Skip to content

chore(deps): update dependency @sanity/pkg-utils to v10 - #1783

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/sanity-pkg-utils-10.x
Open

chore(deps): update dependency @sanity/pkg-utils to v10#1783
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/sanity-pkg-utils-10.x

Conversation

@renovate

@renovate renovate Bot commented Jan 26, 2026

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@sanity/pkg-utils (source) 8.1.2910.9.2 age confidence

Release Notes

sanity-io/pkg-utils (@​sanity/pkg-utils)

v10.9.2

Compare Source

Patch Changes

v10.9.1

Compare Source

Patch Changes

v10.9.0

Compare Source

Minor Changes
  • #​2955 935f6f6 Thanks @​stipsan! - Enable transpileTemplateLiterals by default in the babel.styledComponents transform, so unused styled components can be tree-shaken.

    The pure: true default has been emitting /*#__PURE__*/ annotations in front of tagged template expressions, a position no bundler supports (see rollup#4035), so the annotations were dropped and unused styled components were never tree-shaken - not by pkg-utils itself, and not by the bundlers of apps consuming the published package. Transpiling styled.button`...` to styled.button(["..."]) turns the styled component initializer into a plain call expression, which pure annotations are defined for:

    const UsedButton = /*#__PURE__*/ styled.button.withConfig({
      displayName: 'UsedButton',
      componentId: 'sc-1fal5wv-1',
    })(['cursor:pointer;'])

    With this shape, unused styled components are now removed from the build output, and the annotation survives into the published output so app bundlers (rollup, webpack, esbuild, etc) can drop exported styled components that the app never imports.

    To restore the previous output, set babel: {styledComponents: {transpileTemplateLiterals: false}} in package.config.ts.

Patch Changes

v10.8.2

Compare Source

Patch Changes
  • #​2934 d6cfe32 Thanks @​stipsan! - fix: preserve side-effect-only imports of external packages

    Tree-shaking no longer sets the equivalent of moduleSideEffects: 'no-external' and instead relies on the bundler's default (moduleSideEffects: true). Previously, binding-less side-effect imports of external package subpaths — e.g. import 'react-time-ago/locale/en' — were stripped from the output, breaking consumers that depended on those side effects. package.json sideEffects fields are still honored for bundled modules, so dead-code elimination is unaffected.

v10.8.1

Compare Source

Patch Changes

v10.8.0

Compare Source

Minor Changes
  • #​2888 59fdc02 Thanks @​stipsan! - feat: add strict dependency placement checks for well-known packages

    When running with --strict, package.json is now validated to ensure these packages are declared in the correct dependency fields:

    • react-is and @sanity/ui should not be in peerDependencies (use dependencies or devDependencies).
    • sanity, styled-components, react, and react-dom should not be in dependencies (use devDependencies and/or peerDependencies).
    • @types/react, @types/react-dom, and @types/node should not be in dependencies (use devDependencies and/or peerDependencies), and when listed in peerDependencies the version range should be *.
    • rxjs and @sanity/client should not be in peerDependencies (use dependencies or devDependencies).

    Each check is enabled by default at the error level and can be downgraded to warn or disabled via strictOptions in package.config.ts, e.g.:

    import {defineConfig} from '@​sanity/pkg-utils'
    
    export default defineConfig({
      strictOptions: {
        noReactDependency: 'warn',
        noSanityClientPeerDependency: 'off',
      },
    })
Patch Changes
  • #​2903 296482a Thanks @​stipsan! - feat: disallow @sanity/icons in peerDependencies

    When running with --strict, package.json is now validated to ensure @sanity/icons is not declared in peerDependencies (use dependencies or devDependencies instead). The check defaults to error and can be configured via noSanityIconsPeerDependency in strictOptions.

v10.7.2

Compare Source

Patch Changes
  • #​2897 de87bc9 Thanks @​stipsan! - fix: mirror the auto-added bundle.css export into publishConfig.exports

    In vanilla-extract compat mode, pkg-utils auto-writes the conditional "./bundle.css" export to package.json. It only updated the top-level exports, so packages that also declare publishConfig.exports ended up out of sync, and the next strict --check failed with publishConfig.exports: missing export path "./bundle.css" that exists in exports.

    The conditional CSS export is now mirrored into publishConfig.exports as well (when that field exists), keeping the two in sync. The entry is identical in both places since the CSS export has no source/development/monorepo conditions to strip. publishConfig.exports is never created when it is absent.

  • #​2899 97cbc33 Thanks @​stipsan! - Emit a <css>.d.ts declaration alongside the vanilla-extract compat-mode CSS shim, so dts export checkers that resolve a .d.ts for every export target don't crash on a missing declaration file.

v10.7.1

Compare Source

Patch Changes
  • #​2895 ba964f1 Thanks @​stipsan! - Revert the upgrade of @babel/core and @babel/preset-typescript to v8, pinning them back to v7

v10.7.0

Compare Source

Minor Changes
  • #​2890 c219497 Thanks @​stipsan! - feat: auto-wire the conditional bundle.css export for vanilla-extract

    When rollup.vanillaExtract is enabled, pkg-utils now (by default) bakes in the conditional CSS export pattern so userland no longer needs a manual rollup.output.intro + shim plugin + package.json export. This new "compat mode" (rollup.vanillaExtract.extract.compatMode, defaults to true):

    • injects the self-referential import "<pkg-name>/<name>" into each entry chunk,
    • emits a no-op <name>.js shim for runtimes that cannot import .css files, and
    • writes the conditional "./<name>" export to package.json (browser/style → the real CSS, node/default → the shim).

    The emitted CSS file name is configurable via rollup.vanillaExtract.extract.name (default "bundle.css"), and the vanillaExtract option is now fully typed (PkgVanillaExtractOptions) with its real defaults documented. Set extract.compatMode: false to opt out and wire these up yourself.

Patch Changes

v10.6.0

Compare Source

Minor Changes
  • #​2887 a6adaa1 Thanks @​stipsan! - feat: support conditional exports for CSS files

    CSS subpath exports may now be declared as a conditional object (a flat map of condition name to path) instead of only a plain string. This enables re-adding a import "<pkg>/bundle.css" statement that resolves to the real CSS file in bundler/browser environments, while resolving to a no-op JS shim in runtimes (like Node) that cannot import .css files directly:

    {
      "exports": {
        "./bundle.css": {
          "browser": "./dist/bundle.css",
          "style": "./dist/bundle.css",
          "node": "./dist/bundle.css.js",
          "default": "./dist/bundle.css.js"
        }
      }
    }
Patch Changes

v10.5.8

Compare Source

Patch Changes

v10.5.7

Compare Source

Patch Changes

v10.5.6

Compare Source

Patch Changes

v10.5.5

Compare Source

Patch Changes

v10.5.4

Compare Source

Patch Changes
  • #​2837 cc5b92a Thanks @​renovate! - fix(deps): Update dependency @​microsoft/api-extractor to ^7.58.8

  • #​2844 c27e975 Thanks @​jasonevines! - fix: preserve subpath imports of external packages in rolldown dts output

    Bare specifiers are now matched against their package name when deciding externals in the rolldown dts pipeline, so subpath imports of external dependencies (e.g. @sanity/client/stega) keep their original specifier instead of resolving to an absolute filesystem path in the emitted declarations.

v10.5.3

Compare Source

Patch Changes

v10.5.2

Compare Source

Patch Changes

v10.5.1

Compare Source

Patch Changes

v10.5.0

Compare Source

Minor Changes
  • #​2781 a8f395f Thanks @​rexxars! - feat: schedule JS build tasks for node export sub-conditions

    Exports with a node sub-condition (exports['.'].node.import / .require) now generate JS build tasks under runtime: 'node' using target.node, symmetric to how browser sub-conditions are already handled. Previously these outputs only got .d.ts files emitted while the JS was never built, leaving the declared output paths dangling. Isomorphic packages can now ship a node-specific entry without relaxing the package-wide browserslist.

Patch Changes

v10.4.18

Compare Source

Patch Changes

v10.4.17

Compare Source

Patch Changes

v10.4.16

Compare Source

Patch Changes

v10.4.15

Compare Source

Patch Changes

v10.4.14

Compare Source

Patch Changes

v10.4.13

Compare Source

Patch Changes

v10.4.12

Compare Source

Patch Changes

v10.4.11

Compare Source

Patch Changes

v10.4.10

Compare Source

Patch Changes

v10.4.9

Compare Source

Patch Changes

v10.4.8

Compare Source

Patch Changes

v10.4.7

Compare Source

Patch Changes

v10.4.6

Compare Source

Patch Changes

v10.4.5

Compare Source

Patch Changes

v10.4.4

Compare Source

Patch Changes

v10.4.3

Compare Source

Patch Changes

v10.4.2

Compare Source

Patch Changes

v10.4.1

Compare Source

Patch Changes

v10.4.0

Compare Source

Minor Changes
  • #​2538 a7bd216 Thanks @​copilot-swe-agent! - Auto-enable styled-components compiler when detected as peer dependency. If styled-components is in peerDependencies and babel-plugin-styled-components is in devDependencies, the babel plugin is automatically enabled without requiring explicit configuration. Users can disable this behavior by setting babel: { styledComponents: false } in package.config.ts.
Patch Changes

v10.3.5

Compare Source

Patch Changes

v10.3.4

Compare Source

Patch Changes

v10.3.3

Compare Source

Patch Changes

v10.3.2

Compare Source

Patch Changes

v10.3.1

Compare Source

Patch Changes

v10.3.0

Compare Source

Minor Changes

Note

PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "before 3am on the first day of the month"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate using a curated preset maintained by Sanity. View repository job log here

@vercel

vercel Bot commented Jan 26, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
preview-kit-next-app-router Error Error Jul 30, 2026 7:24pm
preview-kit-next-pages-router Error Error Jul 30, 2026 7:24pm
preview-kit-remix Error Error Jul 30, 2026 7:24pm
preview-kit-test-studio Error Error Jul 30, 2026 7:24pm

Request Review

@renovate
renovate Bot force-pushed the renovate/sanity-pkg-utils-10.x branch from 33b1d3c to c1a8ccc Compare January 28, 2026 12:54
@renovate
renovate Bot force-pushed the renovate/sanity-pkg-utils-10.x branch from c1a8ccc to 374ce21 Compare January 28, 2026 19:47
@renovate
renovate Bot force-pushed the renovate/sanity-pkg-utils-10.x branch from 374ce21 to aeb152e Compare January 29, 2026 13:06
@renovate
renovate Bot force-pushed the renovate/sanity-pkg-utils-10.x branch from aeb152e to 6a0eced Compare January 30, 2026 11:15
@renovate
renovate Bot force-pushed the renovate/sanity-pkg-utils-10.x branch from 6a0eced to 01a95cc Compare February 2, 2026 11:41
@renovate
renovate Bot force-pushed the renovate/sanity-pkg-utils-10.x branch from 4936c49 to ff88d6b Compare February 12, 2026 14:53
@renovate
renovate Bot force-pushed the renovate/sanity-pkg-utils-10.x branch from ff88d6b to 3c94432 Compare February 17, 2026 18:38
@renovate
renovate Bot force-pushed the renovate/sanity-pkg-utils-10.x branch from 3c94432 to 450e2c4 Compare March 1, 2026 22:59
@renovate
renovate Bot force-pushed the renovate/sanity-pkg-utils-10.x branch from 450e2c4 to 34800be Compare March 3, 2026 16:06
@renovate
renovate Bot force-pushed the renovate/sanity-pkg-utils-10.x branch from 34800be to d857ce6 Compare March 5, 2026 18:06
@renovate
renovate Bot force-pushed the renovate/sanity-pkg-utils-10.x branch from d857ce6 to 6cb9e0a Compare March 9, 2026 06:47
@socket-security

socket-security Bot commented Apr 1, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm @emnapi/runtime is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yamlnpm/@sanity/[email protected]npm/@emnapi/[email protected]

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm typescript

License: LicenseRef-W3C-Community-Final-Specification-Agreement - The applicable license policy does not permit this license (5) (package/ThirdPartyNoticeText.txt)

From: pnpm-lock.yamlnpm/@sanity/[email protected]npm/[email protected]

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@socket-security

socket-security Bot commented Apr 15, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addednpm/​@​types/​react@​19.2.171001007992100
Addednpm/​isbot@​5.2.110010010094100
Addednpm/​@​sanity/​pkg-utils@​10.9.29710010098100

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants