[dependabot]

Bumps the infrastructure group with 42 updates in the / directory:

Package	From	To
toml	5.0.0	5.0.1
@biomejs/biome	2.5.14	2.6.4
@j178/prek	0.5.3	0.5.9
@tauri-apps/cli	2.11.5	2.12.4
@types/node	26.6.2	26.6.6
js-yaml	5.4.2	5.5.0
smol-toml	1.8.0	1.9.1
wrangler	4.135.0	4.156.1
@react-router/node	8.4.0	8.5.1
@react-router/serve	8.4.0	8.5.1
fumadocs-core	16.15.12	16.17.9
fumadocs-mdx	15.4.3	15.4.10
fumadocs-ui	16.15.12	16.17.9
mermaid	12.0.0	12.2.0
react	19.3.0	19.3.1
react-dom	19.3.0	19.3.1
react-router	8.4.0	8.5.1
@react-router/dev	8.4.0	8.5.1
vite	8.3.0	8.3.5
@base-ui/react	1.8.0	1.9.0
@hookform/resolvers	5.9.1	7.0.1
@stepperize/react	8.0.0	8.0.1
@tauri-apps/api	2.11.1	2.12.4
@tauri-apps/plugin-dialog	2.7.3	2.8.4
@tauri-apps/plugin-fs	2.5.2	2.7.1
@tauri-apps/plugin-shell	2.3.6	2.6.0
@tauri-apps/plugin-updater	2.12.0	2.14.1
driver.js	1.8.0	1.10.2
es-toolkit	1.52.0	1.53.1
i18next	26.4.2	26.7.1
lucide-react	1.47.0	1.68.0
marked	18.0.13	18.1.2
monaco-editor	0.56.0	0.57.0
radix-ui	1.6.7	1.8.1
react-hook-form	7.88.0	7.91.0
react-i18next	17.0.14	17.1.11
zod	4.6.5	4.6.7
zustand	5.0.15	5.0.16
@playwright/test	1.63.0	1.64.1
@vitejs/plugin-react	6.1.1	6.2.1
globals	17.12.0	17.14.0
shadcn	4.21.0	4.23.0

Updates toml from 5.0.0 to 5.0.1

Changelog

Sourced from toml's changelog.

5.0.1 - October 12 2026

• Address four security advisories, each reachable by parsing untrusted input:
  • CVE-2026-114142, in which a crafted document could still write to Object.prototype. Two distinct key paths could render to the same bookkeeping string, letting an array-of-tables header clear the guard on an unrelated key, after which a dotted key could descend through a date value into its prototype chain. The compiler now records how each table was defined on the table itself rather than in string-keyed sets, so paths cannot collide and key paths can only descend through tables the compiler created.
  • CVE-2026-114143, in which dotted keys, table headers, and inline-table keys with many segments took quadratic time to resolve.
  • CVE-2026-114141, in which every array-of-tables header rescanned all paths defined so far, so documents with many such headers took quadratic time.
  • CVE-2026-114144, in which integer literals were converted to BigInt before any size check, so a multi-megabyte literal consumed super-linear CPU time before being rejected. Literals with more digits than any 64-bit integer are now rejected before conversion.

Commits

• 9ebfa69 5.0.1
• 22cf8bb Update changelog for 5.0.1
• 9d52e38 Reject integer literals too long for int64 before converting to BigInt
• 609c873 Track table origin on the table instead of in string-keyed path sets
• df2bd01 Add tests for advisories GHSA-h895-cgqg-jf52, GHSA-9j65-hcg3-gc64, GHSA-4qx8-...
• 1b2ac40 Update CHANGELOG with assigned CVE
• See full diff in compare view

Updates @biomejs/biome from 2.5.14 to 2.6.4

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.6.4

2.6.4

Patch Changes

• #12261 19fbfb2 Thanks @​dyc3! - Added the new nursery rule noConsoleSpaces, which reports a leading or trailing space in a console.log(), console.debug(), console.info(), console.warn(), or console.error() argument that sits next to another argument. These methods already put a space between arguments, so such a space prints twice.

  console.log("abc ", "def");

• #12469 cd716d3 Thanks @​dyc3! - Added the new nursery rule noMagicArrayFlatDepth, which reports number literals other than 1 passed as the depth of Array.prototype.flat() unless a comment inside the parentheses explains them.

  const items = array.flat(2);

• #12470 92c9e81 Thanks @​dyc3! - Added the nursery rule noNull, which reports uses of the null literal and suggests undefined instead. Strict comparisons such as foo === null are allowed.

  let foo = null;

• #12483 9bd3527 Thanks @​dyc3! - Added the nursery rule noReturnArrayPush, which reports code that uses the return value of push() or unshift(). These methods return the new length of the array, not the added item or the array.

  function add(item) {
    return items.push(item);
  }

• #12477 a384892 Thanks @​dyc3! - Added the nursery rule noUnreadableIife, which reports arrow functions that are called right where they are defined and whose body is wrapped in parentheses.

  const foo = (bar => (bar ? bar.baz : baz))(getBar());

• #12447 0a963e4 Thanks @​dyc3! - Added the nursery rule noUselessRecursion, which reports functions that return a call to themselves when a loop can do the same work. Too many nested calls can crash the program with a stack overflow error.

  function findRoot(node) {
      if (node.parent) {
          return findRoot(node.parent);
      }
      return node;
  }

• #12554 2eddda9 Thanks @​dyc3! - Added the nursery rule noVueComputedPropertiesInData, which reports computed properties used inside the data function of a Vue component. Vue runs data before it sets up computed properties, so the value read there is undefined.

... (truncated)

Commits

• 5653874 ci: release (#12647)
• 824df15 feat(lint): add noVueDeprecatedDeleteSet (#12586)
• 861b288 feat(lint): add noVueUnusedRefs (#12603)
• 2eddda9 feat(lint): add noVueComputedPropertiesInData (#12554)
• 5d7553b feat(lint): add noVueMultipleSlotArgs (#12562)
• de1188f feat(lint): add noVueDeprecatedScopeAttribute (#12631)
• 2e520d8 feat(lint): add noVueMutatingProps (#12513)
• ade9845 feat(lint): add useVueDefineOptions (#12615)
• 6fc1a51 feat(lint): add noVueDeprecatedRouterLinkTagProp (#12648)
• a810209 feat(lint): add useVueValidDefineEmits (#12591)
• Additional commits viewable in compare view

Updates @j178/prek from 0.5.3 to 0.5.9

Release notes

Sourced from @​j178/prek's releases.

0.5.9

Release Notes

Released on 2026-10-30.

Enhancements

• Add normalize-indentation builtin hook (#2967)
• Allow overriding the uv install version (#2923)
• Embed dependency metadata in release binaries (#2976)
• Select musl Bun builds when glibc is unavailable (#2972)

Performance

• Improve workspace discovery performance (#2936)

Bug fixes

• Preserve clean-filtered files during stashing (#2915)

Contributors

• @​j178
• @​tchernobog

Install prek 0.5.9

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.9/prek-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.9/prek-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install prek

Download prek 0.5.9

File	Platform	Checksum
prek-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum

... (truncated)

Changelog

Sourced from @​j178/prek's changelog.

0.5.9

Released on 2026-10-30.

Enhancements

• Add normalize-indentation builtin hook (#2967)
• Allow overriding the uv install version (#2923)
• Embed dependency metadata in release binaries (#2976)
• Select musl Bun builds when glibc is unavailable (#2972)

Performance

• Improve workspace discovery performance (#2936)

Bug fixes

• Preserve clean-filtered files during stashing (#2915)

Contributors

• @​j178
• @​tchernobog

0.5.7

Released on 2026-10-21.

Enhancements

• Support system Rust toolchains without rustup (#2887)

Performance

• Use blocking file checks for CPU-heavy builtin hooks (#2910)

Other changes

• Update CA root crates and uv for the eMudhra intermediate CA compromise (#2919)

Contributors

• @​shaanmajid
• @​j178

0.5.6

Released on 2026-10-19.

Enhancements

... (truncated)

Commits

• 48c8a3e Bump version to 0.5.9
• 9f23bb8 Bump version to 0.5.8 (#2978)
• b209d53 Bump dependencies (#2977)
• e935fd6 Embed dependency metadata in release binaries (#2976)
• 7ca1efa Select musl Bun builds when glibc is unavailable (#2972)
• 69b23d8 Detect available glibc and musl runtimes (#2975)
• 08098ac Add normalize-indentation builtin hook (#2967)
• aa757d3 Revert "Add expand-tabs builtin hook (#2918)" (#2968)
• 310a66f Lock mise development tool versions (#2965)
• 36f4502 Report precise cargo-bloat sizes and symbol changes (#2963)
• Additional commits viewable in compare view

Updates @tauri-apps/cli from 2.11.5 to 2.12.4

Release notes

Sourced from @​tauri-apps/cli's releases.

@​tauri-apps/cli v2.12.4

[2.12.4]

Bug Fixes

• 136a28eaa (#16305 by @​Chaosnico9000) Skip the --target validation when rustup target list fails, e.g. when rustup is on PATH but has no toolchain installed, instead of rejecting every target as missing.
• 52081e04a (#16333 by @​amrbashir) Rename the misspelled choowHowToInstall NSIS language string to chooseHowToInstall. A custom language file in bundle.windows.nsis.customLanguageFiles that only defines the old name keeps working for now, but users should migrate to the new name.

Dependencies

• Upgraded to tauri-cli@2.12.4
• 4a6f51251 (#16317 by @​lazerg) Updated zip to v9 to fix RUSTSEC-2026-0367, RUSTSEC-2026-0368 and RUSTSEC-2026-0369.

@​tauri-apps/cli v2.12.3

[2.12.3]

Bug Fixes

• c95be4615 (#16287) Fix tauri ios xcode-script failing to find the Tauri project when Xcode inherits package manager environment variables from tauri ios dev --open, or when pnpm runs the CLI directly from the gen/apple folder.
• d62e5d9c0 (#16184) Fix NSIS installer leaving uninstall.exe and the installation directory behind when uninstalling an existing installation from the installer.

Dependencies

• Upgraded to tauri-cli@2.12.3
• 5a2953e55 (#16237) Updated NSIS to 3.13

@​tauri-apps/cli v2.12.2

[2.12.2]

Bug Fixes

• c48e1ca89 (#16246) On iOS, mark the Swift @_cdecl entry points that Rust links against as public (in the iOS API and in the plugin templates), so release builds made with Xcode 27 keep them global and link.

Dependencies

• Upgraded to tauri-cli@2.12.2
• fd319dd43 Update base64 to 0.23.

@​tauri-apps/cli v2.12.1

[2.12.1]

Enhancements

• 64bfdd909 (#16165 by @​Legend-Master) Ignore src-tauri in tauri plugin init example template

Dependencies

• Upgraded to tauri-cli@2.12.1

@​tauri-apps/cli v2.12.0

... (truncated)

Commits

• 993038c apply version updates (#16303)
• 0007a43 fix(macos-sign) Also list iPhone Distribution/Developer certs (#14838)
• 97ccd82 chore(deps): update rust crate zip to v9.0.5 (#16346)
• 5b50edd fix(api): type check dev tooling configs (#16353)
• cf40b73 chore(deps): update rust crate ico to 0.6 (#16348)
• d440abf chore(deps): update rust crate shared_child to v1.1.2 (#16308)
• 4c5593c chore(deps): update rust crate tower to v0.5.3 (#16309)
• a376abd chore(deps): update rust crate serde_json to v1.0.154 (#16307)
• 68e60c1 chore(deps): update dependency vitest to v5.0.5 (#16339)
• 9318ab8 chore(deps): update rust crate which to v8.0.6 (#16310)
• Additional commits viewable in compare view

Updates @types/node from 26.6.2 to 26.6.6

Commits

• See full diff in compare view

Updates js-yaml from 5.4.2 to 5.5.0

Changelog

Sourced from js-yaml's changelog.

[5.5.0] - 2026-10-16

Changed

• Updated argparse to v3.
• Updated development dependencies.

Fixed

• Correct percent-encoding of shorthand and verbatim tags.
• Reject ,, ], and } at the start of block plain scalars, #801.
• Report the exact position of non-printable characters in errors, #801.

[5.4.3] - 2026-10-06

Fixed

• Fixed loading a whitespace-only block scalar followed by a less indented line, #802.

Commits

• cb62b2d 5.5.0 released
• 87aed90 Deps bump
• 3aec511 Fix error positions for non-printable characters, #801
• 11aa483 Reject flow indicators at the start of block plain scalars, #801
• 339d8e0 Refactor tag encoder and decoder to match the YAML specification
• 7832624 5.4.3 released
• 0cbb471 Fix whitespace-only block scalar followed by a less indented line, close #802
• 30108cc Parse the first block mapping key once (#800)
• See full diff in compare view

Updates smol-toml from 1.8.0 to 1.9.1

Release notes

Sourced from smol-toml's releases.

v1.9.1

What's Changed

• fix: reject invalid extra exponent sign by @​cyyynthia

Full Changelog: squirrelchat/smol-toml@v1.9.0...v1.9.1

v1.9.0

Huge update!!! This is most likely the largest update the library received since its release, with lots of new features and improvements.

Performance improvements

Significant parts of the internal parse logic have been rewritten, improving performance by 1.5x-2x. The library was already comfortably ahead of the others, but it is now faster than ever, sitting at 4x faster parse performance than the closest maintained implementation.

Problematic code paths have also been replaced by safer implementations, solving potential DoS vectors. See GHSA-r4xh-jqrq-34v2.

Note: the objects returned by the library now have a null prototype. This is a transparent change for 99.9% of users, and is one of the most significant contributors to the major performance gains in this version.

Full Temporal support

Version 1.8.0 brought support for Temporal in stringify; now the library is also able to emit Temporal objects instead of its own ad-hoc TomlDate object. It is not enabled by default, but it will become the default in v2. Enable by setting useLegacyDate: false in the parser's options.

Better Temporal support in stringify

Temporal support has been improved since it released: Temporal objects that cannot be represented (such as Temporal.PlainMonthDay) now throw an error (instead of silently emitting a bogus object).

A new option has been added to stringify to disallow Temporal objects that cannot be fully represented in TOML. This includes ZonedDateTime objects with a IANA timezone attached instead of a plain offset, and dates with a specific calendar value set. Enable by setting strictTemporal: true in the options.

Handling of unsafe keys

Since its release the library has been protected against prototype pollution attacks, setting properties like __proto__ using safe mechanisms that do not trigger prototype pollution. However, while the returned objects are safe on their own, they may become problematic if used carelessly.

Inspired by secure-json-parse, the library now offers a way to either drop unsafe properties from the returned object, or to throw an error and reject documents altogether. By default, these potentially unsafe keys are preserved and returned.

Miscellaneous updates

• Unicode BOM is now gracefully accepted and ignored.
• Table array headers are now properly checked again. Reported in #65.
• Closed certain gaps where invalid whitespace would be accepted. Reported in #61.
• Bogus local date and local time values with a UTC offset are no longer accepted.
• Certain error messages are more accurate and handle errors at line boundaries better.
• The default export of the lib is now formally deprecated; use a import * instead. Proposed in #50.
• On Node 20+, strings that contain lone surrogates are now normalised to well-formed strings.
• On Node 20+, keys that contain lone surrogates are now rejected.

Full Changelog: squirrelchat/smol-toml@v1.8.0...v1.9.0

Commits

• 69aa050 fix: actually properly fix exponent issues
• 7be7084 chore: version bump
• be3290d chore: upgrade deps
• 86c7613 fix: reject invalid extra exponent sign
• 6f9739a fix: gate [is|to]WellFormed (Node 18 compat)
• a73ca32 fix: no Temporal with toml-test when Node < 26
• 7727890 chore: version bump
• 641903d chore: rewrite README.md
• 2df14c5 fix(types): make it work if Temporal doesn't exist
• 3eaa44e chore: update benchmark harness
• Additional commits viewable in compare view

Updates wrangler from 4.135.0 to 4.156.1

Release notes

Sourced from wrangler's releases.

wrangler@4.156.1

Patch Changes

• #16594 effe4ed Thanks @​jaeminbird! - Fix wrangler types --check reporting CRLF types files as out of date

  When worker-configuration.d.ts was checked out with CRLF line endings (for example with Git's core.autocrlf=true, the default on Windows), the runtime header kept a trailing \r and never matched the expected header. wrangler types --check then always failed, wrangler dev always warned that the types might be out of date, and cached runtime types were never reused. Generated types files are now read with either line ending.

• #16635 76e18a8 Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-01

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #16635 76e18a8 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20261023.1	^5.20261101.1
  workerd	1.20261023.1	1.20261101.1

• #16535 5740867 Thanks @​petebacondarwin! - Keep Pages development asset lookups within the configured directory

  Validate resolved asset paths relative to the Pages output directory, preventing neighboring files and directories with a shared name prefix from being served. This also applies to the Vitest Pages ASSETS helper. Assets inside the directory and existing not-found fallbacks retain their behavior.

• #16366 d174de8 Thanks @​MattieTK! - Deploy the requested directory when wrangler pages deploy <directory> is run as a Workers static-assets deploy

  When wrangler pages deploy <directory> was carried out as a Workers static-assets deploy, the <directory> argument was only used to check for unsupported Pages features and was then dropped. Autoconfig detected an assets directory of its own instead, and when the project root contained an index.html it chose the whole project root, even when a narrower directory such as public had been requested. Source files and configuration outside the requested directory that were not excluded by .assetsignore could then be uploaded as public static assets.

  The requested directory is now validated before files are written and passed through to the deploy. Unconfigured projects are set up for static assets even when framework dependencies are present; existing Workers configs receive an --assets or legacy --site override. Projects configured through the Cloudflare Vite plugin alone keep their configuration and scripts, using the requested directory and an explicit or default compatibility date just for this deploy. Successful deployments without a config file are recorded in the project's .wrangler/deployments directory for that account and Worker, surviving dependency reinstalls. Repeat deploys verify the recorded version still belongs to the target Worker before allowing an update, preserving protection against name collisions and replacements.

• #16562 aece4df Thanks @​audricbizouarn-dashdoc! - Retry transient failures when starting a Workers assets upload session

  Asset manifest registration now uses the same bounded API retry policy as Worker uploads, including support for Retry-After. Temporary server errors no longer immediately abort an otherwise valid deployment. Persistent failures still surface the original error after the retry limit; this does not repair server-side issues affecting a specific Worker.

• #16603 2667a9f Thanks @​petebacondarwin! - Fix repeated slashes in URL paths bypassing Pages Functions middleware

  Pages Functions now collapse repeated slashes when looking up middleware, so requests such as //secure/one run the same middleware as /secure/one. The original request URL and function-route matching are preserved. Middleware receives a functionPath prefix from the original URL so imported assets can still resolve their relative paths.

• #16525 ed7fb41 Thanks @​petebacondarwin! - Validate OAuth error callbacks against the pending login

  All authorization callbacks, including ones without a code or error, now require the matching login state. Unrelated callbacks leave the login running so the authorization page can complete it, and control characters in provider error messages are displayed as escaped text.

• #16597 f9dbb22 Thanks @​guybedford! - Fix WebAssembly stack frames printing as at [object Object] in source-mapped errors

  WebAssembly frames in source-mapped error stack traces now show their original function and location instead of [object Object].

• Updated dependencies [76e18a8, 76e18a8, 009ca6e]:

  • miniflare@5.20261101.0-beta

wrangler@4.156.0

... (truncated)

Commits

• ca55031 Version Packages (#16598)
• 2667a9f [wrangler] Fix Pages Functions middleware routing for repeated slashes (#16603)
• 5740867 [wrangler] Enforce the Pages development asset directory boundary (#16535)
• d174de8 [wrangler] Deploy the requested directory for delegated pages deploy (#16366)
• effe4ed [wrangler] Fix wrangler types --check reporting CRLF types files as out of ...
• b1ced56 Version Packages (#16556)
• 8b64bec [config] Fix Durable Object self-references without changing deployment targe...
• 25802bc [wrangler] Run wrangler d1 insights account-wide (#16532)
• b4653b4 [autoconfig] Write a protective .assetsignore when the project root is the as...
• a09957a Version Packages (#16553)
• Additional commits viewable in compare view

Updates @react-router/node from 8.4.0 to 8.5.1

Release notes

Sourced from @​react-router/node's releases.

v8.5.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v851

v8.5.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v850

Changelog

Sourced from @​react-router/node's changelog.

v8.5.1

Patch Changes

• Updated dependencies:
  • react-router@8.5.1

v8.5.0

Patch Changes

• Write file session data to a temporary file and rename it into place so concurrent commits of the same session can no longer corrupt its file (#15620)
  • Preserve existing session file permissions when replacing the file
• Updated dependencies:
  • react-router@8.5.0

Commits

• a2783e6 Release v8.5.1 (#15656)
• 4fe4525 Release v8.5.0 (#15515)
• f94a829 fix(node): write file sessions atomically (#15620)
• See full diff in compare view

Updates @react-router/serve from 8.4.0 to 8.5.1

Release notes

Sourced from @​react-router/serve's releases.

v8.5.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v851

v8.5.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v850

Changelog

Sourced from @​react-router/serve's changelog.

v8.5.1

Patch Changes

• Avoid writing a blank line to stderr when the server shuts down successfully (#15641)
• Updated dependencies:
  • react-router@8.5.1
  • @react-router/express@8.5.1
  • @react-router/node@8.5.1

v8.5.0

Unstable Changes

⚠️ Unstable features are not recommended for production use

• Support API-only builds in react-router-serve by serving client documents and forwarding data and route discovery requests to the React Router runtime (#15601)
  • Serve prerendered documents when available and use the generated SPA fallback for non-prerendered paths

Patch Changes

• Updated dependencies:
  • react-router@8.5.0
  • @react-router/express@8.5.0
  • @react-router/node@8.5.0

Commits

• a2783e6 Release v8.5.1 (#15656)
• 43038ef Stabilize integration test environments and reduce expected logs (#15641)
• eb51758 chore: format
• 4fe4525 Release v8.5.0 (#15515)
• 9d6468d Support API-only server builds with prerendering (#15601)
• See full diff in compare view

Updates fumadocs-core from 16.15.12 to 16.17.9

Release notes

Sourced from fumadocs-core's releases.

fumadocs@16.17.9

• @​fumadocs/base-ui@​16.17.9
• fumadocs-core@16.17.9
• fumadocs-ui@16.17.9

Keep the theme on Astro navigations

• The Astro RootProvider keeps the theme across navigations of the Astro client router.

Faster and more stable TOC

• TOCItems of the normal and clerk styles no longer throws "is not iterable" when navigating between pages quickly.
• The TOC track is measured once per change and drawn before paint: less work on navigation, no frame showing the previous page's track.
• The normal style highlights the active range right after the page loads, not only after the first scroll.
• Custom heading IDs containing quotes no longer crash the normal and clerk styles.

Fix #3754

Copy the page tree on deserialization

• deserializePageTree() and useFumadocsLoader() no longer mutate the serialized page tree.

Keep the AsyncAPI data of generated pages

• pageSchema keeps _asyncapi in the frontmatter of pages generated by Fumadocs AsyncAPI, like _openapi.

TanStack links with a hash or search params

• Links like /docs/page#heading or /docs/page?q=1 preload and open the right page in the TanStack adapter.

Fix #3758

fumadocs@16.17.8

• @​fumadocs/base-ui@​16.17.8
• fumadocs-core@16.17.8
• fumadocs-ui@16.17.8

Bring your own highlighter

Shiki stays the default, and isn't loaded when you highlight code with another highlighter.

• fumadocs-core/highlight exports a Highlighter interface, created with createHighlights() from fumadocs-core/highlight/highlights (@pierre/highlights) or createShikiHighlighter() from fumadocs-core/highlight/shiki, override() creates one with other options.
• rehypeCodeFromHighlighter from fumadocs-core/mdx-plugins/rehype-code.core highlights code blocks with a highlighter, or a function creating one with the transformers of Fumadocs. createRehypeCode is deprecated, Sätteri has rehypeCodeFromHighlighter in @fumadocs/satteri/rehype-code. Pass transformerTwoslash() in its transformers option to analyze Twoslash blocks in batches.
• createServerCodeBlock() and createDynamicCodeBlock() in Fumadocs UI create code blocks from a highlighter. Dynamic code blocks are highlighted on the server too.
• toJsx() from fumadocs-core/utils/hast-to-jsx converts hast into React elements like toJsxRuntime() of hast-util-to-jsx-runtime, MDX nodes through an evaluator, over 10x faster on highlighted code, whose spans render as one HTML string. Every Fumadocs renderer uses it, hast-util-to-jsx-runtime is no longer a dependency.
• Twoslash loads the languages of code blocks in popups before highlighting, an unknown language there no longer fails the code block.
• OpenAPI Standalone highlights code blocks with Highlights, in its server-rendered pages too.
• The page factories of OpenAPI, GraphQL and AsyncAPI, type tables, createPython(), createPythonComponents(), localHtml() and the shadcn createSnippet() take a highlighter.
• Deprecated shiki and shikiOptions of the API pages and shiki of type tables, pass a highlighter instead.
• Integrations require fumadocs-core 16.17.8, the API pages and shadcn also require fumadocs-ui 16.17.8.

... (truncated)

Commits

• c308d52 Version Packages (#3745)
• bc26607 fix(mdx-remote): strip frontmatter
• 85280a5 docs: group integration guides by framework, align Astro page data (#3760)
• 5adee40 feat(astro): first-class Astro integration and docs (#3759)
• 4be3d58 fix(core): align tanstack link behaviours
• 71d1358 docs: add community Privatus Analytics integration (#3757)
• da4ca7b fix(ui): better toc
• 4a7b6be fix(cli): correct route locations
• 2af7b68 fix(openapi, asyncapi): resolve index card links from the output directory (#...
• 5bf8134 feat(openapi): let renderParameterField render the default input with another...
• Additional commits viewable in compare view

Updates fumadocs-mdx from 15.4.3 to 15.4.10

Release notes

Sourced from fumadocs-mdx's releases.

fumadocs-mdx@15.4.10

remarkInclude in fumadocs-core

<include> moved from Fumadocs MDX to fumadocs-core/mdx-plugins/remark-include, a unified plugin for any MDX or Markdown pipeline.

• fumadocs-mdx/config still exports remarkInclude, forwarded from fumadocs-core.
• getProcessor parses included files by their format, like a .md file included in an .mdx page.
• Headings in an included section get IDs unique among the page's own headings.
• Circular includes throw instead of hanging, and included code files no longer end with an empty line.
• fumadocs-mdx requires fumadocs-core 16.17.8.

fumadocs-mdx@15.4.9

Turbopack loader warnings

• Next.js 16.4 builds no longer warn Module not found: Can't resolve <dynamic> for the config imports of the loaders.

fumadocs-mdx@15.4.8

Imports across Windows drives

• remarkImage and generated .source files import files on another drive or a UNC path by their absolute path.
• Generated imports of files in dot-folders are prefixed with ./.

Fix #3723Description has been truncated

[github-actions]

📦 Semifold release plan

Plan calculated through commit 69a2bad.

Note

This pull request does not introduce any changesets.

After this pull request is merged into main, the release workflow will run and publish any prepared package versions that are not yet available in their registry.

This comment updates automatically as the pull request changes.

[dependabot]

Superseded by #237.