`@sanity/visual-editing` depends on `@sanity/mutate` canary, causing duplicate `@sanity/client` installation

[YuCJ]

Description

While upgrading a monorepo from Sanity v3 to v4, I found two different major versions of @sanity/client are installed.

I have not yet observed any specific runtime errors or functional bugs as a result of this. However, the presence of two different major versions of a critical package like @sanity/client is concerning.

This issue appears to be caused by @sanity/visual-editing (v3.0.3) which has a dependency on a canary version of @sanity/mutate (0.11.0-canary.4). This canary version, in turn, depends on an older major version of @sanity/client (^6.22.4), leading to the duplication.

Steps to Reproduce

1. Set up a project that uses both sanity v4 (for the studio) and next-sanity (for a frontend application).

2. Install the latest versions of the core dependencies, including sanity@^4.6.0 and @sanity/client@^7.10.0.

3. Run npm install.

4. Inspect the package-lock.json file or run npm ls @sanity/client to check for installed versions.

Observed Behavior

The installation results in two versions of @sanity/client being installed: v7.10.0 and v6.29.1.

Expected Behavior

Only a single, deduplicated version of @sanity/client (v7.10.0) should be installed across the project.

Dependency Chain

The problematic dependency chain identified in package-lock.json is:

@sanity/visual-editing@3.0.3
└── @sanity/mutate@"0.11.0-canary.4"
└── @sanity/client@"^6.22.4" (which resolves to v6.29.1)

This conflicts with the top-level dependency which is correctly set to:

"@sanity/client": "^7.10.0"

nextjs-app/package.json:

    "@sanity/client": "^7.10.0",
    "@sanity/image-url": "^1.1.0",
    "@sanity/uuid": "^3.0.2",
    "next-sanity": "^10.0.14",

studio/package.json:

    "@sanity/assist": "^5.0.0",
    "@sanity/icons": "^3.7.4",
    "@sanity/vision": "^4.6.0",
    "sanity": "^4.6.0",

package-lock.json:

    "node_modules/@sanity/client": {
      "version": "7.10.0",
      "resolved": "https://registry.npmjs.org/@sanity/client/-/client-7.10.0.tgz",
      "integrity": "sha512-3UV6pJupue7UAZh4g5n0lYjuRsIb4c6IoqMywVLMHYoSOeHJfgSzbexOPGMNqvF+KUywUA0GyFi9cAVeMKofvw==",
      "license": "MIT",
      "dependencies": {
        "@sanity/eventsource": "^5.0.2",
        "get-it": "^8.6.9",
        "nanoid": "^3.3.11",
        "rxjs": "^7.0.0"
      },
      "engines": {
        "node": ">=20"
      }
    },

// ...

   "node_modules/@sanity/mutate": {
      "version": "0.12.5",
      "resolved": "https://registry.npmjs.org/@sanity/mutate/-/mutate-0.12.5.tgz",
      "integrity": "sha512-vzCs62uTRaiCw1IIIFSqouUAHblWhfjL1s1rIcOLJgNZGDfF40cNeTHLD1JmdrK2/5v/T4oaX/0eEl5E9mPJ5w==",
      "license": "MIT",
      "dependencies": {
        "@sanity/client": "^7.9.0",
        "@sanity/diff-match-patch": "^3.2.0",
        "@sanity/uuid": "^3.0.2",
        "hotscript": "^1.0.13",
	@@ -7000,21 +6744,7 @@
        "node": ">=18"
      }
    },

// ...

   "node_modules/@sanity/visual-editing": {
      "version": "3.0.3",
      "resolved": "https://registry.npmjs.org/@sanity/visual-editing/-/visual-editing-3.0.3.tgz",
      "integrity": "sha512-y5SL+6jfhjp3UeQk67ZRxosa2XZCID8hyvvGF+jrkwxiRr21ABwoxDo8msNGjNFiwKCT/pn7/eTQbsEECrdWgg==",
      "license": "MIT",
      "dependencies": {
        "@sanity/comlink": "^3.0.9",
        "@sanity/icons": "^3.7.4",
        "@sanity/insert-menu": "^2.0.1",
        "@sanity/mutate": "0.11.0-canary.4",
        "@sanity/presentation-comlink": "^1.0.28",
        "@sanity/preview-url-secret": "^2.1.14",
        "@sanity/ui": "^3.0.0",
        "@sanity/visual-editing-csm": "^2.0.23",
        "@vercel/stega": "0.1.2",
        "get-random-values-esm": "^1.0.2",
        "react-compiler-runtime": "19.1.0-rc.2",
        "rxjs": "^7.8.2",
        "scroll-into-view-if-needed": "^3.1.0",
        "use-effect-event": "^2.0.3",
        "xstate": "^5.20.1"
      },
    "node_modules/@sanity/visual-editing/node_modules/@sanity/mutate": {
      "version": "0.11.0-canary.4",
      "resolved": "https://registry.npmjs.org/@sanity/mutate/-/mutate-0.11.0-canary.4.tgz",
      "integrity": "sha512-82jU3PvxQepY+jVJU1WaXQOf2Q9Q/fOCE2ksJZ4cnH3/WFOsg7RceYoOWb1XKthchTCD9zSBS9DRmb7FQ0Jlsg==",
      "license": "MIT",
      "dependencies": {
        "@sanity/client": "^6.22.4",
        "@sanity/diff-match-patch": "^3.1.1",
        "hotscript": "^1.0.13",
        "lodash": "^4.17.21",
        "lodash-es": "^4.17.21",
        "mendoza": "^3.0.7",
        "rxjs": "^7.8.1"
      },
      "engines": {
        "node": ">=18"
      },
      "peerDependencies": {
        "xstate": "^5.19.0"
      },
      "peerDependenciesMeta": {
        "xstate": {
          "optional": true
        }
      }
    },
    "node_modules/@sanity/visual-editing/node_modules/@sanity/mutate/node_modules/@sanity/client": {
      "version": "6.29.1",
      "resolved": "https://registry.npmjs.org/@sanity/client/-/client-6.29.1.tgz",
      "integrity": "sha512-BQRCMeDlBxwnMbFtB61HUxFf9aSb4HNVrpfrC7IFVqFf4cwcc3o5H8/nlrL9U3cDFedbe4W0AXt1mQzwbY/ljw==",
      "license": "MIT",
      "dependencies": {
        "@sanity/eventsource": "^5.0.2",
        "get-it": "^8.6.7",
        "rxjs": "^7.0.0"
      },
      "engines": {
        "node": ">=14.18"
      }
    },