Skip to content

fix(plugin-kit): declare the Node.js versions @sanity/pkg-utils 13 runs on - #2051

Open
stipsan wants to merge 1 commit into
mainfrom
cody/upgrade-tsdown-0-23-e14d
Open

fix(plugin-kit): declare the Node.js versions @sanity/pkg-utils 13 runs on#2051
stipsan wants to merge 1 commit into
mainfrom
cody/upgrade-tsdown-0-23-e14d

Conversation

@stipsan

@stipsan stipsan commented Sep 29, 2026 •
edited by cursor Bot
Loading

Copy link
Copy Markdown
Member

Rebased onto main as one commit. The tsdown upgrade itself reached main through Renovate while this PR was open, so what's left is the Node.js range that comes with it.

What changes

  • @sanity/plugin-kit engines.node: >=24 → ^24.11.0 || >=26.0.0. The CLI needs its @sanity/pkg-utils peer, and pkg-utils 13 (like tsdown 0.23 and @sanity/tsdown-config) supports ^22.18.0 || ^24.11.0 || >=26.0.0. So >=24 advertised Node.js 24.0–24.10 and 25, which the peer rejects. The new range keeps plugin-kit's own Node.js 24 floor (feat(plugin-kit)!: require Node.js 24 and bump held-back CLI deps #1696). 24.11.0 is Node.js 24's first LTS release, and Node.js 25 reached end-of-life on 2026-06-01. The README states the new range.
  • AGENTS.md: notes that range for builds.

The >=20.19 <22 || >=22.12 range that plugin-kit scaffolds and verifies stays. It describes where a published plugin runs, not the Node.js that builds it: pkg-utils' own package template writes it, 48 of the 49 plugins declare it, and tsdown derives the output target from it.

Dropped in the rebase

Changeset

@sanity/plugin-kit: patch, pending your call. main is on plugin-kit 10.1.0, so this releases as 10.1.1. Narrowing engines.node drops Node.js 24.0–24.10 and 25, so Copilot asks for a major bump, as with 10.0.0; that would release 11.0.0. The alternative is to keep >=24 and drop this PR's engines change.

Verification

  • The lockfile is unchanged from main.
  • Local checks pass: oxfmt, lint (including types), plugin-kit's tests (with the init → verify-package → oxlint → pkg-utils build integration test), and the build (51 tasks).
  • Local knip flags lefthook because of this VM's core.hooksPath. It does the same on a pristine main, while CI's knip passes.
Open in Web Open in Cursor 

@changeset-bot

changeset-bot Bot commented Sep 29, 2026 •
edited
Loading

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 20bf2e9

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
@sanity/plugin-kit Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel

vercel Bot commented Sep 29, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
plugins-studio Ready Ready Preview Oct 23, 2026 4:20pm UTC
1 Skipped Deployment
Project Deployment Actions Updated
plugins-e2e-test-studio Ignored Ignored Oct 23, 2026 4:20pm UTC

Request Review

@github-actions

github-actions Bot commented Sep 29, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ E2E Tests

🟢 46 passed • view full report • view run

Studio: https://plugins-e2e-test-studio-adhkq0k7l.sanity.dev

Datasets: pr-2051-chromium-39985836501, pr-2051-firefox-39985836501

@github-actions

github-actions Bot commented Sep 29, 2026 •
edited
Loading

Copy link
Copy Markdown

Coverage Report

Status Category Percentage Covered / Total
🔵 Lines 38.12% 7677 / 20134
🔵 Statements 38.1% 8261 / 21681
🔵 Functions 33.79% 2095 / 6199
🔵 Branches 30.23% 4429 / 14649
File Coverage
File Stmts Branches Functions Lines Uncovered Lines
Changed Files
packages/@sanity/plugin-kit/package.json 100% 100% 100% 100%
Generated in workflow #11352 for commit 20bf2e9 by the Vitest Coverage Report Action

This was referenced Sep 29, 2026
Open
Merged
Merged
@stipsan
stipsan marked this pull request as ready for review September 29, 2026 01:19
@stipsan
stipsan requested a review from a team as a code owner September 29, 2026 01:19
@stipsan
stipsan requested review from juice49 and a balanced review from Copilot and removed request for a team and Copilot September 29, 2026 01:19
stipsan added a commit that referenced this pull request Sep 29, 2026
@stipsan @cursoragent
feat(themer): move @sanity/themer from sanity-io/ui, with a Storybook…
546e3a9 
… and ui's Changesets setup (#2046)

<!-- CURSOR_AGENT_PR_BODY_BEGIN -->
Moves `@sanity/themer` from sanity-io/ui (`packages/themer`) to
`plugins/@sanity/themer`, adds a React Storybook in `dev/storybook`
modeled on sanity-io/ui's `apps/storybook`, and puts the whole repo on
sanity-io/ui's Changesets setup.

## What's in this PR

1. **Changesets setup identical to sanity-io/ui (repo-wide).**
`.changeset/config.json` gains `"format": "oxfmt"` and
`"bumpVersionsWithWorkspaceProtocolOnly": true` (only the changelog
`repo` differs from ui's). `@changesets/cli` ^3.0.3 and
`@changesets/changelog-github` ^1.0.1 are root devDependencies, and
there's a `changeset` script. `release.yml` drops the npm@11 pin, since
`@changesets/cli` 3.0.3 handles npm 12's `pnpm info --json` output
(changesets/changesets#2274). The Renovate changesets workflow is ui's.
2. **Catalog aligned with sanity-io/ui for what themer needs:**
`@sanity/ui` ^4.2.7, `@sanity/icons` ^5.2.2, `motion` ^13.4.4,
`@sanity/vanilla-extract-vite-plugin` ^0.2.20. These are the ranges
`@sanity/themer@0.8.0` was published with. As AGENTS.md asks for uniform
shared-dependency updates, one combined patch changeset covers the 43
published plugins whose `dependencies` ranges change with the
`@sanity/ui`, `@sanity/icons` and `motion` bumps;
`@sanity/vanilla-extract-vite-plugin` is a devDependency everywhere, so
it doesn't reach a published range.
3. **The move.** Source copied from sanity-io/ui `main` (`b28d66c`),
which is exactly the published 0.8.0. The version and CHANGELOG carry
over, so the next release is 0.8.1. `package.json` follows the monorepo
template (plugins repository links, `build`/`prepack` scripts) with the
published exports, `sideEffects`, and dependency ranges.
`@sanity/themer-legacy` (moving to sanity-io/themer) is the published
^0.2.1. `xstate`, `@xstate/react`, and `scroll-into-view-if-needed` move
to the catalog, since other plugins now share them;
`sanity-plugin-dashboard-widget-vercel` gets its own patch changeset for
its `xstate` range (^5.32.5 → ^5.33.2). The test studio switches from
`^0.8.0` on npm to `workspace:*`; `themerTool()` was already wired in
its Home workspace.
4. **Storybook in `dev/storybook`**, next to the test studios, set up
like sanity-io/ui's `apps/storybook`: Storybook 10.6 with the a11y,
docs, links, themes and vitest addons, the React Compiler through
`@vitejs/plugin-react`, and the vanilla-extract plugin for workspace
plugins' `.css.ts` source. The preview imports `@sanity/ui/styles.css`,
since the published dist doesn't. The global decorator renders every
story in the theme `buildTheme` from `@sanity/themer` builds from a
preset picked in the toolbar, next to the light/dark toggle. It adds
`pnpm dev:storybook`, `pnpm storybook:build`, `pnpm test:browser`, ui's
`apps/storybook/vercel.json` unchanged (as `dev/storybook/vercel.json`),
a `storybook-test` CI job like ui's, and eslint-plugin-storybook's CSF
rules through oxlint's JS plugins, as in ui. Unlike ui's job,
`storybook-test` also installs Playwright's system deps when it restores
the browser cache, as this repo's e2e workflow does (Bugbot flagged that
the cache doesn't hold them). Like the other `dev/*` apps, it's skipped
by `pretest` and the CI build job.

## Layout

No existing folder is renamed or moved, and there's no new top-level
folder. `@sanity/themer` goes into the existing `plugins/@sanity/`
folder next to the other `@sanity/*` plugins, not ui's
`packages/themer`. The Storybook goes into the existing `dev/` folder as
`dev/storybook`, next to `dev/test-studio` and `dev/e2e-studio`, so the
`dev/*` workspace glob and the `./dev/*` build filters already cover it.
The root only gains workspace-level config.

## How faithful the move is

- **Build output vs. the npm tarball of 0.8.0:** JavaScript is identical
apart from chunk hashes, and `bundle.css` is byte-identical. The `.d.ts`
files have the same API; tsdown 0.22 writes `declare …; export {…}`
where 0.23 wrote `export declare …`.
- **Source changes:** `type` modifiers on type-only imports (plugins'
`strictest` tsconfig has `verbatimModuleSyntax`), one inline
`oxlint-disable-next-line react/exhaustive-effect-dependencies` with its
reason (the rule is on here and off in ui; the `[palette]` dependency is
deliberate), and the README license link. The tsconfig is `strictest`
without `noUncheckedIndexedAccess`, which ui never enabled
(`sanity-plugin-graph-view` and `plugin-kit` do the same).
- **No React Compiler typings stub:** ui's
`typings/babel-plugin-react-compiler.d.ts` isn't carried over. Here the
real `babel-plugin-react-compiler` types resolve (it's a linked optional
peer of `@sanity/tsdown-config`), so `defineConfig()` picks the
single-config overload, and a wrong `reactCompiler` value is still
flagged (checked with a bad `target`, a misspelled `transform`, a number
`target` and an unknown key).
- **Tests:** themer's Vitest config sets `testTimeout: 30_000`. PR CI
here runs every project with coverage, and the whole-theme `buildTheme`
tests took 8s there against the 5s default (ui runs them without
coverage).
- **Versions:** every themer runtime dependency and the whole Storybook
stack resolve to the same versions as in ui's lockfile.

## What Cody needs to do

- **npm trusted publishing:** publishing runs from
`.github/workflows/release.yml`, which this repo already had; it now
uses ui's version/publish flow. The trusted publisher for
`@sanity/themer` must be repository `sanity-io/plugins`, workflow
`release.yml`, no environment.
- **Vercel:** the Storybook carries ui's `apps/storybook/vercel.json`
unchanged, as `dev/storybook/vercel.json` (`pnpm build` into
`storybook-static`). To deploy it like ui's `sanity-ui-storybook`,
create a project with root directory `dev/storybook`; the file supplies
the build command and output directory. No other Vercel config is
touched: `dev/e2e-studio/vercel.json` and the `plugins-studio` and
`plugins-e2e-test-studio` projects stay as they are, and both previews
built fine on this PR.
- **Secrets and env vars:** none new. The touched workflows use names
this repo already has: `ECOSPARK_APP_ID`, `ECOSPARK_APP_PRIVATE_KEY`,
`vars.ECOSPARK_CLIENT_ID`, `TURBO_TOKEN` and `vars.TURBO_TEAM`.
`storybook-test` uses none.
- **Ruleset:** no swap needed. The `main` ruleset requires `lint`,
`build`, `test` and the two Socket Security checks, and those job names
are unchanged. Optionally, to match ui (which requires `build`, `knip`,
`Test node@lts / ubuntu-latest`, `storybook-test` and its two Vercel
checks), add `storybook-test` and `knip`, and the Storybook's Vercel
check once that project exists.
- **CODEOWNERS:** untouched, per the transfer convention. Add an owner
for `plugins/@sanity/themer` if you want one.

## Open questions

1. **Patch, not major.** The transfer skill defaults to a major, but
themer is 0.x, nothing breaks, the next release should continue from the
published version, and themer's own deprecation notice reserves 1.0 for
removing `@sanity/themer/legacy`. So the changeset is a patch (0.8.1).
The color move made the same call.
2. **Stories.** sanity-io/ui had no themer stories. I ported the ui
stories that exercise what themer builds (theme
Debug/Build/Canvas/Color, and the color palette story on
`buildPalette`'s output) and added stories for the tool's theme
thumbnails and navbar color wheel. Those two aren't public API, so their
stories import them from `plugins/@sanity/themer/src` by relative path.
Keep them, or public API only?
3. **`sanity` peer range.** I kept 0.8.0's optional `^3 || ^4 || ^5 ||
^6` instead of the monorepo's `catalog:peer` (`^5 || ^6.0.0-0`), which
would drop Studio v3/v4. As with 0.8.0 from npm, it doesn't match the
`sanity@next` prereleases here, so the test studio shows a peer warning.
4. **`bumpVersionsWithWorkspaceProtocolOnly`.** With ui's setting,
Changesets no longer rewrites `@sanity/sfcc`'s intentionally wide
`sanity-plugin-internationalized-array` peer (`^4.0.0 || ^5.0.0`), the
only internal dependency that doesn't use `workspace:`. That seems
right, but it's a behavior change.

## Remaining alignment with sanity-io/ui (not in this PR)

This PR stays scoped to the themer move. Matching ui's tooling happens
in five separate PRs, one per tool, each owned by another worker. All
five exist:

- **pnpm** 11.21.0 → 12.6.0 with ui's pnpm setup, including the
`pnpm/setup@v3` CI setup action: #2048 (merged; this branch is merged
with it)
- **oxfmt** ^0.63 → ^0.71 with ui's config: #2047. Dropping the
`@sanity/plugin-kit/oxfmt` preset's Prettier-era `.changeset/*.md`
`singleQuote: false` override, which ui did when it enabled Changesets'
`format: "oxfmt"`, belongs there too; #2047 doesn't include it yet.
- **vitest** ^4.1 → ^5.0, with `@vitest/coverage-v8`: #2050. If it
merges first, the rebase of this PR raises the Storybook's
`@vitest/browser-playwright` to `^5.0.2` and re-resolves
`@storybook/addon-vitest` in the lockfile, since otherwise two stale
vitest 4 packages stay behind. #2050's worker checked that the Storybook
tests pass on vitest 5 with those two changes (`@storybook/addon-vitest`
10.6 officially peers on vitest 3/4; ui runs it on 5 with loose peers).
- **oxlint** ^1.83 → ^1.86 and **oxlint-tsgolint** ^7.0.2001 → ^7.0.2003
with ui's config: #2049. It turns `react/exhaustive-effect-dependencies`
off, as ui does, so if it merges first, the rebase of this PR drops its
one suppression for that rule in `ImagePaletteSection.tsx`, which would
otherwise be an unused-directive error.
- **tsdown** ^0.22 → ^0.23 with **@sanity/tsdown-config** ^0.27 → ^0.28,
which requires tsdown 0.23: #2051

All five also touch files this PR changes (`pnpm-workspace.yaml`,
`pnpm-lock.yaml` and `AGENTS.md`; `package.json` and `README.md` for
#2047 and #2048; `oxlint.config.ts` for #2049;
`.github/workflows/ci.yml` and `.gitignore` for #2050), so whichever PR
merges later rebases and regenerates the lockfile.

Smaller differences left to Renovate or later PRs: `oxc-transform-react`
^0.147 → ^0.151 (#1988), `@types/node` ^24.13 → ^24.19, `jsdom` ^29 →
^30, `knip` ^6.33 → ^6.38, ui's macOS test run, and ui's root
`engines.node: ">=22.13"`.

## Verification

- `pnpm format`, `pnpm knip`, `pnpm lint`, `pnpm build` (54 tasks,
including both studios and the Storybook), `pnpm test run` (235 files,
1,509 tests) and `pnpm test:browser` (7 stories) all pass locally,
starting from `pnpm install --frozen-lockfile`.
- A `changeset version` dry run in a scratch worktree, with ui's config
and `GITHUB_TOKEN`, bumps themer 0.8.0 → 0.8.1 and
dashboard-widget-vercel 4.0.28 → 4.0.29 (before the combined changeset;
`changeset status` now plans 46 patch releases: the 43 plugins, themer,
and `sanity-plugin-studio-smartling` and `sanity-plugin-transifex`,
which follow `sanity-translations-tab` as internal dependents), credits
@stipsan through the `author:` line, and writes CHANGELOGs that pass
`oxfmt --check`.
- `zizmor .github --min-severity high` reports no findings.

## Transfer verification

- [x] `package.json` dependencies, peerDependencies and exports verified
against the published 0.8.0
- [x] `LICENSE` not added: ui's credits only Sanity.io; the README links
this repo's LICENSE
- [x] Test studio uses the workspace package (`themerTool()` was already
wired)
- [x] `pnpm format`, `pnpm knip`, `pnpm lint`, `pnpm build`, `pnpm test
run` pass
- [x] Changeset added (patch; see open question 1)
- [ ] Trusted publishing for `@sanity/themer` configured with
`sanity-io/plugins` and `release.yml`

## Maintainer follow-up

- [ ] Remove `packages/themer` from sanity-io/ui (with its entries in
ui's root `build`/`test` scripts and `pkg-pr-new.yml`) once this lands,
on your go-ahead
- [ ] Point ui's docs and AGENTS.md mentions of `@sanity/themer` to
`plugins/@sanity/themer`
- [ ] Transfer open themer issues from sanity-io/ui and label them
`themer`

## Screenshots

The theme cards of every preset, in the dark scheme:

[Storybook: themer tool theme thumbnails for every
preset](https://cursor.com/agents/bc-7516e1ad-c642-5cd2-97f4-35288fbda30a/artifacts?path=%2Fopt%2Fcursor%2Fartifacts%2Fstorybook_themer_theme_thumbnails_presets.png)

The palette `buildPalette` generates for the Verdant preset, light
scheme (its backgrounds replace black and white, its accent the blue
scale, its text color the gray scale):

[Storybook: generated Verdant palette with contrast
badges](https://cursor.com/agents/bc-7516e1ad-c642-5cd2-97f4-35288fbda30a/artifacts?path=%2Fopt%2Fcursor%2Fartifacts%2Fstorybook_themer_palette_verdant_light.png)

The Debug theme story in the Pink Synth preset, both schemes:

[Storybook: Debug theme story in the Pink Synth
preset](https://cursor.com/agents/bc-7516e1ad-c642-5cd2-97f4-35288fbda30a/artifacts?path=%2Fopt%2Fcursor%2Fartifacts%2Fstorybook_themer_debug_pink_synth.png)


<sub>To show artifacts inline, <a
href="https://cursor.com/dashboard/cloud-agents#team-pull-requests">enable</a>
in settings.</sub>
<!-- CURSOR_AGENT_PR_BODY_END -->

<div><a
href="https://cursor.com/agents/bc-7516e1ad-c642-5cd2-97f4-35288fbda30a?cursor_ref=pr_footer&cursor_cta=open_in_web"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/assets/images/open-in-web-light.png"><img
alt="Open in Web" width="114" height="28"
src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a>&nbsp;<a
href="https://cursor.com/background-agent?bcId=bc-7516e1ad-c642-5cd2-97f4-35288fbda30a&cursor_ref=pr_footer&cursor_cta=open_in_cursor"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img
alt="Open in Cursor" width="131" height="28"
src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a>&nbsp;</div>

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Copilot AI reviewed Sep 29, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟡 Changes recommended

Plugin-kit still advertises and generates Node 25 compatibility despite pkg-utils 13 dropping support.

Review effort: Balanced
Findings: 1 Medium severity

Open (1)
What changed in this PR

Aligns the monorepo’s package-build toolchain with tsdown 0.23 while preventing unintended declaration exports.

Changes:

  • Upgrades tsdown, tsdown-config, and pkg-utils.
  • Patches declaration bundling to preserve private types.
  • Documents compatibility and patch maintenance.
File Description
pnpm-workspace.yaml Updates catalogs and registers the patch.
pnpm-lock.yaml Resolves the upgraded toolchain.
patches/​rolldown-plugin-dts@0.28.6.patch Prevents private declaration exports.
AGENTS.md Documents Node support and patch upgrades.
.changeset/​plugin-kit-pkg-utils-13.md Records the plugin-kit dependency update.
Files not reviewed (1)
  • pnpm-lock.yaml: Generated file

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread pnpm-workspace.yaml Outdated
'@sanity/image-url': ^2.1.1
'@sanity/mutator': ^6.16.0
'@sanity/pkg-utils': ^12.3.4
'@sanity/pkg-utils': ^13.0.3
Copilot AI review requested due to automatic review settings September 29, 2026 02:04
Copilot AI reviewed Sep 29, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟡 Changes recommended

The breaking Node.js engine restriction is incorrectly classified as a patch release.

Review effort: Balanced
Findings: 1 High severity · 1 Medium severity

Open (2)
Files not reviewed (1)
  • pnpm-lock.yaml: Generated file

Comment thread .changeset/plugin-kit-node-engines.md Outdated
@@ -0,0 +1,5 @@
---
"@sanity/plugin-kit": patch
stipsan added a commit that referenced this pull request Sep 29, 2026
@stipsan @cursoragent
chore(format): align oxfmt with sanity-io/ui (^0.71.0, config), pre-c…
89bbaf7 
…ommit hook on lefthook (#2047)

<!-- CURSOR_AGENT_PR_BODY_BEGIN -->
Brings oxfmt in line with sanity-io/ui's `main`: the same version, the
same config, and the same scripts and CI wiring. The pre-commit hook
moves from husky and lint-staged to lefthook, set up like
sanity-io/sanity's. Supersedes #1919.

## Commits

1. **`chore(deps): update oxfmt to ^0.71.0`**: the catalog goes from
^0.63.0 to ui's ^0.71.0, with ui's oxfmt resolution: oxfmt 0.71.0 and
`tinypool` 2.2.0, the same versions and integrity hashes as ui's
lockfile. There's a patch changeset for `@sanity/plugin-kit`, whose
optional `oxfmt` peer uses the catalog.
2. **`chore(format): align the oxfmt config with sanity-io/ui`**: root
`oxfmt.config.ts` now ignores `storybook-static/**` and `CHANGELOG.md`,
like ui's `.oxfmtrc.json`. `.vscode/settings.json` points
`oxc.fmt.configPath` at `oxfmt.config.ts` instead of the `.oxfmtrc.json`
that #1565 deleted. AGENTS.md records the parity with ui and the
exceptions.
3. **`chore: drop the husky and lint-staged pre-commit hook, like
sanity-io/ui`**: superseded by commit 6, which brings the hook back on
lefthook.
4. **`chore(format): drop the oxfmt preset's .changeset/*.md override,
like sanity-io/ui`**: the `@sanity/plugin-kit/oxfmt` preset loses its
Prettier-era `singleQuote: false` override for `.changeset/*.md`, as
ui's `.oxfmtrc.json` did when ui switched Changesets to oxfmt formatting
(sanity-io/ui#2957). It gets a patch changeset for `@sanity/plugin-kit`,
since the preset is published. This part moved here from #2046 because
it's formatter config. AGENTS.md now explains how changesets get quoted.
5. **`chore(format): run pnpm format`**: requotes this PR's own
changeset from commit 1. Everything else already passed under oxfmt
0.71.
6. **`chore: run oxfmt on staged files with lefthook, like
sanity-io/sanity`**: see below.

## Pre-commit hook: husky and lint-staged → lefthook

This mirrors how sanity-io/sanity replaced husky and lint-staged
(sanity-io/sanity#12755, then sanity-io/sanity#12767 and
sanity-io/sanity#12953):

- **`lefthook` ^2.1.14** as a root devDependency, sanity's range. It
resolves to 2.1.14, as in sanity's lockfile.
- **`allowBuilds: lefthook: true`** in `pnpm-workspace.yaml`, as in
sanity. Lefthook's own install script runs `lefthook install` during
`pnpm install`, and it skips when `CI` is set, which covers GitHub
Actions and Vercel. There's no root `postinstall` script: sanity dropped
its `lefthook install --reset-hooks-path` postinstall in #12767 for this
package build.
- **`lefthook.yml`** with sanity's layout: a parallel `pre-commit` with
two jobs that run oxfmt on staged files with `stage_fixed: true`. The
jobs are `format-scripts` (`*.{js,jsx,ts,tsx,mjs,cjs,mts,cts}`) and
`format-other` (`*.{md,yml,yaml,css,json,jsonc}`).
- `mts`, `cts` and `jsonc` are additions to sanity's globs. They cover
this repo's `.mts`, `turbo.jsonc` and `knip.jsonc` files, which the old
lint-staged glob partly covered.
- sanity's `oxlint --fix` line is left to the oxlint alignment (#2049).
- **Direct binary calls:** the jobs call `node_modules/.bin/oxfmt`
instead of sanity's `pnpm oxfmt`. Running pnpm in a hook triggers pnpm
12's implicit install, which flips the lockfile's peer toggle (see
AGENTS.md). sanity switched to `pnpm oxfmt` in #12953 because lefthook
doesn't put `node_modules/.bin` on `PATH`; the path solves that too.
- **Lockfile:** `pnpm-lock.yaml` gains only lefthook 2.1.14 and its
platform packages (100 lines). A plain install would also have bumped
the Studio's `next` overrides from `6.17.0-next.108` to
`6.17.0-next.112`, so I resolved it through a local registry proxy that
served the locked versions as `next`, as AGENTS.md describes. The
lockfile has no `localhost` or `tarball:` entries.
- **Docs:** AGENTS.md documents the hook, `LEFTHOOK=0`, the one-time
reset for clones that ran husky, and `pnpm
--config.verify-deps-before-run=false <script>` for local runs. README's
note that formatting also runs in a pre-commit hook is back.

## Merges with `main`

`main` is merged in, not rebased, so nothing was force-pushed. After
each merge, `pnpm-lock.yaml` is `main`'s lockfile regenerated with pnpm
12.6.0, invoked directly so `packageManagerDependencies` stays, minus
the peer toggle that AGENTS.md describes.

- **#2039 (lock file maintenance):** only the lockfile conflicted.
- **#2048 (pnpm 12.6.0):** `package.json` conflicted next to the removed
`lint-staged` block. The resolution keeps both sides: `main`'s
`packageManager: pnpm@12.6.0` and `vercel` ^60.1.3, without the block. A
follow-up commit restores `main`'s side of the peer toggle, which the
regeneration had flipped.
- **#2046 (themer move):** only the lockfile conflicted. `pnpm format`
then requoted #2046's three changesets in a separate commit:
`dashboard-widget-vercel-xstate`, `shared-deps-sanity-ui-icons-motion`
and `themer-plugins-monorepo`, 45 frontmatter lines, quote-only. The new
`plugins/@sanity/themer` package and `dev/storybook` already passed.
- **#2053 (Version Packages):** it released and deleted those three
changesets, so the modify/delete conflicts resolve to `main`'s
deletions. It didn't change the lockfile, and `pnpm format` changes
nothing after the merge.

`pnpm-lock.yaml` differs from `main` only by this PR's own changes:

- oxfmt and its bindings go from 0.63.0 to 0.71.0, and `tinypool` from
2.1.0 to 2.2.0.
- husky, lint-staged and their four exclusive dependencies are removed.
- lefthook 2.1.14 and its platform packages are added.

No other version moves, and the Studio stays on `6.17.0-next.108`.

## How it compares with ui

- **Options:** identical, overrides included (`printWidth`, `semi`,
`singleQuote`, `bracketSpacing`, `quoteProps`, `sortImports`,
`sortPackageJson`). They come from the `@sanity/plugin-kit/oxfmt`
preset.
- **Ignore patterns:** `dist/**`, `storybook-static/**`,
`pnpm-lock.yaml` and `CHANGELOG.md` in both. Two differences remain:
  - `turbo/**/*.hbs` is plugins-only (the turbo generator templates).
- ui's `**/sanity.types.ts` is left out. In ui it was for
`apps/docs/sanity.types.ts` and has matched nothing since the docs app
went static. Here, `pnpm typegen` formats
`dev/test-studio/sanity.types.ts` on purpose: the test studio runs
typegen with `formatGeneratedCode: false` and then `pnpm format`.
Ignoring the file would make the next TypeGen PR unformat it.
- **Config file:** plugins keeps `oxfmt.config.ts` re-exporting the
published preset instead of ui's `.oxfmtrc.json`. #1565 made that switch
so the preset is exactly what the monorepo formats with, and
plugin-kit's `verify-package` expects plugins to use it. oxfmt, the Oxc
extension and Changesets' formatter detection all read
`oxfmt.config.ts`. See the open question.
- **Scripts and CI:** the `format` script is identical to ui's (`oxfmt .
--no-error-on-unmatched-pattern`). Neither repo checks formatting on
PRs, and both run the same shared `format-if-needed.yml` on `main`, so
no workflow changes are needed. `oxfmt .` also formats
`.github/workflows/*.yml`, which that workflow can't push, and 0.71
changes none of them. ui has no pre-commit hook; this repo keeps one, on
lefthook.
- **VS Code:** ui points `oxc.fmt.configPath` at its config file, but
plugins pointed it at a file that doesn't exist. I drove `oxfmt --lsp`
directly: with the old setting, the editor silently formats with oxfmt's
defaults (double quotes, semicolons, bracket spacing, unsorted imports),
and with `oxfmt.config.ts` it matches `pnpm format`.

## Changesets

- **Changesets formats what it writes with oxfmt.**
`.changeset/config.json` sets `"format": "oxfmt"` (from #2046). I called
`@changesets/write` (what `changeset add` uses) directly. With the
override it writes `"@sanity/plugin-kit": patch`; without it,
`'@sanity/plugin-kit': patch`, the same as `pnpm format`.
- **`changeset version` is unaffected.** It only hands `CHANGELOG.md`
files to the formatter. This PR ignores those, and oxfmt skips them and
exits 0 thanks to `--no-error-on-unmatched-pattern`.
- **`changeset status` parses the single-quoted frontmatter.** It lists
this PR's two changesets for `@sanity/plugin-kit` 10.0.11.

## What to expect after merging

- **Renovate changesets get a follow-up format PR, as in ui.** The
shared Renovate changesets workflow uses
`mscharley/dependency-changesets-action`, which always writes double
quotes and has no formatting option. After a Renovate PR merges, the
Auto format workflow opens (or updates) a `chore(format): 🤖 ✨` PR that
requotes the changeset. ui has had one after most Renovate merges since
sanity-io/ui#2957: sanity-io/ui#2971, sanity-io/ui#2980,
sanity-io/ui#2986, sanity-io/ui#2998, sanity-io/ui#3002,
sanity-io/ui#3013 and sanity-io/ui#3024.
- **Clones that ran husky need a one-time reset.** They still have
`core.hooksPath=.husky/_`. There, `lefthook install` refuses to install
and prints how to fix it, and `pnpm install` continues. Until the reset,
husky's leftover runner does nothing, so commits simply aren't
formatted. `git config --unset core.hooksPath && pnpm install` fixes it.

## Related PRs

- **#1919** (Renovate, oxfmt ^0.71.0): superseded. This PR has the same
bump, with the lockfile regenerated on current `main`, plus the config
alignment. Close it if Renovate doesn't once this merges.
- **#2046** (themer move) and **#2048** (pnpm 12): merged, and merged
into this PR.
- **#2049** (oxlint) conflicts with this PR in `pnpm-workspace.yaml`,
where its `oxlint` catalog lines sit next to `oxfmt`. Keep both sides.
It could also add sanity's `oxlint --fix` line to the `format-scripts`
job, calling `node_modules/.bin/oxlint` directly.
- **#2050** (vitest 5) conflicts only in `pnpm-lock.yaml`.
- **#2051** (tsdown) doesn't conflict.
- Whichever PR lands later merges `main` and regenerates the lockfile
without committing the peer toggle.

## What Cody needs to do

- Add the `🤖 bot` label: the agent's label tool couldn't edit PRs in
this repository.
- Triage Socket's alert. It flags `lefthook@2.1.14`'s install script
(`node postinstall.js`) as a low-priority warning. That script is what
installs the hook: `allowBuilds: lefthook: true` enables it, as in
sanity-io/sanity, and it skips when `CI` is set. Mark it as acceptable
risk if you agree. Socket's required checks pass either way.
- After merging, tell contributors to run `git config --unset
core.hooksPath && pnpm install` once, so lefthook replaces husky's hook.
- Merge the Renovate follow-up format PRs as they come, as in ui.
- No Vercel, secrets or ruleset changes, and no new secrets or env vars.

## Open question

**`.oxfmtrc.json`:** should plugins switch to ui's JSON config file,
too? That would mean no longer re-exporting the plugin-kit preset, and
it would reverse #1565. I kept `oxfmt.config.ts`, since the formatting
result is already the same as ui's.

## Verification

- **The hook**, tested on throwaway commits, with `pnpm-lock.yaml`
untouched each time:
  - Staged TS and JSON files get formatted and re-staged.
- A tracked `.vscode/settings.json` (its folder is gitignored) is
re-staged without the `[FAILED]` that lint-staged printed.
  - A staged `CHANGELOG.md`, which oxfmt ignores, passes as-is.
- In a partially staged file, only the staged hunk is formatted and the
unstaged hunk is kept.
- The commit that adds the hook ran it on its own files in 0.4 seconds.
- **Clones that ran husky:** with `core.hooksPath=.husky/_`, `lefthook
install` exits 1 with instructions and installs nothing, as described
above.
- **Local checks** at the head commit, with pnpm 12.6.0 on Node 24.21
and `CI=true` (lefthook's install script skips):
- `pnpm install --frozen-lockfile`, which leaves `pnpm-lock.yaml`
untouched
  - `oxfmt --check` (2,018 files)
  - `oxlint` and `knip`
  - the full turbo build (54 tasks)
  - `vitest run` (235 files, 1,509 tests)
  - `pnpm test:browser` (4 files, 7 stories)
- **CI** is fully green at the head commit (`123af257`): build, lint,
knip, all four test shards, coverage, `storybook-test`, both e2e
browsers, Bugbot, and both Vercel checks, whose installs run lefthook's
install script. The branch is up to date with `main`.
<!-- CURSOR_AGENT_PR_BODY_END -->

<div><a
href="https://cursor.com/agents/bc-0b8c4f47-d9af-5929-8254-d25847e7e2dd?cursor_ref=pr_footer&cursor_cta=open_in_web"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/assets/images/open-in-web-light.png"><img
alt="Open in Web" width="114" height="28"
src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a>&nbsp;<a
href="https://cursor.com/background-agent?bcId=bc-0b8c4f47-d9af-5929-8254-d25847e7e2dd&cursor_ref=pr_footer&cursor_cta=open_in_cursor"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img
alt="Open in Cursor" width="131" height="28"
src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a>&nbsp;</div>

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Copilot AI review requested due to automatic review settings September 29, 2026 09:26
Copilot AI reviewed Sep 29, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🔵 Needs a closer look

The breaking Node.js support reduction is incorrectly classified as a patch release.

Review effort: Balanced
Findings: 1 High severity · 1 Medium severity

Open (2)
Files not reviewed (1)
  • pnpm-lock.yaml: Generated file

@cursor
cursor Bot force-pushed the cody/upgrade-tsdown-0-23-e14d branch from 21bb174 to 64e6632 Compare October 23, 2026 12:20
@cursor cursor Bot changed the title fix(deps): upgrade to tsdown 0.23 and @sanity/tsdown-config 0.28, as in sanity-io/ui fix(plugin-kit): declare the Node.js versions @sanity/pkg-utils 13 runs on Oct 23, 2026
@cursor
cursor Bot force-pushed the cody/upgrade-tsdown-0-23-e14d branch from 64e6632 to 3ada194 Compare October 23, 2026 13:29
@cursoragent @stipsan
fix(plugin-kit): declare the Node.js versions @sanity/pkg-utils 13 ru…
20bf2e9 
…ns on

plugin-kit needs its @sanity/pkg-utils peer, and pkg-utils 13 (like
tsdown 0.23 and @sanity/tsdown-config) supports
`^22.18.0 || ^24.11.0 || >=26.0.0`, so `engines.node: ">=24"`
advertised Node.js 24.0-24.10 and 25, which the peer rejects. Keep
plugin-kit's own Node.js 24 floor (#1696) and narrow it to
`^24.11.0 || >=26.0.0`. The `>=20.19 <22 || >=22.12` range that
scaffolded plugins declare is their runtime range and stays.

AGENTS.md notes the toolchain's Node.js range.

Co-authored-by: Cody Olsen <stipsan@users.noreply.github.com>
@cursor
cursor Bot force-pushed the cody/upgrade-tsdown-0-23-e14d branch from 3ada194 to 20bf2e9 Compare October 23, 2026 16:19

This branch was successfully deployed

1 active deployment
Preview – plugins-studio — 20bf2e9b Deployed Oct 23, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@juice49 juice49 Awaiting requested review from juice49 juice49 is a code owner automatically assigned from sanity-io/studio

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@stipsan @cursoragent