Decision record so the next person to see a dependabot Stream bump does not have to re-derive it. Filed after #1282 pinned the Stream stack to exact versions.
Current pins (as of #1282)
| Package |
Pinned |
True latest |
Held? |
@stream-io/video-react-sdk |
1.42.0 |
1.42.0 |
no — at latest |
stream-chat |
9.52.0 |
9.52.0 stable |
no — at latest stable (v10 is rc.8) |
@stream-io/node-sdk |
0.7.64 |
0.8.3 |
yes |
stream-chat-react |
13.14.6 |
14.12.0 |
yes |
@stream-io/node-sdk 0.8.x — held because it buys nothing
0.8.0's only change is dropping support for Node < 22.12.
The Node floor is not a blocker here — .nvmrc, netlify.toml (NODE_VERSION = "22") and .github/workflows/ci.yaml (node-version: "22") all pin Node 22, which resolves past 22.12. So this is a safe no-op bump whenever dependabot raises it, and it can simply be taken.
It was held only because there is no reason to spend a deploy on it today. Take it opportunistically — next time the stream-communication group PR is being reviewed for another reason.
stream-chat-react v14 — held because it is a project, not a bump
v14 is a design-system refresh: MessageComposer redesigned, MessageActions redesigned, new theming tokens. This repo has a heavy custom chat UI under components/chat/, so every custom surface needs a visual pass.
Do not take this inside a grouped dependabot PR. Per #1078 it needs its own PR with a human visual review of the chat surface. Weeks of work for zero correctness gain, so it should be scheduled deliberately or not at all.
stream-chat v10 — not until it leaves RC
Still rc.8, with breaking renames as recently as rc.6/rc.7 (client.instanceConfigurationService → client.config, Channel.getConfig() removed, client.configs → client.channelServerConfigs, linkPreviews.enabled default flipped). Revisit when a stable v10 ships.
How this resurfaces
.github/dependabot.yml groups @stream-io/* and stream-chat* as stream-communication on major/minor/patch with no ignore rules, so dependabot will keep proposing all of the above. That grouping is why the previous bump (#429) sat stale for six months — it mixed a trivial bump with a v14 rewrite.
When that grouped PR next appears: take the node-sdk bump, drop stream-chat-react v14 from it, and link back here.
Related: #1280, #1078, #1282
Decision record so the next person to see a dependabot Stream bump does not have to re-derive it. Filed after #1282 pinned the Stream stack to exact versions.
Current pins (as of #1282)
@stream-io/video-react-sdkstream-chatrc.8)@stream-io/node-sdkstream-chat-react@stream-io/node-sdk0.8.x — held because it buys nothing0.8.0's only change is dropping support for Node < 22.12.
The Node floor is not a blocker here —
.nvmrc,netlify.toml(NODE_VERSION = "22") and.github/workflows/ci.yaml(node-version: "22") all pin Node 22, which resolves past 22.12. So this is a safe no-op bump whenever dependabot raises it, and it can simply be taken.It was held only because there is no reason to spend a deploy on it today. Take it opportunistically — next time the stream-communication group PR is being reviewed for another reason.
stream-chat-reactv14 — held because it is a project, not a bumpv14 is a design-system refresh: MessageComposer redesigned, MessageActions redesigned, new theming tokens. This repo has a heavy custom chat UI under
components/chat/, so every custom surface needs a visual pass.Do not take this inside a grouped dependabot PR. Per #1078 it needs its own PR with a human visual review of the chat surface. Weeks of work for zero correctness gain, so it should be scheduled deliberately or not at all.
stream-chatv10 — not until it leaves RCStill
rc.8, with breaking renames as recently as rc.6/rc.7 (client.instanceConfigurationService→client.config,Channel.getConfig()removed,client.configs→client.channelServerConfigs,linkPreviews.enableddefault flipped). Revisit when a stable v10 ships.How this resurfaces
.github/dependabot.ymlgroups@stream-io/*andstream-chat*asstream-communicationon major/minor/patch with no ignore rules, so dependabot will keep proposing all of the above. That grouping is why the previous bump (#429) sat stale for six months — it mixed a trivial bump with a v14 rewrite.When that grouped PR next appears: take the node-sdk bump, drop
stream-chat-reactv14 from it, and link back here.Related: #1280, #1078, #1282