Modernize: React 18 support and dependency refresh by randytarampi · Pull Request #4 · joindeed/react-activity-feed

randytarampi · 2026-07-10T12:48:38Z

Summary

Builds on the securitize branch (PR #3) with a final modernization pass. Adds React 18 peer dependency support, rebuilds the yarn.lock with updated dependencies, and bumps devDependencies to their latest majors.

Important

This branch includes all commits from securitize. If PR #3 merges first, this PR will automatically reduce to just the single modernization commit below.

Changes

React 18 peer support: peerDependencies widened to react: ^18 || ^17 || ^16.8.0 and react-dom: ^18 || ^17 || ^16.8.0
yarn.lock rebuild: Regenerated with the new dependency ranges
devDependency refresh (bumped to latest majors):

Package	Before	After
`@babel/*`	`^7.13–7.14`	`^7`
`@typescript-eslint/*`	`^4.22`	`^8`
`eslint`	`^7.25`	`^8`
`eslint-config-prettier`	`^8.3`	`^10`
`eslint-config-react-app`	`^6`	`^7`
`eslint-plugin-jest`	`^24`	`^29`
`eslint-plugin-jest-dom`	`^3.8`	`^5`
`eslint-plugin-mdx`	`^1.13`	`^3`
`eslint-plugin-prettier`	`^3.4`	`^4`
`eslint-plugin-promise`	`^5.1`	`^7`
`eslint-plugin-react-hooks`	`^4.2`	`^5`
`eslint-plugin-sonarjs`	`^0.7`	`^0.25.1`
`eslint-plugin-typescript-sort-keys`	`^1.6`	`^3`
`@types/node`	`^15`	`^24`
`babel-plugin-i18next-extract`	`^0.8.3`	`^0.10.0`

New dependency: prop-types: ^15
New resolutions: @babel/core: ^7.29.7, @types/jest: ^29, @types/node: ^24, axios: ^1, lodash: ^4.18.1, lodash-es: ^4.18.1, request: npm:postman-request@2.88.1-postman.48
Dependency bumps: getstream ^7.4.1, react-file-utils ^1.2.0, linkifyjs ^4.3.3, linkify-plugin-mention ^4.3.3, react-image-lightbox ^5.1.4, stream-analytics ^3.4.4, tslib ^2.8.1, url-parse ^1.5.10, i18next ^20.6.1, classnames ^2.5.1, dayjs ^1.11.21, @webscopeio/react-textarea-autocomplete ^4.9.2

Changed files (41 files, +7472 / −5368)

Full diff: securitize...modernize — touches most component files (React 18 compatibility adjustments), package.json, yarn.lock, jest.config.js, .eslintrc.json, and CHANGELOG.md.

Summary by cubic

Adds React 18 support, drops legacy docz/Gatsby docs, and refreshes tooling and dependencies (Node 20.12+), with no public API changes. This clears security advisories and stabilizes the build.

Bug Fixes
- ESLint: switch babel plugin to @babel; update to @babel/no-invalid-this; ignore sx via react/no-unknown-property to prevent false positives.
- Remove docs-specific ignore from .eslintignore.
Dependencies
- Cleanup: remove approvedGitRepositories from .yarnrc.yml.
- Update CHANGELOG.md to document React 18 support and modernization work.

^{Written for commit 3e57a72. Summary will update on new commits.}

bonterra-integrations-serviceuser · 2026-07-10T12:48:50Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

cubic-dev-ai

Review completed against the latest diff

_{Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic}

cubic-dev-ai

Review completed against the latest diff

Not reviewed (too large): docs/page-data/sq/d/1635659820.json (~2 lines) - if these are generated or fixture files, add them to ignored paths to exclude them from future reviews.

_{Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic}

- Remove all docz-related assets: docs/ directory, .docz/ cache, doczrc.js, gatsby-node.js, all .mdx source files, gatsby-theme-docz/, and .github/workflows/docs.yml. - Move test helpers from src/components/docz.tsx to src/components/testUtils.tsx and update Notification.test.tsx import. - Remove docz, eslint-plugin-mdx from devDependencies. - Remove get-intrinsic and tough-cookie resolutions (only needed for the docz/gatsby build). - Remove mdx plugin and overrides from .eslintrc.json. - Remove .docz from .gitignore and docs/ from .eslintignore. - Remove gatsby-theme-docz from tsconfig.json exclude. - Bump engines.node from >=20 to >=20.12.0 (eslint-plugin-jest@^29 requires Node ^20.12.0 || ^22.0.0 || >=24.0.0). - Rebuild yarn.lock without docz/gatsby dependencies.

Support `react@^18`, force `node@>=20`, and rebuild the `yarn.lock` with new dependencies. Let's not plan on touching this for another couple years...

docz v2 / Gatsby v2 / webpack v4 is fundamentally incompatible with the ESM-first dependencies on the modernize branch. The docs build passes on securitize (and will pass on main once securitize merges), but modernize's newer dependency tree introduces too many broken transitive deps for the abandoned docz v2 to handle. The docs build step now uses continue-on-error when the head ref is 'modernize'. Also pin tough-cookie to ^4.1.4 (CJS-compatible) for the modernize branch.

….js.

…hardened mode. The lockfile previously merged diff@npm:5.0.0 and diff@npm:^5.0.0 into a single entry resolving to 5.2.2, which doesn't satisfy mocha@8's exact diff@5.0.0 dependency. Regenerating from scratch produces separate entries: - diff@npm:5.0.0 → 5.0.0 (for mocha@8) - diff@npm:^5.0.0 → 5.2.2 (for other consumers)

- Remove all docz-related assets: docs/ directory, .docz/ cache, doczrc.js, gatsby-node.js, all .mdx source files, gatsby-theme-docz/, and .github/workflows/docs.yml. - Move test helpers from src/components/docz.tsx to src/components/testUtils.tsx and update Notification.test.tsx import. - Remove docz, eslint-plugin-mdx from devDependencies. - Remove get-intrinsic and tough-cookie resolutions (only needed for the docz/gatsby build). - Remove mdx plugin and overrides from .eslintrc.json. - Remove .docz from .gitignore and docs/ from .eslintignore. - Remove gatsby-theme-docz from tsconfig.json exclude. - Bump engines.node from >=20 to >=20.12.0 (eslint-plugin-jest@^29 requires Node ^20.12.0 || ^22.0.0 || >=24.0.0). - Rebuild yarn.lock without docz/gatsby dependencies.

@ts-ignore

- Run prettier on FeedManager.tsx, immutable.ts, tsconfig.json - Add @types/lodash devDependency — was transitive via docz/gatsby on securitize, but the docz removal dropped it from the lockfile - Restore @ts-ignore comments on actor objects in testUtils.tsx — these were present in the original docz.tsx but dropped during the rename. The actor objects lack required EnrichedUser fields (created_at, id, updated_at)

Copilot

Copilot was unable to review this pull request because the user who requested the review is ineligible. To be eligible to request a review, you need a paid Copilot license, or your organization must enable Copilot code review.

Copilot

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

- Remove all docz-related assets: docs/ directory, .docz/ cache, doczrc.js, gatsby-node.js, all .mdx source files, gatsby-theme-docz/, and .github/workflows/docs.yml. - Move test helpers from src/components/docz.tsx to src/components/testUtils.tsx and update Notification.test.tsx import. - Remove docz, eslint-plugin-mdx from devDependencies. - Remove get-intrinsic and tough-cookie resolutions (only needed for the docz/gatsby build). - Remove mdx plugin and overrides from .eslintrc.json. - Remove .docz from .gitignore and docs/ from .eslintignore. - Remove gatsby-theme-docz from tsconfig.json exclude. - Bump engines.node from >=20 to >=20.12.0 (eslint-plugin-jest@^29 requires Node ^20.12.0 || ^22.0.0 || >=24.0.0). - Rebuild yarn.lock without docz/gatsby dependencies.

randytarampi mentioned this pull request Jul 10, 2026

Security: SCA upgrades and tooling modernization #3

Merged

randytarampi changed the base branch from main to securitize July 10, 2026 12:49

randytarampi force-pushed the modernize branch 2 times, most recently from 8ddf119 to 6217bd7 Compare July 10, 2026 13:11

cubic-dev-ai Bot reviewed Jul 10, 2026

View reviewed changes

Comment thread src/components/Dropdown.test.tsx

randytarampi force-pushed the modernize branch 5 times, most recently from 591bcb9 to b1dc6b6 Compare July 10, 2026 16:07

cubic-dev-ai Bot reviewed Jul 10, 2026

View reviewed changes

Comment thread docs/chunk-map.json Outdated

Comment thread package.json

randytarampi force-pushed the modernize branch from 63c694c to 0320219 Compare July 10, 2026 17:07

randytarampi added 5 commits July 10, 2026 19:19

Modernize.

6f855a8

Support `react@^18`, force `node@>=20`, and rebuild the `yarn.lock` with new dependencies. Let's not plan on touching this for another couple years...

Fix eslint warning: remove unused 'stage' and 'path' from gatsby-node…

2b2e03d

….js.

randytarampi self-assigned this Jul 10, 2026

randytarampi added the enhancement New feature or request label Jul 10, 2026

randytarampi force-pushed the modernize branch from 0320219 to b56be7b Compare July 10, 2026 17:56

amodes requested review from Osuka42g and amodes July 13, 2026 10:38

Remove approvedGitRepositories

6fa7481

Copilot AI review requested due to automatic review settings July 20, 2026 13:05

Copilot AI reviewed Jul 20, 2026

randytarampi requested a review from Copilot July 20, 2026 13:53

Copilot started reviewing on behalf of randytarampi July 20, 2026 13:54 View session

Copilot AI reviewed Jul 20, 2026

1.4.2

3e57a72

Osuka42g approved these changes Jul 20, 2026

View reviewed changes

randytarampi merged commit 1f1f7fc into securitize Jul 20, 2026
14 checks passed

This was referenced Jul 20, 2026

fix(security): remediate CVE-2026-29063 in immutable + CVE-2022-24785 in moment #1

Closed

fix(deps): SCA upgrades — immutable (react-activity-feed) #2

Closed

Navigation Menu

Uh oh!

Modernize: React 18 support and dependency refresh - #4

Modernize: React 18 support and dependency refresh#4
randytarampi merged 8 commits into
securitizefrom
modernize

randytarampi commented Jul 10, 2026 •

edited by cubic-dev-ai Bot

Loading

Uh oh!

bonterra-integrations-serviceuser commented Jul 10, 2026 •

edited

Loading

Uh oh!

cubic-dev-ai Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

randytarampi commented Jul 10, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Changed files (41 files, +7472 / −5368)

Summary by cubic

Uh oh!

bonterra-integrations-serviceuser commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

4 participants

randytarampi commented Jul 10, 2026 •

edited by cubic-dev-ai Bot

Loading

bonterra-integrations-serviceuser commented Jul 10, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading