[dependabot]

Updates the requirements on zip to permit the latest version.
Updates zip to 9.1.2

Changelog

Sourced from zip's changelog.

9.1.2 - 2026-10-26

🐛 Bug Fixes

• preserve the file kind (normal/directory/symlink) in raw_copy_file_touch (#1179)
• (write) reject a Unicode Path extra field that would rename the entry (#1177)
• (extract) prevent following symbolic links during file creation (#1116)

9.1.1 - 2026-10-25

🐛 Bug Fixes

• store the raw count instead of a bool (#1174)
• preserve extra fields in raw_copy_file_touch (#1172)
• (write) flag a non-ASCII file comment as UTF-8 when writing it (#1160)
• (write) reject duplicate names in merge_archive, blank stale footers, and add opt-in extra-field validation (#1159)

9.1.0 - 2026-10-24

🚀 Features

• (read) enforce header consistency on extract_with_options and expose duplicate name detection (#1109)
• Add borrowing inner method to reader wrappers (#1050)
• add with_size_limit to ExtractOptions to limit total declared uncompressed size (#1019)
• add file_names_raw iterator (#1082)

🐛 Bug Fixes

• raw_copy_file keeps an entry's name bytes and UTF-8 flag as stored (#1124)
• (write) prevent seek panic on streaming writer with comment (#1151)
• Accept bounded central directory digital signature record when enforcing header consistency in ZipStreamReader (#1134)
• apply unix permissions at creation (#1104)
• raw_copy_file should work with any extra fields (#1120)
• (read) avoid full-file forward scans and redundant allocations in central directory (#1142)
• don't enable typed-path's default std feature (#1112)
• ZIP64 size fields were being deep-copied incorrectly (via Copilot gpt-6-luna) (#1107)
• resolve decoded CP437 member names (#1080) (#1085)
• Debug assertion doesn't account for length of archive comment (#1097)

🚜 Refactor

• Lazy instantiation for all decompressors (#1046) (#1047)

⚡ Performance

• (write) reuse the DEFLATE compressor across entries (#1119)

⚙️ Miscellaneous Tasks

• Fix reference to nonexistent variable on #[cfg(not(any(unix, windows)))] (#1138)

... (truncated)

Commits

• 662ae13 chore: release v9.1.2 (#1176)
• e221cd0 fix: preserve the file kind (normal/directory/symlink) in raw_copy_file_touch...
• 525d81e fix(write): reject a Unicode Path extra field that would rename the entry (#1...
• dcc28ed ci(fuzz): Fixes for fallback when Rust nightly is updated mid-run (#1178)
• 68e7e84 fix(extract): prevent following symbolic links during file creation (#1116)
• b7201ce chore: release v9.1.1 (#1173)
• 67b3e52 fix: store the raw count instead of a bool (#1174)
• 9d710d3 ci: Share cargo-afl build across workflows (#1167)
• d6c0278 fix: preserve extra fields in raw_copy_file_touch (#1172)
• c3232c4 test: cover unreserved validation for prepared files (#1169)
• Additional commits viewable in compare view

Bumps the infrastructure group with 42 updates:

Package	From	To
toml	5.0.0	5.0.1
@biomejs/biome	2.5.14	2.6.3
@j178/prek	0.5.3	0.5.7
@tauri-apps/cli	2.11.5	2.12.4
@types/node	26.6.2	26.6.5
js-yaml	5.4.2	5.5.0
smol-toml	1.8.0	1.9.1
wrangler	4.135.0	4.152.0
@react-router/node	8.4.0	8.5.0
@react-router/serve	8.4.0	8.5.0
fumadocs-core	16.15.12	16.17.8
fumadocs-mdx	15.4.3	15.4.10
fumadocs-ui	16.15.12	16.17.8
mermaid	12.0.0	12.2.0
react	19.3.0	19.3.1
react-dom	19.3.0	19.3.1
react-router	8.4.0	8.5.0
@react-router/dev	8.4.0	8.5.0
vite	8.3.0	8.3.5
@base-ui/react	1.8.0	1.9.0
@hookform/resolvers	5.9.1	6.0.0
@stepperize/react	8.0.0	8.0.1
@tauri-apps/api	2.11.1	2.12.4
@tauri-apps/plugin-dialog	2.7.3	2.8.3
@tauri-apps/plugin-fs	2.5.2	2.7.1
@tauri-apps/plugin-shell	2.3.6	2.5.0
@tauri-apps/plugin-updater	2.12.0	2.14.0
driver.js	1.8.0	1.10.2
es-toolkit	1.52.0	1.53.0
i18next	26.4.2	26.5.11
lucide-react	1.47.0	1.63.0
marked	18.0.13	18.1.1
monaco-editor	0.56.0	0.57.0
radix-ui	1.6.7	1.8.1
react-hook-form	7.88.0	7.91.0
react-i18next	17.0.14	17.1.9
zod	4.6.5	4.6.7
zustand	5.0.15	5.0.16
@playwright/test	1.63.0	1.64.1
@vitejs/plugin-react	6.1.1	6.1.2
globals	17.12.0	17.13.0
shadcn	4.21.0	4.22.1

Updates toml from 5.0.0 to 5.0.1

Changelog

Sourced from toml's changelog.

5.0.1 - October 12 2026

• Address four security advisories, each reachable by parsing untrusted input:
  • CVE-2026-114142, in which a crafted document could still write to Object.prototype. Two distinct key paths could render to the same bookkeeping string, letting an array-of-tables header clear the guard on an unrelated key, after which a dotted key could descend through a date value into its prototype chain. The compiler now records how each table was defined on the table itself rather than in string-keyed sets, so paths cannot collide and key paths can only descend through tables the compiler created.
  • CVE-2026-114143, in which dotted keys, table headers, and inline-table keys with many segments took quadratic time to resolve.
  • CVE-2026-114141, in which every array-of-tables header rescanned all paths defined so far, so documents with many such headers took quadratic time.
  • CVE-2026-114144, in which integer literals were converted to BigInt before any size check, so a multi-megabyte literal consumed super-linear CPU time before being rejected. Literals with more digits than any 64-bit integer are now rejected before conversion.

Commits

• 9ebfa69 5.0.1
• 22cf8bb Update changelog for 5.0.1
• 9d52e38 Reject integer literals too long for int64 before converting to BigInt
• 609c873 Track table origin on the table instead of in string-keyed path sets
• df2bd01 Add tests for advisories GHSA-h895-cgqg-jf52, GHSA-9j65-hcg3-gc64, GHSA-4qx8-...
• 1b2ac40 Update CHANGELOG with assigned CVE
• See full diff in compare view

Updates @biomejs/biome from 2.5.14 to 2.6.3

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.6.3

2.6.3

Patch Changes

• #12275 807e616 Thanks @​dyc3! - Added the new nursery rule noArraySortForMinMax, which reports sorting an array only to read its smallest or largest value. Use Math.min() or Math.max() instead.

  const minimum = array.toSorted((a, b) => a - b)[0];

• #12432 cf61682 Thanks @​dyc3! - Added the nursery rule noBooleanSortComparator, which reports sort comparators that return a boolean instead of a number. For example, array.sort((a, b) => a > b) never puts the first item before the second, so the array isn't sorted correctly.

• #12304 b4654c5 Thanks @​dyc3! - Added the new nursery rule noEagerArrayMethodsInLoops, which reports .map() and .filter() calls in the header of for...of loops. These calls build a new array that is only used by the loop.

  for (const name of users.map((user) => user.name)) {
    console.log(name);
  }

• #12121 66c3791 Thanks @​dyc3! - Added the nursery rule noNewRequire, which disallows calling require with new, such as new require("app-header").

• #12316 34b520d Thanks @​dyc3! - Added the new nursery rule noObsoleteAttributes, which disallows obsolete attributes on HTML elements and suggests what to use instead.

  <table bgcolor="#ffffff" cellpadding="5"></table>

• #12258 cce2385 Thanks @​dyc3! - Added the nursery rule noPathConcat, which disallows building file paths and URLs by joining strings to __dirname, __filename, import.meta.dirname, import.meta.filename, or import.meta.url.

  const fullPath = __dirname + "/foo.js"; // reported

• #12287 e12ad78 Thanks @​dyc3! - Added the new nursery rule noPlaywrightNthMethods, which disallows selecting Playwright elements by position with first(), last(), and nth(). A test that relies on the position of an element can act on a different element when the page changes.

  await page.locator("button").first().click();

• #12343 62ad123 Thanks @​vibbix! - Added the nursery rule noSelfNestedLayer, which disallows nesting a cascade layer inside a layer with the same name. Layer names inside an @layer block are relative to it, so the inner layer below creates the sublayer components.components instead of adding to components.

  @layer components {
    @layer components {
      .button {
        color: red;
      }

... (truncated)

Commits

• c5c3383 ci: release (#12500)
• 7bd38b7 feat(lint): add noVueWatchAfterAwait (#12385)
• 807e616 feat(lint): add noArraySortForMinMax (#12275)
• 407604d feat(lint): add useVueComponentIs (#12400)
• f748ec0 feat(lint): add noSvelteInternal (#12431)
• ab2eb9e feat(lint): add useBlockStatementOverIife (#12300)
• bf1a55a feat(lint): add useVueVOnExact (#12423)
• c371520 feat(lint): add useVueToggleInsideTransition (#12337)
• 8a5974a chore: add syntaxfm to sponsors (#12577)
• 0be8d10 feat(lint): add noUnsafeReturn (#12422)
• Additional commits viewable in compare view

Updates @j178/prek from 0.5.3 to 0.5.7

Release notes

Sourced from @​j178/prek's releases.

0.5.7

Release Notes

Released on 2026-10-21.

Enhancements

• Support system Rust toolchains without rustup (#2887)

Performance

• Use blocking file checks for CPU-heavy builtin hooks (#2910)

Other changes

• Update CA root crates and uv for the eMudhra intermediate CA compromise (#2919)

Contributors

• @​shaanmajid
• @​j178

Install prek 0.5.7

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install prek

Download prek 0.5.7

File	Platform	Checksum
prek-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
prek-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
prek-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
prek-x86_64-pc-windows-msvc.zip	x64 Windows	checksum

... (truncated)

Changelog

Sourced from @​j178/prek's changelog.

0.5.7

Released on 2026-10-21.

Enhancements

• Support system Rust toolchains without rustup (#2887)

Performance

• Use blocking file checks for CPU-heavy builtin hooks (#2910)

Other changes

• Update CA root crates and uv for the eMudhra intermediate CA compromise (#2919)

Contributors

• @​shaanmajid
• @​j178

0.5.6

Released on 2026-10-19.

Enhancements

• Add builtin hook check-commit-trailers (#2885)
• Add builtin hook check-signed-commit (#2725)

Performance

• Enable PGO for native release builds (#2890)
• Reduce hook process launches with balanced batches (#2907)
• Resolve hook commands before batching (#2840)

Bug fixes

• Accept UTF-8 BOM in check-json (#2879)
• Preserve unquoted dotted revisions in prek update (#2853)

Documentation

• Document standalone installer options (#2859)
• Update benchmarks for prek 0.5.5 (#2786)

Other changes

• Enable ICF for release builds (#2891)
• Update uv to 0.13.0 (#2856)

... (truncated)

Commits

• 8569a4a Bump version to 0.5.7 (#2920)
• c290bac Bump certifi from 2026.7.22 to 2026.10.19 (#2921)
• 40287b8 Temporarily skip Aliyun uv download in CI (#2922)
• 062c8a0 Update CA root crates and uv for the eMudhra intermediate CA compromise (#2919)
• 5b66378 Log download and archive extraction stages (#2917)
• c369353 Share tar extraction across compression formats (#2916)
• 1c82a0d Move managed Rust toolchain discovery into the installer (#2914)
• 2bf1958 Support system Rust toolchains without rustup (#2887)
• 812e80f Move shared hook helpers and rename run to concurrency (#2911)
• 615a001 Use blocking file checks for CPU-heavy builtin hooks (#2910)
• Additional commits viewable in compare view

Updates @tauri-apps/cli from 2.11.5 to 2.12.4

Release notes

Sourced from @​tauri-apps/cli's releases.

@​tauri-apps/cli v2.12.4

[2.12.4]

Bug Fixes

• 136a28eaa (#16305 by @​Chaosnico9000) Skip the --target validation when rustup target list fails, e.g. when rustup is on PATH but has no toolchain installed, instead of rejecting every target as missing.
• 52081e04a (#16333 by @​amrbashir) Rename the misspelled choowHowToInstall NSIS language string to chooseHowToInstall. A custom language file in bundle.windows.nsis.customLanguageFiles that only defines the old name keeps working for now, but users should migrate to the new name.

Dependencies

• Upgraded to tauri-cli@2.12.4
• 4a6f51251 (#16317 by @​lazerg) Updated zip to v9 to fix RUSTSEC-2026-0367, RUSTSEC-2026-0368 and RUSTSEC-2026-0369.

@​tauri-apps/cli v2.12.3

[2.12.3]

Bug Fixes

• c95be4615 (#16287) Fix tauri ios xcode-script failing to find the Tauri project when Xcode inherits package manager environment variables from tauri ios dev --open, or when pnpm runs the CLI directly from the gen/apple folder.
• d62e5d9c0 (#16184) Fix NSIS installer leaving uninstall.exe and the installation directory behind when uninstalling an existing installation from the installer.

Dependencies

• Upgraded to tauri-cli@2.12.3
• 5a2953e55 (#16237) Updated NSIS to 3.13

@​tauri-apps/cli v2.12.2

[2.12.2]

Bug Fixes

• c48e1ca89 (#16246) On iOS, mark the Swift @_cdecl entry points that Rust links against as public (in the iOS API and in the plugin templates), so release builds made with Xcode 27 keep them global and link.

Dependencies

• Upgraded to tauri-cli@2.12.2
• fd319dd43 Update base64 to 0.23.

@​tauri-apps/cli v2.12.1

[2.12.1]

Enhancements

• 64bfdd909 (#16165 by @​Legend-Master) Ignore src-tauri in tauri plugin init example template

Dependencies

• Upgraded to tauri-cli@2.12.1

@​tauri-apps/cli v2.12.0

... (truncated)

Commits

• 993038c apply version updates (#16303)
• 0007a43 fix(macos-sign) Also list iPhone Distribution/Developer certs (#14838)
• 97ccd82 chore(deps): update rust crate zip to v9.0.5 (#16346)
• 5b50edd fix(api): type check dev tooling configs (#16353)
• cf40b73 chore(deps): update rust crate ico to 0.6 (#16348)
• d440abf chore(deps): update rust crate shared_child to v1.1.2 (#16308)
• 4c5593c chore(deps): update rust crate tower to v0.5.3 (#16309)
• a376abd chore(deps): update rust crate serde_json to v1.0.154 (#16307)
• 68e60c1 chore(deps): update dependency vitest to v5.0.5 (#16339)
• 9318ab8 chore(deps): update rust crate which to v8.0.6 (#16310)
• Additional commits viewable in compare view

Updates @types/node from 26.6.2 to 26.6.5

Commits

• See full diff in compare view

Updates js-yaml from 5.4.2 to 5.5.0

Changelog

Sourced from js-yaml's changelog.

[5.5.0] - 2026-10-16

Changed

• Updated argparse to v3.
• Updated development dependencies.

Fixed

• Correct percent-encoding of shorthand and verbatim tags.
• Reject ,, ], and } at the start of block plain scalars, #801.
• Report the exact position of non-printable characters in errors, #801.

[5.4.3] - 2026-10-06

Fixed

• Fixed loading a whitespace-only block scalar followed by a less indented line, #802.

Commits

• cb62b2d 5.5.0 released
• 87aed90 Deps bump
• 3aec511 Fix error positions for non-printable characters, #801
• 11aa483 Reject flow indicators at the start of block plain scalars, #801
• 339d8e0 Refactor tag encoder and decoder to match the YAML specification
• 7832624 5.4.3 released
• 0cbb471 Fix whitespace-only block scalar followed by a less indented line, close #802
• 30108cc Parse the first block mapping key once (#800)
• See full diff in compare view

Updates smol-toml from 1.8.0 to 1.9.1

Release notes

Sourced from smol-toml's releases.

v1.9.1

What's Changed

• fix: reject invalid extra exponent sign by @​cyyynthia

Full Changelog: squirrelchat/smol-toml@v1.9.0...v1.9.1

v1.9.0

Huge update!!! This is most likely the largest update the library received since its release, with lots of new features and improvements.

Performance improvements

Significant parts of the internal parse logic have been rewritten, improving performance by 1.5x-2x. The library was already comfortably ahead of the others, but it is now faster than ever, sitting at 4x faster parse performance than the closest maintained implementation.

Problematic code paths have also been replaced by safer implementations, solving potential DoS vectors. See GHSA-r4xh-jqrq-34v2.

Note: the objects returned by the library now have a null prototype. This is a transparent change for 99.9% of users, and is one of the most significant contributors to the major performance gains in this version.

Full Temporal support

Version 1.8.0 brought support for Temporal in stringify; now the library is also able to emit Temporal objects instead of its own ad-hoc TomlDate object. It is not enabled by default, but it will become the default in v2. Enable by setting useLegacyDate: false in the parser's options.

Better Temporal support in stringify

Temporal support has been improved since it released: Temporal objects that cannot be represented (such as Temporal.PlainMonthDay) now throw an error (instead of silently emitting a bogus object).

A new option has been added to stringify to disallow Temporal objects that cannot be fully represented in TOML. This includes ZonedDateTime objects with a IANA timezone attached instead of a plain offset, and dates with a specific calendar value set. Enable by setting strictTemporal: true in the options.

Handling of unsafe keys

Since its release the library has been protected against prototype pollution attacks, setting properties like __proto__ using safe mechanisms that do not trigger prototype pollution. However, while the returned objects are safe on their own, they may become problematic if used carelessly.

Inspired by secure-json-parse, the library now offers a way to either drop unsafe properties from the returned object, or to throw an error and reject documents altogether. By default, these potentially unsafe keys are preserved and returned.

Miscellaneous updates

• Unicode BOM is now gracefully accepted and ignored.
• Table array headers are now properly checked again. Reported in #65.
• Closed certain gaps where invalid whitespace would be accepted. Reported in #61.
• Bogus local date and local time values with a UTC offset are no longer accepted.
• Certain error messages are more accurate and handle errors at line boundaries better.
• The default export of the lib is now formally deprecated; use a import * instead. Proposed in #50.
• On Node 20+, strings that contain lone surrogates are now normalised to well-formed strings.
• On Node 20+, keys that contain lone surrogates are now rejected.

Full Changelog: squirrelchat/smol-toml@v1.8.0...v1.9.0

Commits

• 69aa050 fix: actually properly fix exponent issues
• 7be7084 chore: version bump
• be3290d chore: upgrade deps
• 86c7613 fix: reject invalid extra exponent sign
• 6f9739a fix: gate [is|to]WellFormed (Node 18 compat)
• a73ca32 fix: no Temporal with toml-test when Node < 26
• 7727890 chore: version bump
• 641903d chore: rewrite README.md
• 2df14c5 fix(types): make it work if Temporal doesn't exist
• 3eaa44e chore: update benchmark harness
• Additional commits viewable in compare view

Updates wrangler from 4.135.0 to 4.152.0

Release notes

Sourced from wrangler's releases.

wrangler@4.151.3

Patch Changes

• #15611 4508172 Thanks @​taylorlee! - Allow wrangler dev to start module Workers without a default export

  Previously, wrangler dev failed to start module Workers that exported only named entrypoints, such as RPC services, unless an unused default export was added. These Workers now start normally in local development without that workaround.

• #16370 61fc739 Thanks @​WalshyDev! - Fetch the remote config diff from the configured compliance region

  When a Worker was last deployed from the dashboard, wrangler deploy and wrangler versions upload download its remote configuration to compare with the local one. These requests ignored the compliance_region field in the Wrangler configuration file and only honoured the CLOUDFLARE_COMPLIANCE_REGION environment variable. A FedRAMP High Worker configured through the config file would send them to api.cloudflare.com instead of api.fed.cloudflare.com, and the deploy would fail with authentication errors. They now use the same compliance region as the rest of the deploy.

• #15846 a88cac4 Thanks @​oddharsh! - Fail with an error instead of hanging when local dev requests can't work under Bun

  Bun's fetch() ignores the undici dispatcheroven-sh/bun#39247createTestHarness()'s server.fetch() and server.getWorker()'s fetch(), email() and scheduled() now throw a UserError, requests to the dev server URL get a 503 naming the cause, and starting remote bindings throws a UserError. Each of these used to hang with no error. server.getWorker().getEnv() and getExport() keep working under Bun.

• #16359 262021d Thanks @​tw4! - Stop --strict deploys and version uploads from aborting when the API omits optional binding fields

  Previously, wrangler deploy --strict and wrangler versions upload --strict could report a destructive change for an unchanged configuration, for example an R2 bucket in the default jurisdiction, because a field the API left out was compared as removed. Missing and unset optional fields are now treated as equal, so these commands proceed when the local configuration matches the deployed Worker.

• Updated dependencies [3464abc]:

  • miniflare@5.20261019.1-beta

wrangler@4.151.2

Patch Changes

• #16307 37ab91c Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20261006.1	^5.20261016.1
  workerd	1.20261012.1	1.20261016.1

• #16352 0ae7926 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20261016.1	^5.20261019.1
  workerd	1.20261016.1	1.20261019.1

• Updated dependencies [37ab91c, 0ae7926]:

  • miniflare@5.20261019.0-beta

wrangler@4.151.1

Patch Changes

• #15541 e13d5cc Thanks @​mack-erel! - Keep remote dev sessions alive through transient network failures

... (truncated)

Commits

• See full diff in compare view

Updates @react-router/node from 8.4.0 to 8.5.0

Release notes

Sourced from @​react-router/node's releases.

v8.5.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v850

Changelog

Sourced from @​react-router/node's changelog.

v8.5.0

Patch Changes

• Write file session data to a temporary file and rename it into place so concurrent commits of the same session can no longer corrupt its file (#15620)
  • Preserve existing session file permissions when replacing the file
• Updated dependencies:
  • react-router@8.5.0

Commits

• 4fe4525 Release v8.5.0 (#15515)
• f94a829 fix(node): write file sessions atomically (#15620)
• See full diff in compare view

Updates @react-router/serve from 8.4.0 to 8.5.0

Release notes

Sourced from @​react-router/serve's releases.

v8.5.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v850

Changelog

Sourced from @​react-router/serve's changelog.

v8.5.0

Unstable Changes

⚠️ Unstable features are not recommended for production use

• Support API-only builds in react-router-serve by serving client documents and forwarding data and route discovery requests to the React Router runtime (#15601)
  • Serve prerendered documents when available and use the generated SPA fallback for non-prerendered paths

Patch Changes

• Updated dependencies:
  • react-router@8.5.0
  • @react-router/express@8.5.0
  • @react-router/node@8.5.0

Commits

• 4fe4525 Release v8.5.0 (#15515)
• 9d6468d Support API-only server builds with prerendering (#15601)
• See full diff in compare view

Updates fumadocs-core from 16.15.12 to 16.17.8

Release notes

Sourced from fumadocs-core's releases.

fumadocs@16.17.8

• @​fumadocs/base-ui@​16.17.8
• fumadocs-core@16.17.8
• fumadocs-ui@16.17.8

Bring your own highlighter

Shiki stays the default, and isn't loaded when you highlight code with another highlighter.

• fumadocs-core/highlight exports a Highlighter interface, created with createHighlights() from fumadocs-core/highlight/highlights (@pierre/highlights) or createShikiHighlighter() from fumadocs-core/highlight/shiki, override() creates one with other options.
• rehypeCodeFromHighlighter from fumadocs-core/mdx-plugins/rehype-code.core highlights code blocks with a highlighter, or a function creating one with the transformers of Fumadocs. createRehypeCode is deprecated, Sätteri has rehypeCodeFromHighlighter in @fumadocs/satteri/rehype-code. Pass transformerTwoslash() in its transformers option to analyze Twoslash blocks in batches.
• createServerCodeBlock() and createDynamicCodeBlock() in Fumadocs UI create code blocks from a highlighter. Dynamic code blocks are highlighted on the server too.
• toJsx() from fumadocs-core/utils/hast-to-jsx converts hast into React elements like toJsxRuntime() of hast-util-to-jsx-runtime, MDX nodes through an evaluator, over 10x faster on highlighted code, whose spans render as one HTML string. Every Fumadocs renderer uses it, hast-util-to-jsx-runtime is no longer a dependency.
• Twoslash loads the languages of code blocks in popups before highlighting, an unknown language there no longer fails the code block.
• OpenAPI Standalone highlights code blocks with Highlights, in its server-rendered pages too.
• The page factories of OpenAPI, GraphQL and AsyncAPI, type tables, createPython(), createPythonComponents(), localHtml() and the shadcn createSnippet() take a highlighter.
• Deprecated shiki and shikiOptions of the API pages and shiki of type tables, pass a highlighter instead.
• Integrations require fumadocs-core 16.17.8, the API pages and shadcn also require fumadocs-ui 16.17.8.

remarkInclude in fumadocs-core

<include> moved from Fumadocs MDX to fumadocs-core/mdx-plugins/remark-include, a unified plugin for any MDX or Markdown pipeline.

• fumadocs-mdx/config still exports remarkInclude, forwarded from fumadocs-core.
• getProcessor parses included files by their format, like a .md file included in an .mdx page.
• Headings in an included section get IDs unique among the page's own headings.
• Circular includes throw instead of hanging, and included code files no longer end with an empty line.
• fumadocs-mdx requires fumadocs-core 16.17.8.

Processed Markdown links page-relative images at their served URLs

• Images imported by Remark Image get the URLs bundlers serve them at in Remark LLMs, instead of their relative paths
• Stringifiers output JS expressions with s.expression(), for Markdown only known at runtime
• Search records of included content with images are no longer cut
• The Sätteri preset only imports images in bundlers, at runtime it resolves their sizes like the MDX preset

fumadocs@16.17.7

• @​fumadocs/base-ui@​16.17.7
• fumadocs-core@16.17.7
• fumadocs-ui@16.17.7

Imports across Windows drives

• remarkImage and generated .source files import files on another drive or a UNC path by their absolute path.
• Generated imports of files in dot-folders are prefixed with ./.

Fix #3723

fumadocs@16.17.6

• @​fumadocs/base-ui@​16.17.6

... (truncated)

Commits

• 97e62b9 Version Packages (#3733)
• ccae3e0 fix(core): improve shiki compat
• 96a571b chore: bump deps
• 097b5cc fix: workaround ts 7.1 bugs
• 2fced92 feat(twoslash,story,typescript): use typescript 7.1
• 6e2a75e perf(core): improve transformer performance
• 4f5cbd3 perf(core): rewrite hast-util-to-jsx-runtime
• f0d8981 feat(*): new highlighter API + highlights
• bc86bbb fix(core,satteri): use served URLs of imported images in processed Markdown (...

[github-actions]

📦 Semifold release plan

Plan calculated through commit 26cff4e.

Note

This pull request does not introduce any changesets.

After this pull request is merged into main, the release workflow will run and publish any prepared package versions that are not yet available in their registry.

This comment updates automatically as the pull request changes.