Skip to content

Bump the "dependencies" group with 1 update across multiple ecosystems - #17

Merged
diazdesandi merged 1 commit into
mainfrom
dependabot/dependencies-9ec8b1ea74
Oct 31, 2026
Merged

Bump the "dependencies" group with 1 update across multiple ecosystems#17
diazdesandi merged 1 commit into
mainfrom
dependabot/dependencies-9ec8b1ea74

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 31, 2026

Copy link
Copy Markdown
Contributor

Bumps the dependencies group with 7 updates:

Package From To
fumadocs-core 16.17.7 16.17.8
fumadocs-mdx 15.4.9 15.4.10
lucide-react 1.61.0 1.62.0
next 16.4.2 16.4.3
pele 1.9.0 1.12.0
@biomejs/biome 2.6.2 2.6.3
postcss 8.5.31 8.5.32

Updates fumadocs-core from 16.17.7 to 16.17.8

Release notes

Sourced from fumadocs-core's releases.

fumadocs@16.17.8

  • @​fumadocs/base-ui@​16.17.8
  • fumadocs-core@16.17.8
  • fumadocs-ui@16.17.8

Bring your own highlighter

Shiki stays the default, and isn't loaded when you highlight code with another highlighter.

  • fumadocs-core/highlight exports a Highlighter interface, created with createHighlights() from fumadocs-core/highlight/highlights (@pierre/highlights) or createShikiHighlighter() from fumadocs-core/highlight/shiki, override() creates one with other options.
  • rehypeCodeFromHighlighter from fumadocs-core/mdx-plugins/rehype-code.core highlights code blocks with a highlighter, or a function creating one with the transformers of Fumadocs. createRehypeCode is deprecated, Sätteri has rehypeCodeFromHighlighter in @fumadocs/satteri/rehype-code. Pass transformerTwoslash() in its transformers option to analyze Twoslash blocks in batches.
  • createServerCodeBlock() and createDynamicCodeBlock() in Fumadocs UI create code blocks from a highlighter. Dynamic code blocks are highlighted on the server too.
  • toJsx() from fumadocs-core/utils/hast-to-jsx converts hast into React elements like toJsxRuntime() of hast-util-to-jsx-runtime, MDX nodes through an evaluator, over 10x faster on highlighted code, whose spans render as one HTML string. Every Fumadocs renderer uses it, hast-util-to-jsx-runtime is no longer a dependency.
  • Twoslash loads the languages of code blocks in popups before highlighting, an unknown language there no longer fails the code block.
  • OpenAPI Standalone highlights code blocks with Highlights, in its server-rendered pages too.
  • The page factories of OpenAPI, GraphQL and AsyncAPI, type tables, createPython(), createPythonComponents(), localHtml() and the shadcn createSnippet() take a highlighter.
  • Deprecated shiki and shikiOptions of the API pages and shiki of type tables, pass a highlighter instead.
  • Integrations require fumadocs-core 16.17.8, the API pages and shadcn also require fumadocs-ui 16.17.8.

remarkInclude in fumadocs-core

<include> moved from Fumadocs MDX to fumadocs-core/mdx-plugins/remark-include, a unified plugin for any MDX or Markdown pipeline.

  • fumadocs-mdx/config still exports remarkInclude, forwarded from fumadocs-core.
  • getProcessor parses included files by their format, like a .md file included in an .mdx page.
  • Headings in an included section get IDs unique among the page's own headings.
  • Circular includes throw instead of hanging, and included code files no longer end with an empty line.
  • fumadocs-mdx requires fumadocs-core 16.17.8.

Processed Markdown links page-relative images at their served URLs

  • Images imported by Remark Image get the URLs bundlers serve them at in Remark LLMs, instead of their relative paths
  • Stringifiers output JS expressions with s.expression(), for Markdown only known at runtime
  • Search records of included content with images are no longer cut
  • The Sätteri preset only imports images in bundlers, at runtime it resolves their sizes like the MDX preset
Commits
  • 97e62b9 Version Packages (#3733)
  • ccae3e0 fix(core): improve shiki compat
  • 96a571b chore: bump deps
  • 097b5cc fix: workaround ts 7.1 bugs
  • 2fced92 feat(twoslash,story,typescript): use typescript 7.1
  • 6e2a75e perf(core): improve transformer performance
  • 4f5cbd3 perf(core): rewrite hast-util-to-jsx-runtime
  • f0d8981 feat(*): new highlighter API + highlights
  • bc86bbb fix(core,satteri): use served URLs of imported images in processed Markdown (...
  • cfdccc8 feat(core): support remark-include at core layer (#3740)
  • Additional commits viewable in compare view

Updates fumadocs-mdx from 15.4.9 to 15.4.10

Release notes

Sourced from fumadocs-mdx's releases.

fumadocs-mdx@15.4.10

remarkInclude in fumadocs-core

<include> moved from Fumadocs MDX to fumadocs-core/mdx-plugins/remark-include, a unified plugin for any MDX or Markdown pipeline.

  • fumadocs-mdx/config still exports remarkInclude, forwarded from fumadocs-core.
  • getProcessor parses included files by their format, like a .md file included in an .mdx page.
  • Headings in an included section get IDs unique among the page's own headings.
  • Circular includes throw instead of hanging, and included code files no longer end with an empty line.
  • fumadocs-mdx requires fumadocs-core 16.17.8.
Commits
  • 97e62b9 Version Packages (#3733)
  • ccae3e0 fix(core): improve shiki compat
  • 96a571b chore: bump deps
  • 097b5cc fix: workaround ts 7.1 bugs
  • 2fced92 feat(twoslash,story,typescript): use typescript 7.1
  • 6e2a75e perf(core): improve transformer performance
  • 4f5cbd3 perf(core): rewrite hast-util-to-jsx-runtime
  • f0d8981 feat(*): new highlighter API + highlights
  • bc86bbb fix(core,satteri): use served URLs of imported images in processed Markdown (...
  • cfdccc8 feat(core): support remark-include at core layer (#3740)
  • Additional commits viewable in compare view

Updates lucide-react from 1.61.0 to 1.62.0

Release notes

Sourced from lucide-react's releases.

Version 1.62.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.61.0...1.62.0

Commits
  • 6657faa chore(deps-dev): bump vite from 8.3.2 to 8.3.3 (#5052)
  • 1802f33 feat(lucide-react): add package exports for per-icon imports without changing...
  • 20aef31 chore(packages): Update sponsors (#5034)
  • See full diff in compare view

Updates next from 16.4.2 to 16.4.3

Release notes

Sourced from next's releases.

v16.4.3

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • [lts-active] Fix extensionless Google font URLs in both bundlers (#100277)
  • [lts-active] Don't load the app-page runtime in proxy.ts (#100423)
  • [lts-active] Revert "Turbopack: loader change invalidation (#95732)" (#100438)
  • [lts-active][cd] Gate release bot credentials behind GitHub environments (#100123)
  • [lts-active] test: Pin react-virtualized (#100545)
  • [lts-active][cd] Move release un-draft to a follow-up job in bot-autonomous (#100572)
  • [lts-active] Keep OpenTelemetry request traces together (#100349, #100294, #100324, #100350, #100552, #100583) (#100542)
  • [lts-active] Avoid loading standalone React in server bootstrap (#100610)

Credits

Huge thanks to @​mischnic, @​lukesandberg, @​acdlite, @​eps1lon, and @​sokra for helping!

Commits
  • 29bbeab v16.4.3
  • 5117201 [lts-active] Avoid loading standalone React in server bootstrap (#100610)
  • 37d603b [lts-active] Keep OpenTelemetry request traces together (#100349, #100294, #1...
  • cf9d27d [lts-active][cd] Move release un-draft to a follow-up job in bot-autonomous (...
  • 3f6a632 [lts-active] test: Pin react-virtualized (#100545)
  • f715bba [lts-active][cd] Gate release bot credentials behind GitHub environments (#10...
  • c864c78 [lts-active] Revert "Turbopack: loader change invalidation (#95732)" (#100438)
  • f3ff943 [lts-active] Don't load the app-page runtime in proxy.ts (#100423)
  • f697cf5 [lts-active] Fix extensionless Google font URLs in both bundlers (#100277)
  • See full diff in compare view

Updates pele from 1.9.0 to 1.12.0

Release notes

Sourced from pele's releases.

1.12.0

  • Labels on fills a diagram defines with style, classDef, or a sequence rect or box use whichever of --pele-fg-on-light and --pele-fg-on-dark contrasts more with the fill, so they stay readable in dark themes. Edges and arrows on those fills stay readable too. #29
  • Custom fills on subgraphs, composite states, block composites, ER subgraphs and use case boundaries render at full opacity instead of half opacity. #29
  • Percent escapes such as %20 and %26 are preserved in links.

1.11.0

  • The new monospace option lists the parts of a diagram to draw in the monospace font, sized to fit: class members, ER attributes, TreeView files and sequence messages. #12 #96
  • Sequence: with maxWidth set, long messages use the spare width when that fits them on fewer lines. #18 #88
  • Treemap: all nodes appear, including boxes in sections too small for their header. Labels fit at the font size their class sets. Tooltips show a box's full name when its label is cut short, and its section's name when the section header is hidden. Crowded treemaps use tighter spacing. #91
  • Block: labels on edges between the same two blocks stack along the edge instead of overlapping. When they don't fit, the gap between the blocks grows. #92
  • Zoom: the first click after a pinch or a long touch pan is no longer ignored. #49

1.10.1

  • Flowchart subgraphs and agentflow flows ignore their own direction when their nodes link to nodes outside them. They use their parent's direction, as in Mermaid. #82
  • Diagrams narrow to leave room for the zoom buttons when the buttons would cover their text. #53
  • Names that start with a keyword are read in full: set-theory and text-books in Venn, circles, trueNorth and titles in Radar, and names like titles in architecture, git, event modeling, TreeView, treemap and railroad diagrams. These names used to cause syntax errors. TreeView and railroad could drop the keyword instead, so title.txt appeared as .txt. #65 #62
  • Errors at the end of the input point just after the last line with content, instead of one line past the end or after trailing comments and blank lines. #61
  • Sankey: blanks at the start and end of each row are ignored. #58
  • Quadrant: empty quadrant labels no longer block point labels from their preferred position. #57

1.10.0

  • %% comments no longer remove the character before it, so set A%% note keeps A and A->>B:%% note keeps the :. This applies to Venn, sequence, XY chart, quadrant, gantt, journey and timeline diagrams. A line that worked only because a comment removed a stray : or , is now a syntax error. #64
  • title with nothing after it on its line sets no title, instead of taking the next line as the title and dropping it. This applies to Venn, sequence, gantt, C4, journey and timeline diagrams. #66
  • Error messages show entity codes as written, such as [#35](https://github.com/obsidianmd/pele/issues/35);x, instead of internal placeholders. Lines and columns count the source as written, including front matter, comments, directives and blank lines. #63 #67 #73
  • Sankey: a value that doesn't start with a number, such as abc, is a syntax error instead of an empty flow. 50% still reads as 50. #60
  • Sankey: entity codes in prefix and suffix are decoded in value labels, as in tooltips. #59
  • XY chart: explicit y bounds that both clamp to the same limit fall back to the data range instead of drawing NaN. #56
  • Radar: values near the largest double are drawn in proportion instead of at the center. #74
  • The edge-limit error now states only the limit. #52

1.9.1

  • Rendered SVG no longer contains U+FFFE, U+FFFF or unpaired surrogate halves, so it is always valid XML. #72
  • Style values that contain control characters, or other characters XML doesn't allow, are now ignored instead of written with those characters removed.
  • Links and images now strip U+FFFE, U+FFFF and unpaired surrogate halves before their scheme is checked, as they already did for control characters.
  • Internal links are checked against the note name as a browser reads it, and get no href if that check fails. Their href and data-href are unchanged otherwise.
  • Event modeling: long data, note and specification lines now wrap without splitting emoji.
Commits
  • 8aff183 Release: 1.12.0
  • 7538316 Docs: Shorten the note on labels on fills a diagram sets
  • 5237ab7 SVG: Check edges against fills without reading their paths back
  • 4986bd4 Sequence: Read each rect and box color once per diagram
  • 91033e6 SVG: Remember the label color for each style
  • fa7f241 SVG: Count a style's opacity toward its fill
  • 4bc1a88 Docs: Describe edges inside one fill
  • cfbac60 C4: Draw relations inside one fill in its label color
  • bbbf17d Agentflow: Draw edges inside one fill in its label color
  • 440d9e8 Usecase: Draw edges inside one fill in its label color
  • Additional commits viewable in compare view

Updates @biomejs/biome from 2.6.2 to 2.6.3

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.6.3

2.6.3

Patch Changes

  • #12275 807e616 Thanks @​dyc3! - Added the new nursery rule noArraySortForMinMax, which reports sorting an array only to read its smallest or largest value. Use Math.min() or Math.max() instead.

    const minimum = array.toSorted((a, b) => a - b)[0];

  • #12432 cf61682 Thanks @​dyc3! - Added the nursery rule noBooleanSortComparator, which reports sort comparators that return a boolean instead of a number. For example, array.sort((a, b) => a > b) never puts the first item before the second, so the array isn't sorted correctly.

  • #12304 b4654c5 Thanks @​dyc3! - Added the new nursery rule noEagerArrayMethodsInLoops, which reports .map() and .filter() calls in the header of for...of loops. These calls build a new array that is only used by the loop.

    for (const name of users.map((user) => user.name)) {
  console.log(name);
}

  • #12121 66c3791 Thanks @​dyc3! - Added the nursery rule noNewRequire, which disallows calling require with new, such as new require("app-header").

  • #12316 34b520d Thanks @​dyc3! - Added the new nursery rule noObsoleteAttributes, which disallows obsolete attributes on HTML elements and suggests what to use instead.

    <table bgcolor="#ffffff" cellpadding="5"></table>

  • #12258 cce2385 Thanks @​dyc3! - Added the nursery rule noPathConcat, which disallows building file paths and URLs by joining strings to __dirname, __filename, import.meta.dirname, import.meta.filename, or import.meta.url.

    const fullPath = __dirname + "/foo.js"; // reported

  • #12287 e12ad78 Thanks @​dyc3! - Added the new nursery rule noPlaywrightNthMethods, which disallows selecting Playwright elements by position with first(), last(), and nth(). A test that relies on the position of an element can act on a different element when the page changes.

    await page.locator("button").first().click();

  • #12343 62ad123 Thanks @​vibbix! - Added the nursery rule noSelfNestedLayer, which disallows nesting a cascade layer inside a layer with the same name. Layer names inside an @layer block are relative to it, so the inner layer below creates the sublayer components.components instead of adding to components.

    @layer components {
  @layer components {
    .button {
      color: red;
    }

... (truncated)

Commits

Updates postcss from 8.5.31 to 8.5.32

Release notes

Sourced from postcss's releases.

8.5.32

  • Fixed Input#origin() without opts.from (by @​wleeaf).
  • Fixed final-word lookup without source offsets (by @​Don-Yin).
  • Fixed explicit start in Warning#toString() (by @​Don-Yin).
  • Fixed Promise semantics in LazyResult#finally() (by @​Don-Yin).
Changelog

Sourced from postcss's changelog.

8.5.32

  • Fixed Input#origin() without opts.from (by @​wleeaf).
  • Fixed final-word lookup without source offsets (by @​Don-Yin).
  • Fixed explicit start in Warning#toString() (by @​Don-Yin).
  • Fixed Promise semantics in LazyResult#finally() (by @​Don-Yin).
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the dependencies group with 7 updates
d60034c 
Bumps the dependencies group with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [fumadocs-core](https://github.com/fuma-nama/fumadocs) | `16.17.7` | `16.17.8` |
| [fumadocs-mdx](https://github.com/fuma-nama/fumadocs) | `15.4.9` | `15.4.10` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.61.0` | `1.62.0` |
| [next](https://github.com/vercel/next.js) | `16.4.2` | `16.4.3` |
| [pele](https://github.com/obsidianmd/pele) | `1.9.0` | `1.12.0` |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.6.2` | `2.6.3` |
| [postcss](https://github.com/postcss/postcss) | `8.5.31` | `8.5.32` |


Updates `fumadocs-core` from 16.17.7 to 16.17.8
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs@16.17.7...fumadocs@16.17.8)

Updates `fumadocs-mdx` from 15.4.9 to 15.4.10
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs-mdx@15.4.9...fumadocs-mdx@15.4.10)

Updates `lucide-react` from 1.61.0 to 1.62.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.62.0/packages/lucide-react)

Updates `next` from 16.4.2 to 16.4.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.4.2...v16.4.3)

Updates `pele` from 1.9.0 to 1.12.0
- [Release notes](https://github.com/obsidianmd/pele/releases)
- [Commits](obsidianmd/pele@1.9.0...1.12.0)

Updates `@biomejs/biome` from 2.6.2 to 2.6.3
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/CHANGELOG_v1.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.6.3/packages/@biomejs/biome)

Updates `postcss` from 8.5.31 to 8.5.32
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.31...8.5.32)

---
updated-dependencies:
- dependency-name: fumadocs-core
  dependency-version: 16.17.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: fumadocs-mdx
  dependency-version: 15.4.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: lucide-react
  dependency-version: 1.62.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: next
  dependency-version: 16.4.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: pele
  dependency-version: 1.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: "@biomejs/biome"
  dependency-version: 2.6.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: postcss
  dependency-version: 8.5.32
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@vercel

vercel Bot commented Oct 31, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment
Project Deployment Actions Updated
website Ignored Ignored Preview Oct 31, 2026 4:30am UTC

Request Review

@dependabot
dependabot Bot requested a review from a team as a code owner October 31, 2026 04:30
@dependabot dependabot Bot added dependencies Updates a dependency javascript Pull requests that update javascript code labels Oct 31, 2026
@strix-security

strix-security Bot commented Oct 31, 2026 •
edited
Loading

Copy link
Copy Markdown

Strix Security Review

✅ No open security findings.

PR summary: Bumps seven npm dependencies (including `next`, `fumadocs-core`, `fumadocs-mdx`, `pele`, `lucide-react`, `@​biomejs/biome`, and `postcss`) to their latest patch/minor versions and updates the `bun.lock` entries accordingly.

Review summary

This pull request is a Dependabot group update that only raises version pins for seven npm packages (fumadocs-core, fumadocs-mdx, lucide-react, next, pele, @biomejs/biome, postcss) in package.json and refreshes the corresponding entries and integrity hashes in bun.lock. No application source, route handlers, authentication logic, or runtime configuration is touched, and no dependency manifests gain new install hooks, registry redirects, or added packages — the only resolution changes beyond the bumped packages are the transitive chokidar update required by fumadocs-mdx and a normal nested lucide-react copy under the pinned fumadocs-ui alias. No security-relevant change to review.

Review 1 on this PR · d60034c · requested Oct 31 04:30 UTC when the PR was opened

Reviewed by Strix
Re-run review · Configure security review settings

@coderabbitai

coderabbitai Bot commented Oct 31, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: d4765f65-726f-4375-9e24-8e4c33ccbe25

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

@diazdesandi
diazdesandi merged commit 82d0ee7 into main Oct 31, 2026
5 checks passed
@diazdesandi
diazdesandi deleted the dependabot/dependencies-9ec8b1ea74 branch October 31, 2026 04:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@diazdesandi diazdesandi

Labels

dependencies Updates a dependency javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@diazdesandi