Skip to content

chore(deps): update non-major - #166

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/non-major
Open

chore(deps): update non-major#166
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/non-major

Conversation

@renovate

@renovate renovate Bot commented Jul 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update
@changesets/changelog-github (source) ^0.6.0 → ^0.7.0 age confidence devDependencies minor
@changesets/cli (source) ^2.30.0 → ^2.31.1 age confidence devDependencies minor
@sanity/tsconfig (source) ^2.1.0 → ^2.2.1 age confidence devDependencies minor
@sanity/tsdown-config (source) ^0.5.8 → ^0.31.1 age confidence devDependencies minor
@types/node (source) ^24.12.2 → ^24.19.2 age confidence devDependencies minor
@vitest/coverage-v8 (source) ^4.1.2 → ^4.1.12 age confidence devDependencies patch
oxfmt (source) ^0.44.0 → ^0.73.0 age confidence devDependencies minor
oxlint (source) ^1.59.0 → ^1.88.0 age confidence devDependencies minor
peaceiris/actions-gh-pages (changelog) 4f9cc66 → 84c30a8 action digest
portabletext/.github (changelog) 4d2d3a0 → 10bcd35 workflow digest
tsdown (source) ^0.21.7 → ^0.23.1 age confidence devDependencies minor
typedoc (source) ^0.28.18 → ^0.28.20 age confidence devDependencies patch
vitest (source) ^4.1.2 → ^4.1.12 age confidence devDependencies patch

Release Notes

changesets/changesets (@​changesets/changelog-github)

v0.7.0

Compare Source

Minor Changes
changesets/changesets (@​changesets/cli)

v2.31.1

Compare Source

Patch Changes
  • #​2159 15cf592 Thanks @​ingvaldlorentzen! - Fixed already-published version detection with npm 12, which always wraps successful npm info --json output in an array. The unwrapped output made changeset publish treat every package as unpublished and fail attempting to republish existing versions.

v2.31.0

Compare Source

Minor Changes

  • #​1889 96ca062 Thanks @​mixelburg! - Error on unsupported flags for individual CLI commands and print the matching command usage to make mistakes easier to spot.

  • #​1873 42943b7 Thanks @​mixelburg! - Respond to --help on all subcommands. Previously, --help was only handled when it was the sole argument; passing it alongside a subcommand (e.g. changeset version --help) would silently execute the command instead. Now --help always exits early and prints per-command usage when a known subcommand is provided, or the general help text otherwise.

Patch Changes
sanity-io/pkg-utils (@​sanity/tsconfig)

v2.2.1

Compare Source

Patch Changes
  • #​3032 229154b Thanks @​stipsan! - fix: use a literal @ instead of the percent-encoded %40 in the homepage links to the packages/@sanity/* directories, so the URLs read cleanly in the npm UI (GitHub resolves both forms)

v2.2.0

Compare Source

Minor Changes

  • #​2959 7a1e207 Thanks @​stipsan! - Add outDir: "${configDir}/dist" to the recommended preset

    Emitting to dist is already the default in @sanity/pkg-utils and tsdown, but every repo extending these presets had to repeat it in their own tsconfig. Since ${configDir} resolves to the directory of the tsconfig that extends the preset, output now lands in the dist folder next to your package.json by default, and the manual declaration can be removed:

    {
  "extends": "@sanity/tsconfig/strictest",
-  "compilerOptions": {
-    "outDir": "${configDir}/dist"
-  }
}
sanity-io/pkg-utils (@​sanity/tsdown-config)

v0.31.1

Compare Source

No changes in this release.

v0.31.0

Compare Source

Minor Changes

  • #​3646 95ad65a Thanks @​stipsan! - Add panda.cascadeLayers, passed through to @sanity/pandacss-tsdown-plugin. It defaults to true, so the Panda stylesheet keeps its cascade layers, as before; panda: {cascadeLayers: false} publishes it without them, so consumers can override its base styles without overriding its states. Switching the default to false is planned for a later release of its own, once @sanity/ui and sanity have adopted the option.

    A panda option the installed plugin doesn't have (cascadeLayers on a plugin before 0.2.0, say) now fails the config with the upgrade to make, instead of reaching a plugin that ignores it; the peer range still accepts every version of the plugin.

v0.30.1

Compare Source

Patch Changes

  • #​3642 158b317 Thanks @​stipsan! - Fix how CSS targets and the panda option resolve:

    • target: 'baseline-widely-available' now transforms the CSS of vanillaExtract, panda and css for the browsers tsdown expands it to, instead of the @sanity/browserslist-config fallback. A browser you name next to the alias (['chrome61', 'baseline-widely-available']) keeps the lower of the two versions.
    • panda reads the top-level target from the final config, so a target you set with mergeConfig() after defineConfig() decides the browsers. An explicit panda.target or panda.lightningcss.targets still wins.
    • panda and vanillaExtract or css writing the same stylesheet is detected for ./-prefixed names too, and a css option with splitting no longer counts as a conflict.
    • Enabling panda without @sanity/pandacss-tsdown-plugin installed explains how to install it.

    The target fixes apply with @sanity/pandacss-tsdown-plugin 0.1.0 as well.

v0.30.0

Compare Source

Minor Changes

  • #​3639 da36413 Thanks @​stipsan! - Add the panda option for packages styled with Panda CSS. Set panda: true to enable @sanity/pandacss-tsdown-plugin with the Sanity defaults, or pass an options object to customize it.

    By default:

    • the style calls that can be resolved statically are rewritten into class names, and the generated CSS is extracted into dist/bundle.css
    • the entry chunks that use Panda styles import the stylesheet
    • the stylesheet is published as a conditional ./bundle.css export: the browser and style conditions select the CSS file, node and default a no-op JS shim, so the import also loads in Node.js

    The CSS syntax is transformed for the configured browsers — panda.target, falling back to the top-level target. When neither names browsers (for example node20), the browsers of @sanity/browserslist-config are used instead.

    Minification is opt-in:

    export default defineConfig({
  panda: {minify: true},
})

    Setup: install @sanity/pandacss-tsdown-plugin as a dev dependency; it is an optional peer dependency of this package. @pandacss/dev is recommended — for the usual "prepare": "panda codegen" script and the panda CLI — but not required.

  • #​3623 04ff6bd Thanks @​stipsan! - vanillaExtract.minify and css.minify no longer default to true. CSS is left unminified unless minify: true is set. The CSS syntax-lowering target default is unchanged.

Patch Changes

v0.29.0

Compare Source

Minor Changes

  • #​3618 a5b59df Thanks @​stipsan! - feat: add the opt-in identifiers: 'safe' option, keeping class names apart across package releases

    The default 'short' identifiers hash only the package name and the file path, then append a counter of the identifiers generated in the file so far. So a release that reorders a file's styles reuses its class names for different rules: ._2mi48t0 is the Button loading overlay in @sanity/ui 4.4.2 and the Button root in 4.4.4, and pages that loaded the CSS of both releases styled the new Buttons with the old overlay rule.

    identifiers: 'safe' is 'short' with the package version in the file-scope hash: @emotion/hash(packageName + '@' + packageVersion + filePath), followed by the same base-36 counter, with the same _ prefix when the name starts with a digit. The version is read from the same package.json as the package name. Every release gets its own class names, and the same release always builds the same ones. It is available in @sanity/vanilla-extract-rolldown-plugin, @sanity/vanilla-extract-tsdown-plugin, @sanity/vanilla-extract-vite-plugin (including createCompiler), and the vanillaExtract option of @sanity/tsdown-config:

    // tsdown.config.ts
import {defineConfig} from '@sanity/tsdown-config'

export default defineConfig({
  vanillaExtract: {identifiers: 'safe'},
})

    The defaults are unchanged. @sanity/vanilla-extract-integration exports resolveIdentifierOption() and the PluginIdentifierOption type that implement the option, and getPackageInfo() now also returns the package version.

Patch Changes

v0.28.8

Compare Source

Patch Changes

v0.28.7

Compare Source

Patch Changes

v0.28.6

Compare Source

Patch Changes

v0.28.5

Compare Source

Patch Changes

v0.28.4

Compare Source

Patch Changes

v0.28.3

Compare Source

Patch Changes

v0.28.2

Compare Source

Patch Changes

v0.28.1

Compare Source

Patch Changes

v0.28.0

Compare Source

Minor Changes

  • #​3406 5372ae6 Thanks @​stipsan! - Upgrade tsdown and @tsdown/css to 0.23.

    BREAKING: the @sanity/tsdown-config and @sanity/vanilla-extract-tsdown-plugin
    tsdown peer range is now ^0.23.0; tsdown 0.22 is no longer supported. Node.js 25
    can no longer run either package or pkg build. Use Node ^22.18.0, ^24.11.0, or
    >=26.0.0.

    tsdown 0.23 removes deprecated config options. Replace dts.tsgo: true and
    dts.oxc: true with dts.generator: 'tsgo' and dts.generator: 'oxc'.
    Replace dts.oxc: false with dts.generator: 'tsc'. Remove dts.cjsReexport.
    Replace dts.volarPlugins with dts.customLanguages and rename each language's
    create hook to createVolarPlugins.
    Under deps, replace skipNodeModulesBundle: true with neverBundle: true
    and onlyAllowBundle with onlyBundle.

    deps.resolveDepSubpath: true preserves the old dependency-specifier behavior.
    pkg watch now closes tsdown's native watch handle, including its Rolldown watchers
    and keyboard-shortcut resources, and sets ignoreWatch on package.json and
    tsconfig.json so tsdown does not restart itself and orphan a watcher that abort
    cannot close. CSS builds now need @tsdown/css@0.23.0, the exact version tsdown 0.23
    pins.

    tsdown 0.23 also emits declarations with inline export declare modifiers instead of
    a trailing export list. A .d.ts with no export statement is an export context, so a
    type that the source left unexported becomes part of the published API. Export the
    types you mean to publish and tag them @public.

Patch Changes

v0.27.1

Compare Source

Patch Changes

v0.27.0

Compare Source

Minor Changes
  • #​3320 8d15fe5 Thanks @​stipsan! - Breaking: the babel pipeline is opt-in. reactCompiler defaults to transform: 'oxc', and @rolldown/plugin-babel + @babel/core are optional peer dependencies instead of dependencies. To stay on babel: set transform: 'babel' and pnpm add -D @rolldown/plugin-babel @babel/core babel-plugin-react-compiler.
Patch Changes

v0.26.2

Compare Source

Patch Changes

v0.26.1

Compare Source

Patch Changes

v0.26.0

Compare Source

Minor Changes
  • #​3312 24bfc3f Thanks @​stipsan! - Add reactCompiler.transform to pick the React Compiler implementation: 'babel' (the default, runs babel-plugin-react-compiler) or the experimental 'oxc' (runs oxc-transform-react, the Rust port — one native pass for React Compiler + TypeScript/JSX). Both compilers are optional peer dependencies.

v0.25.0

Compare Source

Minor Changes

  • #​3310 171251e Thanks @​stipsan! - Add a bundleAnalyzer option that wires Rolldown's experimental markdown bundle analyzer.

    true selects format: 'md' (an LLM-friendly analyze-data.md in outDir) rather than the plugin's own JSON default, so an env-gated opt-in is enough:

    bundleAnalyzer: process.env.ENABLE_BUNDLE_ANALYZER === 'true'

    Pass an object to customize format / fileName. The report is not a publishable artifact — exclude it from package.json files (e.g. "!dist/analyze-data.md"). @sanity/pkg-utils forwards the same option from package.config.ts.

v0.24.2

Compare Source

Patch Changes

  • #​3297 5496b49 Thanks @​squiggler-app! - fix(deps): update dependency rolldown to ~1.2.4

  • #​3288 5bfa760 Thanks @​stipsan! - Stop flagging the synthesized namespace wrappers of the declaration bundler with ae-missing-release-tag.

    Namespace re-exports (export * as ns from './module', or import * as ns + export {ns}) make the declaration bundling pass synthesize a declare namespace <module>_d_exports {…} wrapper that drops the doc comment of the re-export statement, so the wrapper could never carry a release tag and there was no userland fix short of downgrading the rule for the whole package. The TSDoc check now recognizes those wrappers (the interop naming, declared as a namespace in the entry or a shared chunk, a body that only re-exports sibling declarations, and re-exported under an alias) and exempts them from ae-missing-release-tag, like API Extractor's own rollups never checked the equivalent namespace. Everything else, including user namespaces that merely resemble the interop naming, stays checked: a namespace that declares members of its own is yours to tag, even when the bundler's deconflicting hands it a wrapper-shaped name.

  • Updated dependencies [5496b49]:

v0.24.1

Compare Source

Patch Changes

v0.24.0

Compare Source

Minor Changes

  • #​3250 33e7b93 Thanks @​stipsan! - Move the conditional CSS export from inject.nodeCompat to exports.nodeCompat, and give @tsdown/css output the same treatment.

    nodeCompat configures how the CSS file is published, not how the import is injected, so it moves to a dedicated exports option. inject and exports are now independent: inject prepends an import of the CSS to entry chunks, while exports publishes it as the ./<fileName> export subpath (which also makes any injected import self-referential). exports: true declares a plain string export for browser-only packages; exports: {nodeCompat: true} declares the conditional export and emits the no-op JS shim plus its .d.ts. inject: {nodeCompat: true} keeps working, normalized to {inject: true, exports: {nodeCompat: true}} with a deprecation warning; an explicit exports wins over it.

    @sanity/tsdown-config gains a css.exports option implementing the same pattern on top of @tsdown/css (an optional peer dependency), which compiles CSS but has no node-shim concept of its own — its inject emits a relative import that throws in runtimes that cannot load .css files.

    @sanity/pkg-utils gains a css option, and builds a .css export subpath that declares a source:

    "./ui/styles.css": {"source": "./src/ui/styles.css"}

    pkg build compiles it to dist/ui/styles.css with the same minify and lowering settings vanillaExtract gets, emits the shim, and fills in the types/browser/style/node/default conditions. @sanity/parse-package-json exposes the new parseCssExports for reading those subpaths, and parseExports no longer returns them as JS entries.

  • #​3253 bc16006 Thanks @​stipsan! - Suppress CIRCULAR_DEPENDENCY warnings from the declaration bundling pass by default, and add a suppressWarnings option.

    defineConfig enables Rolldown's checks.circularDependency, which also reports cycles between the emitted .d.ts modules. Those imports are type-only and erased at runtime, so the cycles carry none of the hazards the check exists to surface, and they're unavoidable for mutually referencing public types — in sanity-io/sanity#13753 109 of 136 cycle warnings were declaration-only, drowning out the 27 real ones. The config now sets tsdown's suppressWarnings to drop warnings whose entire cycle consists of declaration files (.d.ts/.d.mts/.d.cts); a cycle that includes even one runtime module still warns. Consumers that filtered these out themselves (like @repo/tsdown.config in sanity-io/sanity) can drop their own predicate.

    The new suppressWarnings option takes tsdown's own value shapes (strings matched with includes, regular expressions matched with test, or a predicate) and is OR'd with the built-in suppression, so per-package suppressions can't silently undo it. Merging suppressWarnings over the returned config still replaces the default entirely (mergeConfig replaces functions), which is the escape hatch for restoring every warning: mergeConfig(await defineConfig(), {suppressWarnings: () => false}).

    tsdown added suppressWarnings in 0.22.7, so the tsdown peer range is raised from ^0.22.5 to ^0.22.7. On 0.22.5/0.22.6 the option is silently ignored (the cycle warnings keep appearing) and the UserConfig['suppressWarnings'] indexed access in the published declarations does not resolve.

  • #​3246 c1106f1 Thanks @​stipsan! - Move the tsdoc feature (API Extractor TSDoc/release-tag checking) from @sanity/pkg-utils into @sanity/tsdown-config.

    In @sanity/tsdown-config the option is false by default; set tsdoc: true (or an options object) to run the check after the build via tsdown's build:done hook. The checker lives at @sanity/tsdown-config/tsdoc and is lazy-loaded from the root config, so API Extractor is not part of the default entry's module graph. @sanity/pkg-utils continues enabling it by default (tsdoc: true) when composing the config, and still runs it during pkg check via checkTsdoc from @sanity/tsdown-config/tsdoc.

Patch Changes

v0.23.0

Compare Source

Minor Changes

  • #​3238 e19e63e Thanks @​stipsan! - Default exports.enabled to true instead of 'local-only'.

    Gating on CI via 'local-only'/'ci-only' surprised environments that set CI=true without meaning "don't rewrite package.json" (notably Cursor Cloud and GitHub Copilot)

Patch Changes

v0.22.0

Compare Source

Minor Changes

  • #​3221 125080f Thanks @​stipsan! - Make defineConfig a composable base for programmatic hosts (like the upcoming tsdown-powered @sanity/pkg-utils):

    • New cwd option: forwarded to tsdown's own cwd, and used for the package-manager detection behind the devExports default instead of process.cwd() — so builds driven programmatically for a package in another directory resolve the right defaults.
    • Package-manager detection only runs when it can affect the outcome: it exists solely to decide the pnpm-gated devExports: true default, so it is skipped when the userland exports value replaces the defaults (false, true, a bare CI condition) or sets devExports explicitly. Explicit configs behave identically across package managers, with no filesystem probing.
    • The composition contract is now documented and covered by tests: defineConfig() output is a mergeConfig-safe base — plugins append (never clobbering the React Compiler / vanilla-extract plugins this config sets up), plain objects deep-merge, and scalars/non-plugin arrays replace.
    • Node 20 support is dropped: engines.node is now ^22.18.0 || >=24.11.0, matching tsdown's own requirement. The previous >=20.19 <22 range was unachievable in practice — this package only executes inside tsdown's process, which already requires Node ^22.18.0.
Patch Changes

v0.21.3

Compare Source

Patch Changes

v0.21.2

Compare Source

Patch Changes

v0.21.1

Compare Source

Patch Changes

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "before 3am on the first day of the month"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate using a curated preset maintained by Sanity. View repository job log here

@changeset-bot

changeset-bot Bot commented Jul 1, 2026 •
edited
Loading

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: b5a59b9

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@socket-security

socket-security Bot commented Jul 1, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updated@​changesets/​changelog-github@​0.6.0 ⏵ 0.7.010010068 +194 +2100
Updated@​sanity/​tsconfig@​2.1.0 ⏵ 2.2.176 +110094 +192 +8100
Updated@​vitest/​coverage-v8@​4.1.3 ⏵ 4.1.12991007999 +2100
Updatedvitest@​4.1.3 ⏵ 4.1.1298 +1100 +27999 +2100
Updated@​types/​node@​24.12.2 ⏵ 24.19.2100 +110081 +196100
Updatedtypedoc@​0.28.18 ⏵ 0.28.201001009788 -2100
Updatedoxfmt@​0.44.0 ⏵ 0.73.094 +81008896 +1100
Updatedtsdown@​0.21.7 ⏵ 0.23.19810088 +196 +1100
Updatedoxlint@​1.59.0 ⏵ 1.88.099 +110091 +196 +1100
Updated@​changesets/​cli@​2.30.0 ⏵ 2.31.197 +1100100 +195100
Updated@​sanity/​tsdown-config@​0.5.8 ⏵ 0.31.196 +28100100 +3698 -1100

View full report

@socket-security

socket-security Bot commented Jul 1, 2026 •
edited
Loading

Copy link
Copy Markdown

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

@renovate
renovate Bot force-pushed the renovate/non-major branch 9 times, most recently from bd0dbec to aca7094 Compare July 8, 2026 15:55
@renovate
renovate Bot force-pushed the renovate/non-major branch 9 times, most recently from 901c94b to 489ba79 Compare July 16, 2026 10:05
@renovate
renovate Bot force-pushed the renovate/non-major branch 5 times, most recently from 2fc190b to c2486b5 Compare July 18, 2026 09:33
@renovate
renovate Bot force-pushed the renovate/non-major branch 5 times, most recently from b43d7ee to 1e1964c Compare August 18, 2026 12:43
@renovate
renovate Bot force-pushed the renovate/non-major branch 4 times, most recently from b40e642 to 32cd22f Compare August 25, 2026 12:38
@renovate
renovate Bot force-pushed the renovate/non-major branch 5 times, most recently from f8d1c61 to dd01944 Compare September 1, 2026 18:10
@renovate
renovate Bot force-pushed the renovate/non-major branch 8 times, most recently from 59c220b to f5ddb5d Compare September 9, 2026 18:39
@renovate
renovate Bot force-pushed the renovate/non-major branch 6 times, most recently from b738210 to f3dc9fe Compare September 16, 2026 19:43
stipsan
stipsan previously approved these changes Oct 13, 2026
View reviewed changes

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@stipsan stipsan stipsan left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

🤖 bot 📦 deps

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@stipsan