Skip to content

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Nov 24, 2025

Note: This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update Pending
@sanity/pkg-utils (source) 9.0.39.2.3 age confidence dependencies minor
@sanity/prettier-config ^2.0.1^2.0.3 age confidence devDependencies patch
@types/node (source) ^24.10.0^24.10.7 age confidence dependencies patch
peter-evans/create-pull-request (changelog) 271a8d022a9089 action digest
prettier (source) ^3.6.2^3.7.4 age confidence devDependencies patch
renovate (source) ^42.0.2^42.74.7 age confidence dependencies minor 42.78.2 (+11)

Release Notes

sanity-io/pkg-utils (@​sanity/pkg-utils)

v9.2.3

Compare Source

Patch Changes

v9.2.2

Compare Source

Patch Changes

v9.2.1

Compare Source

Patch Changes

v9.2.0

Compare Source

Minor Changes

v9.1.5

Compare Source

Patch Changes

v9.1.4

Compare Source

Patch Changes

v9.1.3

Compare Source

Patch Changes

v9.1.2

Compare Source

Patch Changes

v9.1.1

Compare Source

Patch Changes

v9.1.0

Compare Source

Minor Changes
  • #​2202 207f489 Thanks @​copilot-swe-agent! - feat: Add configurable strict checks for legacy package.json fields

    Added new strict options to warn about deprecated package.json fields that are no longer needed with modern Node.js and bundlers:

    • noPackageJsonMain - Warns when main field is present (use exports instead)
    • noPackageJsonModule - Warns when module field is present (use exports instead)
    • noPackageJsonBrowser - Warns when browser field is present (use browser condition in exports)
    • noPackageJsonTypesVersions - Warns when typesVersions field is present (TypeScript supports types condition in exports)
    • preferModuleType - Warns when type field is missing or set to commonjs (future versions will require "type": "module")

    All new checks default to warn level and are configurable via strictOptions in package.config.ts.

    BREAKING CHANGES:

    • Removed alwaysPackageJsonMain strict option (conflicted with the new noPackageJsonMain option)
    • The top-level types field is still required for npm package listings to show TypeScript support
  • #​2221 107c8a6 Thanks @​stipsan! - Update @microsoft/api-extractor to ^7.55.0 and @microsoft/tsdoc-config to ^0.18.0

Patch Changes

v9.0.9

Compare Source

Patch Changes

v9.0.8

Compare Source

Patch Changes

v9.0.6

Compare Source

Patch Changes

v9.0.5

Compare Source

Patch Changes

v9.0.4

Compare Source

Bug Fixes
sanity-io/prettier-config (@​sanity/prettier-config)

v2.0.3

Compare Source

Bug Fixes
prettier/prettier (prettier)

v3.7.4

Compare Source

diff

LWC: Avoid quote around interpolations (#​18383 by @​kovsu)
<!-- Input -->
<div foo={bar}>   </div>

<!-- Prettier 3.7.3 (--embedded-language-formatting off) -->
<div foo="{bar}"></div>

<!-- Prettier 3.7.4 (--embedded-language-formatting off) -->
<div foo={bar}></div>
TypeScript: Fix comment inside union type gets duplicated (#​18393 by @​fisker)
// Input
type Foo = (/** comment */ a | b) | c;

// Prettier 3.7.3
type Foo = /** comment */ (/** comment */ a | b) | c;

// Prettier 3.7.4
type Foo = /** comment */ (a | b) | c;
TypeScript: Fix unstable comment print in union type comments (#​18395 by @​fisker)
// Input
type X = (A | B) & (
  // comment
  A | B
);

// Prettier 3.7.3 (first format)
type X = (A | B) &
  (// comment
  A | B);

// Prettier 3.7.3 (second format)
type X = (
  | A
  | B // comment
) &
  (A | B);

// Prettier 3.7.4
type X = (A | B) &
  // comment
  (A | B);

v3.7.3

Compare Source

diff

API: Fix prettier.getFileInfo() change that breaks VSCode extension (#​18375 by @​fisker)

An internal refactor accidentally broke the VSCode extension plugin loading.

v3.7.2

Compare Source

diff

JavaScript: Fix string print when switching quotes (#​18351 by @​fisker)
// Input
console.log("A descriptor\\'s .kind must be \"method\" or \"field\".")

// Prettier 3.7.1
console.log('A descriptor\\'s .kind must be "method" or "field".');

// Prettier 3.7.2
console.log('A descriptor\\\'s .kind must be "method" or "field".');
JavaScript: Preserve quote for embedded HTML attribute values (#​18352 by @​kovsu)
// Input
const html = /* HTML */ ` <div class="${styles.banner}"></div> `;

// Prettier 3.7.1
const html = /* HTML */ ` <div class=${styles.banner}></div> `;

// Prettier 3.7.2
const html = /* HTML */ ` <div class="${styles.banner}"></div> `;
TypeScript: Fix comment in empty type literal (#​18364 by @​fisker)
// Input
export type XXX = {
  // tbd
};

// Prettier 3.7.1
export type XXX = { // tbd };

// Prettier 3.7.2
export type XXX = {
  // tbd
};
renovatebot/renovate (renovate)

v42.74.7

Compare Source

Bug Fixes
  • deps: update ghcr.io/renovatebot/base-image docker tag to v12.21.1 (main) (#​40343) (1eb2554)
Miscellaneous Chores

v42.74.6

Compare Source

Bug Fixes

v42.74.5

Compare Source

Bug Fixes

v42.74.4

Compare Source

Bug Fixes
Miscellaneous Chores

v42.74.3

Compare Source

Bug Fixes
Miscellaneous Chores

v42.74.2

Compare Source

Bug Fixes
Miscellaneous Chores
  • deps: update prom/prometheus docker tag to v3.9.1 (main) (#​40313) (efda1ab)
Code Refactoring

v42.74.1

Compare Source

Bug Fixes
Documentation

v42.74.0

Compare Source

Features

v42.73.0

Compare Source

Features
Documentation
  • Use matchPackageNames in dependencyDashboardApproval example (#​40301) (d300868)

v42.72.0

Compare Source

Features
  • deps: update ghcr.io/renovatebot/base-image docker tag to v12.21.0 (main) (#​40300) (eeea6f2)
Miscellaneous Chores
  • deps: update dependency pnpm to v10.27.0 (main) (#​40299) (6a9c714)
  • deps: update otel/opentelemetry-collector-contrib docker tag to v0.143.0 (main) (#​40295) (80f0335)
  • deps: update otel/opentelemetry-collector-contrib docker tag to v0.143.1 (main) (#​40297) (0355125)
  • deps: update prom/prometheus docker tag to v3.9.0 (main) (#​40296) (88aa5eb)

v42.71.4

Compare Source

Bug Fixes
Documentation
Tests

v42.71.3

Compare Source

Bug Fixes
Miscellaneous Chores

v42.71.2

Compare Source

Bug Fixes
  • deps: update ghcr.io/renovatebot/base-image docker tag to v12.20.11 (main) (#​40281) (7aad009)

v42.71.1

Compare Source

Bug Fixes
  • deps: update ghcr.io/containerbase/sidecar docker tag to v13.25.21 (main) (#​40280) (4679fcf)
Documentation
Miscellaneous Chores

v42.71.0

Compare Source

Features
Miscellaneous Chores

v42.70.3

Compare Source

Miscellaneous Chores
  • deps: update jaegertracing/jaeger docker tag to v2.14.1 (main) (#​40258) (6298a49)
Build System

v42.70.2

Compare Source

Bug Fixes
  • deps: update ghcr.io/renovatebot/base-image docker tag to v12.20.10 (main) (#​40256) (5b94718)

v42.70.1

Compare Source

Bug Fixes
  • deps: update ghcr.io/containerbase/sidecar docker tag to v13.25.20 (main) (#​40255) (2a642a7)
Miscellaneous Chores
  • deps: update ghcr.io/containerbase/devcontainer docker tag to v13.25.20 (main) (#​40254) (605af72)

v42.70.0

Compare Source

Features
Miscellaneous Chores

v42.69.2

Compare Source

Miscellaneous Chores
Build System

v42.69.1

Compare Source

Bug Fixes

v42.69.0

Compare Source

Features
  • self-hosted: allow choice of shell: true for postUpgradeTasks (#​40229) (cbe1d04)

v42.68.5

Compare Source

Bug Fixes
  • postUpgradeTasks: always run commands with shell mode (140a777)
  • util/exec: don't use shell by default (f430552)
Documentation
  • self-hosting: note risk of postUpgradeTasks with shell execution (d2872e2)
Code Refactoring
  • github-actions: Simplify line parsing (#​40216) (fb80abb)
  • util/exec: specify the args array for execa (a0a84a4)
  • util/exec: use spawnargs to return error messages (b19c3ee)
Tests
  • only validate subset of arguments to exec (bebff1c)
  • remove encoding from stubs (#​40221) (8fab5f0)
  • util/exec: clarify existing behaviour of shell parameter (d0bee7f)
  • util/exec: document ability to use arguments with spaces (c5c98ea)

v42.68.4

Compare Source

Bug Fixes
  • deps: update ghcr.io/renovatebot/base-image docker tag to v12.20.9 (main) (#​40224) (51d097e)

v42.68.3

Compare Source

Bug Fixes
  • deps: update ghcr.io/renovatebot/base-image docker tag to v12.20.8 (main) (#​40223) (847413f)
Miscellaneous Chores

v42.68.2

Compare Source

Bug Fixes
  • deps: update ghcr.io/containerbase/sidecar docker tag to v13.25.19 (main) (#​40219) (16a1325)
  • deps: update ghcr.io/renovatebot/base-image docker tag to v12.20.7 (main) (#​40220) (9d6553d)

v42.68.1

Compare Source

Bug Fixes
Miscellaneous Chores
  • deps: update dependency pnpm to v10.26.2 (main) (#​40217) (fdbeaba)
  • deps: update ghcr.io/containerbase/devcontainer docker tag to v13.25.19 (main) (#​40218) (3d8cca4)

v42.68.0

Compare Source

Features
Miscellaneous Chores
  • deps: update containerbase/internal-tools action to v3.14.42 (main) (#​40214) (73c14df)

v42.67.0

Compare Source

Features
Documentation
Miscellaneous Chores
Code Refactoring

v42.66.14

Compare Source

Bug Fixes
  • deps: update ghcr.io/renovatebot/base-image docker tag to v12.20.6 (main) (#​40207) (ac0e6ae)

v42.66.13

Compare Source

Bug Fixes
  • deps: update ghcr.io/renovatebot/base-image docker tag to v12.20.5 (main) (#​40206) (a7d4425)
Miscellaneous Chores
Code Refactoring

v42.66.12

Compare Source

Bug Fixes
Documentation
Miscellaneous Chores
Code Refactoring

v42.66.11

Compare Source

Bug Fixes
Miscellaneous Chores

v42.66.10

Compare Source

Bug Fixes

[v42.66.9](https://redirect.gith


Configuration

📅 Schedule: Branch creation - "before 3am on Monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate using a curated preset maintained by Sanity. View repository job log here

@socket-security
Copy link

socket-security bot commented Nov 24, 2025

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatednpm/​@​sanity/​prettier-config@​2.0.2 ⏵ 2.0.384 +11007995 +2100
Updatednpm/​@​types/​node@​24.10.1 ⏵ 24.10.710010081 +196 +2100
Updatednpm/​renovate@​42.25.4 ⏵ 42.78.296 +11001009870
Updatednpm/​prettier@​3.7.1 ⏵ 3.7.490 +11009795 -2100
Updatednpm/​@​sanity/​pkg-utils@​9.0.3 ⏵ 9.2.397 +7100100100 +1100

View full report

@socket-security
Copy link

socket-security bot commented Nov 24, 2025

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
License policy violation: npm @renovatebot/detect-tools under AGPL-3.0-only

License: AGPL-3.0-only - the applicable license policy does not allow this license (4) (npm metadata)

License: AGPL-3.0-only - the applicable license policy does not allow this license (4) (package/LICENSE)

License: AGPL-3.0-only - the applicable license policy does not allow this license (4) (package/package.json)

From: package-lock.jsonnpm/[email protected]npm/@renovatebot/[email protected]

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@renovatebot/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm renovate under AGPL-3.0-only

License: AGPL-3.0-only - the applicable license policy does not allow this license (4) (npm metadata)

License: AGPL-3.0-only - the applicable license policy does not allow this license (4) (package/license)

License: AGPL-3.0-only - the applicable license policy does not allow this license (4) (package/package.json)

From: package-lock.jsonnpm/[email protected]

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@renovate renovate bot force-pushed the renovate/non-major branch 19 times, most recently from 11a18a3 to d8f2fee Compare November 30, 2025 18:58
@renovate renovate bot force-pushed the renovate/non-major branch 7 times, most recently from 0c0d582 to 9ff4d96 Compare December 4, 2025 05:13
@renovate renovate bot force-pushed the renovate/non-major branch 13 times, most recently from 40d6749 to 27f30bb Compare January 2, 2026 18:46
@renovate renovate bot force-pushed the renovate/non-major branch 10 times, most recently from f0254c0 to 459d8a6 Compare January 10, 2026 02:10
@renovate renovate bot force-pushed the renovate/non-major branch 5 times, most recently from dd1a9c8 to 44f251c Compare January 11, 2026 21:57
@renovate renovate bot force-pushed the renovate/non-major branch from 44f251c to 138a9cc Compare January 12, 2026 06:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants