Gathering detailed insights and metrics for @sanity/observable
Gathering detailed insights and metrics for @sanity/observable
Sanity Studio – Rapidly configure content workspaces powered by structured content
Installations
npm install @sanity/observableDeveloper Guide
BETA
Typescript
Yes
Module System
CommonJS
Node Version
12.18.3
NPM Version
lerna/3.22.1/node@v12.18.3+x64 (darwin)
Releases
588
Languages
5
TypeScript
JavaScript
HTML
CSS
Astro
TypeScript (96.99%)
JavaScript (2.96%)
HTML (0.03%)
CSS (0.02%)
Developer
Download Statistics
Total Downloads
0
Last Day
0
Last Week
0
Last Month
0
Last Year
0
GitHub Statistics
MIT License
5,735 Stars
18,880 Commits
482 Forks
84 Watchers
952 Branches
153 Contributors
Updated on Jul 17, 2025
Maintainers
22
Package Meta Information
Latest Version
2.0.9
Package Id
@sanity/observable@2.0.9
Unpacked Size
7.80 kB
Size
3.48 kB
File Count
12
NPM Version
lerna/3.22.1/node@v12.18.3+x64 (darwin)
Node Version
12.18.3
Total Downloads
Cumulative downloads
Total Downloads
NaN
Last Day
0%
NaN
Compared to previous day
Last Week
0%
NaN
Compared to previous week
Last Month
0%
NaN
Compared to previous month
Last Year
0%
NaN
Compared to previous year
Weekly Downloads
Monthly Downloads
Yearly Downloads
Dependencies
2
Dev Dependencies
5
Build powerful production-ready content workspaces
The Sanity Composable Content Cloud lets teams create remarkable digital experiences at scale. Sanity Studio is an open-source, single-page application that is fast to set up and quick to configure. The Studio comes with a complete studio customization framework that lets you tailor the workspace as your needs grow.
Sanity hosts your content in a real-time, hosted data store called Content Lake. Get started with the free plan with generous bandwidth and hosting included and pay-as-you-go for overages.
Quickstart
Initiate a new project by running the following command:
1npm create sanity@latest 2 3# With other package managers: 4yarn create sanity@latest 5pnpm create sanity@latest
Go here for a step-by-step guide on how to get up and running.
Check out the docs and plugins and start building.
Key Features
Sanity Studio
Sanity Studio is an open-source real-time CMS, that you can customize with JavaScript and React.
- Efficient editing, instant UI for complex fields
- Responsive, works on narrow screens
- Plug-in architecture and custom components
- Style with your own branding
- Advanced block editor for structured content
- Use JavaScript to add field validations, organize documents, and set initial values
Developer experience
- Bring your own frontend, or whatever else you might need.
- Sweet APIs for reading, writing, importing, exporting, go back in time, and listening for updates.
- Secure, scalable and GDPR compliant.
- Zero config Graph Oriented Query Language (GROQ), and GraphQL API.
- Helpful and friendly developer community.
Structured Content
- Distribute from a single source of truth, in real-time.
- Unlock programmatic approaches to workflows and design.
- Upload images and transform them on demand.
- Query images for metadata like dominant colors, sizes, geo-location, and EXIF metadata.
- Rich text that can be serialized into any markup language.
Stay up to date
- Follow us on X
- Follow us on Bluesky
- Subscribe to our YouTube channel
- Subscribe to our blog by RSS
- Subscribe to our newsletter
- Join the Sanity community
Code of Conduct
We aim to be an inclusive, welcoming community for everyone. To make that explicit, we have a code of conduct that applies to communication around the project.
Want to contribute?
Found a bug, or want to contribute code? Pull requests and issues are most welcome. Read our contributing guidelines to learn how.
Help Improve Sanity Studio translations
We're always looking to make Sanity Studio more accessible and user-friendly, and your contributions can make a big difference. Whether you're a seasoned developer or just starting out, helping with translations is a fantastic way to get involved.
If you're fluent in a language other than English, we'd love your help in reviewing and improving translations. Your expertise can greatly enhance the experience for users worldwide.
How to Contribute:
- Visit our sanity-io/locales repository and try out a locale you are fluent in.
- Have ideas for improvements? Submit a PR following the contributing guide.
- See if there are open PRs in languages you are fluent in and help review them.
Interested in playing a bigger role? You can ask to be added as a maintainer to oversee translations for specific languages, where you will be automatically added as a reviewer on PRs that involve your language. See the sanity-io/locales README for more.
Your contributions not only improve Sanity Studio but also bring together a diverse and global community of users. We appreciate every effort, big or small, and we can't wait to see what you bring to the table!
License
Sanity Studio is available under the MIT License
No vulnerabilities found.
Reason
all changesets reviewed
Reason
30 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: MIT License: LICENSE:0
Reason
no binaries found in the repo
Reason
security policy file detected
Details
- Info: security policy file detected: github.com/sanity-io/.github/SECURITY.md:1
- Info: Found linked content: github.com/sanity-io/.github/SECURITY.md:1
- Info: Found disclosure, vulnerability, and/or timelines in security policy: github.com/sanity-io/.github/SECURITY.md:1
- Info: Found text in security policy: github.com/sanity-io/.github/SECURITY.md:1
Reason
branch protection is not maximal on development and all release branches
Details
- Info: 'allow deletion' disabled on branch 'main'
- Info: 'force pushes' disabled on branch 'main'
- Warn: 'branch protection settings apply to administrators' is disabled on branch 'main'
- Info: 'stale review dismissal' is required to merge on branch 'main'
- Warn: required approving review count is 1 on branch 'main'
- Warn: codeowners review is not required on branch 'main'
- Info: 'last push approval' is required to merge on branch 'main'
- Warn: 'up-to-date branches' is disabled on branch 'main'
- Info: status check found to merge onto on branch 'main'
- Info: PRs are required in order to make changes on branch 'main'
Reason
dependency not pinned by hash detected -- score normalized to 2
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/cli-test.yml:49: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/cli-test.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/cli-test.yml:85: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/cli-test.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/cli-test.yml:87: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/cli-test.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/create-release-pr.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/create-release-pr.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/create-release-pr.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/create-release-pr.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/create-release-pr.yml:32: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/create-release-pr.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/create-release-pr.yml:37: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/create-release-pr.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/depCheck.yml:10: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/depCheck.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/depCheck.yml:11: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/depCheck.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/depCheck.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/depCheck.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docReport.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/docReport.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/docReport.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/docReport.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docReport.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/docReport.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e-ct.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e-ct.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/e2e-ct.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e-ct.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e-ct.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e-ct.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e-ct.yml:50: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e-ct.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/e2e-ct.yml:51: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e-ct.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e-ct.yml:52: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e-ct.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e-ct.yml:68: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e-ct.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e-ct.yml:88: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e-ct.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e-ct.yml:100: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e-ct.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/e2e-ct.yml:101: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e-ct.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e-ct.yml:102: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e-ct.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e-ct.yml:111: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e-ct.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e-ct.yml:120: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e-ct.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e-ui.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e-ui.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/e2e-ui.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e-ui.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e-ui.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e-ui.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e-ui.yml:35: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e-ui.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e-ui.yml:51: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e-ui.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/e2e-ui.yml:54: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e-ui.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e-ui.yml:55: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e-ui.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e-ui.yml:60: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e-ui.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e-ui.yml:85: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e-ui.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/e2e-ui.yml:88: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e-ui.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e-ui.yml:89: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e-ui.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e-ui.yml:93: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e-ui.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e-ui.yml:111: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e-ui.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e-ui.yml:154: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e-ui.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/e2e-ui.yml:157: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e-ui.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e-ui.yml:158: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e-ui.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e-ui.yml:162: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e-ui.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e-ui.yml:179: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e-ui.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e-ui.yml:206: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e-ui.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e-ui.yml:218: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e-ui.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/e2e-ui.yml:221: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e-ui.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e-ui.yml:222: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e-ui.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e-ui.yml:231: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e-ui.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e-ui.yml:241: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e-ui.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e.yml:323: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/e2e.yml:324: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e.yml:325: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e.yml:334: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e.yml:345: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/e2e.yml:35: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e.yml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e.yml:73: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e.yml:90: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/e2e.yml:91: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e.yml:92: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e.yml:137: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/e2e.yml:138: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e.yml:139: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e.yml:251: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/e2e.yml:252: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e.yml:253: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e.yml:271: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e.yml:309: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/e2e.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/efps.yml:42: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/efps.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/efps.yml:43: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/efps.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/efps.yml:44: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/efps.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/efps.yml:71: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/efps.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/efps.yml:90: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/efps.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/efps.yml:102: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/efps.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/efps.yml:103: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/efps.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/efps.yml:104: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/efps.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/efps.yml:113: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/efps.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/etl.yml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/etl.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/etl.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/etl.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/etl.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/etl.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/formatCheck.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/formatCheck.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/formatCheck.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/formatCheck.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/formatCheck.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/formatCheck.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/formatCheck.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/formatCheck.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/generate-dts-tests-if-needed.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/generate-dts-tests-if-needed.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/generate-dts-tests-if-needed.yml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/generate-dts-tests-if-needed.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/generate-dts-tests-if-needed.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/generate-dts-tests-if-needed.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/generate-dts-tests-if-needed.yml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/generate-dts-tests-if-needed.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint-fix-if-needed.yml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/lint-fix-if-needed.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/lint-fix-if-needed.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/lint-fix-if-needed.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint-fix-if-needed.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/lint-fix-if-needed.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint-fix-if-needed.yml:35: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/lint-fix-if-needed.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint-fix-if-needed.yml:40: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/lint-fix-if-needed.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lintPr.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/lintPr.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/lintPr.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/lintPr.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lintPr.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/lintPr.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/perf.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/perf.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/perf.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/perf.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/perf.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/perf.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/perf.yml:32: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/perf.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pkg-pr-new.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/pkg-pr-new.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/pkg-pr-new.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/pkg-pr-new.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pkg-pr-new.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/pkg-pr-new.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pnpm-if-needed.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/pnpm-if-needed.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/pnpm-if-needed.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/pnpm-if-needed.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pnpm-if-needed.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/pnpm-if-needed.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pnpm-if-needed.yml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/pnpm-if-needed.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pr-cleanup.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/pr-cleanup.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/pr-cleanup.yml:40: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/pr-cleanup.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pr-cleanup.yml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/pr-cleanup.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pr-cleanup.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/pr-cleanup.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/pr-cleanup.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/pr-cleanup.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pr-cleanup.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/pr-cleanup.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/react-compiler.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/react-compiler.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/react-compiler.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/react-compiler.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/react-compiler.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/react-compiler.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/react-compiler.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/react-compiler.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-latest.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/release-latest.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/release-latest.yml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/release-latest.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-latest.yml:37: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/release-latest.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-next.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/release-next.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-next.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/release-next.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/release-next.yml:32: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/release-next.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-next.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/release-next.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/test.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/test.yml:73: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/test.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:75: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/test.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:101: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/test.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:114: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/test.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/test.yml:149: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/test.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:151: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/test.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:163: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/test.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/testExports.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/testExports.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/testExports.yml:46: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/testExports.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/testExports.yml:48: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/testExports.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/typeCheck.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/typeCheck.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/typeCheck.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/typeCheck.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/typeCheck.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/sanity-io/sanity/typeCheck.yml/main?enable=pin
- Info: 0 out of 104 GitHub-owned GitHubAction dependencies pinned
- Info: 16 out of 52 third-party GitHubAction dependencies pinned
Reason
9 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-cwfw-4gq5-mrqx
- Warn: Project is vulnerable to: GHSA-g95f-p29q-9xw4
- Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg
- Warn: Project is vulnerable to: GHSA-67mh-4wv8-2f99
- Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv
- Warn: Project is vulnerable to: GHSA-8g77-54rh-46hx
- Warn: Project is vulnerable to: GHSA-9wv6-86v2-598j
- Warn: Project is vulnerable to: GHSA-x7hr-w5r2-h6wg
- Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw
Reason
dangerous workflow patterns detected
Details
- Warn: script injection with untrusted input ' github.head_ref || github.ref_name ': .github/workflows/e2e.yml:185
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: jobLevel 'contents' permission set to 'write': .github/workflows/create-release-pr.yml:20
- Warn: jobLevel 'contents' permission set to 'write': .github/workflows/release-latest.yml:25
- Warn: no topLevel permission defined: .github/workflows/cli-test.yml:1
- Info: topLevel 'contents' permission set to 'read': .github/workflows/create-release-pr.yml:9
- Warn: no topLevel permission defined: .github/workflows/depCheck.yml:1
- Warn: no topLevel permission defined: .github/workflows/e2e-ct.yml:1
- Info: topLevel 'contents' permission set to 'read': .github/workflows/e2e-ui.yml:3
- Info: topLevel 'contents' permission set to 'read': .github/workflows/e2e.yml:3
- Warn: no topLevel permission defined: .github/workflows/etl.yml:1
- Warn: no topLevel permission defined: .github/workflows/formatCheck.yml:1
- Info: topLevel 'contents' permission set to 'read': .github/workflows/generate-dts-tests-if-needed.yml:13
- Info: topLevel 'contents' permission set to 'read': .github/workflows/lint-fix-if-needed.yml:14
- Warn: no topLevel permission defined: .github/workflows/lintPr.yml:1
- Warn: no topLevel permission defined: .github/workflows/perf.yml:1
- Info: topLevel 'contents' permission set to 'read': .github/workflows/pnpm-if-needed.yml:16
- Warn: no topLevel permission defined: .github/workflows/pr-cleanup.yml:1
- Info: topLevel 'contents' permission set to 'read': .github/workflows/react-compiler.yml:13
- Warn: topLevel 'contents' permission set to 'write': .github/workflows/release-latest.yml:16
- Info: topLevel 'contents' permission set to 'read': .github/workflows/release-next.yml:9
- Warn: no topLevel permission defined: .github/workflows/test.yml:1
- Warn: no topLevel permission defined: .github/workflows/testExports.yml:1
- Warn: no topLevel permission defined: .github/workflows/typeCheck.yml:1
- Info: topLevel 'pull-requests' permission set to 'read': .github/workflows/validate-pr-title.yml:12
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 30 are checked with a SAST tool
Score
4.4
/10
Last Scanned on 2025-07-07
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More