Skip to content

Conversation

@rcmaples
Copy link
Contributor

@rcmaples rcmaples commented Sep 18, 2025

Description

This PR addresses issue #283 by replacing git-user-info and updates Sanity to version 4.9.0.

Changes introduced:

  • Replace vulnerable git-user-info dependency with native Node.js execSync git commands
  • Upgraded sanity to v4.9.0 which required upgrading TypeScript to v5.8.3
  • Upgraded @typescript-eslint from v7.18.0 to v8.26.0 for TypeScript v5.8.3 support
  • Migrate ESLint configuration from legacy .eslintrc.js to modern flat config format
  • Fix test expectations to include tsconfig.tsbuildinfo in build output

Why these changes:

  • Eliminates parse-git-config security vulnerability (parse-git-config issue 14)
  • Brings plugin-kit up to date with other sanity packages (pkg-utils, ui, etc...)

Note: There are still a couple of npm audit warnings due to Tap's bundled dependencies. It looked like there were quite a bit of breaking changes that would need to be addressed to upgrade Tap v16 to versions 18 - 22.

What to review

Key areas to review:

  • src/util/user.ts - New native git config implementation replacing git-user-info
  • eslint.config.mjs - New flat config format with project service enabled
  • package.json - Dependency version updates
  • test/init-verify-build.test.ts - Updated expected build output files

Testing flows:

  • Run npm audit to verify vulnerability resolution
  • Run npm run lint to confirm no TypeScript version warnings
  • Test git user info functionality (plugin initialization with author detection)
  • Verify all existing tests pass

Testing

Automated testing:

  • All existing tests pass including the updated build output expectations
  • ESLint runs successfully on entire codebase without warnings
  • Build process completes without errors

Manual verification:

  • Confirmed npm audit no longer shows parse-git-config vulnerability
  • Verified git user detection works with native implementation
  • Tested lint-staged pre-commit hooks function correctly

No additional automated tests were added as existing test coverage validates the functionality and the changes maintain backward compatibility.

…config

  Resolves TypeScript 5.8.3 compatibility warning by upgrading from v7.18.0.
  Migrates ESLint configuration from legacy .eslintrc.js to modern flat config format.
  Implements project service for improved performance and TypeScript integration.
@rcmaples rcmaples requested a review from a team as a code owner September 18, 2025 22:22
@rcmaples rcmaples changed the title fix(deps): replace git-user-info; upgrade Sanity and TypeScript chore(deps): replace git-user-info; upgrade Sanity and TypeScript Sep 18, 2025
@socket-security
Copy link

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
npm@10.9.3 has Obfuscated code.

Confidence: 0.94

Location: Package overview

From: package-lock.jsonnpm/@sanity/semantic-release-preset@5.0.0npm/npm@10.9.3

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/npm@10.9.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Copy link
Member

@stipsan stipsan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you!

@stipsan stipsan merged commit 0955c03 into sanity-io:main Oct 17, 2025
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants