chore(deps): bump nanoid (via postcss and mocha), hono, undici, dompurify, and js-yaml

[yasnagat]

Proposed changes (including videos or screenshots)

This PR bumps nanoid (via postcss and mocha), hono,undici, dompurify, and js-yaml to address related CVEs.

Issue(s)

https://rocketchat.atlassian.net/browse/SB-1014

Steps to test or reproduce

Further comments

Summary by CodeRabbit

• Chores
  • Updated underlying platform components and tooling to newer supported versions.
  • Improved compatibility and maintenance across application infrastructure.
• Bug Fixes
  • Included routine stability updates with no changes to publicly exposed functionality.

[dionisio-bot]

Looks like this PR is ready to merge! 🎉
If you have any trouble, please check the PR guidelines

[changeset-bot]

⚠️ No Changeset found

Latest commit: a981b87

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 2ab22f6a-a35e-438a-b6bf-873f9c63d747

📥 Commits

Reviewing files that changed from the base of the PR and between 0ed4cb3 and a981b87.

⛔ Files ignored due to path filters (1)

• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (6)

• apps/meteor/package.json
• package.json
• packages/gazzodown/package.json
• packages/livechat/package.json
• packages/ui-client/package.json
• packages/web-ui-registration/package.json

🚧 Files skipped from review as they are similar to previous changes (3)

• package.json
• apps/meteor/package.json
• packages/livechat/package.json

📜 Recent review details

⏰ Context from checks skipped due to timeout. (5)

• GitHub Check: cubic · AI code reviewer
• GitHub Check: 📦 Build Packages
• GitHub Check: CodeQL-Build
• GitHub Check: Hacktron Security Check
• GitHub Check: CodeQL-Build

🧰 Additional context used

📓 Path-based instructions (1)

packages/**

📄 CodeRabbit inference engine (CLAUDE.md)

Shared libraries belong in packages/, while other services belong in apps/ and ee/.

Files:

• packages/gazzodown/package.json
• packages/ui-client/package.json
• packages/web-ui-registration/package.json

🧠 Learnings (3)

📚 Learning: 2026-06-16T14:13:34.463Z

Learnt from: ricardogarim
Repo: RocketChat/Rocket.Chat PR: 40974
File: packages/web-ui-registration/package.json:31-31
Timestamp: 2026-06-16T14:13:34.463Z
Learning: In Rocket.Chat’s monorepo, when reviewing a dependency entry and flagging that a specific version “does not exist” (e.g., in package.json), first verify the exact package/version directly against the npm registry (use URLs like https://registry.npmjs.org/<package>/<version> or https://www.npmjs.com/package/<package>/v/<version>). Do not rely on web search results for this check, since they may be stale or cached and may not reflect the latest published versions.

Applied to files:

• packages/gazzodown/package.json
• packages/ui-client/package.json
• packages/web-ui-registration/package.json

📚 Learning: 2026-06-16T14:13:49.795Z

Learnt from: ricardogarim
Repo: RocketChat/Rocket.Chat PR: 40974
File: packages/web-ui-registration/package.json:26-26
Timestamp: 2026-06-16T14:13:49.795Z
Learning: During code reviews that check whether a dependency version exists in package.json (especially for Rocket.Chat’s rocket.chat/fuselage and related rocket.chat/fuselage-* packages), don’t rely on web search results. Instead, verify the version directly against the npm registry (e.g., via the npm registry API or the canonical package URL https://www.npmjs.com/package/<package>/v/<version>) before deciding that a version bump is invalid. If the version is present in the npm registry, do not flag it as invalid.

Applied to files:

• packages/gazzodown/package.json
• packages/ui-client/package.json
• packages/web-ui-registration/package.json

📚 Learning: 2026-06-16T14:13:59.986Z

Learnt from: ricardogarim
Repo: RocketChat/Rocket.Chat PR: 40974
File: packages/ui-video-conf/package.json:25-25
Timestamp: 2026-06-16T14:13:59.986Z
Learning: In the Rocket.Chat monorepo, when reviewing a dependency version bump for rocket.chat/fuselage in a package.json, do not flag the new version constraint as “non-existent” or invalid unless you verify the published versions directly from the npm registry (https://www.npmjs.com/package/rocket.chat/fuselage). Don’t rely on search/web results for available versions since they can be stale.

Applied to files:

• packages/gazzodown/package.json
• packages/ui-client/package.json
• packages/web-ui-registration/package.json

🔇 Additional comments (3)

packages/gazzodown/package.json (1)

25-25: LGTM!

packages/ui-client/package.json (1)

22-22: LGTM!

packages/web-ui-registration/package.json (1)

20-20: LGTM!

---

Walkthrough

Dependency versions were updated in application manifests, package manifests, and workspace resolution overrides. The changes cover DOMPurify, Hono, Mocha, PostCSS, Undici, js-yaml, and Minimatch.

Changes

Dependency updates

Layer / File(s)	Summary
Dependency declarations apps/meteor/package.json, packages/http-router/package.json, packages/livechat/package.json, packages/gazzodown/package.json, packages/ui-client/package.json, packages/web-ui-registration/package.json	The manifests update DOMPurify, Hono, Mocha, and PostCSS dependency versions.
Resolution overrides package.json, .github/actions/update-version-durability/package.json	The manifests update PostCSS, js-yaml, Mocha/Minimatch, and Undici resolution overrides.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested labels: type: chore

Suggested reviewers: rocketchat-github-ci

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the dependency updates covered by the pull request, including nanoid, hono, undici, dompurify, and js-yaml.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cubic-dev-ai]

No issues found across 7 files

_{Re-trigger cubic}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.68%. Comparing base (93aa04b) to head (a981b87).
⚠️ Report is 6 commits behind head on develop.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop   #41754      +/-   ##
===========================================
- Coverage    68.68%   68.68%   -0.01%     
===========================================
  Files         4166     4168       +2     
  Lines       159382   159487     +105     
  Branches     28253    28325      +72     
===========================================
+ Hits        109479   109544      +65     
- Misses       44747    44781      +34     
- Partials      5156     5162       +6     

Flag	Coverage Δ
e2e	58.89% <ø> (-0.02%)	⬇️
e2e-api	45.73% <ø> (+0.01%)	⬆️
unit	70.57% <ø> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.