feat: add Sanity v4 support

[chenaski]

This PR adds support for Sanity v4 while maintaining backward compatibility with v3.

Changes

• Updated peerDependencies to support both Sanity v3 and v4
• Build verification confirms compatibility
• No code changes required due to stable API usage

Closes #19

Generated with Claude Code

[claude]

Claude finished @chenaski's task —— View job

---

PR Review: Add Sanity v4 Support

Review Checklist:

• Analyze package.json changes
• Review package-lock.json additions
• Examine codebase for Sanity API usage
• Check for potential compatibility issues
• Assess security implications
• Evaluate test coverage
• Provide comprehensive feedback

---

✅ Overall Assessment: APPROVED

This is a well-executed compatibility update that adds Sanity v4 support while maintaining backward compatibility. The approach is conservative and appropriate for the plugin's usage patterns.

📋 Detailed Review

Code Quality & Best Practices ✅

• Change scope: Minimal and focused - only updates peerDependencies in package.json:86
• Backward compatibility: Properly maintained with "sanity": "^3 || ^4"
• API stability: Plugin uses stable Sanity APIs that haven't changed between v3 and v4:
  • definePlugin, defineType from sanity
  • Core input props (StringInputProps, set, unset)
  • Preview interfaces (PreviewLayoutKey, PreviewProps)
  • UI components from @sanity/ui

Potential Issues ✅

• No breaking changes detected: All Sanity APIs used are stable across v3/v4
• Dependencies aligned: Other peer deps (@sanity/ui, react, styled-components) already support compatible ranges
• Build verification: PR description mentions successful build verification

Security Concerns ✅

• SVG sanitization: Continues to use DOMPurify properly for XSS protection (InlineSvgInput.tsx:160, InlineSvgPreviewComponent.tsx:27)
• No new attack vectors: Change only affects dependency resolution, not code execution
• File handling: SVG upload handling remains secure with proper sanitization

Performance Considerations ✅

• No runtime impact: Change only affects package resolution, not runtime code
• Bundle size: No new dependencies added that would affect bundle size
• Existing optimizations preserved: DOMPurify sanitization and styled-components usage unchanged

Test Coverage ⚠️ CONCERN

• No tests found: Plugin has no test files (**/*.test.*, **/*.spec.*)
• Manual testing implied: PR relies on build verification and manual testing
• Risk mitigation: Low risk due to minimal API surface and stable Sanity APIs used

🔧 Recommendations

1. Testing (Medium Priority): Consider adding basic tests for:

   // Suggested test coverage areas:
   - Plugin registration and schema definition
   - SVG input file handling and validation
   - DOMPurify sanitization behavior
   - Preview component rendering

2. Documentation (Low Priority): Update CLAUDE.md:32 to reflect v4 support:

   - Peer dependencies: React 18+, Sanity v3, styled-components, @sanity/ui
   + Peer dependencies: React 18+, Sanity v3/v4, styled-components, @sanity/ui

🎯 Summary

Strengths:

• Clean, minimal change with clear intent
• Proper semver range for backward compatibility
• Uses only stable Sanity APIs
• Maintains security best practices
• No performance impact

Areas for improvement:

• Add test coverage for better confidence
• Update documentation to reflect v4 support

This PR is ready to merge. The lack of tests is the only notable concern, but given the stability of the APIs used and the minimal scope of changes, the risk is acceptable.

---