feat(media): move sanity-plugin-media to the plugins monorepo by stipsan · Pull Request #978 · sanity-io/plugins

stipsan · 2026-06-12T12:57:24Z

Moves sanity-plugin-media (v4.3.1) into the monorepo via git subtree add (full history preserved). Move-only, non-breaking: the goal of this PR is to relocate the plugin and ship a patch release (4.3.2) to verify it publishes from this repo. Bringing the code up to monorepo standards happens in follow-up PRs.

Demo

Manually verified in the test studio (kitchen-sink workspace): Media tool, asset metadata dialog, and the mediaField image picker with mediaTags pre-filtering, asset selection and auto-tagging.

media_plugin_demo_tool_and_asset_source.mp4

Image field picker pre-filtered by the product tag

What changed

Imported the full repo history via git subtree add (no generator, per maintainer direction)
Deleted standalone-repo tooling (.github/, eslint/prettier/husky/commitlint/semantic-release configs, LICENSE, package-lock.json); kept src/, README.md, CHANGELOG.md, the original tsconfigs/vitest configs, sanity.json + v2-incompatible.js (published files), scripts/migrate-to-localized-fields.ts (referenced by the README), and sanity.config.ts (reference for the test-studio setup)
Extended the root .gitignore with the entries only the plugin's gitignore covered (.vscode, .idea/*.iml, .yalc) before removing the plugin-level file
package.json: kept the original build toolchain (@sanity/pkg-utils@^7 + @sanity/plugin-kit, dual CJS/ESM output) and left dependencies, peerDependencies, engines, and files unchanged; only repository/homepage/bugs metadata, scripts (build, watch, prepack), and devDependencies changed (catalog: where available)
Verified package parity against the published 4.3.1 tarball: file lists are identical; manifest diffs are limited to metadata/scripts/devDependencies
Minimal dev-environment fixes (no behavior change):
- phantom is-hotkey import switched to the declared is-hotkey-esm dependency (previously worked only via npm hoisting)
- removed a @ts-expect-error that is unused against current Sanity types
- disabled exactOptionalPropertyTypes (fresh dependency resolution surfaces violations the old standalone lockfile masked; type-check only)
- root packageExtensions for @hookform/resolvers so its types resolve the dependent's zod v3 instead of the hidden-hoisted zod v4
- vitest config: replaced the removed Vite esbuild option with its Vite 8 oxc equivalent (all 37 test files / 149 tests pass under the root vitest)
Excluded the plugin from oxlint and knip (oxfmt-only for now); formatted with oxfmt
Added a mediaExample (kitchen-sink workspace) modeled on the plugin's standalone dev studio config, exercising media() and mediaField with image + file fields
Added the plugin to the root README.md table and a patch changeset

Transfer verification

Trusted publishing configured: npm trust github sanity-plugin-media --file=release.yml --repository=sanity-io/plugins
package.json dependencies/peerDependencies/exports/engines/files verified unchanged against the published 4.3.1 package
Test studio example wired and manually verified (pnpm dev, see demo video)
pnpm format, pnpm knip, pnpm lint, pnpm build, pnpm test run all pass
Patch changeset added (move-only release to verify publishing from this repo)

Follow-up PRs (intentionally out of scope here)

Re-enable oxlint/knip for plugins/sanity-plugin-media and fix legacy lint/type issues (React Compiler rules, type-aware rules, re-enable exactOptionalPropertyTypes)
Align build toolchain with monorepo standards (@repo/package.config, @sanity/pkg-utils v10, React Compiler, ESM-only) as a major release
Move @sanity/plugin-kit into the repo (then drop the plugin-local devDependency)
Remove the reference sanity.config.ts from the plugin workspace once no longer needed

Maintainer follow-up

Update the original repo README (https://github.com/sanity-io/sanity-plugin-media/blob/main/README.md) and replace it with: # [This plugin has moved](https://github.com/sanity-io/plugins/tree/main/plugins/sanity-plugin-media)
Transfer pending issues from the original repo to this monorepo and label them as media
Archive the original repo: https://github.com/sanity-io/sanity-plugin-media/settings

_{To show artifacts inline, enable in settings.}

…ent z-index clashing

…uploads with native inputs

… dedicated selected reducer

Correction of typos

Hey Robin 👋 `@sanity/base` is using `@sanity/ui: ^0.33.6`, which forces package managers to download two versions of the library when this plugin is installed. This is making studios throw an error `Cannot read property 'sanity' of undefined`. For more context, see sanity-io/sanity#2190 I'd suggest moving `@sanity/ui` and `styled-components` into `peerDependencies` as those are shipped with Sanity studio. This will make your plugin more resilient in the long run :)

…t with scoped provider

…e component

…#267) Co-authored-by: Cody Olsen <81981+stipsan@users.noreply.github.com>

* fix: allow sanity v5 as peer dependency * fix(types): match client version, allow only image/file types - not video

…utils (#290) * chore: setup vitest and test the main plugin actions, components and utils * fix: lint issues * fix: copilot pr comments * fix: add generic error payload for notifications

* feat: add localization support to media plugin configuration and components You can now enable localization support by passing a `locales` array to the plugin config

Adds the ability to automatically tag assets when they are uploaded through image field. This helps keep the media library organized without relying on users to manually tag assets. When opening the Media Browser from a field with mediaTags configured, the browser now automatically filters to show only assets that have those tags, making it easier to find relevant assets. --------- Co-authored-by: pedrobonamin <pedrobonamin@gmail.com>

…ddeb42718af90f382b8' git-subtree-dir: plugins/sanity-plugin-media git-subtree-mainline: 4226408 git-subtree-split: 5dc844b

…itignore

@ts-expect-error

- point repository/homepage/bugs metadata at sanity-io/plugins - trim standalone-repo scripts and devDependencies; use catalog: where available - keep pkg-utils v7 + plugin-kit build toolchain, dual CJS/ESM output, dependencies, peerDependencies, engines and files unchanged - disable plugin-kit eslint/scripts checks that no longer apply in the monorepo - disable exactOptionalPropertyTypes (fresh dep resolution surfaces violations the old standalone lockfile masked; type-check only) - fix phantom 'is-hotkey' import to use the declared is-hotkey-esm dependency - remove @ts-expect-error that is unused against current sanity types - add zod packageExtension so @hookform/resolvers types resolve the dependent's zod v3 instead of the hidden-hoisted zod v4

…est 4 config - oxlint and knip exclusion is temporary until the legacy code is brought up to monorepo standards in a follow-up PR - replace the removed Vite 'esbuild' option with its Vite 8 'oxc' equivalent so JSX in component tests transforms again (all 149 tests pass)

…angeset

changeset-bot · 2026-06-12T12:57:28Z

🦋 Changeset detected

Latest commit: a2e7ee4

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
sanity-plugin-media	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

vercel · 2026-06-12T12:57:30Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
plugins-studio	Ready	Preview, Comment	Jun 12, 2026 3:12pm

socket-security · 2026-06-12T12:58:37Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/jsdom@25.0.1
	npm/redux-observable@3.0.0-rc.2
	npm/pluralize@8.0.0
	npm/react-file-icon@1.6.0
	npm/groq@3.99.0
	npm/@types/pluralize@0.0.33
	npm/@sanity/incompatible-plugin@1.0.5
	npm/@sanity/plugin-kit@4.0.20
	npm/react-dropzone@11.7.1
	npm/react-select@5.10.2
	npm/@tanem/react-nprogress@5.0.63
	npm/copy-to-clipboard@3.3.3
	npm/@types/react-file-icon@1.0.5
	npm/@testing-library/user-event@14.6.1
	npm/@hookform/resolvers@3.10.0
	npm/react-virtuoso@4.18.7
	npm/filesize@9.0.11
	npm/typescript@5.8.2
	npm/@reduxjs/toolkit@2.12.0
	npm/zod@3.25.76
	npm/react-hook-form@7.78.0
	npm/@sanity/pkg-utils@7.11.9

View full report

socket-security · 2026-06-12T12:58:39Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `get-it` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/@sanity/plugin-kit@4.0.20` → `npm/get-it@8.6.3` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/get-it@8.6.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `immer` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/@reduxjs/toolkit@2.12.0` → `npm/sanity@6.0.0` → `npm/immer@11.1.8` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/immer@11.1.8`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `rrweb-cssom` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/jsdom@25.0.1` → `npm/rrweb-cssom@0.7.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/rrweb-cssom@0.7.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `typescript` License: LicenseRef-W3C-Community-Final-Specification-Agreement - The applicable license policy does not permit this license (5) (package/ThirdPartyNoticeText.txt) From: plugins/sanity-plugin-media/package.json → `npm/typescript@5.8.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/typescript@5.8.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

…-plugin-media-7523 # Conflicts: # pnpm-lock.yaml

robinpyon and others added 30 commits February 24, 2021 12:04

docs: update readme

a66d558

fix: revert to wrapping select browser inside a custom portal to prev…

14462ab

…ent z-index clashing

fix: prevent dnd propagation in select context to prevent accidental …

6fe2297

…uploads with native inputs

chore(release): 1.1.1

b19ac1c

fix: re-add ability to display all assets in current document, create…

e89702d

… dedicated selected reducer

chore(release): 1.1.2

fad63dd

Corrections of typos

16b4535

Merge pull request #27 from Hahlh/patch-1

2426ee1

Correction of typos

Merge branch 'hdoro-patch-1'

1da01a1

refactor: remove unused type packages

b68d865

fix: move sanity-ui and styled-components into peer deps

6c51ba3

chore(release): 1.1.3

416f855

revert: move sanity-ui and styled-components back into main deps

b010852

chore(release): 1.1.4

2d4639c

chore(deps): upgrade @sanity/client dev dependency

b8ee6b3

refactor: use type-only imports from @sanity/client

e1d3d7f

feat: use API-versioned client if available

c953d1e

chore(deps): remove @sanity/client from peer dependencies

c1fed1f

Merge branch 'rexxars-feat/client-versioning'

880a795

chore(release): 1.2.0

0340b6e

chore: bump sanity/ui

5100ef9

chore(release): 1.2.1

7ca1b63

fix: fix portal container positioning: use @sanity/ui portal componen…

ea0cb07

…t with scoped provider

chore(release): 1.2.2

9dae9f5

docs: update README

2c37ce5

feat: add “Copy URL” button to asset metadata actions

4cf25cc

feat: wrap copy URL button with a timed popover and move to a separat…

4eb579e

…e component

chore(release): 1.3.0

4e21681

chore: bump framer-motion to v4

916d736

Shastel and others added 21 commits December 4, 2025 15:54

feat: allow 'directUploads' option on the tool (#266)

aabaf2c

feat: create ability to define a custom compoenent to present details (…

d334712

…#267) Co-authored-by: Cody Olsen <81981+stipsan@users.noreply.github.com>

chore(release): 4.1.0 [skip ci]

1380680

fix: allow sanity v5 as peer dependency (#270)

be3d114

* fix: allow sanity v5 as peer dependency * fix(types): match client version, allow only image/file types - not video

chore(release): 4.1.1 [skip ci]

b0bc508

Update useVersionedClient.ts (#288)

ecdebff

chore: setup vitest and test the main plugin actions, components and …

b5c444f

…utils (#290) * chore: setup vitest and test the main plugin actions, components and utils * fix: lint issues * fix: copilot pr comments * fix: add generic error payload for notifications

feat: localized asset fields options (#271)

17c46fe

* feat: add localization support to media plugin configuration and components You can now enable localization support by passing a `locales` array to the plugin config

chore(release): 4.2.0 [skip ci]

2265f41

chore(release): 4.3.0 [skip ci]

77e7aab

chore(deps): add support for sanity v6 prerelease versions (#295)

4239b26

fix(deps): add support for sanity v6 prerelease versions (#297)

dcd94e6

chore(release): 4.3.1 [skip ci]

5dc844b

Add 'plugins/sanity-plugin-media/' from commit '5dc844b78ea336e4e0658…

752d006

…ddeb42718af90f382b8' git-subtree-dir: plugins/sanity-plugin-media git-subtree-mainline: 4226408 git-subtree-split: 5dc844b

chore(media): remove standalone-repo tooling files and extend root .g…

aa656cb

…itignore

feat(test-studio): add media plugin example to kitchen-sink workspace

d00b9ae

docs(media): fix changelog header, add to plugins table, add patch ch…

72976d5

…angeset

style(media): format with oxfmt

0ba0053

stipsan added the 🤖 bot label Jun 12, 2026 — with Cursor

Merge remote-tracking branch 'origin/main' into cursor/migrate-sanity…

4916083

…-plugin-media-7523 # Conflicts: # pnpm-lock.yaml

vercel Bot deployed to Preview June 12, 2026 14:53 View deployment

Merge remote-tracking branch 'origin/main' into cursor/migrate-sanity…

a2e7ee4

…-plugin-media-7523 # Conflicts: # pnpm-lock.yaml

vercel Bot deployed to Preview June 12, 2026 15:12 View deployment

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(media): move sanity-plugin-media to the plugins monorepo#978

feat(media): move sanity-plugin-media to the plugins monorepo#978
stipsan wants to merge 536 commits into
mainfrom
cursor/migrate-sanity-plugin-media-7523

stipsan commented Jun 12, 2026 •

edited by cursor Bot

Loading

Uh oh!

changeset-bot Bot commented Jun 12, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Jun 12, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jun 12, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jun 12, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

Conversation

stipsan commented Jun 12, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Demo

What changed

Transfer verification

Follow-up PRs (intentionally out of scope here)

Maintainer follow-up

Uh oh!

changeset-bot Bot commented Jun 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

vercel Bot commented Jun 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jun 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jun 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

stipsan commented Jun 12, 2026 •

edited by cursor Bot

Loading

changeset-bot Bot commented Jun 12, 2026 •

edited

Loading

vercel Bot commented Jun 12, 2026 •

edited

Loading

socket-security Bot commented Jun 12, 2026 •

edited

Loading

socket-security Bot commented Jun 12, 2026 •

edited

Loading