chore(deps): upgrade Sanity Studio from 5 to 6 (does not improve security)

[joaquimds]

Draft: this upgrade does not improve security. It makes the audit worse. Opening it because the work is done and verified, so you can decide on currency grounds and click-test the Studio.

The rationale for this upgrade turned out to be wrong

The reason to go to Sanity 6 was the high-severity adm-zip chain — adm-zip → @sanity/runtime-cli → @sanity/cli → sanity — which genuinely cannot be fixed on Sanity 5. 5.31.1 is the last 5.x release and pins @sanity/cli ^6.7.2, while the fix requires @sanity/cli 7.x.

Sanity 6 does pull @sanity/cli@7.12.1, and it does fix that path — @sanity/runtime-cli now uses adm-zip@0.6.0.

But it also introduces two new dependency subtrees, @sanity/workbench-cli and @vercel/frameworks, which bring:

• a different vulnerable adm-zip@0.5.10, via @module-federation/dts-plugin
• a vulnerable js-yaml

Measured on this branch: 15 → 20 advisories (high 8 → 11). The upgrade trades one vulnerable transitive path for two new ones. All of them are CLI/build-time tooling rather than request-path code, on both sides of the comparison.

Code changes required

Two, both small:

• @sanity/image-url v2 removed the deep lib/types/types entry point; SanityImageSource now comes from the package root.
• @sanity/icons v5 moved individual icons to subpath exports — the root entry only exports Icon and the icons map, so PlayIcon now comes from @sanity/icons/Play. Worth knowing: its root .d.ts still declares the individual icons, so tsc --noEmit passed and only the Turbopack build caught this. A typecheck-only CI gate would have shipped a broken build.

Verification

• npm run lint — clean
• npm run build — succeeds
• npm test -- run tests/unit — 285 passed, 15 skipped

What still needs a human

Nothing automated covers the Studio UI. Before this could merge, /studio needs a click-through of:

• Portable Text editing (@portabletext/editor v7) — the blockContent schema
• Mux video input — the mp4_support: "standard" option
• React strict mode, now on by default in the Studio, which double-renders and can surface latent effect bugs in the custom structure and the feature-child template

Recommendation

Merge #458 (Chain A) — that one clears 5 moderate advisories with no migration. Hold this one unless you want Sanity 6 for support/feature reasons, in which case the branch is ready and verified.

🤖 Generated with Claude Code

[joaquimds]

Closing per maintainer decision. This upgrade increases the audit count (15 → 20, highs 8 → 11) by pulling in @sanity/workbench-cli and @vercel/frameworks, which bring a different vulnerable adm-zip and a vulnerable js-yaml. It fixes the original adm-zip chain but nets negative, so it is not worth merging as a security change. The branch chore/sanity-6 and its analysis remain available if a Sanity 6 upgrade is wanted later for support/feature reasons.