Repository navigation
Conversation
|
|
The latest updates on your projects. Learn more about Vercel for GitHub.
1 Skipped Deployment
|
stipsan
marked this pull request as ready for review
September 19, 2026 14:03
stipsan
requested review from
juice49
and
a lite review from Copilot
and removed request for
a team
September 19, 2026 14:03
Contributor
There was a problem hiding this comment.
Copilot wasn't able to review any files in this pull request.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
✅ E2E Tests🟢 46 passed • view full report • view run Studio: https://plugins-e2e-test-studio-9q7s69xm6.sanity.dev Datasets: |
Coverage Report
File CoverageNo changed files found. |
juice49
previously approved these changes
Sep 21, 2026
stipsan
added a commit
that referenced
this pull request
Sep 29, 2026
…2048) <!-- CURSOR_AGENT_PR_BODY_BEGIN --> Puts this repo on the same pnpm version and settings as [sanity-io/ui](https://github.com/sanity-io/ui) `main`: `packageManager` `pnpm@12.6.0`, ui's pnpm settings in `pnpm-workspace.yaml`, ui's CI setup action (`pnpm/setup@v3`) but with its store cache off, and a lockfile regenerated with pnpm 12.6.0. The `Dedupe lockfile` workflow stays, with the one change pnpm 12 needs. ## Builds on #2044, supersedes #2043, #2044 and #1131 - **#2044** (pnpm 12.6.0 + `autoDedupe` + Vercel CLI bump) is the base. Its commits are cherry-picked with `-x`. #2044's interim `installCommand` workaround in `dev/e2e-studio/vercel.json`, which it later removed, is left out, so this PR doesn't touch any Vercel config. #2044 left CI on `pnpm/action-setup` + `actions/setup-node`; this PR switches to ui's action. - **#2043** (Renovate's plain `packageManager` bump) fails `E2E / deploy-preview`, because `vercel@57` can't parse pnpm 12's lockfile (see below). - **#1131** (an early `pnpm/setup@v1` attempt) is covered by the CI change here. - **#2018** (lockfile regenerated from scratch) is not superseded: it re-resolves every dependency, which is out of this PR's scope. ## Changes | | Before | After | | --- | --- | --- | | `packageManager` | `pnpm@11.21.0` | `pnpm@12.6.0` (as in ui) | | `pnpm-workspace.yaml` | | `autoDedupe: true` and `strictPeerDependencies: false` (as in ui) | | `.github/actions/setup` | `pnpm/action-setup@v6` + `actions/setup-node@v7` + `pnpm install` | ui's action (`pnpm/setup@v3`, `runtime: node@lts`) with `cache: false`, where ui has `cache: true` | | `.github/workflows/pnpm-if-needed.yml` (`Dedupe lockfile`) | runs `pnpm dedupe` once | kept; runs `pnpm dedupe` twice | | `vercel` (root devDependency) | `^57.0.0` | `^60.1.3` | - **Lockfile:** main's lockfile after #2039, plus this PR's changes as pnpm 12.6.0 re-applied them. Those changes are the `packageManagerDependencies` block, the `vercel@60.1.3` tree with the optional-peer suffixes it brings, and `autoDedupe`'s dedupes: the same `zod` and `gaxios` ones as the pending #2052, plus the peer toggle described below. No other versions change, and `sanity@6.17.0-next.108` stays put. #2039's refresh had already removed the three duplicates the first revision collapsed. - **Vercel CLI:** pnpm 12 writes the lockfile as two YAML documents. `vercel@57`'s bundled `@vercel/build-utils` reads only the first, falls back to npm, and fails on `workspace:*`, which is #2043's failure. `58.9.5` is the first CLI that parses it, and every release from `58.7.0` on ships without npm provenance (still published from GitHub Actions OIDC). So `trustPolicy: no-downgrade` needs the exact versions pnpm reports as `ERR_PNPM_TRUST_DOWNGRADE` in `trustPolicyExclude`: `vercel@60.1.3` and 31 `@vercel/*` packages. - **CI setup:** `pnpm/setup` reads `packageManager`, installs Node LTS, runs `pnpm install`, and caches pnpm's lockfile-verification verdict across jobs, which saves the ~28s supply-chain check. `ailf-eval.yml` passes `runtime: node@lts` instead of `node-version: lts/*`. `release.yml` keeps `pnpm/action-setup` + `actions/setup-node`, as in ui. - **Store cache off, unlike ui** (commit `bddef7a4`). With `cache: true`, `pnpm/setup` uploads a new ~645 MiB store entry after every job, even for an unchanged lockfile, because its keys include the run id. That was 12 entries (7.7 GB) per push here, evicting the Playwright browser caches the e2e jobs reuse. With it off, test shards spend 16–19s in setup and nothing afterwards, against 19–23s plus 9–12s of upload with it on. ui keeps `cache: true` and has the same issue. Revert `bddef7a4` to match ui. - **`Dedupe lockfile` workflow kept, adapted for pnpm 12** (commit `a7e1057f`). On the current lockfile, pnpm 12.6.0's `pnpm dedupe` isn't idempotent. Each run toggles `@vitejs/devtools` and `oxc-transform-react` in the peer suffixes of `plugins/@sanity/debug-preview-url-secret-plugin`'s `sanity` and `@sanity/tsdown-config` entries, without changing any version. Run once, as before, the workflow would open a toggle-only PR after every lockfile change on `main`, and each automerged dedupe PR would trigger the next. A second run undoes the toggle and keeps real dedupes. An earlier commit in this branch deleted the workflow; `82810b5e` reverts that. - **Docs:** AGENTS.md, CONTRIBUTING.md and README.md now require pnpm v12. AGENTS.md and `e2e/README.md` explain the two-document lockfile and the Vercel CLI floor; per Copilot's review of #2044, the trust-policy wording only lists versions that pnpm reports as downgrades. AGENTS.md also says not to commit lockfile diffs that only flip the peer toggle. No changeset: no published package's manifest or runtime code changes, as with the pnpm 11 bump in #1579. ## Merge with main `main` gained one commit after this branch started: Renovate's lock file maintenance (#2039, `cb68d65e`). It conflicted only in `pnpm-lock.yaml`. `main` is merged in rather than rebased, so nothing was force-pushed. The resolution takes main's lockfile and lets pnpm 12.6.0 re-apply this PR's changes; `pnpm-workspace.yaml` needed no further changes. #2039's 25 source files merged cleanly. ## What Cody needs to do - **Add the "🤖 bot" label.** The agent's label tool can't edit PRs in this repo. - **Close #2044 and #1131** when this lands. Renovate autocloses #2043. The pending dedupe PR #2052 is redundant, since its four lines are already in this lockfile. It merges cleanly with this PR in either order. - **Vercel:** nothing to set up. No project, env var or `vercel.json` changes; only the root `vercel` CLI devDependency moves. - **Secrets and ruleset:** no new secrets, and the required checks (`lint`, `build`, `test`, Socket) keep their names. ## Open questions 1. **Vercel CLI trust exclusions.** This is #2044's call, which overrides the reason #1890 was closed: 32 exact versions without provenance in `trustPolicyExclude`. Every future `vercel` bump has to add its own versions, so Renovate's `vercel` PRs will fail their artifact update until someone does. The alternative is e2e previews that can't build on pnpm 12. 2. **`strictPeerDependencies: false`** matches ui but is already pnpm's default; ui carried it over from an old `.npmrc`. Keep it for parity, or drop it? 3. **Store cache in ui.** ui has the same per-job uploads. Turn its store cache off too? ## Known pnpm 12.6.0 issue The peer toggle also shows up locally. A fresh `pnpm install`, or the implicit install pnpm runs before scripts when `node_modules` looks stale, flips those two suffixes in `pnpm-lock.yaml`. Frozen installs, which CI uses, never do. The lockfile before #2039 didn't toggle; main's refreshed resolutions exposed it, and it happens with `autoDedupe` off too. ## Not in this PR - vitest 5, oxfmt (#2047), oxlint (#2049) and the tsdown setup are sibling PRs. Whichever lands later merges `main` and regenerates the lockfile. - ui's `packageExtensions` entry for `@testing-library/jest-dom` belongs to its vitest 5 setup. - ui's root `engines.node: ">=22.13"` and macOS test job are Node and test-matrix changes, not pnpm. Plugins' tooling needs Node ≥ 22.18 anyway (AGENTS.md). - Plugins-specific pnpm settings that ui doesn't have (`trustPolicy`, `dedupePeers`, `dedupeDirectDeps`, `publicHoistPattern`) stay. ## Verification - **Lockfile:** regenerated on `main` at `cb68d65e` by pnpm 12.6.0 run directly on Node 24.21.0. A cold `pnpm install --frozen-lockfile` passes the supply-chain check (2,615 entries), and without the Vercel exclusions it fails with `ERR_PNPM_TRUST_DOWNGRADE`. - **Dedupe workflow:** from the committed lockfile, from its toggled state, and from the committed lockfile with #2052's duplicates put back, two `CI=true pnpm dedupe --config.ignore-scripts=true` runs give, respectively, no change, no change, and exactly #2052's dedupes. A single run gives the toggle every time. - **Local checks on the merged tree:** `pnpm lint`, `pnpm knip`, `pnpm build` (52/52 tasks) and `pnpm test run` (224 files, 1,391 tests) pass. - **CI:** everything passes on `bddef7a4`, including `deploy-preview` (Vercel CLI 60.1.3 detects the lockfile and installs with pnpm 12.6.0) and e2e on Chromium and Firefox. CI on `a7e1057f`, which only touches the dedupe workflow and AGENTS.md, is running. - **zizmor:** `zizmor .github` reports the same findings as on `main` at every severity. <!-- CURSOR_AGENT_PR_BODY_END --> <div><a href="https://cursor.com/agents/bc-0c45b56b-fd33-55f7-b22c-89bde73748e4?cursor_ref=pr_footer&cursor_cta=open_in_web"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a href="https://cursor.com/background-agent?bcId=bc-0c45b56b-fd33-55f7-b22c-89bde73748e4&cursor_ref=pr_footer&cursor_cta=open_in_cursor"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img alt="Open in Cursor" width="131" height="28" src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com>
stipsan
enabled auto-merge (squash)
October 23, 2026 15:41
Member
Author
|
@copilot resolve the merge conflicts in this pull request |
auto-merge was automatically disabled
October 23, 2026 15:46
Head branch was pushed to by a user without write access
Contributor
Resolved and pushed in merge commit |
cursor
Bot
force-pushed
the
cursor/regen-pnpm-lockfile-fc49
branch
from
October 23, 2026 15:59
cb3d50d to
7f364ce
Compare
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
Delete node_modules and pnpm-lock.yaml, then reinstall with pnpm 12.6.0 so the lockfile is a fresh resolution of current ranges. A clean resolve moves the Studio next overrides from 6.21.0-next.53 to 6.21.0-next.70. It also records the trust downgrades that install reported (lefthook@2.2.2, @vercel/oidc@3.8.10, @vercel/cli-config@0.3.1, and the @vercel/vc-native-*@60.1.3 builds). tsdown stays on 0.23.1 because 0.23.2's rolldown-plugin-dts beta cannot emit declarations on TypeScript 7, and oxlint-tsgolint stays on 7.0.2003 because 7.0.2005 reports no-unsafe-type-assertion on the `as` token. The unused i18next@26.4.4 minimumReleaseAge exclude is pruned. Co-authored-by: Cody Olsen <stipsan@users.noreply.github.com>
cursor
Bot
force-pushed
the
cursor/regen-pnpm-lockfile-fc49
branch
from
October 23, 2026 16:06
7f364ce to
178c9da
Compare
stipsan
added
the
✨ ai
Cursor
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
![https://cursor.com/assets/images/open-in-web-dark.png"><source](https://cursor.com/assets/images/open-in-web-dark.png"><source){kind=link}
![https://cursor.com/assets/images/open-in-web-light.png"><img](https://cursor.com/assets/images/open-in-web-light.png"><img){kind=link}
![https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a](https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a){kind=link}
![https://cursor.com/assets/images/open-in-cursor-dark.png"><source](https://cursor.com/assets/images/open-in-cursor-dark.png"><source){kind=link}
![https://cursor.com/assets/images/open-in-cursor-light.png"><img](https://cursor.com/assets/images/open-in-cursor-light.png"><img){kind=link}
![https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div](https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div){kind=link}
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clean lockfile regen on current
main: deletenode_modulesandpnpm-lock.yaml, thenpnpm installwith the pinnedpnpm@12.6.0binary (sopackageManagerDependenciesis recorded). Verified withpnpm install --frozen-lockfileandpnpm lint.A full re-resolve moves the Studio
nextoverrides from6.21.0-next.53to6.21.0-next.70.Policy exceptions so that install and lint succeed:
trustPolicyExcludefor the high-risk trust downgradespnpm installreported:lefthook@2.2.2(maintainer publish, no provenance; 2.2.0 and 2.2.1 had it),@vercel/oidc@3.8.10,@vercel/cli-config@0.3.1, and the@vercel/vc-native-*@60.1.3builds.@vercel/oidc@3.8.9is replaced by 3.8.10.tsdownstays on0.23.1.0.23.2depends onrolldown-plugin-dts@0.29.0-beta.2, which cannot emit declarations under TypeScript 7.oxlint-tsgolintstays on7.0.2003(whatmainalready lints with).7.0.2005reportstypescript/no-unsafe-type-assertionon theastoken, so existingoxlint-disable-next-linecomments no longer apply.The unused
i18next@26.4.4minimumReleaseAgeExcludeentry was pruned. Catalog ranges were not otherwise changed.