fix(deps): update dependency tsdown to ^0.23.0

[squiggler-app]

This PR contains the following updates:

Package	Change	Age	Confidence
tsdown (source)	^0.22.14 → ^0.23.0

---

Release Notes

rolldown/tsdown (tsdown)

v0.23.0

Compare Source

   🧭 Migration Guide

Most users can upgrade directly. Before upgrading, run one final build with tsdown@0.22.14 and resolve all deprecation warnings.

• config:
  • bundle: false → unbundle: true; bundle: true can be removed
  • outExtension → outExtensions
  • publicDir / --public-dir → copy / --copy
  • removeNodeProtocol: true → nodeProtocol: 'strip'
  • injectStyle → css.inject
• deps:
  • inlineOnly / deps.onlyAllowBundle → deps.onlyBundle
  • skipNodeModulesBundle: true → deps.neverBundle: true
  • resolveDepSubpath now defaults to false; set it to true to preserve the previous behavior
• dts:
  • rolldown-plugin-dts was upgraded from 0.27.13 to 0.28.5
  • dts.oxc: true → dts.generator: 'oxc'
  • dts.tsgo: true → dts.generator: 'tsgo'; oxc and tsgo objects now only configure their respective generators
  • dts.volarPlugins → dts.customLanguages; rename each language's create hook to createVolarPlugins
  • Custom languages, including vue, now throw when combined with an incompatible generator
  • dts.cjsReexport was removed; dual-format builds now generate CJS declarations in a separate pass
• attw:
  • The default profile changed from strict to esm-only; set profile: 'strict' to preserve the previous checks
• programmatic API:
  • build() now returns { bundles, watch }; replace const bundles = await build() with const { bundles } = await build()
• requirements:
  • Node.js 25 is no longer supported; use ^22.18.0, ^24.11.0, or >=26.0.0
  • rolldown-plugin-dts now requires Rolldown 1.2.x
  • Legacy types and typesVersions fallbacks were removed; use TypeScript's bundler, node16, or nodenext module resolution

   🚨 Breaking Changes

• Drop support for Node.js 25  -  by @​sxzz (26950)
• Remove deprecated tsup compatibility options  -  by @​sxzz (50766)
• Drop types and typesVersionsfields  -  by @​sxzz (be3ea)
• attw:
  • Change default profile to esm-only  -  by @​sxzz (9b3cf)
• deps:
  • Remove deprecated deps.onlyAllowBundle  -  by @​sxzz (30c55)
  • Disable resolveDepSubpath by default  -  by @​sxzz (d300f)
  • Remove deprecated skipNodeModulesBundle  -  by @​sxzz (f2a3d)
• dts:
  • Remove dts.cjsReexport option  -  by @​sxzz (9c70f)
  • Make dts.generator the only way to select generator  -  by @​sxzz (eb75f)

   🚀 Features

• Expose programmatic watch controls  -  by @​sxzz in #​1062 (96a40)
• css: Support function form for css.modules.localsConvention  -  by @​sxzz and @​lazerg (b566f)
• report: Add summary option to skip per-file size logs  -  by @​lazerg in #​1036 (020e9)

   🐞 Bug Fixes

• Allow unplugin-unused v0.5+  -  by @​sxzz (53c78)
• Ignore optional dependencies in type definitions  -  by @​sxzz (94622)
• cli:
  • Camel-case nested flag keys  -  by @​sxzz (bf53f)
• css:
  • Watch files imported via @import  -  by @​lazerg in #​1038 (ebee5)
• deps:
  • Apply resolveDepSubpath when neverBundle is true  -  by @​lazerg in #​1053 (4943c)
• exports:
  • Scope inlined dependencies to configs with exports  -  by @​lazerg in #​1040 (d5b80)
• migrate:
  • Pin migrated projects to tsdown 0.22.14  -  by @​sxzz (113fb)
  • Support non-interactive environments  -  by @​sxzz (51e41)

   🏎 Performance

• Remove asyncDispose polyfill  -  by @​sxzz (82675)
• Replace ansis with util.styleText  -  by @​sxzz (be6bf)

    View changes on GitHub

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate using a curated preset maintained by . View repository job log here

---

Note

Medium Risk
tsdown 0.23 includes breaking build/config changes that could affect package builds across the monorepo; this PR only updates the catalog version, not local tsdown configs.

Overview
Bumps the shared tsdown catalog dependency from ^0.22.14 to ^0.23.0 in pnpm-workspace.yaml, so every workspace package that builds through the catalog picks up the new bundler version on install.

Adds a changeset that records a patch release for the listed @sanity/* and sanity-plugin-* packages so the dependency bump can ship through the normal release workflow.

^{Reviewed by Cursor Bugbot for commit 5c88be4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
plugins-studio	Ready	Preview	Oct 9, 2026 2:44pm UTC

1 Skipped Deployment

Project	Deployment	Actions	Updated
plugins-e2e-test-studio	Ignored		Oct 9, 2026 2:44pm UTC

[changeset-bot]

🦋 Changeset detected

Latest commit: 5c88be4

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 50 packages

Name	Type
@sanity/plugin-kit	Patch
@sanity/assist	Patch
@sanity/block-insert-picker	Patch
@sanity/code-input	Patch
@sanity/color-input	Patch
@sanity/cross-dataset-duplicator	Patch
@sanity/dashboard	Patch
@sanity/debug-live-sync-tags	Patch
@sanity/debug-preview-url-secret-plugin	Patch
@sanity/document-internationalization	Patch
@sanity/embeddings-index-ui	Patch
@sanity/form-toolkit	Patch
@sanity/google-maps-input	Patch
@sanity/hierarchical-document-list	Patch
@sanity/language-filter	Patch
@sanity/orderable-document-list	Patch
@sanity/personalization-plugin	Patch
@sanity/presets	Patch
@sanity/rich-date-input	Patch
@sanity/sanity-plugin-async-list	Patch
@sanity/sfcc	Patch
@sanity/studio-secrets	Patch
@sanity/table	Patch
@sanity/themer	Patch
@sanity/vercel-protection-bypass	Patch
sanity-naive-html-serializer	Patch
sanity-plugin-aprimo	Patch
sanity-plugin-asset-source-unsplash	Patch
sanity-plugin-bynder-input	Patch
sanity-plugin-cloudinary	Patch
sanity-plugin-dashboard-widget-document-list	Patch
sanity-plugin-dashboard-widget-netlify	Patch
sanity-plugin-dashboard-widget-vercel	Patch
sanity-plugin-documents-pane	Patch
sanity-plugin-google-translate	Patch
sanity-plugin-graph-view	Patch
sanity-plugin-hotspot-array	Patch
sanity-plugin-iframe-pane	Patch
sanity-plugin-internationalized-array	Patch
sanity-plugin-latex-input	Patch
sanity-plugin-markdown	Patch
sanity-plugin-media	Patch
sanity-plugin-mux-input	Patch
sanity-plugin-shopify-assets	Patch
sanity-plugin-studio-smartling	Patch
sanity-plugin-transifex	Patch
sanity-plugin-utils	Patch
sanity-plugin-workflow	Patch
sanity-plugin-workspace-home	Patch
sanity-translations-tab	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

✅ E2E Tests

🟢 43 passed • 🟡 1 flaky • view full report • view run

Studio: https://plugins-e2e-test-studio-r1mla8pr1.sanity.dev

Datasets: pr-2125-chromium-37946348294, pr-2125-firefox-37946348294

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​sanity/​util@​6.19.0-next.17 ⏵ 6.19.0-next.25
	npm/​@​sanity/​mutator@​6.19.0-next.17 ⏵ 6.19.0-next.25
	npm/​groq@​6.19.0-next.17 ⏵ 6.19.0-next.25
	npm/​sanity@​6.19.0-next.17 ⏵ 6.19.0-next.25	-10
	npm/​tsdown@​0.23.0
	npm/​@​sanity/​vision@​6.19.0-next.17 ⏵ 6.19.0-next.25
	npm/​@​sanity/​schema@​6.19.0-next.17 ⏵ 6.19.0-next.25

View full report

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	35.79%	6535 / 18259
🔵	Statements	35.71%	6964 / 19501
🔵	Functions	31.9%	1750 / 5485
🔵	Branches	27.21%	3498 / 12851

File Coverage

No changed files found.

Generated in workflow #10623 for commit 5c88be4 by the Vitest Coverage Report Action

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit f0b4dc3. Configure here.}