fix(deps): bump activity-feed and threaded-annotations

[jackiejou]

Summary

• Bump @box/activity-feed to ^1.25.10 and @box/threaded-annotations to ^1.97.16.
• Bump direct peer Box deps to satisfy new peer requirements: @box/blueprint-web ^15.10.0, @box/blueprint-web-assets ^4.131.1, @box/collaboration-popover ^1.64.13, @box/readable-time ^1.43.13, @box/user-selector ^1.78.13.

Test plan

• yarn install clean
• npx yarn-deduplicate yarn.lock applied
• Visually verify the v2 activity feed renders correctly

Summary by CodeRabbit

• Chores
  • Updated internal dependency version ranges in the project configuration for both development and peer requirements to maintain compatibility and stability.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• src/elements/content-sidebar/__tests__/__snapshots__/SidebarFileProperties.test.js.snap is excluded by !**/*.snap

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: dafd17fc-0f84-4939-a861-5dd4f009e7a6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Walkthrough

Seven @box/* packages (activity-feed, blueprint-web, blueprint-web-assets, collaboration-popover, readable-time, threaded-annotations, user-selector) have their version ranges bumped in both devDependencies and peerDependencies sections of package.json. No source code changes are included.

Changes

@box/* Dependency Version Bumps

Layer / File(s)	Summary
devDependencies bumps package.json	Bumps @box/activity-feed, @box/blueprint-web, @box/blueprint-web-assets, @box/collaboration-popover, @box/readable-time, @box/threaded-annotations, and @box/user-selector to newer version ranges.
peerDependencies bumps package.json	Mirrors the same seven version range updates in the peerDependencies section.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

• box/box-ui-elements#4625: Same package.json-only @box/* dependency bumps including @box/activity-feed and @box/threaded-annotations in both devDependencies and peerDependencies.
• box/box-ui-elements#4619: Directly overlapping @box/activity-feed and @box/threaded-annotations version range bumps in package.json.
• box/box-ui-elements#4555: Same pattern of package.json-only bumps for @box/activity-feed and @box/threaded-annotations in both devDependencies and peerDependencies.

Suggested labels

ready-to-merge

Suggested reviewers

• reneshen0328
• JChan106
• ahorowitz123

Poem

🐰 Hop, hop, hooray for versions new,
The @box packages all got their due!
From activity-feed to user-selector's cheer,
Dev and peer deps bumped without a fear.
A rabbit's work is tidy and neat,
Seven packages updated — what a feat! 🎉

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	The title mentions only two of seven updated dependencies and doesn't capture the full scope of the change, which includes multiple peer dependency bumps required to satisfy new peer requirements.	Revise the title to reflect the broader scope of dependency updates, e.g., 'fix(deps): bump activity-feed, threaded-annotations, and peer dependencies' or make it more specific about the peer dependency updates.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description provides a clear summary of all dependency updates, includes a test plan with completed verification steps, and identifies remaining work; it effectively communicates the PR's intent despite not strictly following the template structure.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​box/​activity-feed@​1.25.0 ⏵ 1.25.10				+1
	npm/​@​box/​collaboration-popover@​1.64.5 ⏵ 1.64.13				+1
	npm/​@​box/​readable-time@​1.43.5 ⏵ 1.43.13				+1
	npm/​@​box/​threaded-annotations@​1.97.6 ⏵ 1.97.16	+1		+1	+1
	npm/​@​box/​user-selector@​1.78.5 ⏵ 1.78.13
	npm/​@​box/​blueprint-web@​15.9.0 ⏵ 15.10.0	+1		+1
	npm/​@​box/​blueprint-web-assets@​4.125.1 ⏵ 4.131.1

View full report

[jackiejou]

@Mergifyio queue

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-06-18 18:34 UTC · Rule: Automatic strict merge
• ✅ Checks skipped · PR is already up-to-date
• ✅ Merged — 2026-06-18 18:34 UTC · at 1b433241f73df67971a86af1aeb9d61d1a7d17f4 · squash

This pull request spent 16 seconds in the queue, including 2 seconds running CI.

Required conditions to merge

• #approved-reviews-by >= 1 [🛡 GitHub branch protection]
  • fix(deps): bump activity-feed and threaded-annotations #4640
• #review-threads-unresolved = 0 [🛡 GitHub branch protection]
  • fix(deps): bump activity-feed and threaded-annotations #4640
• github-review-decision = APPROVED [🛡 GitHub branch protection]
  • fix(deps): bump activity-feed and threaded-annotations #4640
• any of [🛡 GitHub branch protection]:
  • check-success = Summary
  • check-neutral = Summary
  • check-skipped = Summary
• any of [🛡 GitHub branch protection]:
  • check-success = lint_test_build
  • check-neutral = lint_test_build
  • check-skipped = lint_test_build
• any of [🛡 GitHub branch protection]:
  • check-success = license/cla
  • check-neutral = license/cla
  • check-skipped = license/cla
• any of [🛡 GitHub branch protection]:
  • check-success = lint_pull_request
  • check-neutral = lint_pull_request
  • check-skipped = lint_pull_request