chore: bump threaded-annotations to 4.0.3 and activity-feed to 2.2.1

[jackiejou]

Description

Bumps @box/threaded-annotations to 4.0.3 and @box/activity-feed to 2.2.1, along with the peer versions threaded-annotations 4.x requires.

Package	Before	After
@box/threaded-annotations	^3.1.1	^4.0.3
@box/activity-feed	^2.1.9	^2.2.1
@box/blueprint-web	^16.1.4	^16.8.0
@box/blueprint-web-assets	^5.2.2	^5.4.3
@box/collaboration-popover	^2.1.4	^2.1.23
@box/readable-time	^2.1.4	^2.1.23
@box/user-selector	^2.1.5	^2.1.24

Notable changes pulled in by threaded-annotations 4.x:

• Updated resin analytics targets for activity feed v2 (new feature constant, renamed comment card target, new delete confirm/cancel, mention, and profile link targets)
• New defaultExpanded prop on the v2 threaded annotations component
• Styling fixes across the v2 message components

@box/activity-feed moves in lockstep since 2.2.1 peers on threaded-annotations ^4.0.3 and blueprint-web ^16.8.0.

Ranges updated in both devDependencies and peerDependencies; lockfile deduplicated so each bumped package resolves to a single version.

Testing

• yarn test --watchAll=false --testPathPattern="activity-feed-v2" - 11 suites, 341 tests passed.

Summary by CodeRabbit

• Chores
  • Updated several Box UI package versions to maintain compatibility and support the latest improvements.
  • Aligned development and peer dependency versions across the affected UI components.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​box/​activity-feed@​2.1.9 ⏵ 2.2.1				+1
	npm/​@​box/​collaboration-popover@​2.1.4 ⏵ 2.1.23				+1
	npm/​@​box/​readable-time@​2.1.4 ⏵ 2.1.23				+1
	npm/​@​box/​user-selector@​2.1.5 ⏵ 2.1.24	+1		+1
	npm/​@​box/​threaded-annotations@​3.1.1 ⏵ 4.0.3	+1		+1	+1
	npm/​@​box/​blueprint-web-assets@​5.2.2 ⏵ 5.4.3	+1		+1
	npm/​@​box/​blueprint-web@​16.1.4 ⏵ 16.8.0	+1		+1

View full report

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 1be58d5a-6ed3-4742-aec9-50493730881f

📥 Commits

Reviewing files that changed from the base of the PR and between ab66f5f and 09ca114.

⛔ Files ignored due to path filters (1)

• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (1)

• package.json

---

Walkthrough

Updated seven Box UI package versions in devDependencies and peerDependencies within package.json.

Changes

Dependency alignment

Layer / File(s)	Summary
Update Box UI package versions package.json	Development and peer dependency versions for activity feed, Blueprint, collaboration popover, readable time, threaded annotations, and user selector packages were bumped consistently.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• box/box-ui-elements#4648: Updates the same set of Box UI package versions.
• box/box-ui-elements#4597: Updates matching Box UI dependency ranges in both dependency sections.
• box/box-ui-elements#4619: Overlaps on the same Box UI dependency version updates.

Suggested labels: ready-to-merge

Suggested reviewers: ahorowitz123, jfox-box, tjiang-box

Poem

I’m a rabbit with packages neat,
Seven versions now hop to the beat.
Dev and peer paths align,
In the manifest they shine—
A tidy update, crisp and complete!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly matches the main dependency version bumps in the pull request.
Description check	✅ Passed	The description includes a clear summary, version table, notable changes, and testing details.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}