chore(deps): bump 50 patch-level deps across monorepo

[ggazzo]

Summary

• Bumps 50 deps within their current major.minor (no breaking changes), produced via npm-check-updates --target patch across the workspace.
• Most-impacted runtime deps: eslint, @types/react, react-virtuoso, webpack, dompurify, hono, katex, @swc/core, vite, ts-jest, esbuild, bson, twilio, zustand, qs, re-resizable, overlayscrollbars, adm-zip, cron, codemirror, turbo, typedoc, uuid, tinybench, sass-loader, ts-loader, @msgpack/msgpack, @noble/ed25519, @octokit/core, @opentelemetry/api, @react-aria/toolbar, @react-spectrum/test-utils, @codemirror/lang-javascript, @xmldom/xmldom, meteor-node-stubs, jsrsasign, sanitize-html, @changesets/cli, plus several eslint-plugin-* and @types/*.
• 70 package.json files + yarn.lock updated.

Notes

• @react-pdf/renderer was held back at ^4.3.2. The 4.3.3 release transitively pulls @react-pdf/image@3.1.0, which references the unpublished package @react-pdf/svg^1.1.0 — yarn install fails. Worth revisiting once upstream republishes a working @react-pdf/image.
• @msgpack/msgpack 3.0.0-beta2 → 3.0.1 crosses the prerelease→stable boundary (still within 3.0.x).
• katex ~0.16.28 → ~0.16.45 (17 patches behind) and @swc/core 1.15.11 → 1.15.26 (15 patches) are the largest jumps within their patch ranges.

Test plan

• yarn install succeeds (peer-deps warnings are pre-existing on develop).
• yarn turbo run typecheck passes for 39 workspaces. Pre-existing failures on develop were excluded: core-services, media-calls, federation-matrix, ui-voip, meteor (verified by stashing this PR's changes and reproducing the same failures on develop).
• yarn turbo run testunit passes on a representative sample (random, api-client, i18n, tools, log-format, sha256, jwt, ui-kit, message-parser, http-router, gazzodown, web-ui-registration, ui-avatar, ui-composer, tracing). ui-client shows the same 4 pre-existing failures as develop.
• CI run on this PR.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated development tooling and dependencies to latest patch versions across the project, including ESLint, testing utilities, and build tools.

[dionisio-bot]

Looks like this PR is not ready to merge, because of the following issues:

• This PR is missing the 'stat: QA assured' label
• This PR is missing the required milestone or project

Please fix the issues and try again

If you have any trouble, please check the PR guidelines

[changeset-bot]

⚠️ No Changeset found

Latest commit: 9fae619

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 175c246e-4558-43b9-acc8-b35b8a7efc28

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Walkthrough

This PR systematically updates dependency and devDependency versions across the monorepo's package.json files. The primary change is bumping eslint from ~9.39.3 to ~9.39.4, with additional patch and minor version updates to dependencies like react-virtuoso, @types/react, webpack, and others across multiple packages.

Changes

Cohort / File(s)	Summary
Root & Core Configuration package.json, packages/eslint-config/package.json	Root package bumps @changesets/cli (^2.27.11 → ^2.27.12), eslint (~9.39.3 → ~9.39.4), and turbo (2.8.12 → 2.8.21). ESLint config updates core ESLint packages and related plugins (@eslint/js, eslint-plugin-jest, eslint-plugin-storybook, eslint-plugin-testing-library).
App-Level Manifests apps/meteor/package.json, apps/uikit-playground/package.json	apps/meteor performs broad dependency updates including @noble/ed25519, @opentelemetry/api, @types/meteor, adm-zip, bson, codemirror, cron, dompurify, hono, jsrsasign, katex, meteor-node-stubs, overlayscrollbars, qs, re-resizable, react-virtuoso, twilio, zustand, and devDependencies. apps/uikit-playground updates @codemirror/lang-javascript, react-virtuoso, and various dev tooling.
Enterprise Apps ee/apps/account-service/package.json, ee/apps/authorization-service/package.json, ee/apps/ddp-streamer/package.json, ee/apps/omnichannel-transcript/package.json, ee/apps/presence-service/package.json, ee/apps/queue-worker/package.json	Updates eslint patch version (~9.39.3 → ~9.39.4); ddp-streamer additionally bumps uuid (^11.0.3 → ^11.0.5); omnichannel-transcript and presence-service also update @types/react and related devDependencies.
Enterprise Packages ee/packages/abac/package.json, ee/packages/federation-matrix/package.json, ee/packages/license/package.json, ee/packages/media-calls/package.json, ee/packages/network-broker/package.json, ee/packages/omni-core-ee/package.json, ee/packages/omnichannel-services/package.json, ee/packages/pdf-worker/package.json, ee/packages/presence/package.json	Most packages update eslint (~9.39.3 → ~9.39.4). federation-matrix additionally bumps sanitize-html (~2.17.0 → ~2.17.3) and @types/sanitize-html; license updates @types/ws (^8.5.13 → ^8.5.14); pdf-worker updates @types/react (~18.3.27 → ~18.3.28).
Core Packages - ESLint Only packages/account-utils/package.json, packages/api-client/package.json, packages/apps/package.json, packages/cas-validate/package.json, packages/core-services/package.json, packages/core-typings/package.json, packages/cron/package.json, packages/ddp-client/package.json, packages/desktop-api/package.json, packages/favicon/package.json, packages/i18n/package.json, packages/instance-status/package.json, packages/jwt/package.json, packages/log-format/package.json, packages/logger/package.json, packages/media-signaling/package.json, packages/message-types/package.json, packages/model-typings/package.json, packages/models/package.json, packages/mongo-adapter/package.json, packages/omni-core/package.json, packages/password-policies/package.json, packages/patch-injection/package.json, packages/random/package.json, packages/release-changelog/package.json, packages/rest-typings/package.json, packages/server-cloud-communication/package.json, packages/sha256/package.json, packages/tools/package.json	Update eslint devDependency from ~9.39.3 to ~9.39.4 only.
Core Packages - Multi-Dependency Updates packages/agenda/package.json, packages/apps-engine/package.json, packages/http-router/package.json, packages/jest-presets/package.json, packages/message-parser/package.json, packages/release-action/package.json, packages/server-fetch/package.json, packages/tracing/package.json	Update eslint plus other dependencies: agenda adds cron (~1.8.2 → ~1.8.3) and @types/debug; apps-engine bumps @msgpack/msgpack, adm-zip, esbuild, and type definitions; http-router updates hono and qs; jest-presets updates @swc/core; message-parser updates tinybench, ts-loader, webpack; release-action updates @octokit/core; server-fetch updates @types/jest; tracing updates @opentelemetry/api and ts-jest.
UI & Frontend Packages packages/fuselage-ui-kit/package.json, packages/gazzodown/package.json, packages/livechat/package.json, packages/ui-avatar/package.json, packages/ui-client/package.json, packages/ui-composer/package.json, packages/ui-contexts/package.json, packages/ui-kit/package.json, packages/ui-video-conf/package.json, packages/ui-voip/package.json, packages/web-ui-registration/package.json	Update eslint, @types/react, react-virtuoso, webpack, and other UI-related dependencies. ui-client and ui-composer update @react-aria/toolbar nightly tags; gazzodown and others update dompurify and katex; ui-voip updates @react-spectrum/test-utils.
Build & Storybook Config packages/peggy-loader/package.json, packages/storybook-config/package.json	Update eslint and webpack; storybook-config additionally updates react-virtuoso.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

• chore(deps): Patch dependencies #38349: Performs broad dependency version bumps across many package.json files (including apps/meteor), following similar patch upgrade patterns.
• chore(deps): Upgrade some dependencies #37508: Updates dependencies across numerous package.json files in the monorepo (apps/meteor, apps/uikit-playground, and various packages).
• chore(deps): Upgrade some dependencies #36905: Dependency-bump chore modifying many package.json files including apps/meteor and other packages.

Suggested labels

type: chore, dependencies

Suggested reviewers

• d-gubert

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cubic-dev-ai]

1 issue found across 71 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="packages/apps-engine/package.json">

<violation number="1" location="packages/apps-engine/package.json:80">
P2: Keep the msgpack version in sync across the Apps Engine and Deno runtime manifests; otherwise the two codecs will run against different library versions.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P2: Keep the msgpack version in sync across the Apps Engine and Deno runtime manifests; otherwise the two codecs will run against different library versions.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At packages/apps-engine/package.json, line 80:

<comment>Keep the msgpack version in sync across the Apps Engine and Deno runtime manifests; otherwise the two codecs will run against different library versions.</comment>

<file context>
@@ -77,10 +77,10 @@
 	"dependencies": {
-		"@msgpack/msgpack": "3.0.0-beta2",
-		"adm-zip": "^0.5.16",
+		"@msgpack/msgpack": "3.0.1",
+		"adm-zip": "^0.5.17",
 		"debug": "^4.3.7",
</file context>