chore(deps): dedupe @module-federation runtime packages to 2.7.0

[gu-stav]

Description

#1484 bumped @module-federation/vite to 1.16.14, which pulls @module-federation/{runtime,runtime-core,sdk,error-codes} 2.7.0. The lockfile regeneration was minimal, so @sanity/workbench's ^2.6.0 range stayed resolved at 2.6.0 — leaving two copies of each package in the lockfile.

That state isn't a pnpm fixed point: any branch that touches dependencies gets this dedupe as unrelated churn on install (it showed up in #1486). This lands the dedupe on its own so other diffs stay clean.

What to review

Lockfile only. The 2.6.0 entries are removed and @sanity/workbench now resolves its runtime to 2.7.0 — the same version mf-vite already uses since #1484.

Testing

pnpm install --frozen-lockfile, pnpm build:cli, and a re-run of pnpm install (no lockfile drift) all pass locally.

Notes for release

N/A

---

Note

Low Risk
Dependency lockfile deduplication only; no application source changes, with workbench already semver-compatible with 2.7.0.

Overview
Lockfile-only change that removes duplicate @module-federation/{runtime,runtime-core,sdk,error-codes} 2.6.0 entries and pins everything to 2.7.0, matching what @module-federation/vite already pulled in after #1484.

@sanity/workbench’s runtime dependency moves from 2.6.0 to 2.7.0, so the tree no longer carries two versions and pnpm install stops rewriting the lockfile on unrelated dependency work.

^{Reviewed by Cursor Bugbot for commit c9ff4d7. Bugbot is set up for automated code reviews on this repo. Configure here.}

[gu-stav]

This change is part of the following stack:

• chore(deps): dedupe @module-federation runtime packages to 2.7.0 #1487 ◀

_{Change managed by git-spice.}

[github-actions]

📦 Bundle Stats — @sanity/cli

Compared against main (473ae366)

@sanity/cli

Metric	Value	vs main (473ae36)
Internal (raw)	2.2 KB	-
Internal (gzip)	838 B	-
Bundled (raw)	11.16 MB	-
Bundled (gzip)	2.10 MB	-
Import time	864ms	-0ms, -0.0%

bin:sanity

Metric	Value	vs main (473ae36)
Internal (raw)	782 B	-
Internal (gzip)	423 B	-
Bundled (raw)	9.87 MB	-
Bundled (gzip)	1.78 MB	-
Import time	2.24s	+26ms, +1.2%

🗺️ View treemap · Artifacts

Details

• Import time regressions over 10% are flagged with ⚠️
• Sizes shown as raw / gzip 🗜️. Internal bytes = own code only. Total bytes = with all dependencies. Import time = Node.js cold-start median.

📦 Bundle Stats — @sanity/cli-core

Compared against main (473ae366)

Metric	Value	vs main (473ae36)
Internal (raw)	108.1 KB	-
Internal (gzip)	27.0 KB	-
Bundled (raw)	21.72 MB	-
Bundled (gzip)	3.46 MB	-
Import time	770ms	+3ms, +0.4%

🗺️ View treemap · Artifacts

Details

• Import time regressions over 10% are flagged with ⚠️
• Sizes shown as raw / gzip 🗜️. Internal bytes = own code only. Total bytes = with all dependencies. Import time = Node.js cold-start median.

📦 Bundle Stats — create-sanity

Compared against main (473ae366)

Metric	Value	vs main (473ae36)
Internal (raw)	908 B	-
Internal (gzip)	483 B	-
Bundled (raw)	931 B	-
Bundled (gzip)	491 B	-
Import time	❌ ChildProcess denied: node	-

Details

• Import time regressions over 10% are flagged with ⚠️
• Sizes shown as raw / gzip 🗜️. Internal bytes = own code only. Total bytes = with all dependencies. Import time = Node.js cold-start median.

[github-actions]

Coverage Delta

No covered files changed in this PR.

Overall Coverage

Metric	Coverage
Statements	74.8% (±0%)
Branches	64.7% (±0%)
Functions	69.9% (±0%)
Lines	75.2% (±0%)