feat(deps): Upgrade blueprint-web to 12.93.4-BUIE #4361
Conversation
WalkthroughUpdates dependency and peerDependency versions in package.json for two Box blueprint packages: Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes
Possibly related PRs
Suggested labels
Suggested reviewers
Poem
Pre-merge checks and finishing touches❌ Failed checks (1 inconclusive)
✅ Passed checks (2 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
package.json (1)
127-127: Consider whether exact pinning is appropriate for the-BUIEsuffixed version.The
^12.93.4-BUIEconstraint uses a caret, which normally allows patch updates. However, if the-BUIEsuffix represents a specific release to resolve CSS issues (per the PR description), you may want to consider whether exact pinning (12.93.4-BUIEwithout the^) would be more appropriate to avoid unexpected version changes.If you want stricter control:
- "@box/blueprint-web": "^12.93.4-BUIE", + "@box/blueprint-web": "12.93.4-BUIE",Also applies to: 299-299
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
yarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (1)
package.json(2 hunks)
🧰 Additional context used
🧠 Learnings (3)
📓 Common learnings
Learnt from: tjuanitas
Repo: box/box-ui-elements PR: 4224
File: package.json:296-297
Timestamp: 2025-08-12T18:04:17.698Z
Learning: In the box-ui-elements project, the team is comfortable with raising peerDependency minimum versions when upgrading blueprint-web packages, even if it's a breaking change for consumers.
📚 Learning: 2025-08-12T18:04:17.698Z
Learnt from: tjuanitas
Repo: box/box-ui-elements PR: 4224
File: package.json:296-297
Timestamp: 2025-08-12T18:04:17.698Z
Learning: In the box-ui-elements project, the team is comfortable with raising peerDependency minimum versions when upgrading blueprint-web packages, even if it's a breaking change for consumers.
Applied to files:
package.json
📚 Learning: 2025-08-21T19:19:44.584Z
Learnt from: jpan-box
Repo: box/box-ui-elements PR: 4237
File: src/api/ZipDownload.ts:6-8
Timestamp: 2025-08-21T19:19:44.584Z
Learning: For Box TypeScript SDK integrations, jpan-box prefers deep imports (e.g., from box-typescript-sdk-gen/lib/schemas/...generated.d.ts.js) over defining local types, citing that Box v2 APIs don't typically have breaking changes, making the deep import approach more viable despite potential brittleness.
Applied to files:
package.json
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
- GitHub Check: lint_test_build
- GitHub Check: Analyze (javascript-typescript)
- GitHub Check: Summary
🔇 Additional comments (1)
package.json (1)
127-128: Consistent dependency updates across devDependencies and peerDependencies.The changes update both
@box/blueprint-weband@box/blueprint-web-assetsconsistently in both sections, maintaining alignment between development and peer dependencies. This is good practice and aligns with the team's approach from prior PRs regarding blueprint-web version updates.Based on learnings from prior Box UI Elements PRs, the team is comfortable with raising peerDependency minimum versions when upgrading blueprint packages.
Also applies to: 299-300
| "@box/blueprint-web": "^12.93.4-BUIE", | ||
| "@box/blueprint-web-assets": "^4.78.4", |
There was a problem hiding this comment.
🧩 Analysis chain
Verify both updated package versions exist on npm registry.
The changes update @box/blueprint-web and @box/blueprint-web-assets consistently across both dependencies and peerDependencies, which is good. However, the -BUIE suffix on the blueprint-web version is non-standard, and web search results suggest @box/blueprint-web-assets 4.78.4 may not exist (latest shown: 4.42.1).
Also applies to: 299-300
🏁 Script executed:
#!/bin/bash
# Verify the specified package versions exist on npm
echo "Checking @box/blueprint-web versions..."
npm view @box/[email protected] version 2>&1
echo ""
echo "Checking @box/blueprint-web-assets versions..."
npm view @box/[email protected] version 2>&1
echo ""
echo "Checking latest versions available..."
npm view @box/blueprint-web@latest version
npm view @box/blueprint-web-assets@latest versionLength of output: 546
🏁 Script executed:
#!/bin/bash
# Check for npm registry configuration and custom build setup
echo "=== Checking for .npmrc configuration ==="
if [ -f .npmrc ]; then
cat .npmrc
else
echo "No .npmrc file found"
fi
echo ""
echo "=== Checking package.json for npm registry config ==="
rg -A 5 '"registry"' package.json 2>/dev/null || echo "No registry config in package.json"
echo ""
echo "=== Searching for BUIE version references ==="
rg -r "BUIE|12\.93\.4" --type=json --type=md . 2>/dev/null | head -20
echo ""
echo "=== Checking for .npmrc.example or similar ==="
fd -i "npmrc" . 2>/dev/null
echo ""
echo "=== Checking package.json scripts for custom build ==="
jq '.scripts' package.json 2>/dev/null | grep -i "build\|publish\|version" || echo "No relevant scripts"Length of output: 11675
🏁 Script executed:
#!/bin/bash
# Get exact content of package.json lines around the changed versions
echo "=== Lines 120-135 of package.json ==="
sed -n '120,135p' package.json
echo ""
echo "=== Lines 295-305 of package.json ==="
sed -n '295,305p' package.json
echo ""
echo "=== Check if yarn.lock or package-lock.json exists ==="
if [ -f yarn.lock ]; then
echo "yarn.lock found - searching for blueprint-web versions..."
grep -A 2 "@box/blueprint-web" yarn.lock | head -20
fi
if [ -f package-lock.json ]; then
echo "package-lock.json found - searching for blueprint-web versions..."
grep -A 2 "@box/blueprint-web" package-lock.json | head -20
fiLength of output: 2110
Remove or clarify the non-standard -BUIE suffix in @box/blueprint-web version spec.
The package.json specifies @box/blueprint-web@^12.93.4-BUIE, but yarn.lock shows it resolves to 12.93.4 (without the suffix) from the public npm registry. The -BUIE suffix doesn't prevent installation but creates a misleading version spec that doesn't match what actually gets installed.
Either: (1) use ^12.93.4 if the intent is the standard version, or (2) if -BUIE represents a custom build, ensure that exact version is published and resolvable. The @box/blueprint-web-assets@^4.78.4 version is correctly specified and resolves as expected.
🤖 Prompt for AI Agents
In package.json around lines 127 to 128, the dependency "@box/blueprint-web":
"^12.93.4-BUIE" uses a non-standard "-BUIE" suffix that does not match the
resolved version in yarn.lock (12.93.4); either remove the suffix and change the
spec to "^12.93.4" or, if "-BUIE" denotes a custom build, publish that exact
semver tag to a registry and update package.json to point to the resolvable
package (or use a cid/git/registry URL that resolves to the custom build) so the
declared version matches what actually installs.
|
No longer needed, upgrading to 12.93.5 |
BUIE needs to be updated to this suffixed version of blueprint to avoid CSS issues.
Summary by CodeRabbit