@depup/sanity 5.17.1-depup.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2016 - 2026 Sanity.io
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,57 @@
+# @depup/sanity
+
+> Dependency-bumped version of [sanity](https://www.npmjs.com/package/sanity)
+
+Generated by [DepUp](https://github.com/depup/npm) -- all production
+dependencies bumped to latest versions.
+
+## Installation
+
+```bash
+npm install @depup/sanity
+```
+
+| Field | Value |
+|-------|-------|
+| Original | [sanity](https://www.npmjs.com/package/sanity) @ 5.17.1 |
+| Processed | 2026-03-17 |
+| Smoke test | failed |
+| Deps updated | 27 |
+
+## Dependency Changes
+
+| Dependency | From | To |
+|------------|------|-----|
+| @dnd-kit/modifiers | ^6.0.1 | ^9.0.0 |
+| @dnd-kit/sortable | ^7.0.2 | ^10.0.0 |
+| @isaacs/ttlcache | ^1.4.1 | ^2.1.4 |
+| @mux/mux-player-react | ^3.10.2 | ^3.11.5 |
+| @portabletext/editor | ^6.4.0 | ^6.5.0 |
+| @portabletext/plugin-markdown-shortcuts | ^7.0.19 | ^7.0.20 |
+| @portabletext/plugin-one-line | ^6.0.19 | ^6.0.20 |
+| @portabletext/plugin-paste-link | ^3.0.19 | ^3.0.20 |
+| @portabletext/plugin-typography | ^7.0.19 | ^7.0.20 |
+| @sanity/cli | ^6.1.5 | ^6.1.7 |
+| @sanity/diff-patch | ^5.0.0 | ^6.0.0 |
+| @sanity/sdk | 2.1.2 | ^2.8.0 |
+| @sentry/react | ^8.55.0 | ^10.44.0 |
+| @tanstack/react-virtual | ^3.13.18 | ^3.13.23 |
+| @xstate/react | ^6.0.0 | ^6.1.0 |
+| classnames | ^2.2.5 | ^2.5.1 |
+| i18next | ^25.8.17 | ^25.8.18 |
+| isomorphic-dompurify | 2.26.0 | ^3.5.0 |
+| lodash-es | ^4.17.22 | ^4.17.23 |
+| motion | ^12.27.1 | ^12.38.0 |
+| nanoid | ^3.3.11 | ^5.1.7 |
+| path-to-regexp | ^6.3.0 | ^8.3.0 |
+| player.style | ^0.1.9 | ^0.3.1 |
+| react-i18next | 15.6.1 | ^16.5.8 |
+| semver | ^7.7.2 | ^7.7.4 |
+| uuid | ^11.1.0 | ^13.0.0 |
+| xstate | ^5.25.1 | ^5.28.0 |
+
+---
+
+Source: https://github.com/depup/npm | Original: https://www.npmjs.com/package/sanity
+
+License inherited from the original package.

package/bin/sanity

@@ -0,0 +1,209 @@
+#!/usr/bin/env node
+/**
+ * `npx sanity`: in order for this to work, the `sanity` module should be the one
+ * exposing a binary. However, the `@sanity/cli` module is the one who _actually_ ship
+ * the CLI binary.
+ *
+ * To solve this:
+ * 1. `@sanity/cli` is a dependency of the `sanity` module
+ * 2. The path to this file is configured as `bin.sanity` in the `sanity` module
+ * 3. This script resolves the `@sanity/cli` package, finds the path to the `sanity`
+ *    binary from the `@sanity/cli` package declaration (`bin.sanity`)
+ * 4. Either imports the resolved path directly (if it's a Node.js script), or spawns it
+ *    (if the path specified does not point to a Node.js script)
+ *
+ * See `runSanityCli()` for more details on the dual approach of importing vs spawning.
+ */
+
+/* eslint-disable import/no-dynamic-require, no-process-exit */
+import {readFile, open} from 'node:fs/promises'
+import {createRequire} from 'node:module'
+import {dirname, resolve} from 'node:path'
+import {pathToFileURL} from 'node:url'
+import {spawn} from 'node:child_process'
+
+const require = createRequire(import.meta.url)
+
+runSanityCli().catch((err) => {
+  // Use setImmediate/setTimeout to throw outside the promise chain
+  setImmediate(() => {
+    throw err
+  })
+})
+
+/**
+ * Resolves the Sanity CLI binary from `@sanity/cli` and executes it in the best
+ * possible way available to us, based on the module type:
+ *
+ * - If the binary is a Node.js script, we either `import()` or `require()` it based on
+ *   the extension (cjs/mjs) or the package `type` field. This is prefered as it does
+ *   not require spawning a new process.
+ * - If the binary is not a Node.js script, we spawn it as a child process. On Windows,
+ *   shebangs are parsed manually and the interpreter is invoked directly. stdio is
+ *   inherited from the parent process.
+ *
+ * Note:
+ * The "new" CLI is an ESM module, while the "old" CLI is CommonJS.
+ * In theory, Node.js now has support for transparently mixing CommonJS and ESM, but in
+ * practice we've seen some issues with this approach for the CLI specifically. Thus, we
+ * explicitly check the package type and use either `import()` or `require()` accordingly.
+ */
+async function runSanityCli() {
+  const {bin, type} = await getSanityCliBin()
+  const shebang = await parseShebang(bin)
+
+  // The optimal case: the binary is a Node.js script - import/require it directly to
+  // prevent needing to spawn a new process
+  if (isNodeScript(bin, shebang)) {
+    if (type === 'module') {
+      await import(pathToFileURL(bin).href)
+    } else {
+      require(bin)
+    }
+    return
+  }
+
+  // Fallback: spawn the binary as a child process.
+  // Note: because we resolve the `bin` field from `@sanity/cli`'s package.json, the path
+  // points to the actual source file, not a cmd-shim wrapper. This means we don't need the
+  // full cmd-shim argument escaping that libraries like `cross-spawn` provide - we only need
+  // to handle shebangs on Windows, where they are not natively supported by the OS.
+  // On Unix, the OS handles shebangs natively.
+  let command = bin
+  let args = process.argv.slice(2)
+  if (process.platform === 'win32' && shebang) {
+    command = shebang.interpreter
+    args = [...shebang.args, bin, ...process.argv.slice(2)]
+  }
+
+  const child = spawn(command, args, {stdio: 'inherit'})
+
+  // Forward signals to the child process
+  const signals = ['SIGINT', 'SIGTERM', 'SIGHUP']
+  const signalHandlers = signals.map((signal) => {
+    const handler = () => child.kill(signal)
+    process.on(signal, handler)
+    return {signal, handler}
+  })
+
+  try {
+    const exitCode = await new Promise((resolve, reject) => {
+      child.on('error', reject)
+      child.on('close', (code) => resolve(code ?? 1))
+    })
+    process.exitCode = exitCode
+  } finally {
+    // Clean up signal handlers
+    for (const {signal, handler} of signalHandlers) {
+      process.off(signal, handler)
+    }
+  }
+}
+
+async function getSanityCliBin() {
+  // Resolve package.json from `@sanity/cli` instead of the main export to allow
+  // resolving before the package is built. Note that this might fail if `@sanity/cli`
+  // does not explicitly list `./package.json` in the exports field, but since control
+  // this module, this feels like a safe assumption.
+  const pkgPath = require.resolve('@sanity/cli/package.json')
+
+  let pkg
+  try {
+    pkg = JSON.parse(await readFile(pkgPath, 'utf8'))
+  } catch (err) {
+    throw new Error(`Failed to read @sanity/cli package.json: ${err.message}`)
+  }
+
+  if (!pkg.bin?.sanity) {
+    throw new Error('Failed to find `bin.sanity` field in @sanity/cli package.json')
+  }
+
+  // Assuming `package.json` is located at the root of the package - anything else would
+  // be… wild, unconventional, unorthodox… I'd even say… heretical.
+  const cliDir = dirname(pkgPath)
+
+  // Note that npm normalizes bin paths: `./bin/sanity` -> `bin/sanity`
+  const bin = resolve(cliDir, pkg.bin.sanity)
+  const type = determineModuleType(bin, pkg)
+  return {bin, type}
+}
+
+/**
+ * Parses the shebang from a script file and returns the interpreter and its arguments.
+ * Returns `null` if the file has no shebang.
+ *
+ * Handles both direct paths and `env` invocations:
+ * - `#!/usr/bin/node` => `{interpreter: '/usr/bin/node', args: []}`
+ * - `#!/usr/bin/env node` => `{interpreter: 'node', args: []}`
+ * - `#!/usr/bin/env -S node --flags` => `{interpreter: 'node', args: ['--flags']}`
+ */
+async function parseShebang(scriptPath) {
+  let file
+  try {
+    file = await open(scriptPath)
+  } catch (err) {
+    throw new Error(
+      `Failed to read CLI binary at ${scriptPath}: ${err instanceof Error ? err.message : err}`,
+    )
+  }
+
+  try {
+    const {buffer, bytesRead} = await file.read({length: 256})
+    const content = buffer.toString('utf8', 0, bytesRead)
+
+    if (!content.startsWith('#!')) {
+      return null
+    }
+
+    const firstLine = content.slice(2, content.indexOf('\n')).trim()
+    const parts = firstLine.split(/\s+/)
+
+    if (parts[0].endsWith('/env')) {
+      // `env` invocation: skip flags (e.g. `-S`) to find the actual interpreter
+      const interpreterIdx = parts.findIndex((part, i) => i > 0 && !part.startsWith('-'))
+      if (interpreterIdx === -1) {
+        return null
+      }
+      return {
+        interpreter: parts[interpreterIdx],
+        args: parts.slice(interpreterIdx + 1),
+      }
+    }
+
+    return {
+      interpreter: parts[0],
+      args: parts.slice(1),
+    }
+  } finally {
+    await file.close()
+  }
+}
+
+/**
+ * Determines if the file at `scriptPath` is a Node.js script by checking its shebang.
+ * Returns true if:
+ * - The shebang interpreter is `node` (e.g., `#!/usr/bin/node`, `#!/usr/bin/env node`)
+ * - The file has a `.js`, `.mjs`, or `.cjs` extension (fallback when no shebang)
+ */
+function isNodeScript(scriptPath, shebang) {
+  if (shebang) {
+    const {interpreter} = shebang
+    return interpreter.endsWith('node') || interpreter.endsWith('node.exe')
+  }
+
+  // No shebang - fall back to extension check (.js, .mjs, .cjs)
+  // This is not perfect - but it's better than nothing
+  return /\.(m?js|cjs)$/.test(scriptPath)
+}
+
+function determineModuleType(binPath, pkgJson) {
+  if (binPath.endsWith('.cjs')) {
+    return 'commonjs'
+  }
+
+  if (binPath.endsWith('.mjs')) {
+    return 'module'
+  }
+
+  return pkgJson.type === 'module' ? 'module' : 'commonjs'
+}

package/changes.json

@@ -0,0 +1,114 @@
+{
+  "bumped": {
+    "@dnd-kit/modifiers": {
+      "from": "^6.0.1",
+      "to": "^9.0.0"
+    },
+    "@dnd-kit/sortable": {
+      "from": "^7.0.2",
+      "to": "^10.0.0"
+    },
+    "@isaacs/ttlcache": {
+      "from": "^1.4.1",
+      "to": "^2.1.4"
+    },
+    "@mux/mux-player-react": {
+      "from": "^3.10.2",
+      "to": "^3.11.5"
+    },
+    "@portabletext/editor": {
+      "from": "^6.4.0",
+      "to": "^6.5.0"
+    },
+    "@portabletext/plugin-markdown-shortcuts": {
+      "from": "^7.0.19",
+      "to": "^7.0.20"
+    },
+    "@portabletext/plugin-one-line": {
+      "from": "^6.0.19",
+      "to": "^6.0.20"
+    },
+    "@portabletext/plugin-paste-link": {
+      "from": "^3.0.19",
+      "to": "^3.0.20"
+    },
+    "@portabletext/plugin-typography": {
+      "from": "^7.0.19",
+      "to": "^7.0.20"
+    },
+    "@sanity/cli": {
+      "from": "^6.1.5",
+      "to": "^6.1.7"
+    },
+    "@sanity/diff-patch": {
+      "from": "^5.0.0",
+      "to": "^6.0.0"
+    },
+    "@sanity/sdk": {
+      "from": "2.1.2",
+      "to": "^2.8.0"
+    },
+    "@sentry/react": {
+      "from": "^8.55.0",
+      "to": "^10.44.0"
+    },
+    "@tanstack/react-virtual": {
+      "from": "^3.13.18",
+      "to": "^3.13.23"
+    },
+    "@xstate/react": {
+      "from": "^6.0.0",
+      "to": "^6.1.0"
+    },
+    "classnames": {
+      "from": "^2.2.5",
+      "to": "^2.5.1"
+    },
+    "i18next": {
+      "from": "^25.8.17",
+      "to": "^25.8.18"
+    },
+    "isomorphic-dompurify": {
+      "from": "2.26.0",
+      "to": "^3.5.0"
+    },
+    "lodash-es": {
+      "from": "^4.17.22",
+      "to": "^4.17.23"
+    },
+    "motion": {
+      "from": "^12.27.1",
+      "to": "^12.38.0"
+    },
+    "nanoid": {
+      "from": "^3.3.11",
+      "to": "^5.1.7"
+    },
+    "path-to-regexp": {
+      "from": "^6.3.0",
+      "to": "^8.3.0"
+    },
+    "player.style": {
+      "from": "^0.1.9",
+      "to": "^0.3.1"
+    },
+    "react-i18next": {
+      "from": "15.6.1",
+      "to": "^16.5.8"
+    },
+    "semver": {
+      "from": "^7.7.2",
+      "to": "^7.7.4"
+    },
+    "uuid": {
+      "from": "^11.1.0",
+      "to": "^13.0.0"
+    },
+    "xstate": {
+      "from": "^5.25.1",
+      "to": "^5.28.0"
+    }
+  },
+  "timestamp": "2026-03-17T22:56:07.073Z",
+  "totalUpdated": 27
+}