Skip to content

chore(deps): bump patch-level dependencies - #41653

Open
tassoevan wants to merge 2 commits into
developfrom
chore/deps
Open

chore(deps): bump patch-level dependencies#41653
tassoevan wants to merge 2 commits into
developfrom
chore/deps

Conversation

@tassoevan

@tassoevan tassoevan commented Jul 31, 2026

Copy link
Copy Markdown
Member

Proposed changes (including videos or screenshots)

Routine patch-level dependency maintenance, plus a Yarn upgrade. Every bump is patch-only — no minors or majors — and no code changes were needed.

Runtime dependencies

Dependency Bump Affected packages
react, react-dom, react-is 19.2.719.2.8 meteor, pdf-worker, uikit-playground
ws 8.21.18.21.3 rocketchat-services, ddp-streamer
nodemailer 9.0.39.0.5 meteor
mailparser 3.9.143.9.15 meteor
google-libphonenumber 3.2.443.2.46 meteor
twitter-api-v2 1.29.01.29.1 meteor
ip-range-check 0.2.00.2.1 meteor
esbuild 0.28.10.28.2 apps, release-action
@octokit/core 7.0.67.0.7 release-action
@octokit/plugin-throttling 11.0.311.0.5 release-action
@swc/core 1.15.461.15.47 jest-presets

Build, test and type tooling (devDependencies only)

ts-jest 29.4.1129.4.12 · rollup 4.62.34.62.4 · html-webpack-plugin 5.6.75.6.8 · @vitejs/plugin-react 6.0.36.0.5 · @testing-library/user-event 14.6.114.6.4 · @types/react 19.2.1719.2.18 · @types/react-dom 19.2.319.2.4 · @types/lodash 4.17.244.17.25 · @types/codemirror 5.60.175.60.18 · @types/google-libphonenumber 7.4.307.4.31

A separate commit upgrades Yarn from 4.17.1 to 4.18.0.

Issue(s)

Steps to test or reproduce

No behavior changes are expected. CI (lint, typecheck, unit and E2E) is the coverage here.

Further comments

This branch was rebased onto #41754, which already carries newer hono (4.12.34), postcss (8.5.26) and dompurify (3.4.13). Those three bumps were therefore dropped from this PR — the versions on develop are equal to or newer than what this branch had proposed.

The changeset lists only the packages whose own dependencies moved — @rocket.chat/meteor, rocketchat-services, @rocket.chat/ddp-streamer, @rocket.chat/pdf-worker, @rocket.chat/uikit-playground, @rocket.chat/apps, @rocket.chat/jest-presets and @rocket.chat/release-action — regardless of whether they are published, since a runtime dependency change is a change to what that package executes.

The remaining touched manifests (livechat, fuselage-ui-kit, gazzodown, http-router, mock-providers, mp3-encoder, storybook-config, tracing, ui-kit, the ui-* packages, web-ui-registration, ddp-client and omnichannel-transcript) only moved devDependencies, and no peerDependencies ranges changed anywhere, so those packages produce identical output and are deliberately left out of the changeset.

Summary by CodeRabbit

  • Chores

    • Updated project tooling and package dependencies to newer patch releases.
    • Updated React, React DOM, type definitions, and related testing utilities.
    • Updated networking, security, build, and release tooling dependencies.
    • Upgraded the project’s Yarn release.
  • Release

    • Prepared patch-level package releases reflecting these dependency updates.

@tassoevan
tassoevan requested review from a team as code owners July 31, 2026 20:00
@tassoevan tassoevan added this to the 8.8.0 milestone Jul 31, 2026
@dionisio-bot

dionisio-bot Bot commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

Looks like this PR is not ready to merge, because of the following issues:

  • This PR is missing the 'stat: QA assured' label

Please fix the issues and try again

If you have any trouble, please check the PR guidelines

@changeset-bot

changeset-bot Bot commented Jul 31, 2026

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: dc86b56

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 10 packages
Name Type
@rocket.chat/meteor Patch
rocketchat-services Patch
@rocket.chat/ddp-streamer Patch
@rocket.chat/pdf-worker Patch
@rocket.chat/uikit-playground Patch
@rocket.chat/apps Patch
@rocket.chat/jest-presets Patch
@rocket.chat/release-action Patch
@rocket.chat/core-typings Patch
@rocket.chat/rest-typings Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@tassoevan

Copy link
Copy Markdown
Member Author

/jira ARCH-2200

@coderabbitai

coderabbitai Bot commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Walkthrough

The pull request updates Yarn to 4.18.0 and applies patch-level dependency upgrades across application and workspace manifests. It adds a Changeset for eight affected packages. No public entities or application behavior change.

Changes

Dependency upgrades

Layer / File(s) Summary
Toolchain and release alignment
.yarnrc.yml, package.json, .changeset/deps-patch-bump-dependencies.md
Yarn references and project configuration now use 4.18.0. The Changeset records patch releases for eight packages.
Application and routing dependencies
apps/meteor/package.json, apps/uikit-playground/package.json, apps/meteor/ee/server/services/package.json, ee/apps/ddp-streamer/package.json, ee/apps/omnichannel-transcript/package.json, ee/packages/pdf-worker/package.json
Application manifests update React, type definitions, WebSocket, mail, API, UI, and related dependencies.
Workspace React and tooling alignment
packages/*/package.json, packages/apps/package.json, packages/release-action/package.json
Workspace manifests update React packages, type definitions, build tools, test tools, release tools, and related dependencies.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly identifies the pull request as a dependency update, which matches the primary changes across the repository.

Warning

Review ran into problems

🔥 Problems

Errors were encountered while retrieving linked issues.

Errors (1)
  • ARCH-2323: Request failed with status code 401

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 26 files

Re-trigger cubic

@codecov

codecov Bot commented Jul 31, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.92%. Comparing base (19dd455) to head (dc86b56).
⚠️ Report is 1 commits behind head on develop.

Additional details and impacted files

Impacted file tree graph

@@             Coverage Diff             @@
##           develop   #41653      +/-   ##
===========================================
- Coverage    68.93%   68.92%   -0.01%     
===========================================
  Files         4219     4219              
  Lines       165857   165857              
  Branches     29503    29503              
===========================================
- Hits        114330   114316      -14     
- Misses       46358    46378      +20     
+ Partials      5169     5163       -6     
Flag Coverage Δ
e2e 58.88% <ø> (-0.01%) ⬇️
e2e-api 45.76% <ø> (+<0.01%) ⬆️
unit 70.81% <ø> (-0.01%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@tassoevan
tassoevan force-pushed the chore/deps branch 2 times, most recently from 179be6c to 3d4c837 Compare August 4, 2026 04:21
@tassoevan
tassoevan requested a review from a team August 12, 2026 04:37
tassoevan and others added 2 commits August 12, 2026 02:05
Bumps react/react-dom/react-is to 19.2.8, ws to 8.21.3, nodemailer to
9.0.5, mailparser to 3.9.15, google-libphonenumber to 3.2.46,
twitter-api-v2 to 1.29.1, ip-range-check to 0.2.1, esbuild to 0.28.2,
@octokit/core to 7.0.7 and @octokit/plugin-throttling to 11.0.5, plus
build and test tooling (@swc/core, ts-jest, rollup, html-webpack-plugin,
@vitejs/plugin-react, @testing-library/user-event, @types/*).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@tassoevan
tassoevan requested a review from a team as a code owner August 12, 2026 05:28
@coderabbitai

coderabbitai Bot commented Aug 12, 2026

Copy link
Copy Markdown
Contributor

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
packages/release-action/package.json (1)

29-29: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

Align the package manager version with the repository toolchain.

packages/release-action/package.json declares yarn@4.12.0, while both the root manifest and .yarnrc.yml use Yarn 4.18.0. Change the nested declaration to yarn@4.18.0, or remove it if the root manifest is canonical. Then run yarn install --immutable.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/release-action/package.json` at line 29, Update the packageManager
declaration in packages/release-action/package.json to align with the
repository’s Yarn 4.18.0 toolchain, or remove the nested declaration if the root
manifest is canonical. Then run yarn install --immutable to validate the
dependency state.

Source: Learnings

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@packages/release-action/package.json`:
- Line 29: Update the packageManager declaration in
packages/release-action/package.json to align with the repository’s Yarn 4.18.0
toolchain, or remove the nested declaration if the root manifest is canonical.
Then run yarn install --immutable to validate the dependency state.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 001d8be9-6816-497b-9697-8d45eef896a3

📥 Commits

Reviewing files that changed from the base of the PR and between e519470 and dc86b56.

⛔ Files ignored due to path filters (3)
  • .yarn/releases/yarn-4.17.1.cjs is excluded by !**/.yarn/**
  • .yarn/releases/yarn-4.18.0.cjs is excluded by !**/.yarn/**
  • yarn.lock is excluded by !**/yarn.lock, !**/*.lock
📒 Files selected for processing (29)
  • .changeset/deps-patch-bump-dependencies.md
  • .yarnrc.yml
  • apps/meteor/ee/server/services/package.json
  • apps/meteor/package.json
  • apps/uikit-playground/package.json
  • ee/apps/ddp-streamer/package.json
  • ee/apps/omnichannel-transcript/package.json
  • ee/packages/pdf-worker/package.json
  • package.json
  • packages/apps/package.json
  • packages/ddp-client/package.json
  • packages/fuselage-ui-kit/package.json
  • packages/gazzodown/package.json
  • packages/http-router/package.json
  • packages/jest-presets/package.json
  • packages/livechat/package.json
  • packages/mock-providers/package.json
  • packages/mp3-encoder/package.json
  • packages/release-action/package.json
  • packages/storybook-config/package.json
  • packages/tracing/package.json
  • packages/ui-avatar/package.json
  • packages/ui-client/package.json
  • packages/ui-composer/package.json
  • packages/ui-contexts/package.json
  • packages/ui-kit/package.json
  • packages/ui-video-conf/package.json
  • packages/ui-voip/package.json
  • packages/web-ui-registration/package.json
🚧 Files skipped from review as they are similar to previous changes (22)
  • packages/ui-voip/package.json
  • apps/meteor/ee/server/services/package.json
  • .yarnrc.yml
  • packages/web-ui-registration/package.json
  • packages/storybook-config/package.json
  • package.json
  • packages/jest-presets/package.json
  • ee/apps/omnichannel-transcript/package.json
  • ee/packages/pdf-worker/package.json
  • ee/apps/ddp-streamer/package.json
  • packages/fuselage-ui-kit/package.json
  • packages/ui-video-conf/package.json
  • packages/gazzodown/package.json
  • packages/ui-kit/package.json
  • packages/ui-avatar/package.json
  • packages/ui-contexts/package.json
  • apps/uikit-playground/package.json
  • packages/tracing/package.json
  • packages/ddp-client/package.json
  • packages/ui-composer/package.json
  • packages/ui-client/package.json
  • packages/mock-providers/package.json
📜 Review details
⏰ Context from checks skipped due to timeout. (4)
  • GitHub Check: 📦 Build Packages
  • GitHub Check: CodeQL-Build
  • GitHub Check: Hacktron Security Check
  • GitHub Check: CodeQL-Build
🧰 Additional context used
📓 Path-based instructions (2)
packages/**

📄 CodeRabbit inference engine (CLAUDE.md)

Shared libraries belong in packages/, while other services belong in apps/ and ee/.

Files:

  • packages/apps/package.json
  • packages/mp3-encoder/package.json
  • packages/livechat/package.json
  • packages/release-action/package.json
  • packages/http-router/package.json
apps/meteor/**

📄 CodeRabbit inference engine (CLAUDE.md)

The main Rocket.Chat Meteor application resides in apps/meteor/; place its application code there rather than in other monorepo areas.

Files:

  • apps/meteor/package.json
🧠 Learnings (16)
📓 Common learnings
Learnt from: ahmed-n-abdeltwab
Repo: RocketChat/Rocket.Chat PR: 0
File: :0-0
Timestamp: 2026-02-24T19:05:56.710Z
Learning: In Rocket.Chat PRs, keep feature PRs free of unrelated lockfile-only dependency bumps; prefer reverting lockfile drift or isolating such bumps into a separate "chore" commit/PR, and always use yarn install --immutable with the Yarn version pinned in package.json via Corepack.
Learnt from: ahmed-n-abdeltwab
Repo: RocketChat/Rocket.Chat PR: 0
File: :0-0
Timestamp: 2026-02-24T19:05:56.710Z
Learning: Rocket.Chat repo context: When a workspace manifest on develop already pins a dependency version (e.g., packages/web-ui-registration → "rocket.chat/ui-contexts": "27.0.1"), a lockfile change in a feature PR that upgrades only that dependency’s resolution is considered a manifest-driven sync and can be kept, preferably as a small "chore: sync yarn.lock with manifests" commit.
Learnt from: yasnagat
Repo: RocketChat/Rocket.Chat PR: 40950
File: package.json:167-168
Timestamp: 2026-06-15T19:19:01.325Z
Learning: In the RocketChat/Rocket.Chat monorepo's root `package.json`, the Yarn v4 resolution `"uuidnpm:13": "13.0.1"` is intentional. The lockfile resolves four uuid major versions simultaneously (8.3.2, 9.0.1, 11.1.1, 13.0.0) from different dependency chains. Using a bare `"uuid": "13.0.1"` would collapse all of them to v13, breaking packages that depend on ^8.x, ^9.x, and ~11.x. The descriptor-specific `npm:13` key syntax is required to pin only the v13 range without affecting other major version ranges.
Learnt from: yasnagat
Repo: RocketChat/Rocket.Chat PR: 41427
File: package.json:105-106
Timestamp: 2026-07-16T20:32:30.340Z
Learning: In Rocket.Chat’s Yarn dependency management, keep `yarn.lock` entries’ `version:` fields aligned with `package.json` resolution overrides when possible: third-party security tools may parse the lockfile as plain text rather than evaluate Yarn’s resolution engine, causing false unresolved-CVE findings otherwise.
📚 Learning: 2026-06-15T19:19:01.325Z
Learnt from: yasnagat
Repo: RocketChat/Rocket.Chat PR: 40950
File: package.json:167-168
Timestamp: 2026-06-15T19:19:01.325Z
Learning: In the RocketChat/Rocket.Chat monorepo's root `package.json`, the Yarn v4 resolution `"uuidnpm:13": "13.0.1"` is intentional. The lockfile resolves four uuid major versions simultaneously (8.3.2, 9.0.1, 11.1.1, 13.0.0) from different dependency chains. Using a bare `"uuid": "13.0.1"` would collapse all of them to v13, breaking packages that depend on ^8.x, ^9.x, and ~11.x. The descriptor-specific `npm:13` key syntax is required to pin only the v13 range without affecting other major version ranges.

Applied to files:

  • packages/apps/package.json
  • .changeset/deps-patch-bump-dependencies.md
  • apps/meteor/package.json
📚 Learning: 2026-06-16T14:13:34.463Z
Learnt from: ricardogarim
Repo: RocketChat/Rocket.Chat PR: 40974
File: packages/web-ui-registration/package.json:31-31
Timestamp: 2026-06-16T14:13:34.463Z
Learning: In Rocket.Chat’s monorepo, when reviewing a dependency entry and flagging that a specific version “does not exist” (e.g., in package.json), first verify the exact package/version directly against the npm registry (use URLs like https://registry.npmjs.org/<package>/<version> or https://www.npmjs.com/package/<package>/v/<version>). Do not rely on web search results for this check, since they may be stale or cached and may not reflect the latest published versions.

Applied to files:

  • packages/apps/package.json
  • packages/mp3-encoder/package.json
  • packages/livechat/package.json
  • packages/release-action/package.json
  • packages/http-router/package.json
📚 Learning: 2026-06-16T14:13:49.795Z
Learnt from: ricardogarim
Repo: RocketChat/Rocket.Chat PR: 40974
File: packages/web-ui-registration/package.json:26-26
Timestamp: 2026-06-16T14:13:49.795Z
Learning: During code reviews that check whether a dependency version exists in package.json (especially for Rocket.Chat’s rocket.chat/fuselage and related rocket.chat/fuselage-* packages), don’t rely on web search results. Instead, verify the version directly against the npm registry (e.g., via the npm registry API or the canonical package URL https://www.npmjs.com/package/<package>/v/<version>) before deciding that a version bump is invalid. If the version is present in the npm registry, do not flag it as invalid.

Applied to files:

  • packages/apps/package.json
  • packages/mp3-encoder/package.json
  • packages/livechat/package.json
  • packages/release-action/package.json
  • packages/http-router/package.json
📚 Learning: 2026-06-16T14:13:59.986Z
Learnt from: ricardogarim
Repo: RocketChat/Rocket.Chat PR: 40974
File: packages/ui-video-conf/package.json:25-25
Timestamp: 2026-06-16T14:13:59.986Z
Learning: In the Rocket.Chat monorepo, when reviewing a dependency version bump for rocket.chat/fuselage in a package.json, do not flag the new version constraint as “non-existent” or invalid unless you verify the published versions directly from the npm registry (https://www.npmjs.com/package/rocket.chat/fuselage). Don’t rely on search/web results for available versions since they can be stale.

Applied to files:

  • packages/apps/package.json
  • packages/mp3-encoder/package.json
  • packages/livechat/package.json
  • packages/release-action/package.json
  • packages/http-router/package.json
📚 Learning: 2026-06-19T20:51:30.340Z
Learnt from: gabriellsh
Repo: RocketChat/Rocket.Chat PR: 40202
File: packages/ui-voip/package.json:12-12
Timestamp: 2026-06-19T20:51:30.340Z
Learning: In the `rocket.chat/ui-voip` package (`packages/ui-voip`), the `build:post` script runs `node --no-warnings dist/generate-landing-view.js`. Despite the TypeScript compiler being configured with `"module": "esnext"`, the `generate-landing-view.tsx` source uses CJS-compatible Node patterns (such as `createRequire`) rather than ESM-only constructs like `import.meta.url`. As a result, Node can execute the compiled output without requiring `"type": "module"` in `package.json`. Do not flag this as a module format mismatch — the build has been verified to work correctly.

Applied to files:

  • packages/mp3-encoder/package.json
  • .changeset/deps-patch-bump-dependencies.md
  • packages/livechat/package.json
  • packages/release-action/package.json
  • apps/meteor/package.json
📚 Learning: 2025-11-24T17:08:17.065Z
Learnt from: CR
Repo: RocketChat/Rocket.Chat PR: 0
File: .cursor/rules/playwright.mdc:0-0
Timestamp: 2025-11-24T17:08:17.065Z
Learning: Applies to **/*.{ts,tsx,js} : Write concise, technical TypeScript/JavaScript with accurate typing in Playwright tests

Applied to files:

  • packages/mp3-encoder/package.json
  • packages/http-router/package.json
📚 Learning: 2026-02-24T19:05:56.710Z
Learnt from: ahmed-n-abdeltwab
Repo: RocketChat/Rocket.Chat PR: 0
File: :0-0
Timestamp: 2026-02-24T19:05:56.710Z
Learning: Rocket.Chat repo context: When a workspace manifest on develop already pins a dependency version (e.g., packages/web-ui-registration → "rocket.chat/ui-contexts": "27.0.1"), a lockfile change in a feature PR that upgrades only that dependency’s resolution is considered a manifest-driven sync and can be kept, preferably as a small "chore: sync yarn.lock with manifests" commit.

Applied to files:

  • .changeset/deps-patch-bump-dependencies.md
📚 Learning: 2026-02-24T19:05:56.710Z
Learnt from: ahmed-n-abdeltwab
Repo: RocketChat/Rocket.Chat PR: 0
File: :0-0
Timestamp: 2026-02-24T19:05:56.710Z
Learning: In Rocket.Chat PRs, keep feature PRs free of unrelated lockfile-only dependency bumps; prefer reverting lockfile drift or isolating such bumps into a separate "chore" commit/PR, and always use yarn install --immutable with the Yarn version pinned in package.json via Corepack.

Applied to files:

  • .changeset/deps-patch-bump-dependencies.md
📚 Learning: 2026-03-16T21:50:37.589Z
Learnt from: amitb0ra
Repo: RocketChat/Rocket.Chat PR: 39676
File: .changeset/migrate-users-register-openapi.md:3-3
Timestamp: 2026-03-16T21:50:37.589Z
Learning: For changes related to OpenAPI migrations in Rocket.Chat/OpenAPI, when removing endpoint types and validators from rocket.chat/rest-typings (e.g., UserRegisterParamsPOST, /v1/users.register) document this as a minor changeset (not breaking) per RocketChat/Rocket.Chat-Open-API#150 Rule 7. Note that the endpoint type is re-exposed via a module augmentation .d.ts in the consuming package (e.g., packages/web-ui-registration/src/users-register.d.ts). In reviews, ensure the changeset clearly states: this is a non-breaking change, the major version should not be bumped, and the changeset reflects a minor version bump. Do not treat this as a breaking change during OpenAPI migrations.

Applied to files:

  • .changeset/deps-patch-bump-dependencies.md
📚 Learning: 2026-07-16T20:32:30.340Z
Learnt from: yasnagat
Repo: RocketChat/Rocket.Chat PR: 41427
File: package.json:105-106
Timestamp: 2026-07-16T20:32:30.340Z
Learning: In Rocket.Chat’s Yarn dependency management, keep `yarn.lock` entries’ `version:` fields aligned with `package.json` resolution overrides when possible: third-party security tools may parse the lockfile as plain text rather than evaluate Yarn’s resolution engine, causing false unresolved-CVE findings otherwise.

Applied to files:

  • .changeset/deps-patch-bump-dependencies.md
📚 Learning: 2026-02-24T19:09:09.561Z
Learnt from: ahmed-n-abdeltwab
Repo: RocketChat/Rocket.Chat PR: 38974
File: apps/meteor/app/api/server/v1/im.ts:220-221
Timestamp: 2026-02-24T19:09:09.561Z
Learning: In RocketChat/Rocket.Chat OpenAPI migration PRs for apps/meteor/app/api/server/v1 endpoints, maintainers prefer to avoid any logic changes; style-only cleanups (like removing inline comments) may be deferred to follow-ups to keep scope tight.

Applied to files:

  • .changeset/deps-patch-bump-dependencies.md
  • apps/meteor/package.json
📚 Learning: 2026-05-06T20:48:08.244Z
Learnt from: d-gubert
Repo: RocketChat/Rocket.Chat PR: 40186
File: apps/meteor/app/apps/server/bridges/uiInteraction.ts:2-2
Timestamp: 2026-05-06T20:48:08.244Z
Learning: In the RocketChat/Rocket.Chat repository, Meteor's bundler does not respect the `exports` keyword in `package.json` files. Deep imports (e.g., `rocket.chat/apps/dist/server/bridges/UiInteractionBridge`) must be used instead of relying on `exports` subpath mappings. Do not suggest adding `exports` map entries to packages consumed by Meteor (e.g., `packages/apps/package.json`) as a fix for deep imports.

Applied to files:

  • .changeset/deps-patch-bump-dependencies.md
  • apps/meteor/package.json
📚 Learning: 2026-06-16T14:14:09.051Z
Learnt from: ricardogarim
Repo: RocketChat/Rocket.Chat PR: 40974
File: packages/ui-video-conf/package.json:25-25
Timestamp: 2026-06-16T14:14:09.051Z
Learning: When reviewing rocket.chat/fuselage version bumps in the Rocket.Chat monorepo, do not flag version constraints as non-existent without verifying directly against the npm registry page (https://www.npmjs.com/package/rocket.chat/fuselage). Web search results for npm package versions can be stale and may not reflect the latest published releases.

Applied to files:

  • .changeset/deps-patch-bump-dependencies.md
📚 Learning: 2026-06-18T21:15:00.821Z
Learnt from: abhinavkrin
Repo: RocketChat/Rocket.Chat PR: 41009
File: apps/meteor/tests/end-to-end/apps/apps-update.ts:27-39
Timestamp: 2026-06-18T21:15:00.821Z
Learning: In Rocket.Chat's Apps Engine, the app update API does not check or enforce version constraints. When writing E2E tests for app updates (e.g., in apps/meteor/tests/end-to-end/apps/apps-update.ts), it is valid and intentional to install and update using the same version fixture (e.g., appUpdateTest v0.0.1 for both install and update). Do not flag same-version update tests as missing a realistic version upgrade scenario.

Applied to files:

  • .changeset/deps-patch-bump-dependencies.md
  • apps/meteor/package.json
📚 Learning: 2026-02-25T20:10:16.987Z
Learnt from: ahmed-n-abdeltwab
Repo: RocketChat/Rocket.Chat PR: 38913
File: packages/ddp-client/src/legacy/types/SDKLegacy.ts:34-34
Timestamp: 2026-02-25T20:10:16.987Z
Learning: In the RocketChat/Rocket.Chat monorepo, packages/ddp-client and apps/meteor do not use TypeScript project references. Module augmentations in apps/meteor (e.g., declare module 'rocket.chat/rest-typings') are not visible when compiling packages/ddp-client in isolation, which is why legacy SDK methods that depend on OperationResult types for OpenAPI-migrated endpoints must remain commented out.

Applied to files:

  • .changeset/deps-patch-bump-dependencies.md
  • apps/meteor/package.json
🔇 Additional comments (7)
.changeset/deps-patch-bump-dependencies.md (1)

1-12: LGTM!

apps/meteor/package.json (1)

199-199: LGTM!

Also applies to: 219-219, 223-223, 231-231, 248-248, 264-264, 287-293, 315-315, 346-346, 358-358, 368-368, 381-381, 408-409, 445-445

packages/apps/package.json (1)

42-42: LGTM!

packages/http-router/package.json (1)

37-37: LGTM!

packages/livechat/package.json (1)

73-73: LGTM!

Also applies to: 84-84, 89-89, 97-98

packages/mp3-encoder/package.json (1)

49-50: LGTM!

packages/release-action/package.json (1)

15-16: LGTM!

Also applies to: 25-25

@tassoevan tassoevan changed the title chore(deps): bump react, hono, google-libphonenumber, postcss, and build tooling chore(deps): bump patch-level dependencies Aug 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants