chore(deps): bump sanity-plugin-mux-input and next-sanity#461
Merged
Conversation
Clears the prismjs advisory chain without touching the Sanity major: prismjs -> refractor -> react-refractor -> @sanity/ui -> sanity-plugin-mux-input. Five moderate advisories, 20 -> 15 total. Both plugins declare peer support for the Sanity version already in use (mux-input peers sanity ^4 || ^5 || ^6, next-sanity peers ^5.29.0 || ^6.0.0), so no Studio migration is required for this change. mux-input v3 raised its floor to Studio v4 and @sanity/ui v3; we are on Studio 5, so that constraint is already met. next-sanity remains flagged after this, because its advisory is inherited from sanity itself, which needs the v6 major. Verified with npm run lint, npm run build and the full unit suite (285 passed). The Mux video input and Portable Text rendering are Studio UI surfaces that no automated test covers, so both need a click-through before merge.
The self-hosted Studio at /studio and next-sanity's live/preview were blocked by our Content-Security-Policy: connect-src had no Sanity API host, so Studio's getCurrentUser call to <project>.api.sanity.io failed at the network level, and script-src blocked the visual-editing bridge (core.sanity-cdn.com/bridge.js). This is a pre-existing gap -- connect-src never contained a Sanity host, so the embedded Studio only ever worked via the hosted mapped.sanity.studio. The bridge.js requirement is new with the next-sanity 13 upgrade in this branch, which is what surfaced it. Adds to connect-src: api.sanity.io + *.api.sanity.io (content + Studio auth), *.apicdn.sanity.io (useCdn queries), wss://*.api.sanity.io (live listeners), core.sanity-cdn.com (bridge). Adds core.sanity-cdn.com to script-src. Sanity image assets already pass via img-src https:.
Member
Author
|
Added a second commit (b4e544c) fixing the CSP that blocks the embedded |
The visual-editing bridge loads bridge.js from core.sanity-cdn.com but then fetches the Studio's module-federation code from the bare host (sanity-cdn.com/v1/modules/…), which core.sanity-cdn.com did not cover. Replace the single core.sanity-cdn.com entry with sanity-cdn.com plus *.sanity-cdn.com in both script-src and connect-src.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clears the prismjs advisory chain without touching the Sanity major:
prismjs → refractor → react-refractor → @sanity/ui → sanity-plugin-mux-input20 → 15 advisories (5 moderates cleared).
Why no Studio migration is needed
Both plugins declare peer support for the Sanity version already in use:
sanitysanity-plugin-mux-input^4 || ^5 || ^6next-sanity^5.29.0 || ^6.0.0mux-input v3 raised its floor to Studio v4 and
@sanity/uiv3 — we're on Studio 5, so that's already met. No code changes were required.next-sanityremains flagged after this: its advisory is inherited fromsanityitself, which needs the v6 major (see #459 — which turns out not to help).Verification
npm run lint— cleannpm run build— succeedsnpm test -- run tests/unit— 285 passed, 15 skippedNeeds a human before merge
No automated test covers the Studio UI. The Mux video input (
mp4_support: "standard") and Portable Text rendering on the marketing pages both need a click-through.🤖 Generated with Claude Code