fix(activity-feed-v2): show comments-disabled states and bump activity-feed to 2.4.0 by abhishek1128 · Pull Request #4756 · box/box-ui-elements

abhishek1128 · 2026-08-06T23:29:46Z

Summary

When file.permissions.can_comment is false, Activity Feed v2 passes areCommentsDisabled to @box/activity-feed and hides the local composer so the feed shows the comments-disabled empty state / footer instead of the editor.
Defaults to comments enabled when can_comment is unset.
Bumps @box/activity-feed to 2.4.0 (adds areCommentsDisabled support) and the peer versions it requires.

Description

Bumps @box/activity-feed to 2.4.0, along with the peer versions activity-feed 2.4.x requires.

Package	Before	After
`@box/activity-feed`	^2.3.12	^2.4.0
`@box/threaded-annotations`	^4.5.3	^4.8.4
`@box/blueprint-web`	^16.18.0	^16.20.5
`@box/blueprint-web-assets`	^5.6.8	^5.7.12
`@box/collaboration-popover`	^2.2.8	^2.2.21
`@box/readable-time`	^2.2.8	^2.2.21
`@box/user-selector`	^2.2.8	^2.2.22

Ranges updated in both devDependencies and peerDependencies; lockfile deduplicated so each bumped package resolves to a single version.

Testing

Pre-push hook build and changedSince tests passed locally
Unit test: can_comment: false sets areCommentsDisabled and does not render the editor

Summary by CodeRabbit

Bug Fixes
- Commenting in the activity feed now respects the file’s comment permissions.
- Users without comment access see comments disabled, and the comment editor is hidden.
- Commenting is also disabled when permission information is unavailable, preventing unintended comment attempts.
- Existing activity feed interactions remain available when users have permission to comment.

Includes peer bumps required by activity-feed 2.4.0: blueprint-web 16.20.5, blueprint-web-assets 5.7.12, collaboration-popover 2.2.21, readable-time 2.2.21, threaded-annotations 4.8.4, user-selector 2.2.22. Lockfile deduplicated.

…mment is false Wire can_comment into ActivityFeed.Root and hide the editor when comments are disabled.

CLAassistant · 2026-08-06T23:29:53Z

All committers have signed the CLA.

coderabbitai · 2026-08-06T23:30:19Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 536c2af5-b3a3-4658-b67c-8ba0fb86d98b

📥 Commits

Reviewing files that changed from the base of the PR and between cfac570 and 8d1c7bc.

📒 Files selected for processing (1)

src/elements/content-sidebar/activity-feed-v2/ActivityFeedV2.tsx

🚧 Files skipped from review as they are similar to previous changes (1)

src/elements/content-sidebar/activity-feed-v2/ActivityFeedV2.tsx

Walkthrough

ActivityFeedV2 now reads file.permissions.can_comment, passes the result to ActivityFeed.Root, and hides the comment editor when commenting is unavailable. Related @box/* development and peer dependency versions are also updated.

Changes

Activity feed comment permissions

Layer / File(s)	Summary
Comment permission flow and coverage `src/elements/content-sidebar/activity-feed-v2/types.ts`, `src/elements/content-sidebar/activity-feed-v2/ActivityFeedV2.tsx`, `src/elements/content-sidebar/activity-feed-v2/__tests__/ActivityFeedV2.test.tsx`	`ActivityFeedV2File` supports `permissions.can_comment`. `ActivityFeed.Root` receives the disabled state, and the editor renders only when commenting is allowed. Tests cover denied, missing, undefined, and enabled comment permissions.
Activity feed dependency updates `package.json`	Related `@box/*` versions are updated in development and peer dependencies.

Estimated code review effort: 2 (Simple) | ~10 minutes

Sequence Diagram(s)

sequenceDiagram
  participant File as File permissions
  participant ActivityFeedV2
  participant Root as ActivityFeed.Root
  participant Editor as Comment editor
  File->>ActivityFeedV2: Provide permissions.can_comment
  ActivityFeedV2->>Root: Set areCommentsDisabled
  ActivityFeedV2->>Editor: Render editor when canComment is true

Possibly related PRs

box/box-ui-elements#4591: Both changes modify ActivityFeedV2.tsx and its tests.
box/box-ui-elements#4620: Both changes modify ActivityFeedV2 file metadata handling, types, and tests.
box/box-ui-elements#4643: Both changes update overlapping @box/* dependency versions.

Suggested labels: ready-to-merge

Suggested reviewers: ahorowitz123, zhirongwang

Poem

A rabbit checks the comment gate,
can_comment sets the state.
The editor waits when access ends,
Tests confirm the rule, dear friends.
New packages hop in line,
The activity feed is fine.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the comments-disabled behavior and dependency upgrade.
Description check	✅ Passed	The description clearly explains the behavior change, dependency updates, and completed testing.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

socket-security · 2026-08-06T23:30:44Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
npm/@box/activity-feed@2.3.12 ⏵ 2.4.0	⁺¹	⁺¹	⁺¹
npm/@box/collaboration-popover@2.2.8 ⏵ 2.2.21			⁺¹
npm/@box/readable-time@2.2.8 ⏵ 2.2.21			⁺¹
npm/@box/threaded-annotations@4.5.3 ⏵ 4.8.4	⁺¹	⁺¹	⁺¹
npm/@box/user-selector@2.2.8 ⏵ 2.2.22
npm/@box/blueprint-web@16.18.0 ⏵ 16.20.5		⁺¹
npm/@box/blueprint-web-assets@5.6.8 ⏵ 5.7.12	⁺¹	⁺¹

View full report

…s unset Treat missing file/permissions as comments disabled, and update tests to cover those cases while explicitly enabling comments where the editor is exercised.

coderabbitai

🧹 Nitpick comments (1)

src/elements/content-sidebar/activity-feed-v2/__tests__/ActivityFeedV2.test.tsx (1)
222-233: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Assert the enabled root prop.

The enabled test checks editor visibility but not lastRootProps.areCommentsDisabled. Add an assertion that the prop is false; otherwise a regression could mark permitted feeds as disabled while this test still passes.
Proposed test assertion
         expect(screen.getByTestId('activity-feed-editor')).toBeVisible();
+        expect(lastRootProps.areCommentsDisabled).toBe(false);
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@src/elements/content-sidebar/activity-feed-v2/__tests__/ActivityFeedV2.test.tsx`
around lines 222 - 233, Add an assertion in the enabled ActivityFeedV2 test to
verify lastRootProps.areCommentsDisabled is false, alongside the existing
visibility assertions. Use the test’s existing root-props capture mechanism and
preserve the current rendering setup.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In
`@src/elements/content-sidebar/activity-feed-v2/__tests__/ActivityFeedV2.test.tsx`:
- Around line 222-233: Add an assertion in the enabled ActivityFeedV2 test to
verify lastRootProps.areCommentsDisabled is false, alongside the existing
visibility assertions. Use the test’s existing root-props capture mechanism and
preserve the current rendering setup.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 05cf7909-641f-4d1f-aeec-1ab1346bcda1

📥 Commits

Reviewing files that changed from the base of the PR and between 71e0ead and 141ac0f.

📒 Files selected for processing (2)

src/elements/content-sidebar/activity-feed-v2/ActivityFeedV2.tsx
src/elements/content-sidebar/activity-feed-v2/__tests__/ActivityFeedV2.test.tsx

…enting is enabled

mergify · 2026-08-07T23:46:05Z

…bump

abhishek1128 added 2 commits August 6, 2026 16:25

fix: bump activity-feed to 2.4.0

fabfe28

Includes peer bumps required by activity-feed 2.4.0: blueprint-web 16.20.5, blueprint-web-assets 5.7.12, collaboration-popover 2.2.21, readable-time 2.2.21, threaded-annotations 4.8.4, user-selector 2.2.22. Lockfile deduplicated.

fix(activity-feed-v2): show comments-disabled empty state when can_co…

71e0ead

…mment is false Wire can_comment into ActivityFeed.Root and hide the editor when comments are disabled.

abhishek1128 requested review from a team as code owners August 6, 2026 23:29

abhishek1128 added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 6, 2026

zhirongwang reviewed Aug 6, 2026

View reviewed changes

Comment thread src/elements/content-sidebar/activity-feed-v2/ActivityFeedV2.tsx Outdated

fix(activity-feed-v2): default can_comment to false when permission i…

141ac0f

…s unset Treat missing file/permissions as comments disabled, and update tests to cover those cases while explicitly enabling comments where the editor is exercised.

coderabbitai Bot reviewed Aug 7, 2026

View reviewed changes

test(activity-feed-v2): assert areCommentsDisabled is false when comm…

cfac570

…enting is enabled

kduncanhsu reviewed Aug 7, 2026

View reviewed changes

Comment thread src/elements/content-sidebar/activity-feed-v2/ActivityFeedV2.tsx Outdated

refactor(activity-feed-v2): use && for optional comment editor render

8d1c7bc

kduncanhsu approved these changes Aug 7, 2026

View reviewed changes

zhirongwang approved these changes Aug 7, 2026

View reviewed changes

abhishek1128 added ready-to-merge and removed ready-to-merge labels Aug 7, 2026

jpan-box approved these changes Aug 7, 2026

View reviewed changes

abhishek1128 added the ready-to-merge label Aug 7, 2026

mergify Bot added the queued label Aug 7, 2026

Merge branch 'master' into fix/activity-feed-v2-comments-disabled-af-…

80d49b9

…bump

mergify Bot merged commit 84b90a7 into box:master Aug 7, 2026
9 of 10 checks passed

mergify Bot removed the queued label Aug 7, 2026

Navigation Menu

Uh oh!

fix(activity-feed-v2): show comments-disabled states and bump activity-feed to 2.4.0 - #4756

fix(activity-feed-v2): show comments-disabled states and bump activity-feed to 2.4.0#4756
mergify[bot] merged 6 commits into
box:masterfrom
abhishek1128:fix/activity-feed-v2-comments-disabled-af-bump

abhishek1128 commented Aug 6, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

CLAassistant commented Aug 6, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Aug 6, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Aug 6, 2026 •

edited

Loading

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

mergify Bot commented Aug 7, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

abhishek1128 commented Aug 6, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Description

Testing

Summary by CodeRabbit

Uh oh!

CLAassistant commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

socket-security Bot commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mergify Bot commented Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merge Queue Status

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

abhishek1128 commented Aug 6, 2026 •

edited by coderabbitai Bot

Loading

CLAassistant commented Aug 6, 2026 •

edited

Loading

coderabbitai Bot commented Aug 6, 2026 •

edited

Loading

socket-security Bot commented Aug 6, 2026 •

edited

Loading

mergify Bot commented Aug 7, 2026 •

edited

Loading