Repository navigation
chore(deps): update non-major - #134
renovate[bot] wants to merge 1 commit into
Conversation
|
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
212f6c7 to
e37d8e5
Compare
1ecd286 to
9423614
Compare
|
All alerts resolved. Learn more about Socket for GitHub. This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored. |
dd71de3 to
dad8d12
Compare
0671ec2 to
c546b7c
Compare
b5fcd04 to
de7e097
Compare
e3b42e9 to
08de102
Compare
d3cc691 to
ea86999
Compare
7465fe0 to
cc74633
Compare
7ce8a20 to
1d1136f
Compare
| "@sanity/tsdown-config": "^0.31.2", | ||
| "oxfmt": "^0.74.0", | ||
| "oxlint": "^1.89.0", | ||
| "oxlint-tsgolint": "^0.25.0", |
There was a problem hiding this comment.
Incompatible oxlint-tsgolint peer version
High Severity
oxlint 1.89.0 requires oxlint-tsgolint >=7.0.2003, but this update leaves oxlint-tsgolint at 0.25.0. The lint script uses --type-aware --type-check, so type-aware linting can fail or skip those rules in CI.
Reviewed by Cursor Bugbot for commit cb03396. Configure here.
| "oxfmt": "^0.74.0", | ||
| "oxlint": "^1.89.0", | ||
| "oxlint-tsgolint": "^0.25.0", | ||
| "tsdown": "^0.23.1", |
There was a problem hiding this comment.
Build tools drop supported Node versions
Medium Severity
tsdown 0.23.1 and @sanity/tsdown-config 0.31.2 require Node ^22.18.0 || ^24.11.0 || >=26.0.0, but this package still declares >=20.19 <22 || >=22.12. pnpm build and pretest will fail on Node 20 and on Node 22 below 22.18.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit cb03396. Configure here.
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
There are 3 total unresolved issues (including 2 from previous reviews).
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 742fee3. Configure here.
| "@changesets/changelog-github": "^0.7.0", | ||
| "@changesets/cli": "^2.31.1", | ||
| "@sanity/tsconfig": "^2.2.1", | ||
| "@sanity/tsdown-config": "^0.31.2", |
There was a problem hiding this comment.
TypeScript peer range no longer satisfied
Medium Severity
@sanity/tsdown-config 0.31.2 requires a typescript peer of 6.x or 7.x, but the repo still pins 5.9.3. That pairing is unsupported and can break defineConfig types or the tsdown build.
Reviewed by Cursor Bugbot for commit 742fee3. Configure here.


Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
^0.5.2→^0.7.0^2.29.8→^2.31.1^2.1.0→^2.2.1^0.5.8→^0.31.2^0.36.0→^0.74.0^1.51.0→^1.89.0^0.16.0→^0.25.04f9cc66→84c30a8^0.20.3→^0.23.2^0.28.17→^0.28.20Release Notes
changesets/changesets (@changesets/changelog-github)
v0.7.0Compare Source
Minor Changes
94578cfThanks @Kauhsa! - AddeddisableThanksoptionv0.6.0Compare Source
Minor Changes
fd0bc2eThanks @mixelburg! - Linkify issue references in changelog entries.Patch Changes
#1810
27fd8f4Thanks @hirasso! - Replace deprecatedString.prototype.trimRightwithString.prototype.trimEndUpdated dependencies [
d4b8ad8,e462d89]:changesets/changesets (@changesets/cli)
v2.31.1Compare Source
Patch Changes
15cf592Thanks @ingvaldlorentzen! - Fixed already-published version detection with npm 12, which always wraps successfulnpm info --jsonoutput in an array. The unwrapped output madechangeset publishtreat every package as unpublished and fail attempting to republish existing versions.v2.31.0Compare Source
Minor Changes
#1889
96ca062Thanks @mixelburg! - Error on unsupported flags for individual CLI commands and print the matching command usage to make mistakes easier to spot.#1873
42943b7Thanks @mixelburg! - Respond to--helpon all subcommands. Previously,--helpwas only handled when it was the sole argument; passing it alongside a subcommand (e.g.changeset version --help) would silently execute the command instead. Now--helpalways exits early and prints per-command usage when a known subcommand is provided, or the general help text otherwise.Patch Changes
d2121dcThanks @Andarist! - Fix npm auth for path-based registries during publish by preserving configured registry URLs instead of normalizing them.#1888
036fdd4Thanks @mixelburg! - Fix severalchangeset versionissues with workspace protocol dependencies. Valid explicitworkspace:ranges and aliases are no longer rewritten unnecessarily, and workspace path references are handled correctly during versioning.#1903
5c4731fThanks @Andarist! - Gracefully handle stalenpm infodata leading to duplicate publish attempts.#1867
f61e716Thanks @Andarist! - Improved detection forpublishedstate of prerelease-only packages withoutlatestdist-tag on GitHub Packages registry.Updated dependencies [
036fdd4,036fdd4,036fdd4]:v2.30.0Compare Source
Minor Changes
#1840
057cca2Thanks @wotan-allfather! - Add--sinceflag toaddcommandThe
addcommand now supports a--sinceflag that allows you to specify which branch, tag, or git ref to use when detecting changed packages. This is useful for gitflow workflows where you have multiple target branches and thebaseBranchconfig option doesn't cover all use cases.Example:
changeset add --since=developIf not provided, the command falls back to the
baseBranchvalue in your.changeset/config.json.#1845
2b4a66aThanks @Andarist! - Delegate OTP prompting to the package manager instead of handling it in-process. This allows Changesets to use the package manager's native web auth support.#1774
667fe5aThanks @bluwy! - Support importing customcommitoption ES module. Previously, it usedrequire()which only worked for CJS modules, however now it usesimport()which supports both CJS and ES modules.#1839
73b1809Thanks @leochiu-a! - Add a--message(-m) flag tochangeset add(and defaultchangeset) so the changeset summary can be provided from the command line. When--messageis present, the summary prompt is skipped while the final confirmation step is kept.#1806
0e8e01eThanks @luisadame! - Changeset CLI can now be run from the nested directories in the project, where the.changesetdirectory has to be found in one of the parent directoriesPatch Changes
#1849
9dc3230Thanks @Andarist! - Compute the terminal's size lazily to avoid spurious stderr output in non-interactive mode#1857
2a73025Thanks @mixelburg! - Fix confusing prompt labels when entering changeset summary after external editor fallback#1842
6df3a5eThanks @RodrigoHamuy! - Allow private packages to depend on skipped packages without requiring them to also be skipped. Private packages are not published to npm, so it is safe for them to have dependencies on ignored or unversioned packages.#1776
503fcaaThanks @bluwy! - Support absolute paths inchangeset status --output <path>Updated dependencies [
667fe5a,1772598,b6f4c74,6df3a5e,6df3a5e,27fd8f4]:sanity-io/pkg-utils (@sanity/tsconfig)
v2.2.1Compare Source
Patch Changes
229154bThanks @stipsan! - fix: use a literal@instead of the percent-encoded%40in thehomepagelinks to thepackages/@sanity/*directories, so the URLs read cleanly in the npm UI (GitHub resolves both forms)v2.2.0Compare Source
Minor Changes
#2959
7a1e207Thanks @stipsan! - AddoutDir: "${configDir}/dist"to therecommendedpresetEmitting to
distis already the default in@sanity/pkg-utilsandtsdown, but every repo extending these presets had to repeat it in their own tsconfig. Since${configDir}resolves to the directory of the tsconfig that extends the preset, output now lands in thedistfolder next to yourpackage.jsonby default, and the manual declaration can be removed:{ "extends": "@sanity/tsconfig/strictest", - "compilerOptions": { - "outDir": "${configDir}/dist" - } }sanity-io/pkg-utils (@sanity/tsdown-config)
v0.31.2Compare Source
Patch Changes
b4849abThanks @squiggler-app! - fix(deps): update dependency browserslist to ^4.29.4v0.31.1Compare Source
No changes in this release.
v0.31.0Compare Source
Minor Changes
#3646
95ad65aThanks @stipsan! - Addpanda.cascadeLayers, passed through to@sanity/pandacss-tsdown-plugin. It defaults totrue, so the Panda stylesheet keeps its cascade layers, as before;panda: {cascadeLayers: false}publishes it without them, so consumers can override its base styles without overriding its states. Switching the default tofalseis planned for a later release of its own, once@sanity/uiandsanityhave adopted the option.A
pandaoption the installed plugin doesn't have (cascadeLayerson a plugin before 0.2.0, say) now fails the config with the upgrade to make, instead of reaching a plugin that ignores it; the peer range still accepts every version of the plugin.v0.30.1Compare Source
Patch Changes
#3642
158b317Thanks @stipsan! - Fix how CSS targets and thepandaoption resolve:target: 'baseline-widely-available'now transforms the CSS ofvanillaExtract,pandaandcssfor the browsers tsdown expands it to, instead of the@sanity/browserslist-configfallback. A browser you name next to the alias (['chrome61', 'baseline-widely-available']) keeps the lower of the two versions.pandareads the top-leveltargetfrom the final config, so atargetyou set withmergeConfig()afterdefineConfig()decides the browsers. An explicitpanda.targetorpanda.lightningcss.targetsstill wins.pandaandvanillaExtractorcsswriting the same stylesheet is detected for./-prefixed names too, and acssoption withsplittingno longer counts as a conflict.pandawithout@sanity/pandacss-tsdown-plugininstalled explains how to install it.The target fixes apply with
@sanity/pandacss-tsdown-plugin0.1.0 as well.v0.30.0Compare Source
Minor Changes
#3639
da36413Thanks @stipsan! - Add thepandaoption for packages styled with Panda CSS. Setpanda: trueto enable@sanity/pandacss-tsdown-pluginwith the Sanity defaults, or pass an options object to customize it.By default:
dist/bundle.css./bundle.cssexport: thebrowserandstyleconditions select the CSS file,nodeanddefaulta no-op JS shim, so the import also loads in Node.jsThe CSS syntax is transformed for the configured browsers —
panda.target, falling back to the top-leveltarget. When neither names browsers (for examplenode20), the browsers of@sanity/browserslist-configare used instead.Minification is opt-in:
Setup: install
@sanity/pandacss-tsdown-pluginas a dev dependency; it is an optional peer dependency of this package.@pandacss/devis recommended — for the usual"prepare": "panda codegen"script and thepandaCLI — but not required.#3623
04ff6bdThanks @stipsan! -vanillaExtract.minifyandcss.minifyno longer default totrue. CSS is left unminified unlessminify: trueis set. The CSS syntax-loweringtargetdefault is unchanged.Patch Changes
648e64bThanks @squiggler-app! - fix(deps): update dependency rolldown to ~1.2.14648e64b]:v0.29.0Compare Source
Minor Changes
#3618
a5b59dfThanks @stipsan! - feat: add the opt-inidentifiers: 'safe'option, keeping class names apart across package releasesThe default
'short'identifiers hash only the package name and the file path, then append a counter of the identifiers generated in the file so far. So a release that reorders a file's styles reuses its class names for different rules:._2mi48t0is the Button loading overlay in@sanity/ui4.4.2 and the Button root in 4.4.4, and pages that loaded the CSS of both releases styled the new Buttons with the old overlay rule.identifiers: 'safe'is'short'with the package version in the file-scope hash:@emotion/hash(packageName + '@' + packageVersion + filePath), followed by the same base-36 counter, with the same_prefix when the name starts with a digit. The version is read from the samepackage.jsonas the package name. Every release gets its own class names, and the same release always builds the same ones. It is available in@sanity/vanilla-extract-rolldown-plugin,@sanity/vanilla-extract-tsdown-plugin,@sanity/vanilla-extract-vite-plugin(includingcreateCompiler), and thevanillaExtractoption of@sanity/tsdown-config:The defaults are unchanged.
@sanity/vanilla-extract-integrationexportsresolveIdentifierOption()and thePluginIdentifierOptiontype that implement the option, andgetPackageInfo()now also returns the packageversion.Patch Changes
a5b59df]:v0.28.8Compare Source
Patch Changes
dd545f3Thanks @squiggler-app! - fix(deps): update tsdown to ^0.23.1dd545f3]:v0.28.7Compare Source
Patch Changes
v0.28.6Compare Source
Patch Changes
#3569
5f50c99Thanks @squiggler-app! - fix(deps): update dependency @microsoft/api-extractor to ^7.59.4#3576
a7d96e4Thanks @squiggler-app! - fix(deps): update dependency rolldown to ~1.2.13Updated dependencies [
a7d96e4,d212bfa]:v0.28.5Compare Source
Patch Changes
#3559
54a7663Thanks @squiggler-app! - fix(deps): update dependency @vitejs/plugin-react to ^6.1.2#3561
809af9aThanks @squiggler-app! - fix(deps): update dependency package-manager-detector to ^1.9.0Updated dependencies []:
v0.28.4Compare Source
Patch Changes
#3534
847e9c3Thanks @squiggler-app! - fix(deps): update dependency rolldown to ~1.2.12#3541
ea9ea1cThanks @squiggler-app! - fix(deps): update dependency publint to ^0.3.25#3546
733c107Thanks @squiggler-app! - fix(deps): update dependency @microsoft/api-extractor to ^7.59.3#3547
db47390Thanks @squiggler-app! - fix(deps): update dependency @microsoft/tsdoc-config to ^0.18.3#3548
3cc7ff8Thanks @squiggler-app! - fix(deps): update dependency browserslist to ^4.29.3Updated dependencies [
847e9c3]:v0.28.3Compare Source
Patch Changes
v0.28.2Compare Source
Patch Changes
#3488
76c7488Thanks @squiggler-app! - fix(deps): update dependency @microsoft/api-extractor to ^7.59.2#3504
a709c9eThanks @squiggler-app! - fix(deps): update dependency browserslist to ^4.29.1#3513
9f1d9faThanks @squiggler-app! - fix(deps): update dependency rolldown to ~1.2.11Updated dependencies [
9f1d9fa]:v0.28.1Compare Source
Patch Changes
#3424
232d6eaThanks @squiggler-app! - fix(deps): update dependency @microsoft/api-extractor to ^7.59.1#3440
4c451e1Thanks @squiggler-app! - fix(deps): update dependency browserslist to ^4.29.0#3441
7bbcee4Thanks @squiggler-app! - fix(deps): update dependency rolldown to ~1.2.9#3449
857c2ddThanks @squiggler-app! - fix(deps): update dependency @microsoft/tsdoc-config to ^0.18.2Updated dependencies [
7bbcee4]:v0.28.0Compare Source
Minor Changes
#3406
5372ae6Thanks @stipsan! - Upgrade tsdown and@tsdown/cssto 0.23.BREAKING: the
@sanity/tsdown-configand@sanity/vanilla-extract-tsdown-plugintsdownpeer range is now^0.23.0; tsdown 0.22 is no longer supported. Node.js 25can no longer run either package or
pkg build. Use Node^22.18.0,^24.11.0, or>=26.0.0.tsdown 0.23 removes deprecated config options. Replace
dts.tsgo: trueanddts.oxc: truewithdts.generator: 'tsgo'anddts.generator: 'oxc'.Replace
dts.oxc: falsewithdts.generator: 'tsc'. Removedts.cjsReexport.Replace
dts.volarPluginswithdts.customLanguagesand rename each language'screatehook tocreateVolarPlugins.Under
deps, replaceskipNodeModulesBundle: truewithneverBundle: trueand
onlyAllowBundlewithonlyBundle.deps.resolveDepSubpath: truepreserves the old dependency-specifier behavior.pkg watchnow closes tsdown's native watch handle, including its Rolldown watchersand keyboard-shortcut resources, and sets
ignoreWatchonpackage.jsonandtsconfig.jsonso tsdown does not restart itself and orphan a watcher that abortcannot close. CSS builds now need
@tsdown/css@0.23.0, the exact version tsdown 0.23pins.
tsdown 0.23 also emits declarations with inline
export declaremodifiers instead ofa trailing export list. A
.d.tswith no export statement is an export context, so atype that the source left unexported becomes part of the published API. Export the
types you mean to publish and tag them
@public.Patch Changes
7edcb76Thanks @squiggler-app! - fix(deps): update dependency rolldown to ~1.2.77edcb76,5372ae6]:v0.27.1Compare Source
Patch Changes
#3348
4abbbe4Thanks @squiggler-app! - fix(deps): update dependency rolldown to ~1.2.6#3361
b7ca997Thanks @squiggler-app! - fix(deps): update dependency @vitejs/plugin-react to ^6.1.1Updated dependencies [
4abbbe4]:v0.27.0Compare Source
Minor Changes
8d15fe5Thanks @stipsan! - Breaking: the babel pipeline is opt-in.reactCompilerdefaults totransform: 'oxc', and@rolldown/plugin-babel+@babel/coreare optional peer dependencies instead of dependencies. To stay on babel: settransform: 'babel'andpnpm add -D @rolldown/plugin-babel @babel/core babel-plugin-react-compiler.Patch Changes
v0.26.2Compare Source
Patch Changes
#3317
dd6510fThanks @squiggler-app! - fix(deps): update dependency rolldown to ~1.2.5Updated dependencies [
dd6510f]:v0.26.1Compare Source
Patch Changes
#3332
39567eaThanks @squiggler-app! - fix(deps): update dependency @microsoft/api-extractor to ^7.58.13#3334
8aa45dfThanks @squiggler-app! - fix(deps): update dependency publint to ^0.3.24#3338
c22bbd1Thanks @squiggler-app! - fix(deps): update dependency @microsoft/api-extractor to ^7.59.0#3319
f4ce0f7Thanks @stipsan! - Installing only one of the optional React Compiler packages no longer breaksdefineConfig()'s types. The missing package's typings used to degrade toanyand collapse theReactCompilerOptionsunion, so everyreactCompilerconfig resolved to thereactServer: trueoverload (Promise<UserConfig[]>) unless consumers stubbed the missing module. Now the uninstalled branch degrades to justtransform/reactServerwhile the installed one keeps its real typings — stubs like sanity-io/ui'stypings/babel-plugin-react-compiler.d.tscan be deleted.Updated dependencies [
8aa45df]:v0.26.0Compare Source
Minor Changes
24bfc3fThanks @stipsan! - AddreactCompiler.transformto pick the React Compiler implementation:'babel'(the default, runsbabel-plugin-react-compiler) or the experimental'oxc'(runsoxc-transform-react, the Rust port — one native pass for React Compiler + TypeScript/JSX). Both compilers are optional peer dependencies.v0.25.0Compare Source
Minor Changes
#3310
171251eThanks @stipsan! - Add abundleAnalyzeroption that wires Rolldown's experimental markdown bundle analyzer.trueselectsformat: 'md'(an LLM-friendlyanalyze-data.mdinoutDir) rather than the plugin's own JSON default, so an env-gated opt-in is enough:Pass an object to customize
format/fileName. The report is not a publishable artifact — exclude it frompackage.jsonfiles(e.g."!dist/analyze-data.md").@sanity/pkg-utilsforwards the same option frompackage.config.ts.v0.24.2Compare Source
Patch Changes
#3297
5496b49Thanks @squiggler-app! - fix(deps): update dependency rolldown to ~1.2.4#3288
5bfa760Thanks @stipsan! - Stop flagging the synthesized namespace wrappers of the declaration bundler withae-missing-release-tag.Namespace re-exports (
export * as ns from './module', orimport * as ns+export {ns}) make the declaration bundling pass synthesize adeclare namespace <module>_d_exports {…}wrapper that drops the doc comment of the re-export statement, so the wrapper could never carry a release tag and there was no userland fix short of downgrading the rule for the whole package. The TSDoc check now recognizes those wrappers (the interop naming, declared as a namespace in the entry or a shared chunk, a body that only re-exports sibling declarations, and re-exported under an alias) and exempts them fromae-missing-release-tag, like API Extractor's own rollups never checked the equivalent namespace. Everything else, including user namespaces that merely resemble the interop naming, stays checked: a namespace that declares members of its own is yours to tag, even when the bundler's deconflicting hands it a wrapper-shaped name.Updated dependencies [
5496b49]:v0.24.1Compare Source
Patch Changes
#3214
23788f8Thanks @squiggler-app! - fix(deps): update dependency rolldown to ~1.2.3#3271
f489697Thanks @squiggler-app! - fix(deps): update dependency browserslist to ^4.28.8Updated dependencies [
23788f8]:v0.24.0Compare Source
Minor Changes
#3250
33e7b93Thanks @stipsan! - Move the conditional CSS export frominject.nodeCompattoexports.nodeCompat, and give@tsdown/cssoutput the same treatment.nodeCompatconfigures how the CSS file is published, not how the import is injected, so it moves to a dedicatedexportsoption.injectandexportsare now independent:injectprepends an import of the CSS to entry chunks, whileexportspublishes it as the./<fileName>export subpath (which also makes any injected import self-referential).exports: truedeclares a plain string export for browser-only packages;exports: {nodeCompat: true}declares the conditional export and emits the no-op JS shim plus its.d.ts.inject: {nodeCompat: true}keeps working, normalized to{inject: true, exports: {nodeCompat: true}}with a deprecation warning; an explicitexportswins over it.@sanity/tsdown-configgains acss.exportsoption implementing the same pattern on top of@tsdown/css(an optional peer dependency), which compiles CSS but has no node-shim concept of its own — itsinjectemits a relative import that throws in runtimes that cannot load.cssfiles.@sanity/pkg-utilsgains acssoption, and builds a.cssexport subpath that declares asource:pkg buildcompiles it todist/ui/styles.csswith the same minify and lowering settingsvanillaExtractgets, emits the shim, and fills in thetypes/browser/style/node/defaultconditions.@sanity/parse-package-jsonexposes the newparseCssExportsfor reading those subpaths, andparseExportsno longer returns them as JS entries.#3253
bc16006Thanks @stipsan! - SuppressCIRCULAR_DEPENDENCYwarnings from the declaration bundling pass by default, and add asuppressWarningsoption.defineConfigenables Rolldown'schecks.circularDependency, which also reports cycles between the emitted.d.tsmodules. Those imports are type-only and erased at runtime, so the cycles carry none of the hazards the check exists to surface, and they're unavoidable for mutually referencing public types — in sanity-io/sanity#13753 109 of 136 cycle warnings were declaration-only, drowning out the 27 real ones. The config now sets tsdown'ssuppressWarningsto drop warnings whose entire cycle consists of declaration files (.d.ts/.d.mts/.d.cts); a cycle that includes even one runtime module still warns. Consumers that filtered these out themselves (like@repo/tsdown.configinsanity-io/sanity) can drop their own predicate.The new
suppressWarningsoption takes tsdown's own value shapes (strings matched withincludes, regular expressions matched withtest, or a predicate) and is OR'd with the built-in suppression, so per-package suppressions can't silently undo it. MergingsuppressWarningsover the returned config still replaces the default entirely (mergeConfigreplaces functions), which is the escape hatch for restoring every warning:mergeConfig(await defineConfig(), {suppressWarnings: () => false}).tsdown added
suppressWarningsin0.22.7, so thetsdownpeer range is raised from^0.22.5to^0.22.7. On0.22.5/0.22.6the option is silently ignored (the cycle warnings keep appearing) and theUserConfig['suppressWarnings']indexed access in the published declarations does not resolve.#3246
c1106f1Thanks @stipsan! - Move thetsdocfeature (API Extractor TSDoc/release-tag checking) from@sanity/pkg-utilsinto@sanity/tsdown-config.In
@sanity/tsdown-configthe option isfalseby default; settsdoc: true(or an options object) to run the check after the build via tsdown'sbuild:donehook. The checker lives at@sanity/tsdown-config/tsdocand is lazy-loaded from the root config, so API Extractor is not part of the default entry's module graph.@sanity/pkg-utilscontinues enabling it by default (tsdoc: true) when composing the config, and still runs it duringpkg checkviacheckTsdocfrom@sanity/tsdown-config/tsdoc.Patch Changes
d952984Thanks @squiggler-app! - fix(deps): update dependency pubConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate using a curated preset maintained by
. View repository job log here