chore(deps): bump activity-feed and threaded-annotations

[jackiejou]

Summary

• Bumps @box/activity-feed to ^1.21.9 and @box/threaded-annotations to ^1.93.2 (latest on npm).
• Bumps peer deps to satisfy the new versions: @box/blueprint-web to ^14.38.0, @box/blueprint-web-assets to ^4.120.5, @box/collaboration-popover to ^1.62.27, @box/readable-time to ^1.41.27, @box/user-selector to ^1.76.27.
• Versions applied to both devDependencies and peerDependencies; yarn.lock updated.

Test plan

• CI green

Summary by CodeRabbit

• Chores
  • Updated multiple internal dependencies including activity feed, collaboration features, annotations, and user management components to their latest compatible versions.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: b707db73-cf00-4fbd-a336-82ee211f0230

📥 Commits

Reviewing files that changed from the base of the PR and between 5b10535 and 66b755b.

⛔ Files ignored due to path filters (1)

• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (1)

• package.json

---

Walkthrough

Seven Box UI component library packages receive version updates across both devDependencies and peerDependencies in package.json, with updates ranging from patch-level increments to minor version increases.

Changes

Dependency Version Updates

Layer / File(s)	Summary
@box/ dependency and peerDependency version updates* package.json	devDependencies and peerDependencies are updated for @box/activity-feed, @box/blueprint-web, @box/blueprint-web-assets, @box/collaboration-popover, @box/readable-time, @box/threaded-annotations, and @box/user-selector to newer patch and minor versions; @box/cldr-data constraint remains at >=34.2.0.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

• box/box-ui-elements#4567: Both PRs bump overlapping @box/* dependency versions in package.json including @box/activity-feed and @box/threaded-annotations.
• box/box-ui-elements#4430: Both PRs update package.json dependency/peerDependency version ranges for @box/blueprint-web and @box/blueprint-web-assets.
• box/box-ui-elements#4101: Both PRs update package.json dependency versions for @box/blueprint-web and @box/blueprint-web-assets in devDependencies and peerDependencies.

Suggested labels

ready-to-merge

Suggested reviewers

• jfox-box
• tjiang-box
• reneshen0328

Poem

🐰 Hopping through the Box libraries so fine,
Version bumps aligned in perfect design,
From blueprint to feeds, they all update their stance,
Modernizing the UI with each careful prance,
Dependencies dancing in harmony's line! 🎉

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main changes in the pull request, specifically identifying the bumping of activity-feed and threaded-annotations as the primary objective.
Description check	✅ Passed	The description provides a clear summary of version bumps, lists all affected dependencies, and includes a test plan with CI verification, covering the essential information about the changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​box/​activity-feed@​1.21.1 ⏵ 1.21.9	-2		-1	+1
	npm/​@​box/​collaboration-popover@​1.62.19 ⏵ 1.62.27	+1
	npm/​@​box/​readable-time@​1.41.19 ⏵ 1.41.27	+1
	npm/​@​box/​threaded-annotations@​1.91.8 ⏵ 1.93.2	-1			+1
	npm/​@​box/​user-selector@​1.76.19 ⏵ 1.76.27	+1
	npm/​@​box/​blueprint-web@​14.33.0 ⏵ 14.38.0	+1
	npm/​@​box/​blueprint-web-assets@​4.119.4 ⏵ 4.120.5	+1		+1

View full report

[coderabbitai]

Actionable comments posted: 0

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-05-28 17:17 UTC · Rule: Automatic strict merge
• ✅ Checks passed · in-place
• ✅ Merged — 2026-05-28 17:35 UTC · at ed5082d467aeaaffba7ee48935daa9d8a9e2d6f4 · squash

This pull request spent 18 minutes 30 seconds in the queue, including 10 minutes 59 seconds running CI.

Required conditions to merge

• #approved-reviews-by >= 1 [🛡 GitHub branch protection]
  • chore(deps): bump activity-feed and threaded-annotations #4597
• #review-threads-unresolved = 0 [🛡 GitHub branch protection]
  • chore(deps): bump activity-feed and threaded-annotations #4597
• github-review-decision = APPROVED [🛡 GitHub branch protection]
  • chore(deps): bump activity-feed and threaded-annotations #4597
• any of [🛡 GitHub branch protection]:
  • check-success = Summary
  • check-neutral = Summary
  • check-skipped = Summary
• any of [🛡 GitHub branch protection]:
  • check-success = lint_test_build
  • check-neutral = lint_test_build
  • check-skipped = lint_test_build
• any of [🛡 GitHub branch protection]:
  • check-success = license/cla
  • check-neutral = license/cla
  • check-skipped = license/cla
• any of [🛡 GitHub branch protection]:
  • check-success = lint_pull_request
  • check-neutral = lint_pull_request
  • check-skipped = lint_pull_request