Skip to content

chore(deps): update non-major - #134

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/non-major
Open

chore(deps): update non-major#134
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/non-major

Conversation

@renovate

@renovate renovate Bot commented Apr 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update
@changesets/changelog-github (source) ^0.5.2 → ^0.7.0 age confidence devDependencies minor
@changesets/cli (source) ^2.29.8 → ^2.31.1 age confidence devDependencies minor
@sanity/tsconfig (source) ^2.1.0 → ^2.2.1 age confidence devDependencies minor
@sanity/tsdown-config (source) ^0.5.8 → ^0.31.1 age confidence devDependencies minor
oxfmt (source) ^0.36.0 → ^0.73.0 age confidence devDependencies minor
oxlint (source) ^1.51.0 → ^1.88.0 age confidence devDependencies minor
oxlint-tsgolint ^0.16.0 → ^0.25.0 age confidence devDependencies minor
peaceiris/actions-gh-pages (changelog) 4f9cc66 → 84c30a8 action digest
tsdown (source) ^0.20.3 → ^0.23.1 age confidence devDependencies minor
typedoc (source) ^0.28.17 → ^0.28.20 age confidence devDependencies patch

Release Notes

changesets/changesets (@​changesets/changelog-github)

v0.7.0

Compare Source

Minor Changes

v0.6.0

Compare Source

Minor Changes
Patch Changes
changesets/changesets (@​changesets/cli)

v2.31.1

Compare Source

Patch Changes
  • #​2159 15cf592 Thanks @​ingvaldlorentzen! - Fixed already-published version detection with npm 12, which always wraps successful npm info --json output in an array. The unwrapped output made changeset publish treat every package as unpublished and fail attempting to republish existing versions.

v2.31.0

Compare Source

Minor Changes

  • #​1889 96ca062 Thanks @​mixelburg! - Error on unsupported flags for individual CLI commands and print the matching command usage to make mistakes easier to spot.

  • #​1873 42943b7 Thanks @​mixelburg! - Respond to --help on all subcommands. Previously, --help was only handled when it was the sole argument; passing it alongside a subcommand (e.g. changeset version --help) would silently execute the command instead. Now --help always exits early and prints per-command usage when a known subcommand is provided, or the general help text otherwise.

Patch Changes

v2.30.0

Compare Source

Minor Changes

  • #​1840 057cca2 Thanks @​wotan-allfather! - Add --since flag to add command

    The add command now supports a --since flag that allows you to specify which branch, tag, or git ref to use when detecting changed packages. This is useful for gitflow workflows where you have multiple target branches and the baseBranch config option doesn't cover all use cases.

    Example: changeset add --since=develop

    If not provided, the command falls back to the baseBranch value in your .changeset/config.json.

  • #​1845 2b4a66a Thanks @​Andarist! - Delegate OTP prompting to the package manager instead of handling it in-process. This allows Changesets to use the package manager's native web auth support.

  • #​1774 667fe5a Thanks @​bluwy! - Support importing custom commit option ES module. Previously, it used require() which only worked for CJS modules, however now it uses import() which supports both CJS and ES modules.

  • #​1839 73b1809 Thanks @​leochiu-a! - Add a --message (-m) flag to changeset add (and default changeset) so the changeset summary can be provided from the command line. When --message is present, the summary prompt is skipped while the final confirmation step is kept.

  • #​1806 0e8e01e Thanks @​luisadame! - Changeset CLI can now be run from the nested directories in the project, where the .changeset directory has to be found in one of the parent directories

Patch Changes
sanity-io/pkg-utils (@​sanity/tsconfig)

v2.2.1

Compare Source

Patch Changes
  • #​3032 229154b Thanks @​stipsan! - fix: use a literal @ instead of the percent-encoded %40 in the homepage links to the packages/@sanity/* directories, so the URLs read cleanly in the npm UI (GitHub resolves both forms)

v2.2.0

Compare Source

Minor Changes

  • #​2959 7a1e207 Thanks @​stipsan! - Add outDir: "${configDir}/dist" to the recommended preset

    Emitting to dist is already the default in @sanity/pkg-utils and tsdown, but every repo extending these presets had to repeat it in their own tsconfig. Since ${configDir} resolves to the directory of the tsconfig that extends the preset, output now lands in the dist folder next to your package.json by default, and the manual declaration can be removed:

    {
  "extends": "@sanity/tsconfig/strictest",
-  "compilerOptions": {
-    "outDir": "${configDir}/dist"
-  }
}
sanity-io/pkg-utils (@​sanity/tsdown-config)

v0.31.1

Compare Source

No changes in this release.

v0.31.0

Compare Source

Minor Changes

  • #​3646 95ad65a Thanks @​stipsan! - Add panda.cascadeLayers, passed through to @sanity/pandacss-tsdown-plugin. It defaults to true, so the Panda stylesheet keeps its cascade layers, as before; panda: {cascadeLayers: false} publishes it without them, so consumers can override its base styles without overriding its states. Switching the default to false is planned for a later release of its own, once @sanity/ui and sanity have adopted the option.

    A panda option the installed plugin doesn't have (cascadeLayers on a plugin before 0.2.0, say) now fails the config with the upgrade to make, instead of reaching a plugin that ignores it; the peer range still accepts every version of the plugin.

v0.30.1

Compare Source

Patch Changes

  • #​3642 158b317 Thanks @​stipsan! - Fix how CSS targets and the panda option resolve:

    • target: 'baseline-widely-available' now transforms the CSS of vanillaExtract, panda and css for the browsers tsdown expands it to, instead of the @sanity/browserslist-config fallback. A browser you name next to the alias (['chrome61', 'baseline-widely-available']) keeps the lower of the two versions.
    • panda reads the top-level target from the final config, so a target you set with mergeConfig() after defineConfig() decides the browsers. An explicit panda.target or panda.lightningcss.targets still wins.
    • panda and vanillaExtract or css writing the same stylesheet is detected for ./-prefixed names too, and a css option with splitting no longer counts as a conflict.
    • Enabling panda without @sanity/pandacss-tsdown-plugin installed explains how to install it.

    The target fixes apply with @sanity/pandacss-tsdown-plugin 0.1.0 as well.

v0.30.0

Compare Source

Minor Changes

  • #​3639 da36413 Thanks @​stipsan! - Add the panda option for packages styled with Panda CSS. Set panda: true to enable @sanity/pandacss-tsdown-plugin with the Sanity defaults, or pass an options object to customize it.

    By default:

    • the style calls that can be resolved statically are rewritten into class names, and the generated CSS is extracted into dist/bundle.css
    • the entry chunks that use Panda styles import the stylesheet
    • the stylesheet is published as a conditional ./bundle.css export: the browser and style conditions select the CSS file, node and default a no-op JS shim, so the import also loads in Node.js

    The CSS syntax is transformed for the configured browsers — panda.target, falling back to the top-level target. When neither names browsers (for example node20), the browsers of @sanity/browserslist-config are used instead.

    Minification is opt-in:

    export default defineConfig({
  panda: {minify: true},
})

    Setup: install @sanity/pandacss-tsdown-plugin as a dev dependency; it is an optional peer dependency of this package. @pandacss/dev is recommended — for the usual "prepare": "panda codegen" script and the panda CLI — but not required.

  • #​3623 04ff6bd Thanks @​stipsan! - vanillaExtract.minify and css.minify no longer default to true. CSS is left unminified unless minify: true is set. The CSS syntax-lowering target default is unchanged.

Patch Changes

v0.29.0

Compare Source

Minor Changes

  • #​3618 a5b59df Thanks @​stipsan! - feat: add the opt-in identifiers: 'safe' option, keeping class names apart across package releases

    The default 'short' identifiers hash only the package name and the file path, then append a counter of the identifiers generated in the file so far. So a release that reorders a file's styles reuses its class names for different rules: ._2mi48t0 is the Button loading overlay in @sanity/ui 4.4.2 and the Button root in 4.4.4, and pages that loaded the CSS of both releases styled the new Buttons with the old overlay rule.

    identifiers: 'safe' is 'short' with the package version in the file-scope hash: @emotion/hash(packageName + '@' + packageVersion + filePath), followed by the same base-36 counter, with the same _ prefix when the name starts with a digit. The version is read from the same package.json as the package name. Every release gets its own class names, and the same release always builds the same ones. It is available in @sanity/vanilla-extract-rolldown-plugin, @sanity/vanilla-extract-tsdown-plugin, @sanity/vanilla-extract-vite-plugin (including createCompiler), and the vanillaExtract option of @sanity/tsdown-config:

    // tsdown.config.ts
import {defineConfig} from '@sanity/tsdown-config'

export default defineConfig({
  vanillaExtract: {identifiers: 'safe'},
})

    The defaults are unchanged. @sanity/vanilla-extract-integration exports resolveIdentifierOption() and the PluginIdentifierOption type that implement the option, and getPackageInfo() now also returns the package version.

Patch Changes

v0.28.8

Compare Source

Patch Changes

v0.28.7

Compare Source

Patch Changes

v0.28.6

Compare Source

Patch Changes

v0.28.5

Compare Source

Patch Changes

v0.28.4

Compare Source

Patch Changes

v0.28.3

Compare Source

Patch Changes

v0.28.2

Compare Source

Patch Changes

v0.28.1

Compare Source

Patch Changes

v0.28.0

Compare Source

Minor Changes

  • #​3406 5372ae6 Thanks @​stipsan! - Upgrade tsdown and @tsdown/css to 0.23.

    BREAKING: the @sanity/tsdown-config and @sanity/vanilla-extract-tsdown-plugin
    tsdown peer range is now ^0.23.0; tsdown 0.22 is no longer supported. Node.js 25
    can no longer run either package or pkg build. Use Node ^22.18.0, ^24.11.0, or
    >=26.0.0.

    tsdown 0.23 removes deprecated config options. Replace dts.tsgo: true and
    dts.oxc: true with dts.generator: 'tsgo' and dts.generator: 'oxc'.
    Replace dts.oxc: false with dts.generator: 'tsc'. Remove dts.cjsReexport.
    Replace dts.volarPlugins with dts.customLanguages and rename each language's
    create hook to createVolarPlugins.
    Under deps, replace skipNodeModulesBundle: true with neverBundle: true
    and onlyAllowBundle with onlyBundle.

    deps.resolveDepSubpath: true preserves the old dependency-specifier behavior.
    pkg watch now closes tsdown's native watch handle, including its Rolldown watchers
    and keyboard-shortcut resources, and sets ignoreWatch on package.json and
    tsconfig.json so tsdown does not restart itself and orphan a watcher that abort
    cannot close. CSS builds now need @tsdown/css@0.23.0, the exact version tsdown 0.23
    pins.

    tsdown 0.23 also emits declarations with inline export declare modifiers instead of
    a trailing export list. A .d.ts with no export statement is an export context, so a
    type that the source left unexported becomes part of the published API. Export the
    types you mean to publish and tag them @public.

Patch Changes

v0.27.1

Compare Source

Patch Changes

v0.27.0

Compare Source

Minor Changes
  • #​3320 8d15fe5 Thanks @​stipsan! - Breaking: the babel pipeline is opt-in. reactCompiler defaults to transform: 'oxc', and @rolldown/plugin-babel + @babel/core are optional peer dependencies instead of dependencies. To stay on babel: set transform: 'babel' and pnpm add -D @rolldown/plugin-babel @babel/core babel-plugin-react-compiler.
Patch Changes

v0.26.2

Compare Source

Patch Changes

v0.26.1

Compare Source

Patch Changes

v0.26.0

Compare Source

Minor Changes
  • #​3312 24bfc3f Thanks @​stipsan! - Add reactCompiler.transform to pick the React Compiler implementation: 'babel' (the default, runs babel-plugin-react-compiler) or the experimental 'oxc' (runs oxc-transform-react, the Rust port — one native pass for React Compiler + TypeScript/JSX). Both compilers are optional peer dependencies.

v0.25.0

Compare Source

Minor Changes

  • #​3310 171251e Thanks @​stipsan! - Add a bundleAnalyzer option that wires Rolldown's experimental markdown bundle analyzer.

    true selects format: 'md' (an LLM-friendly analyze-data.md in outDir) rather than the plugin's own JSON default, so an env-gated opt-in is enough:

    bundleAnalyzer: process.env.ENABLE_BUNDLE_ANALYZER === 'true'

    Pass an object to customize format / fileName. The report is not a publishable artifact — exclude it from package.json files (e.g. "!dist/analyze-data.md"). @sanity/pkg-utils forwards the same option from package.config.ts.

v0.24.2

Compare Source

Patch Changes

  • #​3297 5496b49 Thanks @​squiggler-app! - fix(deps): update dependency rolldown to ~1.2.4

  • #​3288 5bfa760 Thanks @​stipsan! - Stop flagging the synthesized namespace wrappers of the declaration bundler with ae-missing-release-tag.

    Namespace re-exports (export * as ns from './module', or import * as ns + export {ns}) make the declaration bundling pass synthesize a declare namespace <module>_d_exports {…} wrapper that drops the doc comment of the re-export statement, so the wrapper could never carry a release tag and there was no userland fix short of downgrading the rule for the whole package. The TSDoc check now recognizes those wrappers (the interop naming, declared as a namespace in the entry or a shared chunk, a body that only re-exports sibling declarations, and re-exported under an alias) and exempts them from ae-missing-release-tag, like API Extractor's own rollups never checked the equivalent namespace. Everything else, including user namespaces that merely resemble the interop naming, stays checked: a namespace that declares members of its own is yours to tag, even when the bundler's deconflicting hands it a wrapper-shaped name.

  • Updated dependencies [5496b49]:

v0.24.1

Compare Source

Patch Changes

v0.24.0

Compare Source

Minor Changes

  • #​3250 33e7b93 Thanks @​stipsan! - Move the conditional CSS export from inject.nodeCompat to exports.nodeCompat, and give @tsdown/css output the same treatment.

    nodeCompat configures how the CSS file is published, not how the import is injected, so it moves to a dedicated exports option. inject and exports are now independent: inject prepends an import of the CSS to entry chunks, while exports publishes it as the ./<fileName> export subpath (which also makes any injected import self-referential). exports: true declares a plain string export for browser-only packages; exports: {nodeCompat: true} declares the conditional export and emits the no-op JS shim plus its .d.ts. inject: {nodeCompat: true} keeps working, normalized to {inject: true, exports: {nodeCompat: true}} with a deprecation warning; an explicit exports wins over it.

    @sanity/tsdown-config gains a css.exports option implementing the same pattern on top of @tsdown/css (an optional peer dependency), which compiles CSS but has no node-shim concept of its own — its inject emits a relative import that throws in runtimes that cannot load .css files.

    @sanity/pkg-utils gains a css option, and builds a .css export subpath that declares a source:

    "./ui/styles.css": {"source": "./src/ui/styles.css"}

    pkg build compiles it to dist/ui/styles.css with the same minify and lowering settings vanillaExtract gets, emits the shim, and fills in the types/browser/style/node/default conditions. @sanity/parse-package-json exposes the new parseCssExports for reading those subpaths, and parseExports no longer returns them as JS entries.

  • #​3253 bc16006 Thanks @​stipsan! - Suppress CIRCULAR_DEPENDENCY warnings from the declaration bundling pass by default, and add a suppressWarnings option.

    defineConfig enables Rolldown's checks.circularDependency, which also reports cycles between the emitted .d.ts modules. Those imports are type-only and erased at runtime, so the cycles carry none of the hazards the check exists to surface, and they're unavoidable for mutually referencing public types — in sanity-io/sanity#13753 109 of 136 cycle warnings were declaration-only, drowning out the 27 real ones. The config now sets tsdown's suppressWarnings to drop warnings whose entire cycle consists of declaration files (.d.ts/.d.mts/.d.cts); a cycle that includes even one runtime module still warns. Consumers that filtered these out themselves (like @repo/tsdown.config in sanity-io/sanity) can drop their own predicate.

    The new suppressWarnings option takes tsdown's own value shapes (strings matched with includes, regular expressions matched with test, or a predicate) and is OR'd with the built-in suppression, so per-package suppressions can't silently undo it. Merging suppressWarnings over the returned config still replaces the default entirely (mergeConfig replaces functions), which is the escape hatch for restoring every warning: mergeConfig(await defineConfig(), {suppressWarnings: () => false}).

    tsdown added suppressWarnings in 0.22.7, so the tsdown peer range is raised from ^0.22.5 to ^0.22.7. On 0.22.5/0.22.6 the option is silently ignored (the cycle warnings keep appearing) and the UserConfig['suppressWarnings'] indexed access in the published declarations does not resolve.

  • #​3246 c1106f1 Thanks @​stipsan! - Move the tsdoc feature (API Extractor TSDoc/release-tag checking) from @sanity/pkg-utils into @sanity/tsdown-config.

    In @sanity/tsdown-config the option is false by default; set tsdoc: true (or an options object) to run the check after the build via tsdown's build:done hook. The checker lives at @sanity/tsdown-config/tsdoc and is lazy-loaded from the root config, so API Extractor is not part of the default entry's module graph. @sanity/pkg-utils continues enabling it by default (tsdoc: true) when composing the config, and still runs it during pkg check via checkTsdoc from @sanity/tsdown-config/tsdoc.

Patch Changes

v0.23.0

[Compare Source](https://redirect.github.com/sanity-io/pkg-utils/compare/@sanity/tsdown-co

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "before 3am on the first day of the month"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate using a curated preset maintained by Sanity. View repository job log here

@changeset-bot

changeset-bot Bot commented Apr 1, 2026 •
edited
Loading

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 5552619

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@socket-security

socket-security Bot commented Apr 1, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updated@​changesets/​changelog-github@​0.5.2 ⏵ 0.7.010010068 +194 +1100
Updated@​sanity/​tsconfig@​2.1.0 ⏵ 2.2.176 +110094 +192 +8100
Updatedtypedoc@​0.28.17 ⏵ 0.28.201001009788 -3100
Updatedoxfmt@​0.36.0 ⏵ 0.73.094 +81008896 +1100
Updatedtsdown@​0.20.3 ⏵ 0.23.19810088 +196 -1100
Updatedoxlint@​1.51.0 ⏵ 1.88.099 +11009196 +1100
Updatedoxlint-tsgolint@​0.16.0 ⏵ 0.25.0991009693 +2100
Updated@​changesets/​cli@​2.29.8 ⏵ 2.31.197100100 +195 +1100
Updated@​sanity/​tsdown-config@​0.5.8 ⏵ 0.31.196 +28100100 +3698 -1100

View full report

@renovate
renovate Bot force-pushed the renovate/non-major branch 3 times, most recently from 212f6c7 to e37d8e5 Compare April 8, 2026 21:32
@renovate
renovate Bot force-pushed the renovate/non-major branch 4 times, most recently from 1ecd286 to 9423614 Compare April 16, 2026 18:33
@socket-security

socket-security Bot commented Apr 16, 2026 •
edited
Loading

Copy link
Copy Markdown

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

@renovate
renovate Bot force-pushed the renovate/non-major branch 5 times, most recently from dd71de3 to dad8d12 Compare April 25, 2026 17:36
@renovate
renovate Bot force-pushed the renovate/non-major branch 3 times, most recently from 0671ec2 to c546b7c Compare April 29, 2026 10:39
@renovate
renovate Bot force-pushed the renovate/non-major branch 4 times, most recently from b5fcd04 to de7e097 Compare May 11, 2026 21:47
@renovate
renovate Bot force-pushed the renovate/non-major branch 4 times, most recently from e3b42e9 to 08de102 Compare May 19, 2026 10:56
@renovate
renovate Bot force-pushed the renovate/non-major branch 6 times, most recently from e99e9ce to b9c694e Compare June 29, 2026 16:47
@renovate
renovate Bot force-pushed the renovate/non-major branch 7 times, most recently from 783ec04 to 9f530f4 Compare July 4, 2026 18:12
@renovate
renovate Bot force-pushed the renovate/non-major branch 9 times, most recently from 8703394 to b550fc5 Compare July 14, 2026 01:57
@renovate
renovate Bot force-pushed the renovate/non-major branch 7 times, most recently from 7ce8a20 to 1d1136f Compare July 17, 2026 08:30

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

🤖 bot 📦 deps

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants