repo context: When a workspace manifest on develop already pins a dependency version (e.g., packages/web-ui-registration → "rocket.chat/ui-contexts": "27.0.1"), a lockfile change in a feature PR that upgrades only that dependency’s resolution is considered a manifest-driven sync and can be kept, preferably as a small "chore: sync yarn.lock with manifests" commit.
Applied to files:
.changeset/deps-patch-bump-dependencies.md
📚 Learning: 2026-02-24T19:05:56.710Z
Learnt from: ahmed-n-abdeltwab
Repo: RocketChat/Rocket.Chat PR: 0
File: :0-0
Timestamp: 2026-02-24T19:05:56.710Z
Learning: In Rocket.Chat PRs, keep feature PRs free of unrelated lockfile-only dependency bumps; prefer reverting lockfile drift or isolating such bumps into a separate "chore" commit/PR, and always use yarn install --immutable with the Yarn version pinned in package.json via Corepack.
Applied to files:
.changeset/deps-patch-bump-dependencies.md
📚 Learning: 2026-03-16T21:50:37.589Z
Learnt from: amitb0ra
Repo: RocketChat/Rocket.Chat PR: 39676
File: .changeset/migrate-users-register-openapi.md:3-3
Timestamp: 2026-03-16T21:50:37.589Z
Learning: For changes related to OpenAPI migrations in Rocket.Chat/OpenAPI, when removing endpoint types and validators from rocket.chat/rest-typings (e.g., UserRegisterParamsPOST, /v1/users.register) document this as a minor changeset (not breaking) per RocketChat/Rocket.Chat-Open-API#150 Rule 7. Note that the endpoint type is re-exposed via a module augmentation .d.ts in the consuming package (e.g., packages/web-ui-registration/src/users-register.d.ts). In reviews, ensure the changeset clearly states: this is a non-breaking change, the major version should not be bumped, and the changeset reflects a minor version bump. Do not treat this as a breaking change during OpenAPI migrations.
Applied to files:
.changeset/deps-patch-bump-dependencies.md
📚 Learning: 2026-07-16T20:32:30.340Z
Learnt from: yasnagat
Repo: RocketChat/Rocket.Chat PR: 41427
File: package.json:105-106
Timestamp: 2026-07-16T20:32:30.340Z
Learning: In Rocket.Chat’s Yarn dependency management, keep `yarn.lock` entries’ `version:` fields aligned with `package.json` resolution overrides when possible: third-party security tools may parse the lockfile as plain text rather than evaluate Yarn’s resolution engine, causing false unresolved-CVE findings otherwise.
Applied to files:
.changeset/deps-patch-bump-dependencies.md
📚 Learning: 2026-02-24T19:09:09.561Z
Learnt from: ahmed-n-abdeltwab
Repo: RocketChat/Rocket.Chat PR: 38974
File: apps/meteor/app/api/server/v1/im.ts:220-221
Timestamp: 2026-02-24T19:09:09.561Z
Learning: In RocketChat/Rocket.Chat OpenAPI migration PRs for apps/meteor/app/api/server/v1 endpoints, maintainers prefer to avoid any logic changes; style-only cleanups (like removing inline comments) may be deferred to follow-ups to keep scope tight.
Applied to files:
.changeset/deps-patch-bump-dependencies.mdapps/meteor/package.json
📚 Learning: 2026-05-06T20:48:08.244Z
Learnt from: d-gubert
Repo: RocketChat/Rocket.Chat PR: 40186
File: apps/meteor/app/apps/server/bridges/uiInteraction.ts:2-2
Timestamp: 2026-05-06T20:48:08.244Z
Learning: In the RocketChat/Rocket.Chat repository, Meteor's bundler does not respect the `exports` keyword in `package.json` files. Deep imports (e.g., `rocket.chat/apps/dist/server/bridges/UiInteractionBridge`) must be used instead of relying on `exports` subpath mappings. Do not suggest adding `exports` map entries to packages consumed by Meteor (e.g., `packages/apps/package.json`) as a fix for deep imports.
Applied to files:
.changeset/deps-patch-bump-dependencies.mdapps/meteor/package.json
📚 Learning: 2026-06-16T14:14:09.051Z
Learnt from: ricardogarim
Repo: RocketChat/Rocket.Chat PR: 40974
File: packages/ui-video-conf/package.json:25-25
Timestamp: 2026-06-16T14:14:09.051Z
Learning: When reviewing rocket.chat/fuselage version bumps in the Rocket.Chat monorepo, do not flag version constraints as non-existent without verifying directly against the npm registry page (https://www.npmjs.com/package/rocket.chat/fuselage). Web search results for npm package versions can be stale and may not reflect the latest published releases.
Applied to files:
.changeset/deps-patch-bump-dependencies.md
📚 Learning: 2026-06-18T21:15:00.821Z
Learnt from: abhinavkrin
Repo: RocketChat/Rocket.Chat PR: 41009
File: apps/meteor/tests/end-to-end/apps/apps-update.ts:27-39
Timestamp: 2026-06-18T21:15:00.821Z
Learning: In Rocket.Chat's Apps Engine, the app update API does not check or enforce version constraints. When writing E2E tests for app updates (e.g., in apps/meteor/tests/end-to-end/apps/apps-update.ts), it is valid and intentional to install and update using the same version fixture (e.g., appUpdateTest v0.0.1 for both install and update). Do not flag same-version update tests as missing a realistic version upgrade scenario.
Applied to files:
.changeset/deps-patch-bump-dependencies.mdapps/meteor/package.json
📚 Learning: 2026-02-25T20:10:16.987Z
Learnt from: ahmed-n-abdeltwab
Repo: RocketChat/Rocket.Chat PR: 38913
File: packages/ddp-client/src/legacy/types/SDKLegacy.ts:34-34
Timestamp: 2026-02-25T20:10:16.987Z
Learning: In the RocketChat/Rocket.Chat monorepo, packages/ddp-client and apps/meteor do not use TypeScript project references. Module augmentations in apps/meteor (e.g., declare module 'rocket.chat/rest-typings') are not visible when compiling packages/ddp-client in isolation, which is why legacy SDK methods that depend on OperationResult types for OpenAPI-migrated endpoints must remain commented out.
Applied to files:
.changeset/deps-patch-bump-dependencies.mdapps/meteor/package.json
🔇 Additional comments (7)
.changeset/deps-patch-bump-dependencies.md (1)
1-12: LGTM!apps/meteor/package.json (1)
199-199: LGTM!Also applies to: 219-219, 223-223, 231-231, 248-248, 264-264, 287-293, 315-315, 346-346, 358-358, 368-368, 381-381, 408-409, 445-445
packages/apps/package.json (1)
42-42: LGTM!packages/http-router/package.json (1)
37-37: LGTM!packages/livechat/package.json (1)
73-73: LGTM!Also applies to: 84-84, 89-89, 97-98
packages/mp3-encoder/package.json (1)
49-50: LGTM!packages/release-action/package.json (1)
15-16: LGTM!Also applies to: 25-25
react, hono, google-libphonenumber, postcss, and build tooling
Proposed changes (including videos or screenshots)
Routine patch-level dependency maintenance, plus a Yarn upgrade. Every bump is patch-only — no minors or majors — and no code changes were needed.
Runtime dependencies
react,react-dom,react-is19.2.7→19.2.8meteor,pdf-worker,uikit-playgroundws8.21.1→8.21.3rocketchat-services,ddp-streamernodemailer9.0.3→9.0.5meteormailparser3.9.14→3.9.15meteorgoogle-libphonenumber3.2.44→3.2.46meteortwitter-api-v21.29.0→1.29.1meteorip-range-check0.2.0→0.2.1meteoresbuild0.28.1→0.28.2apps,release-action@octokit/core7.0.6→7.0.7release-action@octokit/plugin-throttling11.0.3→11.0.5release-action@swc/core1.15.46→1.15.47jest-presetsBuild, test and type tooling (
devDependenciesonly)ts-jest29.4.11→29.4.12·rollup4.62.3→4.62.4·html-webpack-plugin5.6.7→5.6.8·@vitejs/plugin-react6.0.3→6.0.5·@testing-library/user-event14.6.1→14.6.4·@types/react19.2.17→19.2.18·@types/react-dom19.2.3→19.2.4·@types/lodash4.17.24→4.17.25·@types/codemirror5.60.17→5.60.18·@types/google-libphonenumber7.4.30→7.4.31A separate commit upgrades Yarn from
4.17.1to4.18.0.Issue(s)
Steps to test or reproduce
No behavior changes are expected. CI (lint, typecheck, unit and E2E) is the coverage here.
Further comments
This branch was rebased onto #41754, which already carries newer
hono(4.12.34),postcss(8.5.26) anddompurify(3.4.13). Those three bumps were therefore dropped from this PR — the versions ondevelopare equal to or newer than what this branch had proposed.The changeset lists only the packages whose own
dependenciesmoved —@rocket.chat/meteor,rocketchat-services,@rocket.chat/ddp-streamer,@rocket.chat/pdf-worker,@rocket.chat/uikit-playground,@rocket.chat/apps,@rocket.chat/jest-presetsand@rocket.chat/release-action— regardless of whether they are published, since a runtime dependency change is a change to what that package executes.The remaining touched manifests (
livechat,fuselage-ui-kit,gazzodown,http-router,mock-providers,mp3-encoder,storybook-config,tracing,ui-kit, theui-*packages,web-ui-registration,ddp-clientandomnichannel-transcript) only moveddevDependencies, and nopeerDependenciesranges changed anywhere, so those packages produce identical output and are deliberately left out of the changeset.Summary by CodeRabbit
Chores
Release