fix(deps): update dependency jsdom to v30 by stipsan · Pull Request #1771 · sanity-io/plugins

stipsan · 2026-07-28T12:34:21Z

Bumps the shared pnpm catalog entry for jsdom from ^29.1.1 to ^30.0.0.

Why a patch?

jsdom 30’s new getComputedStyle() pixel conversion crashes when resolving percentage-based calc() values (e.g. width: calc(100% - 10px)). resolveCalc() leaves those unresolved, then FONT_SIZE_REGEXP.exec(...) returns null and the destructuring throws:

TypeError: object null is not iterable

That path is hit by Testing Library / dom-accessibility-api during queries, which broke several plugin test suites on Renovate’s #1767.

This PR adds patches/jsdom@30.0.0.patch so unresolved calc results fall through instead of crashing. Can be removed once upstream ships a fix.

Packages

DevDependency bump via catalog for:

@sanity/block-insert-picker
@sanity/document-internationalization
@sanity/language-filter
@sanity/presets
@sanity/studio-secrets
sanity-naive-html-serializer
sanity-plugin-internationalized-array
sanity-plugin-media

Note: jsdom 30 requires Node ^22.22.2 || ^24.15.0 || >=26.0.0.

Bump the shared catalog entry to ^30.0.0 and patch jsdom so getComputedStyle no longer crashes when percentage-based calc() values cannot be resolved to pixels (triggered by Testing Library a11y queries).

changeset-bot · 2026-07-28T12:34:27Z

🦋 Changeset detected

Latest commit: a629d70

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 17 packages

Name	Type
@sanity/block-insert-picker	Patch
@sanity/document-internationalization	Patch
sanity-plugin-internationalized-array	Patch
@sanity/language-filter	Patch
sanity-plugin-media	Patch
sanity-naive-html-serializer	Patch
@sanity/presets	Patch
@sanity/studio-secrets	Patch
@sanity/sfcc	Patch
sanity-translations-tab	Patch
sanity-plugin-cloudinary	Patch
@sanity/cross-dataset-duplicator	Patch
@sanity/personalization-plugin	Patch
@sanity/sanity-plugin-async-list	Patch
sanity-plugin-studio-smartling	Patch
sanity-plugin-transifex	Patch
@sanity/form-toolkit	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

vercel · 2026-07-28T12:34:28Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
plugins-studio	Ready	Preview, Comment	Jul 28, 2026 12:34pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
plugins-e2e-test-studio	Ignored		Jul 28, 2026 12:34pm

socket-security · 2026-07-28T12:34:34Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/jsdom@30.0.0

View full report

socket-security · 2026-07-28T12:34:36Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `jsdom` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: plugins/@sanity/block-insert-picker/package.json → `npm/jsdom@30.0.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/jsdom@30.0.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `jsdom` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: plugins/@sanity/block-insert-picker/package.json → `npm/jsdom@30.0.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/jsdom@30.0.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

github-actions · 2026-07-28T12:35:14Z

✅ E2E Tests

🟢 12 passed • view full report • view run

Studio: https://plugins-e2e-test-studio-740stii6m.sanity.dev

Datasets: pr-1771-chromium-30359540918, pr-1771-firefox-30359540918

github-actions · 2026-07-28T12:37:52Z

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	30.34%	4835 / 15931
🔵	Statements	30.06%	5089 / 16925
🔵	Functions	25.7%	1228 / 4778
🔵	Branches	21.46%	2398 / 11171

File Coverage

No changed files found.

Generated in workflow #8244 for commit a629d70 by the Vitest Coverage Report Action

fix(deps): update dependency jsdom to v30

a629d70

Bump the shared catalog entry to ^30.0.0 and patch jsdom so getComputedStyle no longer crashes when percentage-based calc() values cannot be resolved to pixels (triggered by Testing Library a11y queries).

vercel Bot deployed to Preview – plugins-studio July 28, 2026 12:34 View deployment

stipsan added the 🤖 bot label Jul 28, 2026 — with Cursor

stipsan closed this Jul 28, 2026

Navigation Menu

Uh oh!

fix(deps): update dependency jsdom to v30 - #1771

fix(deps): update dependency jsdom to v30#1771
stipsan wants to merge 1 commit into
mainfrom
cursor/update-jsdom-v30-0364

stipsan commented Jul 28, 2026

Uh oh!

changeset-bot Bot commented Jul 28, 2026

Uh oh!

vercel Bot commented Jul 28, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jul 28, 2026

Uh oh!

socket-security Bot commented Jul 28, 2026

Uh oh!

github-actions Bot commented Jul 28, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

stipsan commented Jul 28, 2026

Why a patch?

Packages

Uh oh!

changeset-bot Bot commented Jul 28, 2026

🦋 Changeset detected

Uh oh!

vercel Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jul 28, 2026

Uh oh!

socket-security Bot commented Jul 28, 2026

Uh oh!

github-actions Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ E2E Tests

Uh oh!

github-actions Bot commented Jul 28, 2026

Coverage Report

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

vercel Bot commented Jul 28, 2026 •

edited

Loading

github-actions Bot commented Jul 28, 2026 •

edited

Loading