chore: update @sanity/codegen to ^6.1.0

[Copilot]

Description

Updates @sanity/codegen from ^6.0.3 to ^6.1.0 in the pnpm catalog (pnpm-workspace.yaml), picking up the latest minor version.

What to review

• Version bump in pnpm-workspace.yaml catalog entry
• Updated pnpm-lock.yaml
• Changeset added for @sanity/cli (patch)

Testing

• Type checking passes (pnpm check:types)
• Build succeeds (pnpm build:cli)
• No test failures on changed packages

---

Note

Low Risk
Low risk dependency bump limited to workspace catalog/lockfile updates; potential impact is limited to codegen/CLI build behavior if the new minor release changes generation output.

Overview
Updates the workspace @sanity/codegen dependency from ^6.0.3 to ^6.1.0 and refreshes pnpm-lock.yaml accordingly (including the new optional oxfmt peer/optional dependency).

Adds a changeset to publish a patch release of @sanity/cli for the dependency update.

^{Reviewed by Cursor Bugbot for commit fb1e45e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

📦 Bundle Stats — @sanity/cli

Compared against main (6daa7533)

@sanity/cli

Metric	Value	vs main (6daa753)
Internal (raw)	2.1 KB	-
Internal (gzip)	799 B	-
Bundled (raw)	10.97 MB	-
Bundled (gzip)	2.06 MB	-
Import time	844ms	+4ms, +0.5%

bin:sanity

Metric	Value	vs main (6daa753)
Internal (raw)	1023 B	-
Internal (gzip)	486 B	-
Bundled (raw)	9.84 MB	-
Bundled (gzip)	1.77 MB	-
Import time	2.02s	+42ms, +2.1%

🗺️ View treemap · Artifacts

Details

• Import time regressions over 10% are flagged with ⚠️
• Sizes shown as raw / gzip 🗜️. Internal bytes = own code only. Total bytes = with all dependencies. Import time = Node.js cold-start median.

📦 Bundle Stats — @sanity/cli-core

Compared against main (6daa7533)

Metric	Value	vs main (6daa753)
Internal (raw)	95.5 KB	-
Internal (gzip)	22.5 KB	-
Bundled (raw)	21.61 MB	-
Bundled (gzip)	3.42 MB	-
Import time	817ms	-1ms, -0.2%

🗺️ View treemap · Artifacts

Details

• Import time regressions over 10% are flagged with ⚠️
• Sizes shown as raw / gzip 🗜️. Internal bytes = own code only. Total bytes = with all dependencies. Import time = Node.js cold-start median.

📦 Bundle Stats — create-sanity

Compared against main (6daa7533)

Metric	Value	vs main (6daa753)
Internal (raw)	976 B	-
Internal (gzip)	507 B	-
Bundled (raw)	50.7 KB	-
Bundled (gzip)	12.6 KB	-
Import time	❌ ChildProcess denied: node	-

Details

• Import time regressions over 10% are flagged with ⚠️
• Sizes shown as raw / gzip 🗜️. Internal bytes = own code only. Total bytes = with all dependencies. Import time = Node.js cold-start median.

[github-actions]

Coverage Delta

No covered files changed in this PR.

Overall Coverage

Metric	Coverage
Statements	84.3% (±0%)
Branches	74.3% (±0%)
Functions	84.2% (±0%)
Lines	84.8% (±0%)

[stipsan]

@copilot look at the failed checks, can you fix?

[Copilot]

@copilot look at the failed checks, can you fix?

Both failures were on run_attempt: 2 (manual rerun), which sets TURBO_FORCE=true and bypasses turbo cache. This causes a pre-existing race condition in the publint step where build (using --delete-dir-on-start) wipes dist/ before build:types regenerates .d.ts files. The test failure was a flaky Windows worker crash — all 714 tests passed.

Pushed 4762bfc to trigger a fresh CI run (attempt 1, with working turbo cache).

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/repos/sanity-io/cli/actions/runs/25546381959/attempts/1
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node /home/REDACTED/work/_temp/ghcca-node/node/bin/node --enable-source-maps /home/REDACTED/work/_temp/copilot-developer-action-main/dist/index.js (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[claude]

Claude finished @runeb's task in 58s —— View job

---

Review

No blocking issues.

• Version bump in pnpm-workspace.yaml matches the bump in pnpm-lock.yaml (^6.0.3 → ^6.1.0, resolved 6.1.0).
• Lockfile correctly picks up the new optional oxfmt peer (peerDependenciesMeta.oxfmt.optional: true), so installs without oxfmt remain unaffected.
• Changeset is present, patch bump for @sanity/cli is appropriate (transitive build-time minor with no CLI surface change), and the wording matches the repo's existing renovate-style dep-bump changesets (e.g. .changeset/pr-1059.md).
• packages/@sanity/cli/package.json:80 correctly consumes the catalog version — no other consumers in packages/.

Notes (non-blocking)

• Per product copy guidance, dep-bump changesets ideally describe user-visible impact, but the current "from X to Y" phrasing is consistent with prior changesets in this repo, so changing it here would be inconsistent with house style.

• The failed checks were diagnosed by the PR author as flaky / unrelated (turbo TURBO_FORCE=true rerun race in publint + Windows worker crash), with a no-op commit pushed to retrigger CI — that explanation is plausible and not something this PR can fix.

• Read changed files

• Verify changeset

• Check version bump in pnpm-workspace.yaml

• Check pnpm-lock.yaml changes

• Post review
  · Branch

[runeb]

Merging in main to see if this helps the checks