[dependabot]

Bumps the infrastructure group with 44 updates in the / directory:

Package	From	To
toml	5.0.0	5.0.1
@biomejs/biome	2.5.14	2.6.6
@j178/prek	0.5.3	0.5.10
@tauri-apps/cli	2.11.5	2.12.4
@types/node	26.6.2	26.6.6
js-yaml	5.4.2	5.5.0
smol-toml	1.8.0	1.9.1
wrangler	4.135.0	4.158.0
@react-router/node	8.4.0	8.5.1
@react-router/serve	8.4.0	8.5.1
fumadocs-core	16.15.12	16.18.4
fumadocs-mdx	15.4.3	15.5.3
fumadocs-ui	16.15.12	16.18.4
mermaid	12.0.0	12.3.0
react	19.3.0	19.3.1
react-dom	19.3.0	19.3.1
react-router	8.4.0	8.5.1
@react-router/dev	8.4.0	8.5.1
@tailwindcss/vite	4.3.3	4.3.5
tailwindcss	4.3.3	4.3.5
vite	8.3.0	8.3.7
@base-ui/react	1.8.0	1.9.0
@hookform/resolvers	5.9.1	7.0.5
@stepperize/react	8.0.0	8.0.1
@tauri-apps/api	2.11.1	2.12.4
@tauri-apps/plugin-dialog	2.7.3	2.8.4
@tauri-apps/plugin-fs	2.5.2	2.7.1
@tauri-apps/plugin-shell	2.3.6	2.6.0
@tauri-apps/plugin-updater	2.12.0	2.14.1
driver.js	1.8.0	1.11.0
es-toolkit	1.52.0	1.53.2
i18next	26.4.2	27.0.1
lucide-react	1.47.0	1.72.0
marked	18.0.13	18.1.3
monaco-editor	0.56.0	0.57.0
radix-ui	1.6.7	1.8.1
react-hook-form	7.88.0	7.91.0
react-i18next	17.0.14	18.0.1
zod	4.6.5	4.6.7
zustand	5.0.15	5.1.0
@playwright/test	1.63.0	1.65.0
@vitejs/plugin-react	6.1.1	6.3.0
globals	17.12.0	17.14.0
shadcn	4.21.0	4.23.0

Updates toml from 5.0.0 to 5.0.1

Changelog

Sourced from toml's changelog.

5.0.1 - October 12 2026

• Address four security advisories, each reachable by parsing untrusted input:
  • CVE-2026-114142, in which a crafted document could still write to Object.prototype. Two distinct key paths could render to the same bookkeeping string, letting an array-of-tables header clear the guard on an unrelated key, after which a dotted key could descend through a date value into its prototype chain. The compiler now records how each table was defined on the table itself rather than in string-keyed sets, so paths cannot collide and key paths can only descend through tables the compiler created.
  • CVE-2026-114143, in which dotted keys, table headers, and inline-table keys with many segments took quadratic time to resolve.
  • CVE-2026-114141, in which every array-of-tables header rescanned all paths defined so far, so documents with many such headers took quadratic time.
  • CVE-2026-114144, in which integer literals were converted to BigInt before any size check, so a multi-megabyte literal consumed super-linear CPU time before being rejected. Literals with more digits than any 64-bit integer are now rejected before conversion.

Commits

• 9ebfa69 5.0.1
• 22cf8bb Update changelog for 5.0.1
• 9d52e38 Reject integer literals too long for int64 before converting to BigInt
• 609c873 Track table origin on the table instead of in string-keyed path sets
• df2bd01 Add tests for advisories GHSA-h895-cgqg-jf52, GHSA-9j65-hcg3-gc64, GHSA-4qx8-...
• 1b2ac40 Update CHANGELOG with assigned CVE
• See full diff in compare view

Updates @biomejs/biome from 2.5.14 to 2.6.6

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.6.6

2.6.6

Patch Changes

• #12887 da0422e Thanks @​dyc3! - Added the new nursery rule noArrayMethodsOnArguments. It reports calls to array methods on the arguments object, which isn't an array, so these calls throw a TypeError when the code runs.

  function sum() {
    return arguments.reduce((total, value) => total + value, 0);
  }

• #12877 cd9e10f Thanks @​dyc3! - Added the nursery rule noConstantComparisons, which reports && and || conditions that can never be true, are always true, or contain a check with no effect.

  if (statusCode <= 400 && statusCode > 500) {}

• #12876 a7c9586 Thanks @​dyc3! - Added the nursery rule noErasingOperation, which disallows operations with 0 that always result in zero: multiplying by 0, a bitwise AND with 0, and dividing 0 by a number. The other value in these operations has no effect on the result, which usually means the code has a mistake.

  const total = price * 0;

• #12841 e954f55 Thanks @​dyc3! - Added the nursery rule noNegatedArrayPredicate, which reports negated calls to Array#some() and Array#every() and suggests moving the negation into the callback function.

  // Invalid: use `array.every((item) => !isUnicorn(item))` instead.
  const isMissing = !array.some((item) => isUnicorn(item));

• #12888 15039f7 Thanks @​dyc3! - Added the new nursery rule noNumberArgumentOutOfRange, which reports number literal arguments of toString(), toFixed(), toExponential() and toPrecision() that are outside the range the method accepts. These calls throw a RangeError at runtime.

  value.toString(64);

• #12889 1cd7520 Thanks @​dyc3! - Added the nursery rule noSharedBranchCode, which reports code that is repeated at the start or end of every branch of an if statement. That code runs no matter which branch is taken, so it can be moved before or after the if statement.

  if (condition) {
    doSomething();
    cleanup();
  } else {
    doSomethingElse();
    cleanup();
  }

... (truncated)

Commits

• 09ee04d ci: release (#12938)
• 191111d feat(lint): add usePackageJsonEngines (#12310)
• 0538e30 feat(lint): add usePackageJsonCpu (#12309)
• 6b73fcf feat(lint): add noUninvokedArrayCallback (#12890)
• 1cd7520 feat(lint): add noSharedBranchCode (#12889)
• 15039f7 feat(lint): add noNumberArgumentOutOfRange (#12888)
• da0422e feat(lint): add noArrayMethodsOnArguments (#12887)
• 3bb18d8 feat(lint): add useNextScriptForGoogleAnalytics (#12886)
• cd9e10f feat(lint): add noConstantComparisons (#12877)
• a7c9586 feat(lint): add noErasingOperation (#12876)
• Additional commits viewable in compare view

Updates @j178/prek from 0.5.3 to 0.5.10

Release notes

Sourced from @​j178/prek's releases.

0.5.10

Release Notes

Released on 2026-11-04.

Enhancements

• Add a builtin replace-pattern hook (#2981)

Bug fixes

• Avoid downloading Node prereleases by default (#2995)
• Keep file checks out of rayon's recursive frames (#2999)
• Skip Node releases without a compatible archive (#2996)

Documentation

• Add equivalent prek.toml examples throughout the documentation (#2979)

Contributors

• @​connorbrinton
• @​j178

Install prek 0.5.10

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.10/prek-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.10/prek-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install prek

Download prek 0.5.10

File	Platform	Checksum
prek-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
prek-x86_64-apple-darwin.tar.gz	Intel macOS	checksum

... (truncated)

Changelog

Sourced from @​j178/prek's changelog.

0.5.10

Released on 2026-11-04.

Enhancements

• Add a builtin replace-pattern hook (#2981)

Bug fixes

• Avoid downloading Node prereleases by default (#2995)
• Keep file checks out of rayon's recursive frames (#2999)
• Skip Node releases without a compatible archive (#2996)

Documentation

• Add equivalent prek.toml examples throughout the documentation (#2979)

Contributors

• @​connorbrinton
• @​j178

0.5.9

Released on 2026-10-30.

Enhancements

• Add normalize-indentation builtin hook (#2967)
• Allow overriding the uv install version (#2923)
• Embed dependency metadata in release binaries (#2976)
• Select musl Bun builds when glibc is unavailable (#2972)

Performance

• Improve workspace discovery performance (#2936)

Bug fixes

• Preserve clean-filtered files during stashing (#2915)

Contributors

• @​j178
• @​tchernobog

0.5.7

Released on 2026-10-21.

... (truncated)

Commits

• 516f5bd Bump version to 0.5.10 (#3001)
• 6201a32 Upgrade serde-saphyr to 2.1.0 (#2877)
• d08703e Infer the release version from Cargo metadata (#3000)
• f03096a Keep file checks out of rayon's recursive frames (#2999)
• c88a1cc Skip Node releases without a compatible archive (#2996)
• 10e7648 Avoid downloading Node prereleases by default (#2995)
• f1bfe9d Update prek hooks (#2993)
• 71e02db Make release publishing resumable (#2992)
• 84c3c67 Update CI tools (#2983)
• e4a4b4d Group CI tools and compatible Rust dependencies (#2991)
• Additional commits viewable in compare view

Updates @tauri-apps/cli from 2.11.5 to 2.12.4

Release notes

Sourced from @​tauri-apps/cli's releases.

@​tauri-apps/cli v2.12.4

[2.12.4]

Bug Fixes

• 136a28eaa (#16305 by @​Chaosnico9000) Skip the --target validation when rustup target list fails, e.g. when rustup is on PATH but has no toolchain installed, instead of rejecting every target as missing.
• 52081e04a (#16333 by @​amrbashir) Rename the misspelled choowHowToInstall NSIS language string to chooseHowToInstall. A custom language file in bundle.windows.nsis.customLanguageFiles that only defines the old name keeps working for now, but users should migrate to the new name.

Dependencies

• Upgraded to tauri-cli@2.12.4
• 4a6f51251 (#16317 by @​lazerg) Updated zip to v9 to fix RUSTSEC-2026-0367, RUSTSEC-2026-0368 and RUSTSEC-2026-0369.

@​tauri-apps/cli v2.12.3

[2.12.3]

Bug Fixes

• c95be4615 (#16287) Fix tauri ios xcode-script failing to find the Tauri project when Xcode inherits package manager environment variables from tauri ios dev --open, or when pnpm runs the CLI directly from the gen/apple folder.
• d62e5d9c0 (#16184) Fix NSIS installer leaving uninstall.exe and the installation directory behind when uninstalling an existing installation from the installer.

Dependencies

• Upgraded to tauri-cli@2.12.3
• 5a2953e55 (#16237) Updated NSIS to 3.13

@​tauri-apps/cli v2.12.2

[2.12.2]

Bug Fixes

• c48e1ca89 (#16246) On iOS, mark the Swift @_cdecl entry points that Rust links against as public (in the iOS API and in the plugin templates), so release builds made with Xcode 27 keep them global and link.

Dependencies

• Upgraded to tauri-cli@2.12.2
• fd319dd43 Update base64 to 0.23.

@​tauri-apps/cli v2.12.1

[2.12.1]

Enhancements

• 64bfdd909 (#16165 by @​Legend-Master) Ignore src-tauri in tauri plugin init example template

Dependencies

• Upgraded to tauri-cli@2.12.1

Commits

• 993038c apply version updates (#16303)
• 0007a43 fix(macos-sign) Also list iPhone Distribution/Developer certs (#14838)
• 97ccd82 chore(deps): update rust crate zip to v9.0.5 (#16346)
• 5b50edd fix(api): type check dev tooling configs (#16353)
• cf40b73 chore(deps): update rust crate ico to 0.6 (#16348)
• d440abf chore(deps): update rust crate shared_child to v1.1.2 (#16308)
• 4c5593c chore(deps): update rust crate tower to v0.5.3 (#16309)
• a376abd chore(deps): update rust crate serde_json to v1.0.154 (#16307)
• 68e60c1 chore(deps): update dependency vitest to v5.0.5 (#16339)
• 9318ab8 chore(deps): update rust crate which to v8.0.6 (#16310)
• Additional commits viewable in compare view

Updates @types/node from 26.6.2 to 26.6.6

Commits

• See full diff in compare view

Updates js-yaml from 5.4.2 to 5.5.0

Changelog

Sourced from js-yaml's changelog.

[5.5.0] - 2026-10-16

Changed

• Updated argparse to v3.
• Updated development dependencies.

Fixed

• Correct percent-encoding of shorthand and verbatim tags.
• Reject ,, ], and } at the start of block plain scalars, #801.
• Report the exact position of non-printable characters in errors, #801.

[5.4.3] - 2026-10-06

Fixed

• Fixed loading a whitespace-only block scalar followed by a less indented line, #802.

Commits

• cb62b2d 5.5.0 released
• 87aed90 Deps bump
• 3aec511 Fix error positions for non-printable characters, #801
• 11aa483 Reject flow indicators at the start of block plain scalars, #801
• 339d8e0 Refactor tag encoder and decoder to match the YAML specification
• 7832624 5.4.3 released
• 0cbb471 Fix whitespace-only block scalar followed by a less indented line, close #802
• 30108cc Parse the first block mapping key once (#800)
• See full diff in compare view

Updates smol-toml from 1.8.0 to 1.9.1

Release notes

Sourced from smol-toml's releases.

v1.9.1

What's Changed

• fix: reject invalid extra exponent sign by @​cyyynthia

Full Changelog: squirrelchat/smol-toml@v1.9.0...v1.9.1

v1.9.0

Huge update!!! This is most likely the largest update the library received since its release, with lots of new features and improvements.

Performance improvements

Significant parts of the internal parse logic have been rewritten, improving performance by 1.5x-2x. The library was already comfortably ahead of the others, but it is now faster than ever, sitting at 4x faster parse performance than the closest maintained implementation.

Problematic code paths have also been replaced by safer implementations, solving potential DoS vectors. See GHSA-r4xh-jqrq-34v2.

Note: the objects returned by the library now have a null prototype. This is a transparent change for 99.9% of users, and is one of the most significant contributors to the major performance gains in this version.

Full Temporal support

Version 1.8.0 brought support for Temporal in stringify; now the library is also able to emit Temporal objects instead of its own ad-hoc TomlDate object. It is not enabled by default, but it will become the default in v2. Enable by setting useLegacyDate: false in the parser's options.

Better Temporal support in stringify

Temporal support has been improved since it released: Temporal objects that cannot be represented (such as Temporal.PlainMonthDay) now throw an error (instead of silently emitting a bogus object).

A new option has been added to stringify to disallow Temporal objects that cannot be fully represented in TOML. This includes ZonedDateTime objects with a IANA timezone attached instead of a plain offset, and dates with a specific calendar value set. Enable by setting strictTemporal: true in the options.

Handling of unsafe keys

Since its release the library has been protected against prototype pollution attacks, setting properties like __proto__ using safe mechanisms that do not trigger prototype pollution. However, while the returned objects are safe on their own, they may become problematic if used carelessly.

Inspired by secure-json-parse, the library now offers a way to either drop unsafe properties from the returned object, or to throw an error and reject documents altogether. By default, these potentially unsafe keys are preserved and returned.

Miscellaneous updates

• Unicode BOM is now gracefully accepted and ignored.
• Table array headers are now properly checked again. Reported in #65.
• Closed certain gaps where invalid whitespace would be accepted. Reported in #61.
• Bogus local date and local time values with a UTC offset are no longer accepted.
• Certain error messages are more accurate and handle errors at line boundaries better.
• The default export of the lib is now formally deprecated; use a import * instead. Proposed in #50.
• On Node 20+, strings that contain lone surrogates are now normalised to well-formed strings.
• On Node 20+, keys that contain lone surrogates are now rejected.

Full Changelog: squirrelchat/smol-toml@v1.8.0...v1.9.0

Commits

• 69aa050 fix: actually properly fix exponent issues
• 7be7084 chore: version bump
• be3290d chore: upgrade deps
• 86c7613 fix: reject invalid extra exponent sign
• 6f9739a fix: gate [is|to]WellFormed (Node 18 compat)
• a73ca32 fix: no Temporal with toml-test when Node < 26
• 7727890 chore: version bump
• 641903d chore: rewrite README.md
• 2df14c5 fix(types): make it work if Temporal doesn't exist
• 3eaa44e chore: update benchmark harness
• Additional commits viewable in compare view

Updates wrangler from 4.135.0 to 4.158.0

Release notes

Sourced from wrangler's releases.

wrangler@4.158.0

Minor Changes

• #16186 f1d81a2 Thanks @​leostera! - Support local Artifacts across Wrangler, Vite, and Workers Vitest

  Set remote: false on an Artifacts binding to opt into the Miniflare simulator and persistent local repositories during development. Omitted remote continues to use the deployed resource, with a warning that changes affect real repositories; remote: true explicitly selects it. When remote bindings are disabled (wrangler dev --local, or Vite's remoteBindings: false), Artifacts bindings use the local simulator. Workers Vitest uses the local simulator when remote is omitted, so tests do not change real repositories by accident; set remote: true to test against the deployed resource. Local development does not require Cloudflare credentials, but does require Git 2.32 or newer on the host.

  In Miniflare's own options, Artifacts bindings route like every other binding: only dev.remote: true with a remote proxy connection uses the deployed resource. Wrangler and Vite resolve the deployed-by-default rule, and Workers Vitest its local default, before passing options to Miniflare.

Patch Changes

• #16700 dc35efb Thanks @​cjol! - Bump bundled brace-expansion to pick up security fixes

  These packages bundle brace-expansion (a dependency of minimatch), and the bundled versions were affected by published advisories. The bundles now include brace-expansion 2.1.7 (from 2.0.1) and 5.0.12 (from 5.0.5). Normal glob patterns expand as before; only the pathological patterns targeted by the advisories are handled differently.

• #16700 dc35efb Thanks @​cjol! - Bump bundled fast-xml-parser from 4.4.1 to 4.5.5 to pick up security fixes

  Miniflare bundles fast-xml-parser into its local R2 S3 API, and Wrangler bundles it through the AWS SDK used by wrangler pipelines. Version 4.4.1 is affected by several published advisories, and 4.5.5 includes their fixes. XML handling does not change.

• #16700 dc35efb Thanks @​cjol! - Bump bundled minimatch from 5.1.6 to 5.1.9 to pick up security fixes

  These packages bundle minimatch, and 5.1.6 is affected by published ReDoS advisories. Version 5.1.9 includes the fixes. 5.1.8 is skipped because it broke recursive ** matching, which D1's migrations_pattern relies on.

• #16700 dc35efb Thanks @​cjol! - Bump bundled shell-quote from 1.10.0 to 1.11.0 to pick up a security fix

  shell-quote is bundled into Wrangler, which uses it to parse and quote shell commands such as custom build and Pages dev commands. Version 1.10.0 is affected by a published advisory, and 1.11.0 includes the fix. Command parsing does not change.

• #16700 dc35efb Thanks @​cjol! - Bump bundled yaml from 2.8.1 to 2.9.0 to pick up a security fix

  yaml is bundled into Wrangler, which uses it to show container application details. Version 2.8.1 is affected by a published advisory, and versions from 2.8.3 onwards include the fix. Output does not change.

• #16688 fa3edb3 Thanks @​FlorentCollin! - Use the account_id from the configuration file in wrangler d1 migrations list --remote

  Before this change, the command ignored the account_id in the configuration file. When your login had access to more than one account, the command failed in non-interactive mode. In interactive mode, it asked you to select an account. The command now uses the configured account_id, as wrangler d1 migrations apply does.

• #16695 b2061f4 Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-04

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #16695 b2061f4 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20261103.1	^5.20261104.1
  workerd	1.20261103.1	1.20261104.1

• #16306 36e64f2 Thanks @​efalcao! - Report Cloudflare Access login redirects on remote bindings instead of looping until "Too many redirects"

... (truncated)

Commits

• c579d50 Version Packages (#16681)
• f1d81a2 [miniflare] Enable local Artifacts in development tools [3/3] (#16186)
• dc35efb Bump dependencies to clear 101 Dependabot alerts (#16700)
• 4d88a45 [miniflare] Stabilize Artifacts integration tests on Windows (#16693)
• 0083f80 [wrangler] Harden the local KV pagination regression test (#16697)
• fa3edb3 [wrangler] Use config account_id in d1 migrations list --remote (#16688)
• 9a0732c Version Packages (#16654)
• 44d1ee4 fix(wrangler): stop wrangler delete orphaning Container applications (#16011)
• 8ac43df Require explicit route metadata flags when downloading Worker configuration (...
• 680666e Version Packages (#16646)
• Additional commits viewable in compare view

Updates @react-router/node from 8.4.0 to 8.5.1

Release notes

Sourced from @​react-router/node's releases.

v8.5.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v851

v8.5.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v850

Changelog

Sourced from @​react-router/node's changelog.

v8.5.1

Patch Changes

• Updated dependencies:
  • react-router@8.5.1

v8.5.0

Patch Changes

• Write file session data to a temporary file and rename it into place so concurrent commits of the same session can no longer corrupt its file (#15620)
  • Preserve existing session file permissions when replacing the file
• Updated dependencies:
  • react-router@8.5.0

Commits

• a2783e6 Release v8.5.1 (#15656)
• 4fe4525 Release v8.5.0 (#15515)
• f94a829 fix(node): write file sessions atomically (#15620)
• See full diff in compare view

Updates @react-router/serve from 8.4.0 to 8.5.1

Release notes

Sourced from @​react-router/serve's releases.

v8.5.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v851

v8.5.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v850

Changelog

Sourced from @​react-router/serve's changelog.

v8.5.1

Patch Changes

• Avoid writing a blank line to stderr when the server shuts down successfully (#15641)
• Updated dependencies:
  • react-router@8.5.1
  • @react-router/express@8.5.1
  • @react-router/node@8.5.1

v8.5.0

Unstable Changes

⚠️ Unstable features are not recommended for production use

• Support API-only builds in react-router-serve by serving client documents and forwarding data and route discovery requests to the React Router runtime (#15601)
  • Serve prerendered documents when available and use the generated SPA fallback for non-prerendered paths

Patch Changes

• Updated dependencies:
  • react-router@8.5.0
  • @react-router/express@8.5.0
  • @react-router/node@8.5.0

Commits

• a2783e6 Release v8.5.1 (#15656)
• 43038ef Stabilize integration test environments and reduce expected logs (#15641)
• eb51758 chore: format
• 4fe4525 Release v8.5.0 (#15515)
• 9d6468d Support API-only server builds with prerendering (#15601)
• See full diff in compare view

Updates fumadocs-core from 16.15.12 to 16.18.4

Release notes

Sourced from fumadocs-core's releases.

fumadocs@16.18.4

• @​fumadocs/base-ui@​16.18.4
• fumadocs-core@16.18.4
• fumadocs-ui@16.18.4

Links to Tabs and Accordions with Non-ASCII IDs

• Tabs, Accordions and TypeTable decode the URL hash before matching it, so links to an id with non-ASCII characters (e.g. #标签-cpp) open the tab or accordion.

fumadocs@16.18.3

• @​fumadocs/base-ui@​16.18.3
• fumadocs-core@16.18.3
• fumadocs-ui@16.18.3

GitHub links to bracketed paths

• editOnGithub of DocsPage opens files under folders like [slug].

Root Folders of a Type in the Spacious Sidebar

• The Spacious sidebar switches between root folders of a type (root: 'version') below the section switcher, in one control.
• A root folder that only contains folders gets a tab, linking to its first page.

Frontmatter and Meta Files in Code

• An MDX page can export frontmatter, merged into its frontmatter and validated by the schema. On a dynamic page, it reads the params as props.
• Meta files can be modules, like meta.ts. The meta file of a dynamic folder can export a function of the folder's params.

Processed Markdown

• Removed content, like imports, no longer leaves blank lines.

Path params and <show>

• A folder or file named [name] makes a page for each value listed in staticParams of its meta file or frontmatter.
• Each page is compiled for its params, read as props, and a file at a static path replaces the page of its value.
• <show when={...}> shows content on a condition. Conditions on params and inlined env vars are decided before headings, TOC, search and Markdown.
• The define option of Remark Show sets the values resolved at build time, like Vite's define, also per page.
• Custom sources give a dynamic file dataAt(), and getStaticParams() lists its params from any storage.

Rendering Inline Styles

• Inline styles follow hast-util-to-jsx-runtime 2.3.7: property names are lowercased, custom properties keep their case, and only url() keeps a ; inside parentheses.

fumadocs@16.18.2

• @​fumadocs/base-ui@​16.18.2
• fumadocs-core@16.18.2
• fumadocs-ui@16.18.2

Floating Ask AI button in docs layouts

... (truncated)

Commits

• 9cabb86 Version Packages (#3805)
• dbe5d1f perf(cli): bundle magic-string, drop picocolors and @​fuma-cli/interactive
• 1ccde51 Merge pull request #3803 from lord-0011/fix/decode-url-hash-tabs-accordion
• f1ee2fb perf(cli): parse with Babel, no native dependencies
• ceaca34 Merge pull request #3801 from fuma-nama/tegami/version-packages
• afb548e perf(cli): bundle fuma-cli, parse with yuku, drop zod
• 86b93c7 docs: introduction page to choose a framework, framework menu on mobile, fram...
• b39f729 fix(mdx): meta files with the macro on Vite
• 3d29724 Version Packages (#3795)
• 4183b34 fix: encode file paths in GitHub links
• Additional commits viewable in compare view

Updates fumadocs-mdx from 15.4.3 to 15.5.3

Release notes

Sourced from fumadocs-mdx's releases.

fumadocs-mdx@15.5.3

Meta Files with the Macro on Vite

• Vite builds with the React plugin load JSON meta files of macro collections again.
• The macro reports options set through a spread, instead of ignoring them.

fumadocs-mdx@15.5.2

Frontmatter and Meta Files in Code

• An MDX page can export frontmatter, merged into its frontmatter and validated by the schema. On a dynamic page, it reads the params as props.
• Meta files can be modules, like meta.ts. The meta file of a dynamic folder can export a function of the folder's params.

Path params and <show>

• A folder or file named [name] makes a page for each value listed in staticParams of its meta file or frontmatter.
• Each page is compiled for its params, read as props, and a file at a static path replaces the page of its value.
• <show when={...}> shows content on a condition. Conditions on params and inlined env vars are decided before headings, TOC, search and Markdown.
• The define option of Remark Show sets the values resolved at build time, like Vite's define, also per page.
• Custom sources give a dynamic file dataAt(), and getStaticParams() lists its params from any storage.

fumadocs-mdx@15.5.1

Components per page in press plugins

• The press plugins of Fumadocs MDX, Obsidian, Notion and Sanity accept components as a function of the page, typed by the pages of the site.

fumadocs-mdx@15.5.0

Aliases in macro collections on Vite

• Collections of fumadocs-mdx/macro resolve the Vite aliases of your app, like resolve.tsconfigPaths.

Framework plugin

• Added mdxPlugin() as the default export of fumadocs-mdx/press: it renders the pages of Fumadocs MDX collections in frameworks running fumadocs-core/framework/plugin, with your MDX components and relative links resolved.

Faster Vite RSC builds

• Vite builds with React Server Components compile MDX files faster.

fumadocs-mdx@15.4.10

remarkInclude in fumadocs-core

<include> moved from Fumadocs MDX to fumadocs-core/mdx-plugins/remark-include, a unified plugin for any MDX or Markdown pipeline.

• fumadocs-mdx/config still exports remarkInclude, forwarded from fumadocs-core.
• getProcessor parses included files by their format, like a .md file included in an .mdx page.
• Headings in an included section get IDs unique among the page's own headings.
• Circular includes throw instead of hanging, and included code files no longer end with an empty line.
• fumadocs-mdx requires fumadocs-core 16.17.8.

fumadocs-mdx@15.4.9

[github-actions]

📦 Semifold release plan

Plan calculated through commit 680eabc.

Note

This pull request does not introduce any changesets.

After this pull request is merged into main, the release workflow will run and publish any prepared package versions that are not yet available in their registry.

This comment updates automatically as the pull request changes.