ChatUI's README and its package.json disagree about which version you get

The unpkg badge serves 0.1.0 while the manifest declares 3.7.0

The badge row at the top of the repository carries two identical npm links, an unpkg link to `@chatui/[email protected]/dist/index.js`, and a jsDelivr link. That unpkg entry belongs to the very first build of the package, while the manifest sitting in the same tree declares 3.9.0. The only release the project tags on record is 0.1.0 from 2020-09-17, and the install line printed underneath carries no version flag at all.

npm install @chatui/core --save

Drop that unpkg URL into a script tag on a page and you load a bundle from 2020 rather than the artifact the install line produces, and the README does not flag the difference. The two npm badges repeat the same package name, so nothing in that row points a reader at the current build either. Everything below the badge, including the browser support table and the usage sample, describes the library as of the manifest, not as of the bundle those links fetch.

One source tree ships as CommonJS, ESM and UMD

Four entry fields route different consumers to different directories. `main` is `lib/index.js` for CommonJS, `module` is `es/index.js` for ES modules, `browser` is `dist/index.js` for a plain script tag, and `typings` is `lib/index.d.ts`, with `style` pointing at `dist/index.css`.

Only three directories appear in the `files` array, dist, es and lib, so nothing under the source folder reaches the published tarball. The less sources are a partial exception, because `copy:less` runs copyfiles over `src/**/*.less` into the es directory, which means styling stays inspectable after an install while component code does not. Fifteen scripts drive the pipeline, from `clean` and `prebuild` through `js:cjs`, `js:esm`, `build:types`, `build:css` and `build:umd`. `prepublishOnly` fires `build` and then `build:umd`, so nothing reaches the registry without all three outputs regenerated.

React is not among the six runtime dependencies

Six packages are named in the dependency block and none of them is React. They are `@babel/runtime` at ^7.22.6, `@babel/runtime-corejs3` at ^7.22.5, `clsx` at ^1.1.1, `core-js` at ^3.31.0, `dompurify` at ^2.3.8 and `intersection-observer` at ^0.12.2. Two of the six are Babel runtime shims and one is a class name joiner, which leaves three doing real browser work.

A package whose own example imports `Chat`, `Bubble` and `useMessages` from `@chatui/core` still needs a React instance from somewhere, and the dependencies block does not list it.

DOMPurify and IntersectionObserver are pinned, then unexplained

Two of the runtime dependencies, dompurify and intersection-observer, are third-party libraries the README never mentions. `dompurify` is pinned at ^2.3.8 and `intersection-observer` at ^0.12.2, while `clsx` at ^1.1.1 keeps class names consistent without a CSS-in-JS layer.

Nothing in the README explains how the sanitiser is configured, whether raw HTML arriving in a message passes through it by default, or what the observer watches for and what it triggers. For a library whose whole job is displaying output written by a remote model, those two defaults matter more than anything on the feature list. Theming, by contrast, gets a heading of its own with an outbound link and no example underneath.

Chrome 49 and IE11 share one support table

The environment table gives Edge 16+, Firefox 31+, Chrome 49+, Safari 9.1+, iOS Safari 9.3+ and Android WebView 6+, and the line above it conditions the whole library on CSS Variables support. Internet Explorer 11 is named separately and works only with polyfills plus a CSS Variables shim, with two named candidates linked.

That variable dependency shows up in the build. `build:css` compiles `src/styles/index.less` into `dist/index.css`, then `prefix` runs postcss over the same file with `NODE_ENV=production` set. Two of the three Babel environments, cjs and esm, are plain directory builds limited to `.ts,.tsx` extensions, so the UMD bundle is the only artifact that passes through rollup.

The usage sample stops inside renderMessageContent

The single usage sample in the repository wires up a message list and a send handler, then cuts off. It imports the stylesheet on its own line, because the package hands you `dist/index.css` and expects your build to load it.

import Chat, { Bubble, useMessages } from '@chatui/core';
import '@chatui/core/dist/index.css';

`useMessages([])` returns `messages`, `appendMsg` and `setTyping`, and the handler fires only when the incoming type is `text` and the trimmed value is non-empty. Outgoing text carries `position: 'right'`, while the reply appended a second later through a `setTimeout` carries no position field at all and takes the default. After that the block stops inside the first line of `renderMessageContent`, so the README does not show what a custom renderer must return.

Theming and translation are two links and no examples

Both headings point outward and stop there. Theme goes to the customize-theme page, internationalization goes to the i18n page, and both live under chatui.io. The README gives no theme object, locale file or worked example of overriding either one.

The feature list above makes considerably larger claims: internationalization for dozens of languages, theme customisation down to every detail, and an accessibility certification credited to an association that carries no link. That same list attributes the interaction patterns to experience with a product called Alime Chatbot, which is the only statement in the file about where the design decisions came from. Two entries in a six-item list are therefore documented somewhere other than here, and the remaining four are adjectives rather than behaviour.

Husky, commitlint, jest and rollup share one repository

The top level is a full contributor setup rather than a demo-only tree. `.eslintrc.js`, `.eslintignore` and `.prettierrc` govern style, `commitlint.config.js` with `@commitlint/cli` 17.6.6 governs commit messages, and `prepare` runs `husky install` against the `.husky/` directory.

Testing runs through `jest.config.js` and `jest.setup.ts` with three entry points: `jest`, `jest --watch` and `jest --coverage`. The last push on the default branch is dated 2026-03-30. Beneath all of that, `demo/` carries its own `package.json`, `index.html`, `vite.config.ts` and three tsconfig files, and the documented development path runs inside that folder rather than at the repository root.

cd demo
npm i
npm run dev

Editorial conclusion

ChatUI earns a slot in any React app that must render a bot transcript and cannot spare the effort to build bubbles, composer and typing states by hand. Pass on it when your own design system already owns that surface, or when you need server rendering guarantees the repository never states. Before you commit, verify two things yourself: React is absent from the six runtime dependencies, and the unpkg link in the badge row serves 0.1.0 while the manifest declares 3.9.0. Read the theming page on chatui.io before planning a theme, because the repository holds no theme object of its own.

Frequently asked questions

Official sources

1. alibaba/ChatUI on GitHub
2. License: MIT
3. Project website
4. README
5. Releases