chore(deps): bump 50 patch-level deps across monorepo by ggazzo · Pull Request #40172 · RocketChat/Rocket.Chat

ggazzo · 2026-04-15T21:02:46Z

Summary

Bumps 50 deps within their current major.minor (no breaking changes), produced via npm-check-updates --target patch across the workspace.
Most-impacted runtime deps: eslint, @types/react, react-virtuoso, webpack, dompurify, hono, katex, @swc/core, vite, ts-jest, esbuild, bson, twilio, zustand, qs, re-resizable, overlayscrollbars, adm-zip, cron, codemirror, turbo, typedoc, uuid, tinybench, sass-loader, ts-loader, @msgpack/msgpack, @noble/ed25519, @octokit/core, @opentelemetry/api, @react-aria/toolbar, @react-spectrum/test-utils, @codemirror/lang-javascript, @xmldom/xmldom, meteor-node-stubs, jsrsasign, sanitize-html, @changesets/cli, plus several eslint-plugin-* and @types/*.
70 package.json files + yarn.lock updated.

Notes

@react-pdf/renderer was held back at ^4.3.2. The 4.3.3 release transitively pulls @react-pdf/image@3.1.0, which references the unpublished package @react-pdf/svg^1.1.0 — yarn install fails. Worth revisiting once upstream republishes a working @react-pdf/image.
@msgpack/msgpack 3.0.0-beta2 → 3.0.1 crosses the prerelease→stable boundary (still within 3.0.x).
katex ~0.16.28 → ~0.16.45 (17 patches behind) and @swc/core 1.15.11 → 1.15.26 (15 patches) are the largest jumps within their patch ranges.

Test plan

yarn install succeeds (peer-deps warnings are pre-existing on develop).
yarn turbo run typecheck passes for 39 workspaces. Pre-existing failures on develop were excluded: core-services, media-calls, federation-matrix, ui-voip, meteor (verified by stashing this PR's changes and reproducing the same failures on develop).
yarn turbo run testunit passes on a representative sample (random, api-client, i18n, tools, log-format, sha256, jwt, ui-kit, message-parser, http-router, gazzodown, web-ui-registration, ui-avatar, ui-composer, tracing). ui-client shows the same 4 pre-existing failures as develop.
CI run on this PR.

🤖 Generated with Claude Code

Summary by CodeRabbit

Chores
- Updated runtime libraries and developer tooling to newer patch/minor releases across the project (UI rendering, math rendering, virtual lists, and build/test/lint tooling).
- No functional changes to behavior or public APIs; stability, security, and build/test tooling improved.

Task: ARCH-2109

dionisio-bot · 2026-04-15T21:02:50Z

Looks like this PR is not ready to merge, because of the following issues:

This PR is targeting the wrong base branch. It should target 8.5.0, but it targets 8.4.0

Please fix the issues and try again

If you have any trouble, please check the PR guidelines

changeset-bot · 2026-04-15T21:02:55Z

⚠️ No Changeset found

Latest commit: db3ce6f

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

coderabbitai · 2026-04-15T21:03:18Z

Walkthrough

This PR updates version ranges across many package.json files in the monorepo—primarily bumping ESLint (~9.39.3 → ~9.39.4) and applying various patch/minor dependency upgrades. No source code, runtime logic, or public API declarations were changed.

Changes

Cohort / File(s)	Summary
Root & Config `package.json`, `packages/eslint-config/package.json`	Bumped root dev tools (`@changesets/cli`, `turbo`) and upgraded ESLint/core ESLint plugins to new patch releases.
Apps (meteor & playground) `apps/meteor/package.json`, `apps/uikit-playground/package.json`	Broad runtime and devDependency bumps in `apps/meteor` (many libs like `katex`, `adm-zip`, `bson`, `react-virtuoso`, etc.); smaller bumps in `apps/uikit-playground`.
Enterprise apps `ee/apps/.../*.package.json`	Multiple EE app manifests updated—mostly ESLint patch bumps; `ddp-streamer` also bumps `uuid`; some update `@types/react`.
Enterprise packages `ee/packages/.../*.package.json`	Mostly ESLint bumps; select packages update types or runtime deps (`sanitize-html`, `@types/ws`, etc.).
Core packages (ESLint-only) `packages/*` (many files, e.g., `packages/account-utils/package.json`, `packages/logger/package.json`, `packages/models/package.json`, ...)	Large set of packages updated only to bump ESLint devDependency from ~9.39.3 → ~9.39.4.
Core packages (multi-dep updates) `packages/apps-engine/package.json`, `packages/agenda/package.json`, `packages/http-router/package.json`, `packages/message-parser/package.json`, `packages/jest-presets/package.json`, `packages/tracing/package.json`, `packages/server-fetch/package.json`, `packages/release-action/package.json`	ESLint plus targeted runtime/devtool bumps (e.g., `@msgpack/msgpack`, `esbuild`, `hono`, `qs`, `@swc/core`, `ts-jest`, `tinybench`, `webpack`, etc.).
UI & Frontend `packages/ui-*`, `packages/fuselage-ui-kit/package.json`, `packages/gazzodown/package.json`, `packages/livechat/package.json`, `packages/web-ui-registration/package.json`, `packages/storybook-config/package.json`	Bumped UI-related deps and types (`@types/react`, `react-virtuoso`, `dompurify`, `katex`, `webpack`) and ESLint across multiple UI packages; some nightly tags updated for `@react-aria/toolbar`.
Build / Tooling `packages/peggy-loader/package.json`, `packages/storybook-config/package.json`, `packages/peggy-loader/package.json`	Updated build tool devDeps (webpack, ts-jest, etc.) and storybook-related packages.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

chore(deps): Patch dependencies #38349: Overlapping dependency/version bumps across many package.json files (includes apps/meteor and similar packages).
chore(deps): Upgrade some dependencies #37508: Similar monorepo-wide dependency upgrades touching apps/meteor and multiple packages.
chore(deps): Upgrade some dependencies #36905: Related chore updating dependency versions across package manifests.

Suggested reviewers

d-gubert

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The pull request title clearly and concisely summarizes the main change: bumping 50 patch-level dependencies across the monorepo.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

cubic-dev-ai

1 issue found across 71 files

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="packages/apps-engine/package.json">

<violation number="1" location="packages/apps-engine/package.json:80">
P2: Keep the msgpack version in sync across the Apps Engine and Deno runtime manifests; otherwise the two codecs will run against different library versions.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

codecov · 2026-04-17T23:16:40Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 69.79%. Comparing base (987728a) to head (db3ce6f).
⚠️ Report is 5 commits behind head on develop.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop   #40172      +/-   ##
===========================================
- Coverage    69.87%   69.79%   -0.09%     
===========================================
  Files         3296     3296              
  Lines       119166   119166              
  Branches     21482    21435      -47     
===========================================
- Hits         83270    83169     -101     
- Misses       32611    32689      +78     
- Partials      3285     3308      +23

Flag	Coverage Δ
e2e	`59.68% <ø> (-0.17%)`	⬇️
e2e-api	`46.23% <ø> (-0.06%)`	⬇️
unit	`70.55% <ø> (-0.06%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Bumps within current major.minor (no breaking changes), including: `eslint`, `@types/react`, `react-virtuoso`, `webpack`, `dompurify`, `hono`, `katex`, `@swc/core`, `vite`, `ts-jest`, `esbuild`, `bson`, `twilio`, `zustand`, `qs`, `re-resizable`, `overlayscrollbars`, `adm-zip`, `cron`, `codemirror`, `turbo`, `typedoc`, `uuid`, `tinybench`, `sass-loader`, `ts-loader`, `eslint-plugin-jest`, `eslint-plugin-storybook`, `eslint-plugin-testing-library`, `@msgpack/msgpack`, `@noble/ed25519`, `@octokit/core`, `@opentelemetry/api`, `@react-aria/toolbar`, `@react-spectrum/test-utils`, `@codemirror/lang-javascript`, `@xmldom/xmldom`, `meteor-node-stubs`, `jsrsasign`, `sanitize-html`, `@changesets/cli`, `@types/*`. `@react-pdf/renderer` 4.3.3 was held back at 4.3.2 because it transitively pulls a broken `@react-pdf/image@3.1.0` (references unpublished `@react-pdf/svg`). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

@octokit/core 5.0.2's OctokitOptions no longer carries the throttle option's contextual type, so the inline callbacks in setupOctokit lost their parameter inference and tripped TS7006. Annotate the parameters to match @octokit/plugin-throttling's LimitHandler signature. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Reverts @react-aria/toolbar from ^3.0.0-nightly-ffb1a9d0d-260323 back to ^3.0.0-nightly.5042 — the newer nightly doesn't ship .d.ts files, causing TS7016 in ui-composer build. Also reverts @react-spectrum/test-utils from ~1.0.0-beta.4 back to ~1.0.0-alpha.8 to stay on the known-good pre-release line. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

The newer nightly (ffb1a9d0d-260323) doesn't ship dist/types.d.ts, causing TS7016 during ui-composer build. Pin to the previous nightly (fb28ab3b4-241024) via a resolution entry to match develop's lockfile. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

re-resizable 6.11.2 no longer emits empty class="" attributes on resize handle divs. Updated CallHistoryContextualbar snapshots to match. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…reorder Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…lures Reverts three patch-level bumps suspected of breaking CI: - cron 1.8.3 -> 1.8.2 (migrated moment-timezone -> luxon internally; suspected cause of Livechat business hours failures) - @noble/ed25519 3.0.1 -> 3.0.0 (new modP() with negative-coordinate validation; suspected cause of E2EE placeholder/PDF export timeouts) - hono 4.12.14 -> 4.12.5 pinned exact (cookie/CORS changes across v4.12.9-v4.12.14; suspected cause of ABAC PERMIT and iframe auth fails) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…patch versions The caret spec (^X.Y.Z) allowed minor version jumps far beyond what a patch-level bump should be: - react-virtuoso: 4.12.0 -> 4.18.5 (+6 minor versions) — likely cause of the channel/team-management members dialog test failures - overlayscrollbars: 2.11.4 -> 2.15.1 (+4 minor versions) - twilio: 5.4.2 -> 5.13.1 (+9 minor versions) Replace ^ with ~ to stay within patch-level. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ggazzo · 2026-04-22T18:04:45Z

/jira ARCH-2083

dionisio-bot · 2026-04-22T18:04:51Z

⚠️ Dionisio (Jira)

The milestone "8.5.0" does not exist on the Jira board; the task was created without Fix version.

ggazzo requested review from a team as code owners April 15, 2026 21:02

ggazzo marked this pull request as draft April 15, 2026 21:03

coderabbitai Bot added the type: chore label Apr 15, 2026

cubic-dev-ai Bot reviewed Apr 15, 2026

View reviewed changes

Comment thread packages/apps-engine/package.json

ggazzo mentioned this pull request Apr 15, 2026

chore(deps): close ~36 Dependabot advisories via resolutions and direct bumps #40174

Merged

6 tasks

ggazzo force-pushed the chore/deps-bump branch 3 times, most recently from 9fae619 to b1435ff Compare April 17, 2026 22:58

ggazzo force-pushed the chore/deps-bump branch 3 times, most recently from 72a7d62 to e84897e Compare April 22, 2026 15:10

ggazzo and others added 8 commits April 22, 2026 13:29

test(ui-voip): update snapshots for re-resizable 6.11.2

bb3c13f

re-resizable 6.11.2 no longer emits empty class="" attributes on resize handle divs. Updated CallHistoryContextualbar snapshots to match. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

test(room-members): update snapshots for react-virtuoso CSS property …

793477f

…reorder Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ggazzo force-pushed the chore/deps-bump branch from e84897e to db3ce6f Compare April 22, 2026 16:49

ggazzo added this to the 8.5.0 milestone Apr 22, 2026

ggazzo marked this pull request as ready for review April 22, 2026 18:03

ggazzo added the stat: QA assured Means it has been tested and approved by a company insider label Apr 22, 2026

coderabbitai Bot removed the type: chore label Apr 22, 2026

tassoevan approved these changes Apr 22, 2026

View reviewed changes

tassoevan enabled auto-merge April 22, 2026 18:14

ggazzo disabled auto-merge April 22, 2026 18:15

ggazzo merged commit 0d68957 into develop Apr 22, 2026
81 of 83 checks passed

ggazzo deleted the chore/deps-bump branch April 22, 2026 18:15

This was referenced Apr 22, 2026

chore(deps): bump 6 patch-level deps #40261

Merged

chore(deps): bump hono from 4.12.5 to 4.12.14 (combines #40260, #40258) #40263

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump 50 patch-level deps across monorepo#40172

chore(deps): bump 50 patch-level deps across monorepo#40172
ggazzo merged 8 commits intodevelopfrom
chore/deps-bump

ggazzo commented Apr 15, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

dionisio-bot Bot commented Apr 15, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Apr 15, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Apr 15, 2026 •

edited

Loading

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

Uh oh!

codecov Bot commented Apr 17, 2026 •

edited

Loading

Uh oh!

ggazzo commented Apr 22, 2026

Uh oh!

dionisio-bot Bot commented Apr 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

ggazzo commented Apr 15, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Notes

Test plan

Summary by CodeRabbit

Uh oh!

dionisio-bot Bot commented Apr 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot Bot commented Apr 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

coderabbitai Bot commented Apr 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested reviewers

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

codecov Bot commented Apr 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

ggazzo commented Apr 22, 2026

Uh oh!

dionisio-bot Bot commented Apr 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ggazzo commented Apr 15, 2026 •

edited by coderabbitai Bot

Loading

dionisio-bot Bot commented Apr 15, 2026 •

edited

Loading

changeset-bot Bot commented Apr 15, 2026 •

edited

Loading

coderabbitai Bot commented Apr 15, 2026 •

edited

Loading

codecov Bot commented Apr 17, 2026 •

edited

Loading