Skip to content

chore(deps): bump postcss, fumadocs-core, fumadocs-mdx, fumadocs-openapi, fumadocs-ui and next - #132

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-84962ea163
Open

chore(deps): bump postcss, fumadocs-core, fumadocs-mdx, fumadocs-openapi, fumadocs-ui and next#132
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-84962ea163

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 16, 2026

Copy link
Copy Markdown
Contributor

Bumps postcss to 8.5.23 and updates ancestor dependencies postcss, fumadocs-core, fumadocs-mdx, fumadocs-openapi, fumadocs-ui and next. These dependencies need to be updated together.

Updates postcss from 8.4.31 to 8.5.23

Release notes

Sourced from postcss's releases.

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

  • Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

  • Fixed Maximum call stack size exceeded error.
  • Fixed Prototype hijacking for postcss.fromJSON().
  • Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

8.5.15

  • Fixed declaration parsing performance (by @​homanp).

8.5.14

8.5.13

  • Fixed postcss-scss commend regression.

8.5.12

  • Fixed reading any file via user-generated CSS.
  • Added opts.unsafeMap to disable checks.

8.5.11

  • Fixed nested brackets parsing performance (by @​offset).

8.5.10

  • Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

  • Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

  • Fixed Maximum call stack size exceeded error.
  • Fixed Prototype hijacking for postcss.fromJSON().
  • Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

8.5.15

  • Fixed declaration parsing performance (by @​homanp).

8.5.14

8.5.13

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.


Updates fumadocs-core from 15.7.5 to 16.15.11

Release notes

Sourced from fumadocs-core's releases.

fumadocs@16.15.11

  • @​fumadocs/base-ui@​16.15.11
  • fumadocs-core@16.15.11
  • fumadocs-ui@16.15.11

Shadcn UI compatible primitives

The primitives in fumadocs-ui/components/ui/* now follow the API of Shadcn UI, so components installed by the CLI can use the ones you already have.

buttonVariants accepts the default variant of Shadcn UI:

buttonVariants({ variant: 'default', size: 'sm' });

primary and the color alias still work.

fumadocs-ui/components/ui/scroll-area is removed, the sidebars render the scroll area primitives directly.

Mark packages side-effect free

All packages now declare sideEffects in package.json, so bundlers can tree-shake unused modules. Packages shipping stylesheets list them as side effects to keep CSS imports.

fumadocs@16.15.10

  • @​fumadocs/base-ui@​16.15.10
  • fumadocs-core@16.15.10
  • fumadocs-ui@16.15.10

Fix language switching with hidden locale prefixes

Root Provider's i18n option now accepts defaultLanguage and hideLocale. The language switcher uses these options instead of guessing from the current URL, so switching from /zh/docs to the default language en with hideLocale: 'default-locale' navigates to /docs.

i18nProvider() and defineI18nUI() pass these options from your i18n config automatically.

Fix same-page anchors on Tanstack Start

Tanstack Router's Link takes a pathname in to and reads the hash from a separate hash prop, so a same-page anchor like [link](https://github.com/fuma-nama/fumadocs/blob/HEAD/#installation) was rendered as a link to the current page with the hash dropped, clicking it did nothing. The Tanstack adapter now renders a native <a> for those hrefs:

Jump to [Installation](https://github.com/fuma-nama/fumadocs/blob/HEAD/#installation).

fumadocs@16.15.9

  • @​fumadocs/base-ui@​16.15.9
  • fumadocs-core@16.15.9
  • fumadocs-ui@16.15.9

getPageByUrl() on the loader

Look up a page by its URL:

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for fumadocs-core since your current version.


Updates fumadocs-mdx from 11.8.1 to 15.4.1

Release notes

Sourced from fumadocs-mdx's releases.

fumadocs-mdx@15.4.1

Mark packages side-effect free

All packages now declare sideEffects in package.json, so bundlers can tree-shake unused modules. Packages shipping stylesheets list them as side effects to keep CSS imports.

fumadocs-mdx@15.4.0

Remark LLMs: export a component with output: "function"

With output: "function", _markdown becomes a component instead of a string: Markdown content is still stringified at compile time, while JSX elements stay as JSX, receiving their original props.

// fumadocs-mdx collection config
postprocess: {
  includeProcessedMarkdown: { output: 'function' },
},

Render it with renderToMarkdown from fumadocs-core/server. Elements resolve from props.components: a component can call asMarkdown() to output its own Markdown form, other components (including missing ones) are serialized as JSX syntax.

import { renderToMarkdown } from 'fumadocs-core/server';
const { _markdown: Content } = await page.data.load();
const text = await renderToMarkdown(<Content components={getMDXComponents()} />);

getText('processed') keeps working: it renders the component for you, with an optional components map:

const text = await page.data.getText('processed', { components: getMDXComponents() });

Supported in bundler collections with both compilers, and in dynamic: true collections & @fumadocs/satteri/local-md with the Sätteri compiler.

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for fumadocs-mdx since your current version.


Updates fumadocs-openapi from 9.3.2 to 9.7.3

Commits

Updates fumadocs-ui from 15.7.5 to 16.15.11

Release notes

Sourced from fumadocs-ui's releases.

fumadocs@16.15.11

  • @​fumadocs/base-ui@​16.15.11
  • fumadocs-core@16.15.11
  • fumadocs-ui@16.15.11

Shadcn UI compatible primitives

The primitives in fumadocs-ui/components/ui/* now follow the API of Shadcn UI, so components installed by the CLI can use the ones you already have.

buttonVariants accepts the default variant of Shadcn UI:

buttonVariants({ variant: 'default', size: 'sm' });

primary and the color alias still work.

fumadocs-ui/components/ui/scroll-area is removed, the sidebars render the scroll area primitives directly.

Mark packages side-effect free

All packages now declare sideEffects in package.json, so bundlers can tree-shake unused modules. Packages shipping stylesheets list them as side effects to keep CSS imports.

fumadocs@16.15.10

  • @​fumadocs/base-ui@​16.15.10
  • fumadocs-core@16.15.10
  • fumadocs-ui@16.15.10

Fix language switching with hidden locale prefixes

Root Provider's i18n option now accepts defaultLanguage and hideLocale. The language switcher uses these options instead of guessing from the current URL, so switching from /zh/docs to the default language en with hideLocale: 'default-locale' navigates to /docs.

i18nProvider() and defineI18nUI() pass these options from your i18n config automatically.

Fix same-page anchors on Tanstack Start

Tanstack Router's Link takes a pathname in to and reads the hash from a separate hash prop, so a same-page anchor like [link](https://github.com/fuma-nama/fumadocs/blob/HEAD/#installation) was rendered as a link to the current page with the hash dropped, clicking it did nothing. The Tanstack adapter now renders a native <a> for those hrefs:

Jump to [Installation](https://github.com/fuma-nama/fumadocs/blob/HEAD/#installation).

fumadocs@16.15.9

  • @​fumadocs/base-ui@​16.15.9
  • fumadocs-core@16.15.9
  • fumadocs-ui@16.15.9

getPageByUrl() on the loader

Look up a page by its URL:

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for fumadocs-ui since your current version.


Updates next from 15.5.25 to 16.3.5

Release notes

Sourced from next's releases.

v16.3.5

The following bug fixes have been backported. It does not include all pending features/changes on canary.

  • next/image: Skip 0-byte entries when initializing disk LRU cache (#98185)
  • next/image: Reject empty images when reading/writing to the disk cache (#98186)
  • Emit whole-app server NFTs when output: 'standalone' is used with an adapter (#98167)
  • Add CSP nonce to script tags of loading and template files (#98403)
  • Fix use cache prerender signal retention (#98448)

v16.3.4

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

  • testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
  • Fix build error when aliasing typescript to @​typescript/typescript6 (#97997)
  • Fix unset crossOrigin in Turbopack manifests (#97930)

Credits

Huge thanks to @​eps1lon, @​mischnic, and @​timneutkens for helping!

v16.3.3

This release contains security fixes for the following advisories:

Critical:

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • [backport] Scope app-entry export validation to files inside the app directory (#97357)
  • [backport] Fix catch-all index page being served for every other slug (#97416)
  • [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
  • [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
  • [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
  • [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @​lubieowoce, @​unstubbable, @​timneutkens, @​mischnic, and @​eps1lon for helping!

v16.3.1

What's Changed

... (truncated)

Commits
  • ca2c75e v16.3.5
  • 14fb290 [backport] Fix use cache prerender signal retention (#98448)
  • 2b1f28d [16.3.x] Add CSP nonce to script tags of loading and template files (#98403)
  • 4b56cee [16.3.x] Backport docs fixes (#98317)
  • 5568a02 [backport] docs: local development: Rewrite docker section, add Windows Dev D...
  • 93249ab [16.3.X] Emit whole-app server NFTs when output: 'standalone' is used with ...
  • 6549fd7 [16.3.x] next/image: reject empty image on read/write to disk cache (#98186)
  • d9eac96 [16.3.x] next/image: skip 0-byte entries when initializing disk LRU cache (#9...
  • 84b35fe [test] Fix 16.3 deploy test assertions (#98133)
  • 14f9c1a [16.3.x][ci] Run flake detection and new deploy tests when merged and on back...
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump postcss, fumadocs-core, fumadocs-mdx, fumadocs-open…
7a4d127 
…api, fumadocs-ui and next

Bumps [postcss](https://github.com/postcss/postcss) to 8.5.23 and updates ancestor dependencies [postcss](https://github.com/postcss/postcss), [fumadocs-core](https://github.com/fuma-nama/fumadocs), [fumadocs-mdx](https://github.com/fuma-nama/fumadocs), [fumadocs-openapi](https://github.com/fuma-nama/fumadocs), [fumadocs-ui](https://github.com/fuma-nama/fumadocs) and [next](https://github.com/vercel/next.js). These dependencies need to be updated together.


Updates `postcss` from 8.4.31 to 8.5.23
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.4.31...8.5.23)

Updates `fumadocs-core` from 15.7.5 to 16.15.11
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs-core@15.7.5...fumadocs@16.15.11)

Updates `fumadocs-mdx` from 11.8.1 to 15.4.1
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs-mdx@11.8.1...fumadocs-mdx@15.4.1)

Updates `fumadocs-openapi` from 9.3.2 to 9.7.3
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs-openapi@9.3.2...fumadocs-openapi@9.7.3)

Updates `fumadocs-ui` from 15.7.5 to 16.15.11
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs-ui@15.7.5...fumadocs@16.15.11)

Updates `next` from 15.5.25 to 16.3.5
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v15.5.25...v16.3.5)

---
updated-dependencies:
- dependency-name: postcss
  dependency-version: 8.5.23
  dependency-type: indirect
- dependency-name: fumadocs-core
  dependency-version: 16.15.11
  dependency-type: direct:production
- dependency-name: fumadocs-mdx
  dependency-version: 15.4.1
  dependency-type: direct:production
- dependency-name: fumadocs-openapi
  dependency-version: 9.7.3
  dependency-type: direct:production
- dependency-name: fumadocs-ui
  dependency-version: 16.15.11
  dependency-type: direct:production
- dependency-name: next
  dependency-version: 16.3.5
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Sep 16, 2026

Copy link
Copy Markdown
Contributor Author

Assignees

The following users could not be added as assignees: jagjeevanak. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 16, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@JagjeevanAK JagjeevanAK

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@JagjeevanAK