chore(deps): bump adm-zip and sanity

[dependabot]

Bumps adm-zip to 0.6.0 and updates ancestor dependency sanity. These dependencies need to be updated together.

Updates adm-zip from 0.5.17 to 0.6.0

Release notes

Sourced from adm-zip's releases.

v0.6.0

Full Changelog: cthackers/adm-zip@v0.5.18...v0.6.0

This release fixes a security vulnerability (CVE-2026-39244), resolves several long-standing bugs, ships built-in TypeScript types, and includes two behavior changes worth reading before you upgrade.

• extractEntryTo(dirEntry, target, maintainEntryPath = false) now preserves subdirectories instead of flattening files into the target folder by basename (which also silently overwrote same-named files). (#306)
• Extraction no longer fails when the modification time can't be set — utimes is now best-effort. (#379)
• Minimum Node.js is now 14 (the code already required it; engines was incorrectly >=12).
• CVE-2026-39244 — a crafted archive declaring a huge uncompressed size could force an unbounded Buffer.alloc and OOM the process; allocation is now bounded by the data actually present. Reported by Daniel Púa (devploit), Anh Hong, and José Antonio Zamudio Amaya. (#568)
• Hardened entry-name lookup against object injection (proto names). Prototype-less table.
• Data-descriptor regression rejecting valid archives (#548, #533, #554)
• Directory permissions not restored on extract (#530)
• Infinite recursion on symlink loops in addLocalFolder (#541)
• Uncaught process crash in writeFileToAsync on write failure (#470, #459, #402)
• Empty name on directory entries (#466)
• test() always returned false for archives with files
• ~6× faster entry sorting for large archives
• Built-in TypeScript definitions (types.d.ts) — you can drop @​types/adm-zip

v0.5.18

What's Changed

• Bump js-yaml from 4.1.1 to 4.3.0 by @​dependabot[bot] in cthackers/adm-zip#566
• Fix corrupted zip when round-tripping entries with a data descriptor (#555) by @​JohnJunior in cthackers/adm-zip#564
• prevent crashes when process.versions is an empty object by @​matt-fidd in cthackers/adm-zip#551
• support for writing zip64 by @​mielverkerken in cthackers/adm-zip#562
• Fix Archive Utility failure on zips with empty directories (#558) by @​JohnJunior in cthackers/adm-zip#563

New Contributors

• @​JohnJunior made their first contribution in cthackers/adm-zip#564
• @​matt-fidd made their first contribution in cthackers/adm-zip#551
• @​mielverkerken made their first contribution in cthackers/adm-zip#562

Full Changelog: cthackers/adm-zip@v0.5.17...v0.5.18

Changelog

Sourced from adm-zip's changelog.

0.6.0 / 2026-07-10

Security

• Fixed CVE-2026-39244: a crafted archive declaring a huge uncompressed size could force an unbounded Buffer.alloc (memory exhaustion / DoS) before any validation. Allocation is now bounded by the data actually present — STORED output is sized from the real bytes, DEFLATED output is grown by the inflater and capped at the declared size (#568)
• Hardened the internal entry-name lookup table against object injection: entry names come from untrusted archives, and a name such as __proto__ previously resolved to Object.prototype, crashing addFile and hiding the entry from getEntry/readFile. The table is now prototype-less

Bug fixes

• Fixed a regression (0.5.15) that rejected valid archives using a data descriptor (general-purpose bit 3). The payload is now validated against the authoritative central-directory CRC instead of requiring/parsing the trailing descriptor (#548, #533, #554)
• Fixed extractAllTo/extractAllToAsync not restoring directory permissions with keepOriginalPermission; directory modes are applied after their contents are written, deepest path first, and no longer lock the extractor out of a restrictive directory (#530)
• Fixed infinite recursion in addLocalFolder when a folder contains a symlink pointing back to an ancestor (e.g. workspace node_modules); the walk now tracks resolved real paths and skips already-visited directories (#541)
• Fixed an uncaught exception (ERR_INVALID_ARG_TYPE) that crashed the process when writeFileToAsync could not open the target file (bad permissions, invalid filename, exhausted file descriptors); write failures are now reported through the callback and write errors are no longer silently swallowed (#470, #459, #402)
• Fixed directory entries reporting an empty name (e.g. a/b/c/ now returns c) (#466)
• Fixed extractEntryTo flattening subdirectories when maintainEntryPath is false; the structure below the extracted directory is now preserved instead of collapsing (and overwriting) files by basename (#306)
• Fixed a failed utimes aborting extraction; setting the modification time is now best-effort and never fails extraction of already-written content (#379)
• Fixed test() always returning false for any archive containing a file (it indexed the entries array with an entry object instead of reading the entry); it now correctly verifies each entry's CRC

Performance

• Faster entry sorting when writing archives with many entries: names are decoded once instead of on every comparison (about 6× faster sort for large archives)

Added

• Bundled TypeScript type definitions (types.d.ts), so @types/adm-zip is no longer required

Notes

• Behavior change: extractEntryTo(dir, target, /* maintainEntryPath */ false) now preserves subdirectories beneath the extracted directory rather than flattening them
• Behavior change: extraction no longer fails when the modification time cannot be set

0.5.4 / 2021-03-08

• Fixed relative paths
• Added zipcrypto encryption
• Lower verMade for macOS when generating zip file

0.5.3 / 2021-02-07

• Fixed filemode when unzipping

0.5.2 / 2021-01-27

• Fixed path traversal issue (GHSL-2020-198)

0.5.1 / 2020-11-27

• Incremented version (cthackers)
• Fixed outFileName (cthackers)

0.5.0 / 2020-11-19

• Added extra parameter to extractEntryTo so target filename can be renamed (cthackers)

... (truncated)

Commits

• 2b4d840 updated minimum node engine version to >= 14
• dc57f0f Hardened entry-name lookup, fixed test(), and sped up entry sorting
• f81806a Made utimes best-effort so it can't abort extraction (#379)
• ab04324 Fixed extractEntryTo flattening subdirectories (#306)
• 8a5d9ba Fixed empty name for directory entries (#466)
• 3e72790 Fixed uncaught crash in writeFileToAsync on write failure (#470, #459, #402)
• 651ae4c Added typescript types
• e72021d Fixed infinite recursion on symlink loops in addLocalFolder (#541)
• 8f3176b Fixed directory permissions on linux
• 4d2c8f9 Fixed error introduced with zip descriptor checks
• Additional commits viewable in compare view

Updates sanity from 5.19.0 to 6.5.0

Release notes

Sourced from sanity's releases.

v6.5.0

Sanity Studio v6.5.0

This release includes various improvements and bug fixes.

For the complete changelog with all details, please visit: www.sanity.io/changelog/studio-Ni40LjA

Install or upgrade Sanity Studio

To upgrade to this version, run:

npm install sanity@latest

To initiate a new Sanity Studio project or learn more about upgrading, please refer to our comprehensive guide on Installing and Upgrading Sanity Studio.

📓 Full changelog

Author	Message	Commit
squiggler-app[bot]	chore(tests): generate dts tests 🤖 ✨ (#13514)	df9d16fb22c73fdc957b7f9448fa2b3fd25657c3
@​stipsan	fix(release-notes): produce schema-valid suggested content (#13515)	1acd626b300d70e053f93520c8af6cebb4da88f1
@​stipsan	fix(form): keep empty reference array items when clicking custom item UI (#13508)	73aeb3b5128fd06fc49c47d55a50610a2f9a8c00
@​pedrobonamin	fix(core): defer onDeleteComplete until after dialog cleanup (#13512)	7837303aec73f9f465a73c5ee54d453f6b1e2973
@​pedrobonamin	fix(core): clear scheduled draft perspective after deleting scheduled draft (#13509)	1d3ea7997e3c2f4bf9d3359ceb9b7b93eb1d4f1e
@​bjoerge	chore(dev): perf bench followups (#13507)	f6bd1e60f5777ac91ad33c9e8aec9808fd599148
@​snorrees	fix(structure): allow all document actions when a Canvas-linked document is editable (#13506)	02c71ffa4bd49a6543e84910505f644998549d54
@​bjoerge	chore(dev): add perf bench (#13442)	376f1ddd97f63e2fc1b1891cebf9e98665151cad
squiggler-app[bot]	fix(deps): update dependency @​sanity/cli to ^7.8.0 (#13501)	d5384dc81f800b10e629d557d68b70b55b274929
squiggler-app[bot]	chore(tests): generate dts tests 🤖 ✨ (#13492)	c9a1a58a1398144fe33ddf3fb29e211205b914d0
@​bjoerge	fix: only show document sync state toast on actual commit failures (#13487)	0c7bf655d3f70629e0acaab6fd6106ae7fbe3406
@​bjoerge	fix: keep editState + document versions warm across subscription churn (#13490)	f7a0425a98ca83c87df0672e5d17f783f87891f3
@​pedrobonamin	feat(variants): allow creating variant documents in releases (#13488)	bef5e191fa600446716a649e35f1d0059ae846ec
@​stipsan	chore(lint): turn off no-unnecessary-type-assertion (#13486)	b7d3c8d0f7967a3623b1962bcab6659ceff56550
squiggler-app[bot]	chore(deps): update dependency i18next to ^26.3.6 (#13418)	e7270c10b1d0eb9e465f2f239e12fcf11109a061
@​juice49	chore: revert "chore(lint): make no-unnecessary-type-assertion an error with grandfathered suppressions (#13375)" (#13484)	ebae0cee6d38463b68141257f0d2444b33ad2407
squiggler-app[bot]	chore(deps): dedupe pnpm-lock.yaml (#13483)	5fe5c6f35d56a71277d732a38f2f8818faf8c96d
squiggler-app[bot]	chore(tests): generate dts tests 🤖 ✨ (#13471)	da58c4fe39b52b8427197683fb58c3a2f517e8f6
squiggler-app[bot]	chore(deps): update dependency vite to ^8.1.4 (#13369)	b74d8ce3e20571783c7572c7245de07c128d6228
squiggler-app[bot]	chore(deps): dedupe pnpm-lock.yaml (#13444)	8d0f76112dc408ef143d7c31716e8faee3bb33be
@​juice49	chore(sanity): lint getVariantsDocumentCounts (#13479)	4b4bb839640a4834f12d3e3bbc7d2fa99baae3a0
Copilot	fix(variants): pass variant id to useSetVariant from pin button (#13478)	5fc9d92ccb2e185aed89d59402c8bdee7d2a810c
@​jordanl17	feat(telemetry): track workspace feature flags in workspace features observed (#13386)	bb9fccbdf28c521d88c2c24e9246ddf806219ead
@​pedrobonamin	feat(variants): add pin button to variants tool (#13468)	20dc63dfc939cab2fb9d45ed3370c9489e3b3729
@​juice49	refactor(sanity): reduce data needed by setVariant to simply the variant id (#13473)	529eb0e31bf2c9bcb2f81184d80dc0ebae63ff09
@​christianhg	feat(comments): anchor text comments on the block's data path (#13116)	dc5f60109b7785a7005f820c9f365c5a1695dbba
@​christianhg	test(test-studio): toggle inline containers on the Container Table field (#13116)	93e1bb7d072105e035b569cc5b24b2bfc696cdae
@​christianhg	fix(comments): match CommentsField threads by path prefix (#13116)	51859f8f54377e238ac5f4f57721eaf43f2f222f

... (truncated)

Changelog

Sourced from sanity's changelog.

6.5.0 (2026-07-14)

Features

• comments: anchor text comments on the block's data path (dc5f601)
• perspective: support setting variant and perspective atomically (#13461) (a2242c9)
• telemetry: track workspace feature flags in workspace features observed (#13386) (bb9fccb)
• variants: add pin button to variants tool (#13468) (20dc63d)
• variants: allow creating variant documents in releases (#13488) (bef5e19)
• variants: prevent variant deletion when it has documents (#13467) (241ba91)
• variants: show live document counts in variants overview (#13460) (4650c5b)

Bug Fixes

• comments: match CommentsField threads by path prefix (51859f8)
• core: clear scheduled draft perspective after deleting scheduled draft (#13509) (1d3ea79)
• core: defer onDeleteComplete until after dialog cleanup (#13512) (7837303)
• core: delegate useProject request errors to the studio error channel (#13459) (6e197c4)
• core: variants details not rendering the documents (#13455) (4ab4b17)
• deps: update dependency @​sanity/cli to ^7.7.1 (#13453) (bcebe7c)
• deps: update dependency @​sanity/cli to ^7.8.0 (#13501) (d5384dc)
• deps: update dependency @​sanity/preview-url-secret to ^4.0.8 (#13420) (e81a160)
• form: keep empty reference array items when clicking custom item UI (#13508) (73aeb3b)
• keep editState + document versions warm across subscription churn (#13490) (f7a0425)
• only offer reload-to-update for versions auto-update will serve (#13451) (11edcfa)
• only show document sync state toast on actual commit failures (#13487) (0c7bf65)
• sanity: base reload prompt on served package version, drop range heuristic (#13462) (210efaf)
• structure: allow all document actions when a Canvas-linked document is editable (#13506) (02c71ff)
• structure: delegate intent resolution request failures to studio error handler (#13464) (e19ca5c)
• treat session not found as an invalid session (#13458) (0a2698e)
• variants: pass variant id to useSetVariant from pin button (#13478) (5fc9d92)

6.4.0 (2026-07-07)

Features

• improve request error handling (#13367) (b2817c1)
• types: add user attribute types to CurrentUser (#13395) (b7b7fc1)

Bug Fixes

• core: allow pasting references to documents that only exist in a release (#13399) (8072fbc)
• core: draw change connector when hovering image and file diffs (#13428) (028ff93)
• core: force logout only on 401s tagged as session expiry (#13394) (ef537bc)
• core: only cancel commits for known-terminal client errors (#13396) (e38afdc)
• deps: update dependency @​sanity/cli to ^7.5.0 (#13389) (24bce9d)
• deps: update dependency @​sanity/icons to ^3.7.6 (#13384) (260a282)
• deps: update dependency @​sanity/icons to v5 (#13409) (f788296)
• deps: update dependency react-rx to ^4.2.3 (#13405) (10d1a5a)
• deps: update portabletext (#13441) (064bb11)
• portable-text: collect form members at any depth (e8af647)

... (truncated)

Commits

• e8fe72a chore(release): publish v6.5.0 (#13447)
• 73aeb3b fix(form): keep empty reference array items when clicking custom item UI (#13...
• 7837303 fix(core): defer onDeleteComplete until after dialog cleanup (#13512)
• 1d3ea79 fix(core): clear scheduled draft perspective after deleting scheduled draft (...
• 02c71ff fix(structure): allow all document actions when a Canvas-linked document is e...
• d5384dc fix(deps): update dependency @​sanity/cli to ^7.8.0 (#13501)
• 0c7bf65 fix: only show document sync state toast on actual commit failures (#13487)
• f7a0425 fix: keep editState + document versions warm across subscription churn (#13490)
• bef5e19 feat(variants): allow creating variant documents in releases (#13488)
• e7270c1 chore(deps): update dependency i18next to ^26.3.6 (#13418)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.41%. Comparing base (9d3f1a9) to head (2501517).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #168   +/-   ##
=======================================
  Coverage   98.41%   98.41%           
=======================================
  Files           5        5           
  Lines          63       63           
  Branches       18       20    +2     
=======================================
  Hits           62       62           
  Misses          1        1           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[dependabot]

Dependabot attempted to update this pull request, but because the branch dependabot/npm_and_yarn/multi-9486dbc548 is protected it was unable to do so.