Skip to content

fix(deps): update sanity packages #83

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Sep 30, 2025
Merged

fix(deps): update sanity packages #83

merged 1 commit into from
Sep 30, 2025

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Sep 30, 2025 •
edited
Loading

Note

Mend has cancelled the proposed renaming of the Renovate GitHub app being renamed to mend[bot].

This notice will be removed on 2025-10-07.

This PR contains the following updates:

Package Change Age Confidence
@sanity/client (source) ^7.4.0 -> ^7.11.2 age confidence
@sanity/comlink (source) ^3.0.5 -> ^3.0.9 age confidence
@sanity/core-loader (source) ^1.8.10 -> ^1.8.18 age confidence
@sanity/image-url (source) ^1.1.0 -> ^1.2.0 age confidence
@sanity/presentation-comlink (source) ^1.0.21 -> ^1.0.29 age confidence
@sanity/prettier-config ^1.0.3 -> ^1.0.6 age confidence
@sanity/preview-url-secret (source) ^2.1.11 -> ^2.1.15 age confidence
@sanity/types (source) ^3.91.0 -> ^3.99.0 age confidence
@sanity/visual-editing (source) ^2.15.0 -> ^2.15.4 age confidence
groq (source) ^3.91.0 -> ^3.99.0 age confidence
sanity (source) ^3.91.0 -> ^3.99.0 age confidence

Release Notes

sanity-io/client (@​sanity/client)

v7.11.2

Compare Source

Bug Fixes

v7.11.1

Compare Source

Bug Fixes
  • move extra options check after first connect attempt (#​1136) (fa8a040)

v7.11.0

Compare Source

Features

v7.10.0

Compare Source

Features
  • projects: allow a project list to be filtered to a specific Organization ID (#​1131) (b455862)

v7.9.0

Compare Source

Features
  • add ReleaseCardinality type and update ReleaseDocument interface (#​1129) (fd5198e)
  • allow experimental resource for projects and datasets (#​1124) (a2c8892)

v7.8.2

Compare Source

Bug Fixes

v7.8.1

Compare Source

Bug Fixes
  • add missing provider property to CurrentSanityUser type (#​1115) (5d98eca)

v7.8.0

Compare Source

Features
  • version.create action supports optional baseId and versionId instead of document (#​1108) (aaa1042)

v7.7.0

Compare Source

Features
  • add isHttpError method (and shared HttpError interface) (#​1112) (98ee6d3)
  • add ignoreExperimentalApiWarning configuration option (#​1107) (b1cdfbe)

v7.6.0

Compare Source

Features
  • transform: adds support for optional imageUrl param in for target.operation image-description (#​1105) (c47214f)

v7.5.0

Compare Source

Features
  • agent.action.transform can now transform images to text descriptions (#​1096) (609e572)

v7.4.1

Compare Source

Bug Fixes
sanity-io/visual-editing (@​sanity/comlink)

v3.0.9

Bug Fixes

v3.0.8

Bug Fixes

v3.0.7

Bug Fixes
  • deps: bump xstate to 5.20 (5a5c004)

v3.0.6

Bug Fixes
sanity-io/visual-editing (@​sanity/core-loader)

v1.8.18

Dependencies

v1.8.17

Dependencies

v1.8.16

Dependencies

v1.8.15

Dependencies

v1.8.14

Bug Fixes
Dependencies

v1.8.13

Bug Fixes
Dependencies

v1.8.12

Dependencies

v1.8.11

Bug Fixes
Dependencies
sanity-io/image-url (@​sanity/image-url)

v1.2.0

Compare Source

Minor Changes
Patch Changes

All notable changes will be documented in this file.

sanity-io/visual-editing (@​sanity/presentation-comlink)

v1.0.29

Dependencies

v1.0.28

Dependencies
  • The following workspace dependencies were updated

v1.0.27

Dependencies

v1.0.26

Dependencies

v1.0.25

Bug Fixes
Dependencies

v1.0.24

Bug Fixes
Dependencies

v1.0.23

Dependencies
  • The following workspace dependencies were updated

v1.0.22

Bug Fixes
Dependencies
sanity-io/prettier-config (@​sanity/prettier-config)

v1.0.6

Compare Source

Bug Fixes

v1.0.5

Compare Source

Bug Fixes

v1.0.4

Compare Source

Bug Fixes
  • deps: update prettier-plugin-packagejson to v2.5.15 (e3c8ee5)
sanity-io/visual-editing (@​sanity/preview-url-secret)

v2.1.15

Bug Fixes
  • declare @sanity/icons, sanity, as optional peer deps (0e0b8d3)

v2.1.14

Bug Fixes

v2.1.13

Bug Fixes

v2.1.12

Bug Fixes
sanity-io/sanity (@​sanity/types)

v3.99.0

Compare Source

Features

v3.98.1

Compare Source

Note: Version bump only for package @​sanity/types

v3.98.0

Compare Source

Note: Version bump only for package @​sanity/types

v3.97.1

Compare Source

Note: Version bump only for package @​sanity/types

v3.97.0

Compare Source

Note: Version bump only for package @​sanity/types

v3.96.0

Compare Source

Note: Version bump only for package @​sanity/types

v3.95.0

Compare Source

Note: Version bump only for package @​sanity/types

v3.94.2

Compare Source

Note: Version bump only for package @​sanity/types

v3.94.1

Compare Source

Note: Version bump only for package @​sanity/types

v3.94.0

Compare Source

Features
Bug Fixes

v3.93.0

Compare Source

Features
Bug Fixes

v3.92.0

Compare Source

Features
Bug Fixes
sanity-io/visual-editing (@​sanity/visual-editing)

v2.15.4

Bug Fixes
Dependencies

v2.15.3

Bug Fixes
Dependencies

v2.15.2

Bug Fixes
  • deps: bump xstate to 5.20 (5a5c004)
Dependencies

v2.15.1

Bug Fixes
Dependencies
sanity-io/sanity (groq)

v3.99.0

Compare Source

Note: Version bump only for package groq

v3.98.1

Compare Source

Note: Version bump only for package groq

v3.98.0

Compare Source

Note: Version bump only for package groq

v3.97.1

Compare Source

Note: Version bump only for package groq

v3.97.0

Compare Source

Note: Version bump only for package groq

v3.96.0

Compare Source

Note: Version bump only for package groq

v3.95.0

Compare Source

Note: Version bump only for package groq

v3.94.2

Compare Source

Note: Version bump only for package groq

v3.94.1

Compare Source

Note: Version bump only for package groq

v3.94.0

Compare Source

Bug Fixes

v3.93.0

Compare Source

Note: Version bump only for package groq

v3.92.0

Compare Source

Note: Version bump only for package groq

sanity-io/sanity (sanity)

v3.99.0

Compare Source

Features
Bug Fixes

v3.98.1

Compare Source

v3.98.0

Compare Source

Features
Bug Fixes

v3.97.1

Compare Source

Note: Version bump only for package sanity

v3.97.0

Compare Source

Features
Bug Fixes

v3.96.0

Compare Source

Features
  • sanity: account for draft model being switched off in isPerspectiveWriteable (3d68545) by Ash (ash@sanity.io)
  • sanity: add document.drafts.enabled configuration option (a06c4a5) by Ash (ash@sanity.io)
  • sanity: add draft model switched off message to ChooseNewDocumentDestinationBanner (1337002) by Ash (ash@sanity.io)
  • sanity: add option to compare draft to ObsoleteDraftBanner (0f6c350) by Ash (ash@sanity.io)
  • sanity: do not render draft status indicators if draft model is not switched on (453e102) by Ash (ash@sanity.io)
  • sanity: enable dynamic default perspective (508c736) by Ash (ash@sanity.io)
  • sanity: exclude drafts from perspective stack when draft model is not switched on (242c878) by Ash (ash@sanity.io)
  • sanity: make global perspective picker compatible with any default perspective (45a6712) by Ash (ash@sanity.io)
  • sanity: prevent non-live-edit-document creation when the draft model is not switched on (20c6a6f) by Ash (ash@sanity.io)
  • sanity: refine obsolete draft copy (af4c563) by Ash (ash@sanity.io)
  • sanity: warn of obsolete drafts when draft model is switched off (1fd984a) by Ash (ash@sanity.io)
Bug Fixes

Configuration

📅 Schedule: Branch creation - "before 3am on Monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate using a curated preset maintained by Sanity. View repository job log here

@renovate renovate bot force-pushed the renovate/sanity-packages branch from 58da7b0 to a9d8184 Compare September 30, 2025 11:45
@socket-security
Copy link

socket-security bot commented Sep 30, 2025 •
edited
Loading

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updated@​sanity/​types@​3.91.0 ⏵ 3.99.010010073 +1100100
Updated@​sanity/​presentation-comlink@​1.0.21 ⏵ 1.0.29100 +110074 +398 -1100
Updated@​sanity/​prettier-config@​1.0.3 ⏵ 1.0.686 +210077 +289 +2100
Updated@​sanity/​core-loader@​1.8.10 ⏵ 1.8.1899 +110078 +298 -1100
Updatedgroq@​3.91.0 ⏵ 3.99.010010080 +1100100
Updated@​sanity/​image-url@​1.1.0 ⏵ 1.2.010010010088 -1100
Updatedsanity@​3.91.0 ⏵ 3.99.097 +1100100100100
Updated@​sanity/​comlink@​3.0.5 ⏵ 3.0.9100 +110010097 -1100
Updated@​sanity/​preview-url-secret@​2.1.11 ⏵ 2.1.1510010010098 -1100
Updated@​sanity/​visual-editing@​2.15.0 ⏵ 2.15.498 +1100100100100
Updated@​sanity/​client@​7.4.0 ⏵ 7.11.2100 +1100100100 +1100

View full report

@socket-security
Copy link

socket-security bot commented Sep 30, 2025 •
edited
Loading

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn Low
@architect/asap@7.0.10 has Environment variable access.

Location: Package overview

From: pnpm-lock.yaml → npm/sanity@3.99.0 → npm/@architect/asap@7.0.10

ℹ Read more on: This package | This alert | What is environment variable access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@architect/asap@7.0.10. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
@architect/asap@7.0.10 has Environment variable access.

Env Vars: AWS_REGION

Location: Package overview

From: pnpm-lock.yaml → npm/sanity@3.99.0 → npm/@architect/asap@7.0.10

ℹ Read more on: This package | This alert | What is environment variable access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@architect/asap@7.0.10. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
@architect/inventory@4.0.9 has Environment variable access.

Location: Package overview

From: pnpm-lock.yaml → npm/sanity@3.99.0 → npm/@architect/inventory@4.0.9

ℹ Read more on: This package | This alert | What is environment variable access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@architect/inventory@4.0.9. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
@architect/inventory@4.0.9 has Environment variable access.

Env Vars: key

Location: Package overview

From: pnpm-lock.yaml → npm/sanity@3.99.0 → npm/@architect/inventory@4.0.9

ℹ Read more on: This package | This alert | What is environment variable access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@architect/inventory@4.0.9. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
@architect/inventory@4.0.9 has Environment variable access.

Env Vars: AWS_REGION

Location: Package overview

From: pnpm-lock.yaml → npm/sanity@3.99.0 → npm/@architect/inventory@4.0.9

ℹ Read more on: This package | This alert | What is environment variable access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@architect/inventory@4.0.9. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
@architect/utils@4.0.6 has Environment variable access.

Env Vars: ARC_QUIET

Location: Package overview

From: pnpm-lock.yaml → npm/sanity@3.99.0 → npm/@architect/utils@4.0.6

ℹ Read more on: This package | This alert | What is environment variable access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@architect/utils@4.0.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
@architect/utils@4.0.6 has Environment variable access.

Env Vars: QUIET

Location: Package overview

From: pnpm-lock.yaml → npm/sanity@3.99.0 → npm/@architect/utils@4.0.6

ℹ Read more on: This package | This alert | What is environment variable access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@architect/utils@4.0.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
@architect/utils@4.0.6 has Environment variable access.

Env Vars: AWS_REGION

Location: Package overview

From: pnpm-lock.yaml → npm/sanity@3.99.0 → npm/@architect/utils@4.0.6

ℹ Read more on: This package | This alert | What is environment variable access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@architect/utils@4.0.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
@architect/utils@4.0.6 has Environment variable access.

Env Vars: AWS_ACCESS_KEY_ID

Location: Package overview

From: pnpm-lock.yaml → npm/sanity@3.99.0 → npm/@architect/utils@4.0.6

ℹ Read more on: This package | This alert | What is environment variable access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@architect/utils@4.0.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
@architect/utils@4.0.6 has Environment variable access.

Env Vars: AWS_PROFILE

Location: Package overview

From: pnpm-lock.yaml → npm/sanity@3.99.0 → npm/@architect/utils@4.0.6

ℹ Read more on: This package | This alert | What is environment variable access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@architect/utils@4.0.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
@architect/utils@4.0.6 has Environment variable access.

Location: Package overview

From: pnpm-lock.yaml → npm/sanity@3.99.0 → npm/@architect/utils@4.0.6

ℹ Read more on: This package | This alert | What is environment variable access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@architect/utils@4.0.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
@architect/utils@4.0.6 has Environment variable access.

Env Vars: CI

Location: Package overview

From: pnpm-lock.yaml → npm/sanity@3.99.0 → npm/@architect/utils@4.0.6

ℹ Read more on: This package | This alert | What is environment variable access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@architect/utils@4.0.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
@aws-lite/client@0.21.10 has Environment variable access.

Env Vars: AWS_LAMBDA_FUNCTION_NAME

Location: Package overview

From: pnpm-lock.yaml → npm/sanity@3.99.0 → npm/@aws-lite/client@0.21.10

ℹ Read more on: This package | This alert | What is environment variable access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@aws-lite/client@0.21.10. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
@aws-lite/client@0.21.10 has Environment variable access.

Location: Package overview

From: pnpm-lock.yaml → npm/sanity@3.99.0 → npm/@aws-lite/client@0.21.10

ℹ Read more on: This package | This alert | What is environment variable access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@aws-lite/client@0.21.10. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
@aws-lite/client@0.21.10 has Environment variable access.

Env Vars: AWS_PROFILE

Location: Package overview

From: pnpm-lock.yaml → npm/sanity@3.99.0 → npm/@aws-lite/client@0.21.10

ℹ Read more on: This package | This alert | What is environment variable access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@aws-lite/client@0.21.10. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
@aws-lite/client@0.21.10 has Environment variable access.

Env Vars: AWS_LITE_DEBUG

Location: Package overview

From: pnpm-lock.yaml → npm/sanity@3.99.0 → npm/@aws-lite/client@0.21.10

ℹ Read more on: This package | This alert | What is environment variable access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@aws-lite/client@0.21.10. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
aws4@1.13.2 has Environment variable access.

Location: Package overview

From: pnpm-lock.yaml → npm/sanity@3.99.0 → npm/aws4@1.13.2

ℹ Read more on: This package | This alert | What is environment variable access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/aws4@1.13.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
motion-utils@12.23.6 has Environment variable access.

Env Vars: NODE_ENV

Location: Package overview

From: pnpm-lock.yaml → npm/sanity@3.99.0 → npm/@sanity/visual-editing@2.15.4 → npm/motion-utils@12.23.6

ℹ Read more on: This package | This alert | What is environment variable access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/motion-utils@12.23.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@renovate renovate bot force-pushed the renovate/sanity-packages branch from a9d8184 to a50551a Compare September 30, 2025 11:59
@renovate renovate bot merged commit cb23da7 into main Sep 30, 2025
3 checks passed
@renovate renovate bot deleted the renovate/sanity-packages branch September 30, 2025 15:19
This was referenced Sep 30, 2025
Merged
Merged
Closed
Closed
@github-actions github-actions bot locked as resolved and limited conversation to collaborators Oct 8, 2025
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

No reviews

Assignees

No one assigned

Labels

🤖 bot 📦 deps

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants