fix: bump preferred-pm to v5 to resolve js-yaml prototype pollution

[ParakhJaggi]

Summary

Bumps preferred-pm from ^4.1.1 to ^5.0.0 in @sanity/cli to resolve the js-yaml prototype pollution vulnerability (moderate severity).

Dependency chain fix:

• preferred-pm@4 → which-pm@3 → load-yaml-file@0.2 → js-yaml@3.x (vulnerable)
• preferred-pm@5 → which-pm@4 → load-yaml-file@1.0 → js-yaml@4.x (safe)

Code change: The only breaking change in preferred-pm@5 is switching from a default export to a named export. Updated the import in packageManagerChoice.ts accordingly:

-// eslint-disable-next-line unicorn/no-named-default
-import {default as preferredPM} from 'preferred-pm'
+import {preferredPM} from 'preferred-pm'

The function signature is identical — (pkgPath: string) => Promise<{name: 'npm' | 'pnpm' | 'yarn' | 'bun', version: string} | null>.

Related: sanity-io/sanity#11151

Test plan

• pnpm build:cli passes
• pnpm check:types passes
• Lint-staged hooks pass on commit
• CI tests pass

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​preferred-pm@​5.0.0

View full report

[rexxars]

Thanks!