Bump dependencies

[compulim]

Changelog Entry

Changed

• Bumped dependencies, by @compulim in PR #5836
  • Production dependencies
    • @babel/runtime@7.29.7
    • html-react-parser@6.1.2
    • katex@0.17.0
    • microsoft-cognitiveservices-speech-sdk@1.50.0
    • redux-saga@1.5.0
    • uuid@14.0.0
    • valibot@1.4.1
  • Development dependencies
    • @ast-grep/napi@0.43.0
    • @babel/cli@7.29.7
    • @babel/core@7.29.7
    • @babel/plugin-transform-runtime@7.29.7
    • @babel/plugin-transform-typescript@7.29.7
    • @babel/preset-env@7.29.7
    • @babel/preset-react@7.29.7
    • @babel/preset-typescript@7.29.7
    • @babel/runtime@7.29.7
    • @biomejs/biome@2.4.16
    • @fluentui/react-provider@9.22.17
    • @types/dom-speech-recognition@0.0.11
    • @types/node@25.9.1
    • @types/react@16.14.70
    • @typescript-eslint/eslint-plugin@8.60.0
    • @typescript-eslint/parser@8.60.0
    • axe-core@4.11.4
    • concurrently@10.0.0
    • dtsroll@1.8.2
    • eslint-plugin-prettier@5.5.6
    • keep-a-changelog@3.0.4
    • lint-staged@17.0.5
    • nopt@10.0.0
    • selenium-webdriver@4.44.0
    • webpack-cli@7.0.3
    • webpack@5.107.2
    • yaml@2.9.0

Description

We tried multiple ways to add package.json/overrides to force botframework-streaming to use uuid@14.0.0 but NPM never pick it up.

Design

Specific Changes

• npm run bump
• Remove pinDependencies on uuid and @types/uuid
• npm install uuid@latest -w packages/bundle -w packages/core -w packages/core-graph
• npm uninstall @types/uuid -w packages/bundle -w packages/core -w packages/core-graph
  • Newer version of uuid comes with .d.ts
• Modify Jest config to transform both /node_modules/uuid (existing) and /node_modules/botframework-streaming/uuid (new)

• I have added tests and executed them locally
• I have updated CHANGELOG.md
• I have updated documentation

Review Checklist

This section is for contributors to review your work.

• Accessibility reviewed (tab order, content readability, alt text, color contrast)
• Browser and platform compatibilities reviewed
• CSS styles reviewed (minimal rules, no z-index)
• Documents reviewed (docs, samples, live demo)
• Internationalization reviewed (strings, unit formatting)
• package.json and package-lock.json reviewed
• Security reviewed (no data URIs, check for nonce leak)
• Tests reviewed (coverage, legitimacy)

[Copilot]

Pull request overview

This PR bumps a broad set of dependencies across the BotFramework-WebChat monorepo (packages + samples), including upgrading uuid to 14.0.0, updating various build/test tooling versions, refreshing sample package-lock.json files, and adjusting Jest configuration to handle additional uuid transforms.

Changes:

• Bumped production/dev dependencies across multiple workspace packages (notably uuid, redux-saga, valibot, Babel toolchain, etc.).
• Updated samples to reference a newer botframework-webchat nightly build and regenerated sample lockfiles.
• Updated unit-test Jest config to transform an additional nested uuid path and removed a crypto setup file; added a changelog entry.

Reviewed changes

Copilot reviewed 37 out of 41 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
samples/package-lock.json	Regenerated samples lockfile after dependency/nightly version updates.
samples/06.recomposing-ui/e.extending-ui/package.json	Bumped sample to newer botframework-webchat nightly.
samples/06.recomposing-ui/d.plain-ui/package.json	Bumped sample to newer botframework-webchat nightly.
samples/06.recomposing-ui/c.smart-display/package.json	Bumped sample to newer botframework-webchat nightly.
samples/06.recomposing-ui/b.speech-ui/package.json	Bumped sample to newer botframework-webchat nightly.
samples/06.recomposing-ui/a.minimizable-web-chat/package.json	Bumped sample to newer botframework-webchat nightly.
samples/04.api/h.clear-after-idle/package.json	Bumped sample to newer botframework-webchat nightly.
samples/04.api/g.chat-send-history/package.json	Bumped sample to newer botframework-webchat nightly.
samples/04.api/f.selectable-activity/package.json	Bumped sample to newer botframework-webchat + botframework-webchat-api nightly.
samples/04.api/e.piping-to-redux/package.json	Bumped sample to newer botframework-webchat nightly.
samples/01.getting-started/k.direct-line-token/javascript/web/package-lock.json	Regenerated lockfile for the sample web project.
samples/01.getting-started/k.direct-line-token/javascript/bot/package-lock.json	Regenerated lockfile for the sample bot project.
packages/vibe-grep/package.json	Bumped @ast-grep/napi and yaml.
packages/test/test-assets/package.json	Bumped @fluentui/react-provider.
packages/test/page-object/package.json	Bumped concurrently and Speech SDK.
packages/test/harness/package.json	Bumped concurrently, selenium-webdriver, axe-core.
packages/support/cldr-data-downloader/package.json	Bumped nopt.
packages/styles/package.json	Bumped @types/node.
packages/repack/react/package.json	Bumped @types/react.
packages/repack/react@baseline/package.json	Bumped baseline @types/react.
packages/repack/microsoft-cognitiveservices-speech-sdk/package.json	Bumped repacked Speech SDK to 1.50.0.
packages/repack/html-react-parser/package.json	Bumped html-react-parser.
packages/redux-store/package.json	Bumped valibot and @types/react.
packages/react-valibot/package.json	Bumped @types/react.
packages/isomorphic-react/package.json	Bumped Babel + webpack tooling.
packages/isomorphic-react-dom/package.json	Bumped Babel + webpack tooling.
packages/fluent-theme/package.json	Bumped tooling, @types/*, and valibot.
packages/directlinespeech/package.json	Bumped Babel/tooling/runtime versions.
packages/core/package.json	Bumped core deps including uuid@14.0.0, redux-saga@1.5.0, valibot@1.4.1.
packages/core-graph/package.json	Updated peer dependency range to uuid@^14.0.0, bumped valibot.
packages/component/package.json	Bumped Babel toolchain, types, valibot.
packages/bundle/package.json	Bumped production deps including uuid@14.0.0, katex@0.17.0, Speech SDK 1.50.0, valibot@1.4.1.
packages/base/package.json	Bumped @types/node.
packages/api/package.json	Bumped Babel toolchain, types, valibot.
packages/api-middleware/package.json	Bumped @types/node and valibot.
packages/api-graph/package.json	Bumped valibot.
package.json	Bumped root dev tooling dependencies.
CHANGELOG.md	Added an “Unreleased” changelog entry describing the dependency bumps.
tests/unit.setup/setupFiles/setupCrypto.js	Removed crypto UUID polyfill setup file.
tests/unit.setup/jest.config.js	Added transform exception for nested botframework-streaming uuid; removed setupCrypto from test setup.

Files not reviewed (3)

• samples/01.getting-started/k.direct-line-token/javascript/bot/package-lock.json: Language not supported
• samples/01.getting-started/k.direct-line-token/javascript/web/package-lock.json: Language not supported
• samples/package-lock.json: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.