chore(deps): bump postcss and @sanity/plugin-kit

[dependabot]

Bumps postcss to 8.5.15 and updates ancestor dependency @sanity/plugin-kit. These dependencies need to be updated together.

Updates postcss from 8.5.8 to 8.5.15

Release notes

Sourced from postcss's releases.

8.5.15

• Fixed declaration parsing performance (by @​homanp).

8.5.14

• Fixed custom syntax regression (by @​43081j).

8.5.13

• Fixed postcss-scss commend regression.

8.5.12

• Fixed reading any file via user-generated CSS.
• Added opts.unsafeMap to disable checks.

8.5.11

• Fixed nested brackets parsing performance (by @​offset).

8.5.10

• Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

8.5.9

• Speed up source map encoding paring in case of the error.

Changelog

Sourced from postcss's changelog.

8.5.15

• Fixed declaration parsing performance (by @​homanp).

8.5.14

• Fixed custom syntax regression (by @​43081j).

8.5.13

• Fixed postcss-scss commend regression.

8.5.12

• Fixed reading any file via user-generated CSS.
• Added opts.unsafeMap to disable checks.

8.5.11

• Fixed nested brackets parsing performance (by @​offset).

8.5.10

• Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

8.5.9

• Speed up source map encoding paring in case of the error.

Commits

• eae46db Release 8.5.15 version
• 79508ff Update CI actions
• b128e21 Speed up declaration parsing by avoiding creating new array on each token
• 9825dca Fix code format
• 55789c8 Update dependencies
• 84fbbe9 Install older pnpm action for old Node.js
• 9f860bd Revert pnpm action for old Node.js
• 0877198 Update CI actions
• b2d1a33 Fix linter warnings
• 0700dac Merge pull request #2088 from rootvector2/add-oss-fuzz-harness
• Additional commits viewable in compare view

Updates @sanity/plugin-kit from 4.0.20 to 6.0.0

Release notes

Sourced from @​sanity/plugin-kit's releases.

@​sanity/plugin-kit@​6.0.0

Major Changes

• #1353 5ff7063 Thanks @​stipsan! - Remove @sanity/incompatible-plugin from scaffolding and detect leftover usage

  init and inject no longer add the @sanity/incompatible-plugin dependency or scaffold the sanity.json and v2-incompatible.js Sanity Studio v2 compatibility shim. verify-package now fails when it detects that a plugin still ships the shim (dependency, v2-incompatible.js, or a sanity.json referencing it) and explains how to remove it. The sanityPlugin.verifyPackage.sanityV2Json config option has been renamed to incompatiblePlugin.

• #1351 7078a73 Thanks @​stipsan! - Remove the deprecated ui-workshop preset. @sanity/ui-workshop is no longer maintained, so init/inject no longer accept --preset ui-workshop.

Minor Changes

• #1354 3217cf8 Thanks @​stipsan! - Add a verify-package check that bans CommonJS interop in package.json

  verify-package now flags require export conditions and top-level main/module fields. The plugin baseline is Sanity Studio v5+, which is pure ESM, so there is no need to publish a CommonJS build. Supporting CJS is not worth it: it can have unintended side-effects, and the Node.js versions plugin-kit supports fully handle require(esm), so a single published format keeps two copies of a plugin's code out of the module tree (avoiding bundle bloat and slower builds). Disable the check with "sanityPlugin": { "verifyPackage": { "esmOnly": false } }.

• #1352 2bae6e5 Thanks @​stipsan! - Add a verify-package check that bans src from the package.json files array, and stop including src in the files array generated by init. Disable it with sanityPlugin.verifyPackage.bannedFiles: false.

Patch Changes

• #1340 b3c4cc6 Thanks @​squiggler-app! - fix(deps): Update dependency get-it to v9

• #1341 34c2c6f Thanks @​squiggler-app! - fix(deps): Update dependency get-latest-version to v6

• #1354 3217cf8 Thanks @​stipsan! - Scaffold the sanity peer dependency as ^5 || ^6.0.0-0

  init and inject previously forced a stale sanity peer dependency range of ^3 onto generated plugins. They now declare sanity as ^5 || ^6.0.0-0, matching the current plugin baseline.

• #1359 c68af26 Thanks @​stipsan! - Replace @ts-expect-error suppressions with proper type definitions for package validation and license selection dependencies

@​sanity/plugin-kit@​5.0.3

Patch Changes

• 953cbf5 Thanks @​stipsan! - Use type-only imports for type references to satisfy verbatimModuleSyntax

@​sanity/plugin-kit@​5.0.2

Patch Changes

• #1331 a32af06 Thanks @​squiggler-app! - fix(deps): Update dependency validate-npm-package-name to ^5.0.1

• #1120 05863d9 Thanks @​stipsan! - Fix CLI command name in messages, plus typos and a redundant tsconfig read

  • Correct binname to plugin-kit so the version/link-watch help text and the missing-sanity.json error suggest the executable that is actually installed
  • Remove a stray apostrophe from the verify-package --single fail-fast hint so it can be copy-pasted as-is
  • Fix user-facing typos in CLI help and error messages ("promt" → "prompt", "exsists" → "exists", "Typescript" → "TypeScript")
  • Parse the tsconfig file once in readTSConfig instead of reading it twice

@​sanity/plugin-kit@​5.0.1

Patch Changes

• #1202 d95117b Thanks @​squiggler-app! - fix(deps): Update dependency get-it to ^8.8.0

... (truncated)

Changelog

Sourced from @​sanity/plugin-kit's changelog.

6.0.0

Major Changes

• #1353 5ff7063 Thanks @​stipsan! - Remove @sanity/incompatible-plugin from scaffolding and detect leftover usage

  init and inject no longer add the @sanity/incompatible-plugin dependency or scaffold the sanity.json and v2-incompatible.js Sanity Studio v2 compatibility shim. verify-package now fails when it detects that a plugin still ships the shim (dependency, v2-incompatible.js, or a sanity.json referencing it) and explains how to remove it. The sanityPlugin.verifyPackage.sanityV2Json config option has been renamed to incompatiblePlugin.

• #1351 7078a73 Thanks @​stipsan! - Remove the deprecated ui-workshop preset. @sanity/ui-workshop is no longer maintained, so init/inject no longer accept --preset ui-workshop.

Minor Changes

• #1354 3217cf8 Thanks @​stipsan! - Add a verify-package check that bans CommonJS interop in package.json

  verify-package now flags require export conditions and top-level main/module fields. The plugin baseline is Sanity Studio v5+, which is pure ESM, so there is no need to publish a CommonJS build. Supporting CJS is not worth it: it can have unintended side-effects, and the Node.js versions plugin-kit supports fully handle require(esm), so a single published format keeps two copies of a plugin's code out of the module tree (avoiding bundle bloat and slower builds). Disable the check with "sanityPlugin": { "verifyPackage": { "esmOnly": false } }.

• #1352 2bae6e5 Thanks @​stipsan! - Add a verify-package check that bans src from the package.json files array, and stop including src in the files array generated by init. Disable it with sanityPlugin.verifyPackage.bannedFiles: false.

Patch Changes

• #1340 b3c4cc6 Thanks @​squiggler-app! - fix(deps): Update dependency get-it to v9

• #1341 34c2c6f Thanks @​squiggler-app! - fix(deps): Update dependency get-latest-version to v6

• #1354 3217cf8 Thanks @​stipsan! - Scaffold the sanity peer dependency as ^5 || ^6.0.0-0

  init and inject previously forced a stale sanity peer dependency range of ^3 onto generated plugins. They now declare sanity as ^5 || ^6.0.0-0, matching the current plugin baseline.

• #1359 c68af26 Thanks @​stipsan! - Replace @ts-expect-error suppressions with proper type definitions for package validation and license selection dependencies

5.0.3

Patch Changes

• 953cbf5 Thanks @​stipsan! - Use type-only imports for type references to satisfy verbatimModuleSyntax

5.0.2

Patch Changes

• #1331 a32af06 Thanks @​squiggler-app! - fix(deps): Update dependency validate-npm-package-name to ^5.0.1

• #1120 05863d9 Thanks @​stipsan! - Fix CLI command name in messages, plus typos and a redundant tsconfig read

  • Correct binname to plugin-kit so the version/link-watch help text and the missing-sanity.json error suggest the executable that is actually installed
  • Remove a stray apostrophe from the verify-package --single fail-fast hint so it can be copy-pasted as-is
  • Fix user-facing typos in CLI help and error messages ("promt" → "prompt", "exsists" → "exists", "Typescript" → "TypeScript")
  • Parse the tsconfig file once in readTSConfig instead of reading it twice

5.0.1

... (truncated)

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​sanity/plugin-kit since your current version.

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.41%. Comparing base (9e90298) to head (59e72d9).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #163   +/-   ##
=======================================
  Coverage   98.41%   98.41%           
=======================================
  Files           5        5           
  Lines          63       63           
  Branches       18       18           
=======================================
  Hits           62       62           
  Misses          1        1           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[dependabot]

Dependabot attempted to update this pull request, but because the branch dependabot/npm_and_yarn/multi-438ac0cc0c is protected it was unable to do so.

[dependabot]

Superseded by #174.