Repository navigation
chore(deps): update non-major - #356
Merged
Merged
Conversation
|
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
renovate
Bot
force-pushed
the
renovate/non-major
branch
from
September 3, 2026 19:44
ad4d072 to
71c9754
Compare
renovate
Bot
force-pushed
the
renovate/non-major
branch
8 times, most recently
from
September 11, 2026 16:03
4c4e8df to
d933cf6
Compare
renovate
Bot
force-pushed
the
renovate/non-major
branch
7 times, most recently
from
September 19, 2026 17:02
0285958 to
cc729fc
Compare
renovate
Bot
force-pushed
the
renovate/non-major
branch
7 times, most recently
from
September 25, 2026 19:56
0b23a54 to
706194e
Compare
renovate
Bot
force-pushed
the
renovate/non-major
branch
6 times, most recently
from
October 2, 2026 13:08
6fc5f54 to
89ffa45
Compare
renovate
Bot
force-pushed
the
renovate/non-major
branch
9 times, most recently
from
October 10, 2026 18:01
5c8489d to
5e7de5a
Compare
renovate
Bot
force-pushed
the
renovate/non-major
branch
4 times, most recently
from
October 12, 2026 16:45
0c0fc13 to
1ea5324
Compare
renovate
Bot
force-pushed
the
renovate/non-major
branch
from
October 13, 2026 01:09
1ea5324 to
9d3b8ec
Compare
stipsan
approved these changes
Oct 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^8.4.0→^8.9.0^0.27.1→^0.28.8^4.0.7→^4.4.4^19.2.18→^19.3.0^19.2.5→^19.3.0^8.18.1→^8.18.2^6.1.1→^6.1.2^6.12.0→^6.18.0^0.147.0→^0.153.0^0.66.0→^0.72.0^1.81.0→^1.87.0^7.0.2001→^7.0.2004a311e91→10bcd35^19.2.8→^19.3.0^19.2.8→^19.3.0^19.2.8→^19.3.0^6.12.0→^6.18.0^0.22.14→^0.23.1^8.2.2→^8.3.4Release Notes
sanity-io/client (@sanity/client)
v8.9.0Compare Source
Minor Changes
v8.8.0Compare Source
Minor Changes
collaboration: accept comment
anchor, deprecaterange(#1346) (4ce6968)Create and update now take a typed
anchor(type: "portable-text"with optionalfieldValueon the anchor). Deprecatedrange+ top-levelfieldValue(andrange: null) are still accepted and sent asanchor.export
getCommentTargetDocumentReffrom@sanity/client/collaboration(#1343) (71d414a)Builds the global document reference a collaboration comment stores in
target.document._reffrom a resource and a document ID, with no client involved.client.collaboration.comments.getTargetDocumentRefis unchanged and now calls it, reading the resource off the client's configuration.Until now the reference could only be built through a client instance, which meant code that needs it somewhere a client should not be fetched or created, such as a state selector, had to reach for one anyway. Pass the same value
ClientConfig['resource']takes, for example{type: 'dataset', id: 'abc123.production'}.collaboration: send clientVersion on comment writes (#1347) (da15b5e)
update client.context types to the latest Context API (#1348) (69ccdd4)
v8.7.0Compare Source
Minor Changes
abort underlying EventSource request when response fails validation (#1340) (ba3de6b)
add per-resource schema, query and projection registries (#1334) (b43e033)
SanitySchemasByResource,SanityQueriesByResourceandSanityProjectionsByResourcejoin the existingSanityQueriesregistry, following the same pattern: a global interface that the interface exported from@sanity/clientinherits from, so a generated file can register either way and does not depend on module resolution.Each is keyed by a resource, using the same string the App SDK already uses for its runtime cache,
projectId.datasetfor a dataset. This is what lets two datasets whose schemas disagree register different result types for the same query text, which the flatSanityQueriesregistry cannot express. Projections add a document-type level, because a projection resolves against whichever document the caller's handle names.All three are empty by default and nothing in the client reads them yet.
client.fetchandClientReturnare unchanged, and keep resolving through the flat registry. They exist for consumers that do resource-aware lookups themselves, starting with the App SDK's hooks.Patch Changes
v8.6.2Patch Changes
v8.6.1Patch Changes
any-signaldependency and combine abort signals withget-it/any-signal, which uses nativeAbortSignal.anywhere it exists and a plainAbortControlleron Safari 17.0-17.3 (#1329) (4b5c198)v8.6.0Minor Changes
Patch Changes
any-signalinstead ofAbortSignal.anyso cancellable requests work on Safari 17.0-17.3 (#1326) (f87523e)v8.5.0Minor Changes
read query result types from a global
SanityQueriesinterface (#1319) (18313fe)Query result types can now be registered on a global
SanityQueriesinterface, which theSanityQueriesinterface exported from@sanity/clientinherits from.client.fetch,ClientReturnandClientReturnStegaresolve registrations made either way, so thedeclare module '@sanity/client'augmentation that Sanity TypeGen has emitted so far keeps working unchanged. The global registry does not depend on module resolution: it is seen whether or not@sanity/clientis a direct dependency of the generated file, however many copies of the client are installed, and from every entry point including@sanity/client/stega.Patch Changes
sanity-io/pkg-utils (@sanity/tsdown-config)
v0.28.8Compare Source
Patch Changes
dd545f3Thanks @squiggler-app! - fix(deps): update tsdown to ^0.23.1dd545f3]:v0.28.7Compare Source
Patch Changes
v0.28.6Compare Source
Patch Changes
#3569
5f50c99Thanks @squiggler-app! - fix(deps): update dependency @microsoft/api-extractor to ^7.59.4#3576
a7d96e4Thanks @squiggler-app! - fix(deps): update dependency rolldown to ~1.2.13Updated dependencies [
a7d96e4,d212bfa]:v0.28.5Compare Source
Patch Changes
#3559
54a7663Thanks @squiggler-app! - fix(deps): update dependency @vitejs/plugin-react to ^6.1.2#3561
809af9aThanks @squiggler-app! - fix(deps): update dependency package-manager-detector to ^1.9.0Updated dependencies []:
v0.28.4Compare Source
Patch Changes
#3534
847e9c3Thanks @squiggler-app! - fix(deps): update dependency rolldown to ~1.2.12#3541
ea9ea1cThanks @squiggler-app! - fix(deps): update dependency publint to ^0.3.25#3546
733c107Thanks @squiggler-app! - fix(deps): update dependency @microsoft/api-extractor to ^7.59.3#3547
db47390Thanks @squiggler-app! - fix(deps): update dependency @microsoft/tsdoc-config to ^0.18.3#3548
3cc7ff8Thanks @squiggler-app! - fix(deps): update dependency browserslist to ^4.29.3Updated dependencies [
847e9c3]:v0.28.3Compare Source
Patch Changes
v0.28.2Compare Source
Patch Changes
#3488
76c7488Thanks @squiggler-app! - fix(deps): update dependency @microsoft/api-extractor to ^7.59.2#3504
a709c9eThanks @squiggler-app! - fix(deps): update dependency browserslist to ^4.29.1#3513
9f1d9faThanks @squiggler-app! - fix(deps): update dependency rolldown to ~1.2.11Updated dependencies [
9f1d9fa]:v0.28.1Compare Source
Patch Changes
#3424
232d6eaThanks @squiggler-app! - fix(deps): update dependency @microsoft/api-extractor to ^7.59.1#3440
4c451e1Thanks @squiggler-app! - fix(deps): update dependency browserslist to ^4.29.0#3441
7bbcee4Thanks @squiggler-app! - fix(deps): update dependency rolldown to ~1.2.9#3449
857c2ddThanks @squiggler-app! - fix(deps): update dependency @microsoft/tsdoc-config to ^0.18.2Updated dependencies [
7bbcee4]:v0.28.0Compare Source
Minor Changes
#3406
5372ae6Thanks @stipsan! - Upgrade tsdown and@tsdown/cssto 0.23.BREAKING: the
@sanity/tsdown-configand@sanity/vanilla-extract-tsdown-plugintsdownpeer range is now^0.23.0; tsdown 0.22 is no longer supported. Node.js 25can no longer run either package or
pkg build. Use Node^22.18.0,^24.11.0, or>=26.0.0.tsdown 0.23 removes deprecated config options. Replace
dts.tsgo: trueanddts.oxc: truewithdts.generator: 'tsgo'anddts.generator: 'oxc'.Replace
dts.oxc: falsewithdts.generator: 'tsc'. Removedts.cjsReexport.Replace
dts.volarPluginswithdts.customLanguagesand rename each language'screatehook tocreateVolarPlugins.Under
deps, replaceskipNodeModulesBundle: truewithneverBundle: trueand
onlyAllowBundlewithonlyBundle.deps.resolveDepSubpath: truepreserves the old dependency-specifier behavior.pkg watchnow closes tsdown's native watch handle, including its Rolldown watchersand keyboard-shortcut resources, and sets
ignoreWatchonpackage.jsonandtsconfig.jsonso tsdown does not restart itself and orphan a watcher that abortcannot close. CSS builds now need
@tsdown/css@0.23.0, the exact version tsdown 0.23pins.
tsdown 0.23 also emits declarations with inline
export declaremodifiers instead ofa trailing export list. A
.d.tswith no export statement is an export context, so atype that the source left unexported becomes part of the published API. Export the
types you mean to publish and tag them
@public.Patch Changes
7edcb76Thanks @squiggler-app! - fix(deps): update dependency rolldown to ~1.2.77edcb76,5372ae6]:sanity-io/ui (@sanity/ui)
v4.4.4Compare Source
Patch Changes
#3169
7276c74Thanks @stipsan! -Avatar,AvatarCounter,ButtonandSwitchnow load more of their styles from@sanity/ui/styles.cssinstead of generating them with JavaScript at runtime. This reduces runtime styling work while keeping the combined JavaScript and CSS download size nearly unchanged.The components keep the same appearance, props and HTML structure. Theme-dependent and responsive styles continue to work as before, including
Button'swidth="fill"option.When upgrading:
@sanity/ui/styles.cssin your app's entry point.white-spaceoverride instyled(Button)now depends on this order.This is the same stylesheet load-order requirement introduced for other components in 4.1.0 and 4.2.0. If your app already follows it, no changes are needed.
v4.4.3Compare Source
Patch Changes
#3174
513fe51Thanks @stipsan! - Fix a regression introduced in 4.4.2 where callingevent.preventDefault()in the button'sonClickoronKeyDownhandler stoppedMenuButtonfrom opening. These handlers still run first, butpreventDefault()no longer blocks the menu from opening or toggling. To keep the menu closed, disable the button.#3170
246ad17Thanks @stipsan! - Improve rendering performance by sharing common CSS across components instead of generating duplicate styles for each combination of props. This reduces the amount of CSS your app generates and the work needed to render it, especially on pages with many Sanity UI components.Across our Storybook stories in both light and dark mode, generated CSS was 77% smaller and style generation took 54% less time. In a server-rendering benchmark, generated CSS was 80% smaller and rendering took 63% less time. Results will vary by app.
No changes to your code are needed to benefit from these improvements, and components using the built-in themes look the same.
v4.4.2Compare Source
Patch Changes
#3138
2340587Thanks @stipsan! - FixAutocompletevalue syncing, responsiveness, and focus:valuechanges immediately without clearing a typed query when the parent echoes the current value.renderOptionstill run before paint. Closing remains immediate.aria-activedescendantonly while the list is visible.#3144
4916f1eThanks @stipsan! - Remove unnecessaryMenuButtonre-renders when registering elements or hiding and showing them with<Activity>, preventing delayed or skipped<ViewTransition>animations. Set the forwarded button ref on mount rather than one render later.#3137
20c5d3eThanks @stipsan! - FixMenuButtonevent handling:onClick,onKeyDown, andonMouseDownhandlers. They run first;event.preventDefault()skips the menu's default action.onOpenandonCloseduring the triggering event, batching their state updates with the menu's.onOpennow runs before the menu renders, and callback errors are not caught by error boundaries.#3139
4bb2462Thanks @stipsan! - FixMenuGroupstate and styling:ArrowRightopens its child menu, even without a preceding hover.data-pressedwhile pressed foras="a"andas="div", fixing incorrect pressed styling on links.#3143
650ff7eThanks @stipsan! - Remove unnecessaryTooltipandPopoverre-renders when their reference element mounts or<Activity>hides or shows it, preventing delayed or skipped<ViewTransition>animations. Set child refs on mount and preserve them whenPopoveruses a separatereferenceElement.#3141
153a456Thanks @stipsan! - FixPopoversizing:constrainSizeandmatchReferenceWidthchanges on the next positioning pass, clearing the applied max height or matched width when disabled.stylevalues; other styles still apply.v4.4.1Compare Source
Patch Changes
fcf1e8cThanks @squiggler-app! - fix(deps): update dependency motion to ^14.1.0v4.4.0Compare Source
Minor Changes
#3119
62f1b90Thanks @stipsan! -Popover(and with itMenuButton,MenuGroup,AutocompleteandBreadcrumbs) no longer pre-renders its closed content eagerly. Since v4, every closed popover rendered its card andcontentinside a hidden<Activity>boundary from the moment it mounted, so a page with many popovers that are never opened paid for all of that hidden DOM. Now nothing is rendered until the popover opens or is about to: the hidden pre-render starts when the reference element receives focus or a pointer enters or presses it, in a transition, so a click that follows right away is never held up by it. A popover that opens without any of that (programmatically, or withopenset from the start) renders when it opens. Once rendered, a popover stays rendered while closed, as before, so the state of itscontentsurvives reopening.There is no option to pre-render eagerly or to skip the pre-render on intent.
Popoveris controlled throughopen, so a consumer that does not want its content rendered before it opens can leavecontentempty until then.Tests that read the content of a popover or menu that has never been opened or interacted with need to open it first:
expect(screen.getByText('Popover content')).not.toBeVisible()only holds once the popover has rendered, before thatscreen.queryByText('Popover content')isnull. Queries that skip inaccessible elements (*ByRole) need no change.#2757
2050b09Thanks @stipsan! - Add support for styled-components v7 while continuing to support v6.1 and later.Patch Changes
#3142
45f91d5Thanks @stipsan! -Breadcrumbsopens and closes the popover with its collapsed items in a transition (startTransition), as every update of aPopover'sopenshould be. A closed popover pre-renders its content hidden, in a transition, once its reference element shows intent to open it; whenopenchanges in a transition too, React keeps rendering that content in the background if the open comes before it is done, instead of rendering it synchronously in the click. Content that was pre-rendered already still shows in the first frame after the click.The
openprop ofPopovernow documents this for consumers that control it themselves: set it insidestartTransition, wrapping the state update itself (astartTransitionaround code that schedules the update for later, such as a timeout, does not reach it).#3134
0930b21Thanks @stipsan! - fix(dialog): scope click-outside and focus handling to the portal element the dialog renders into.Dialognow resolves its portal element with the same function asPortal, so a dialog with aportalname whose entry is missing falls back to thedefaultportal element for its scoping, as it already did for rendering. Previously it resolvednullin that case, which disabled the scoping: clicks and Escape presses from anywhere in the document closed the dialog, and focus leaving the boundary and portal elements after a click inside the dialog was not moved back.#3125
bd46862Thanks @stipsan! -ElementQueryno longer readswindow.innerWidthduring render. It starts itsResizeObserverfrom a layout effect, so the browser delivers the element's width after layout and before the first paint, and it writesdata-eq-min/data-eq-maxonto the element from the observer callback instead of through state. The first paint now reflects the element's own width rather than the viewport's, a resize no longer re-renders the component, and the component is safe to render on the server.#3131
f2fd1dcThanks @stipsan! - fix(hooks): keepuseMediaIndexsubscribed when the theme object changes but its breakpoints do not. The hook keyed its media query store on the identity of the theme'smediaarray, so a different theme object with the same breakpoints (buildTheme({media})built per workspace or scheme, cloned or deserialized themes) tore down and re-createdmedia.length + 1MediaQueryLists andchangelisteners in every subscribed hook. Equal breakpoint arrays now resolve to one canonical instance, so only an actual change of breakpoints re-subscribes.#3129
158f593Thanks @stipsan! -Popoveronly observes the size of its boundary element while it is open. Every popover used to subscribe to aResizeObserveron the boundary from the moment it mounted, so a page with many closed popovers re-rendered all of them on every boundary resize. The boundary is measured synchronously when the popover opens, so its max width is right in the first painted frame, and followed while it stays open. Floating UI itself was already idle while closed (the floating element lives inside a hidden<Activity>boundary, which detaches its ref), so a closed popover now holds no boundary or Floating UI observation and no positioning listeners; the only thing it keeps are the intent listeners on its reference element until it has rendered once.The shared element size observer behind
useElementSizenow forgets an element once its last subscriber unsubscribes, so a later subscriber starts a new observation. It used to keep the element without an observer (or, when another subscriber had left last, keep an observer no one could stop), so a hook that resubscribed to the same element never received a size again.#3127
1c8fd85Thanks @stipsan! - fix(tooltip): derive the hidden state fromdisabledandcontent, and size the tooltip with Floating UI. A tooltip is now hidden in the same render that disables it or empties itscontent, instead of an effect closing it one commit later. The hover state is kept, so a tooltip that is re-enabled (or given content) while its child is still hovered shows right away rather than on the nextmouseenter. The max width is no longer measured into state from a layout effect; Floating UI'ssizemiddleware applies it inside the positioning pass, only while the tooltip is shown: the clipping width of the boundary element (or of the clipping ancestors, when there is none) within the viewport, capped to the portal element's width. Tooltips placedleftorrightare capped to the room on that side of the reference instead of the full boundary width, so they wrap rather than overlap the reference or spill out of the boundary.#3116
00f0467Thanks @stipsan! - fix(tooltip): keep the referred element mounted whendisabledtoggles. The disabled branch used to return the bare child while the enabled branch returned a fragment with the tooltip, so flippingdisabledchanged the tree shape and remounted the reference element (losing its DOM node, state and focus). Both branches now render the same fragment, with the tooltip slot empty while disabled.v4.3.3Compare Source
Patch Changes
7b0c700Thanks @stipsan! -Tooltipmeasures the boundary, portal anddocument.bodywidths it caps its max width to only when it opens. Previously it read theiroffsetWidthon mount and whenever the boundary or portal element changed, and the React Compiler also liftedportalElement?.offsetWidthinto a render-time memo dependency — a forced synchronous layout per tooltip per render, which adds up in forms with many tooltips.v4.3.2Compare Source
Patch Changes
cda7f08Thanks @squiggler-app! - fix(deps): update dependency motion to v14v4.3.1Compare Source
Patch Changes
fb087b3Thanks @squiggler-app! - fix(deps): update dependency motion to ^13.5.1v4.3.0Compare Source
Minor Changes
49f16c1Thanks @stipsan! -Avatarrenders its image with a native<img>instead of an svg<image>pattern fill, so React treats it like any other image: inside a<ViewTransition>(or a<Suspense>boundary that a transition reveals) React now waits for the avatar image to load, up to a timeout, before it commits, instead of animating an empty circle that the image later pops into. The circle clip, the card and avatar color strokes and the dashedstatus="editing"ring render as before.Patch Changes
cdac1e4Thanks @squiggler-app! - fix(deps): update dependency motion to ^13.4.6v4.2.7Compare Source
Patch Changes
3048289Thanks @squiggler-app! - fix(deps): update dependency motion to ^13.4.4v4.2.6Compare Source
Patch Changes
8cb631aThanks @squiggler-app! - fix(deps): update dependency motion to ^13.4.3v4.2.4Compare Source
Patch Changes
a9fb87cThanks @squiggler-app! - fix(deps): update dependency motion to ^13.4.1v4.2.3Compare Source
Patch Changes
1d0e8deThanks @stipsan! - Adddata-uiidentifiers to internal styled-components hosts.v4.2.2Compare Source
Patch Changes
5f3b645Thanks @squiggler-app! - fix(deps): update dependency motion to ^13.4.0v4.2.1Compare Source
Patch Changes
#2886
7766a79Thanks @stipsan! - FixAvatarrendering the initials fallback for one frame aftersrcchanges away from an image that failed to load. The failed state now resets while rendering instead of in an effect, so the replacement image renders in the same commit as the newsrc.#2894
63a6ca0Thanks @squiggler-app! - fix(deps): update react monorepo to ^19.3.0#2811
9c7a1a7Thanks @stipsan! - AnimateSkeletonshimmer with a CSS mask andtransforminstead ofbackground-position.#2884
7056449Thanks @stipsan! -LayerProvidertracks its child layers with a singleuseReducer, so registering or unregistering a child layer is one state update instead of two.#2873
8c64db2Thanks @stipsan! - Remove thestartTransitionwrappers around theAutocompleteandTreeItemelement-ref state setters. They guarded against a "Maximum update depth exceeded" loop that only occurred on React 18, which is no longer supported since React 19.2 is the minimum version.Updated dependencies [
63a6ca0]:v4.2.0Compare Source
Minor Changes
#2827
4b81730Thanks @stipsan! - Move the remaining fully static styled-components CSS to vanilla-extract, served from@sanity/ui/styles.css:Arrow,AvatarandAvatarStack. Styles that read the theme or props stay on styled-components.No API changes. As with
SrOnlyandSpinnersince 4.0.0, these components render unstyled unless the app imports the stylesheet once:Patch Changes
0128e47Thanks @stipsan! - StopLayerfrom overwritingdata-uionDialogandTooltip, and add identifiers on remaining component roots (PopoverOverlay,ButtonLoading,ToastLoadingBar, dialog regions, andSpanWithTextOverflow).v4.1.1Compare Source
Patch Changes
#2831
c9141dfThanks @squiggler-app! - fix(deps): update dependency motion to ^13.2.0#2858
340baadThanks @stipsan! - Fix animatedPopoverandTooltip(and therebyMenuButton) scaling from the center instead of the reference element every time they are shown after the first. Thetransform-origincomputed by the floating-uioriginmiddleware is now applied as a plain CSS property instead of motion'soriginX/originYstyle keys,Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate using a curated preset maintained by
. View repository job log here