chore(deps): bump the website-dependencies group in /website with 5 updates by dependabot[bot] · Pull Request #1812 · Fission-AI/OpenSpec

dependabot · 2026-09-07T01:46:27Z

Bumps the website-dependencies group in /website with 5 updates:

Package	From	To
fumadocs-core	`16.15.2`	`16.15.5`
fumadocs-ui	`16.15.2`	`16.15.5`
next	`16.3.3`	`16.3.4`
@types/react-dom	`19.2.5`	`19.2.7`
postcss	`8.5.26`	`8.5.28`

Updates fumadocs-core from 16.15.2 to 16.15.5

Release notes

Sourced from fumadocs-core's releases.

fumadocs@16.15.5

@fumadocs/base-ui@16.15.5

fumadocs-core@16.15.5

fumadocs-ui@16.15.5

Root types: version your docs with root: "<type>"

root in meta.json now accepts a string, the type of root folder. Root folders of the same type under the same parent are interchangeable, which is how you keep multiple versions of the same docs in one site:
{
  "title": "1.0.0",
  "root": "version"
}
{
  "title": "2.0.0",
  "root": "version"
}
The sidebar only shows the opened version, and docs layouts render a dropdown to switch between them. Switching keeps your place: it navigates to the same page in the other version (/docs/v1/guide to /docs/v2/guide), or its index page when the page doesn't exist there.

root: true is simply the default type, displayed as tabs. See Versioning for the guide and Root Type for the reference.

Tabs are grouped by root folder

Layout tabs are now grouped by the root folders on the current page's path, with one dropdown per group. This changes a few behaviours of the existing root: true tabs:

Clicking a tab navigates to the same page in the target folder when it exists, otherwise its index page as before.

With nested root folders, each level gets its own dropdown instead of one flat list. Tab lists (tabMode: 'top' on Docs layout, tabMode: 'navbar' on Notebook layout) show the innermost root: true group, and are hidden on pages outside of any root folder.

getLayoutTabs() includes typed root folders too, so a custom transform also decorates them. Custom tabs entries bound to a page tree folder are grouped the same way, other entries are appended to the root: true dropdown.

tabs={false} disables the dropdowns of typed root folders as well.

findProjection() in fumadocs-core/page-tree

Find the structural projection of a page in another root folder, the page at the same file path relative to the root folder:
import { findProjection } from 'fumadocs-core/page-tree';
findProjection(v1, v2, page)?.url;
fumadocs@16.15.4

@fumadocs/base-ui@16.15.4

fumadocs-core@16.15.4

fumadocs-ui@16.15.4

... (truncated)

Commits

1bd6f3b Version Packages (#3524)
8a3592f fix(api-docs): improve schema merging
31f9805 fix build
c7b64ca docs: introduce typed roots
119c2cf feat(core): typed roots
3a93aa5 fix(api-docs): intersect overlapping type sets when merging allOf (#3526)
5a806c9 docs: improve remark-image docs
638457e test(core): cover shiki highlighting of nested code blocks (#3525)
b54011c feat(openapi,api-docs): make components installable
a5e66be docs: add generative-a11y to showcase (#3522)
Additional commits viewable in compare view

Updates fumadocs-ui from 16.15.2 to 16.15.5

Release notes

Sourced from fumadocs-ui's releases.

fumadocs@16.15.5

@fumadocs/base-ui@16.15.5

fumadocs-core@16.15.5

fumadocs-ui@16.15.5

Root types: version your docs with root: "<type>"

root in meta.json now accepts a string, the type of root folder. Root folders of the same type under the same parent are interchangeable, which is how you keep multiple versions of the same docs in one site:
{
  "title": "1.0.0",
  "root": "version"
}
{
  "title": "2.0.0",
  "root": "version"
}
The sidebar only shows the opened version, and docs layouts render a dropdown to switch between them. Switching keeps your place: it navigates to the same page in the other version (/docs/v1/guide to /docs/v2/guide), or its index page when the page doesn't exist there.

root: true is simply the default type, displayed as tabs. See Versioning for the guide and Root Type for the reference.

Tabs are grouped by root folder

Layout tabs are now grouped by the root folders on the current page's path, with one dropdown per group. This changes a few behaviours of the existing root: true tabs:

Clicking a tab navigates to the same page in the target folder when it exists, otherwise its index page as before.

With nested root folders, each level gets its own dropdown instead of one flat list. Tab lists (tabMode: 'top' on Docs layout, tabMode: 'navbar' on Notebook layout) show the innermost root: true group, and are hidden on pages outside of any root folder.

getLayoutTabs() includes typed root folders too, so a custom transform also decorates them. Custom tabs entries bound to a page tree folder are grouped the same way, other entries are appended to the root: true dropdown.

tabs={false} disables the dropdowns of typed root folders as well.

findProjection() in fumadocs-core/page-tree

Find the structural projection of a page in another root folder, the page at the same file path relative to the root folder:
import { findProjection } from 'fumadocs-core/page-tree';
findProjection(v1, v2, page)?.url;
fumadocs@16.15.4

@fumadocs/base-ui@16.15.4

fumadocs-core@16.15.4

fumadocs-ui@16.15.4

... (truncated)

Commits

1bd6f3b Version Packages (#3524)
8a3592f fix(api-docs): improve schema merging
31f9805 fix build
c7b64ca docs: introduce typed roots
119c2cf feat(core): typed roots
3a93aa5 fix(api-docs): intersect overlapping type sets when merging allOf (#3526)
5a806c9 docs: improve remark-image docs
638457e test(core): cover shiki highlighting of nested code blocks (#3525)
b54011c feat(openapi,api-docs): make components installable
a5e66be docs: add generative-a11y to showcase (#3522)
Additional commits viewable in compare view

Updates next from 16.3.3 to 16.3.4

Release notes

Sourced from next's releases.

v16.3.4

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

testmode: Fix infinite recursion in testmode passthrough fetch (#97691)

Fix build error when aliasing typescript to @typescript/typescript6 (#97997)

Fix unset crossOrigin in Turbopack manifests (#97930)

Credits

Huge thanks to @eps1lon, @mischnic, and @timneutkens for helping!

Commits

299180d v16.3.4
12e173d [16.3.x] Re-enable AVIF image optimization and require sharp 0.35.4 (#97949)
5d9022e [backport] Fix unset crossOrigin in Turbopack manifests (#97930)
d8f4560 [16.3.x] Fix build error when aliasing typescript to @typescript/typescript6 ...
656aebf [16.3] testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
f37c1d6 [16.3.x] ci: remove pull_request_stats workflow (#97975)
See full diff in compare view

Updates @types/react-dom from 19.2.5 to 19.2.7

Commits

See full diff in compare view

Updates postcss from 8.5.26 to 8.5.28

Release notes

Sourced from postcss's releases.

8.5.28

Fixes types regression.

8.5.27

Fixed removing any comments starting with /*# (by @dylanpulver).

Fixed * hack before a comment in Custom Properties (by @Jaybhade).

Fixed empty values in the middle of list.comma() (by @MahinAnowar).

Fixed whitespace-only values in list.space() (by @MahinAnowar).

Fixed rule’s end position on space before semicolon (by @maximilliangrand).

Fixed types (by @romainmenke).

Fixed Chinese text in deprecation warning (by @Jesse205).

Changelog

Sourced from postcss's changelog.

8.5.28

Fixes types regression.

8.5.27

Fixed removing any comments starting with /*# (by @dylanpulver).

Fixed * hack before a comment in Custom Properties (by @Jaybhade).

Fixed empty values in the middle of list.comma() (by @MahinAnowar).

Fixed whitespace-only values in list.space() (by @MahinAnowar).

Fixed rule’s end position on space before semicolon (by @maximilliangrand).

Fixed types (by @romainmenke).

Fixed Chinese text in deprecation warning (by @Jesse205).

Commits

e544bff Release 8.5.28 version
f8fc252 Typo
5039fd7 Add missed release notes
ae40ca4 Release 8.5.27 version
62b1626 Fix linter
1dba938 Update dependencies
3e82edc Keep non-annotation comments when the processor has no plugins (#2150)
6d23bc3 Fix link
508e997 Add GitHub Sponsors link
e993739 Add CodeRabbit sponsor (#2145)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the website-dependencies group in /website with 5 updates: | Package | From | To | | --- | --- | --- | | [fumadocs-core](https://github.com/fuma-nama/fumadocs) | `16.15.2` | `16.15.5` | | [fumadocs-ui](https://github.com/fuma-nama/fumadocs) | `16.15.2` | `16.15.5` | | [next](https://github.com/vercel/next.js) | `16.3.3` | `16.3.4` | | [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.5` | `19.2.7` | | [postcss](https://github.com/postcss/postcss) | `8.5.26` | `8.5.28` | Updates `fumadocs-core` from 16.15.2 to 16.15.5 - [Release notes](https://github.com/fuma-nama/fumadocs/releases) - [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs@16.15.2...fumadocs@16.15.5) Updates `fumadocs-ui` from 16.15.2 to 16.15.5 - [Release notes](https://github.com/fuma-nama/fumadocs/releases) - [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs@16.15.2...fumadocs@16.15.5) Updates `next` from 16.3.3 to 16.3.4 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.3.3...v16.3.4) Updates `@types/react-dom` from 19.2.5 to 19.2.7 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom) Updates `postcss` from 8.5.26 to 8.5.28 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.26...8.5.28) --- updated-dependencies: - dependency-name: fumadocs-core dependency-version: 16.15.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: website-dependencies - dependency-name: fumadocs-ui dependency-version: 16.15.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: website-dependencies - dependency-name: next dependency-version: 16.3.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: website-dependencies - dependency-name: "@types/react-dom" dependency-version: 19.2.7 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: website-dependencies - dependency-name: postcss dependency-version: 8.5.28 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: website-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

cloudflare-workers-and-pages · 2026-09-07T01:46:29Z

Deploying openspec-docs with Cloudflare Pages

Latest commit:	`71bffee`
Status:	✅ Deploy successful!
Preview URL:	https://9e1da177.openspec-docs.pages.dev
Branch Preview URL:	https://dependabot-npm-and-yarn-webs-vmif.openspec-docs.pages.dev

View logs

openspec-cloud · 2026-09-07T14:08:48Z

No PR-relevant drift confirmed.

AI-generated · A citation proves the line exists, not that it makes the case — verify before acting.
Checked the 0 requirements selected for this PR at 71bffee (255 total).
This is not a full-repository clean result; see the check for coverage and any broader findings.
View results · Click Refresh, then Scan again in the check. Or comment /openspec-cloud.

clay-good · 2026-09-07T14:33:31Z

Superseded by #1815, which lands these bumps plus the website/pnpm-workspace.yaml postcss override sync that test/pnpm-workspace-config.test.ts requires (that fix can't be pushed here without dependabot closing the PR and deleting the branch).

dependabot · 2026-09-07T14:33:33Z

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

…pdates (Fission-AI#1815) Applies dependabot's website bumps (Fission-AI#1812) and syncs the postcss override in website/pnpm-workspace.yaml, which dependabot does not know about, keeping the three override declarations in agreement. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

…ion-AI#1816) The security overrides were declared twice: in pnpm-workspace.yaml, with the advisory comments explaining each pin, and again under package.json's pnpm.overrides. The copies are not additive — pnpm 10 uses package.json's block instead of the workspace list when both are present — and Dependabot rewrites plain-name entries in package.json whenever it bumps the same package. So a routine bump silently displaces the pins that patch advisories, and fails the equality test that guards them (Fission-AI#1812). Keeps one declaration, in the file that carries the reasoning, and asserts the mirror stays gone. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Defense in depth. The audit confirmed there is no shell injection anywhere in src/ - no `shell: true`, no user value concatenated into a command line - so none of these are live exploits; they are the sharp edges next to that line. Completion install wrote the completions directory into .bashrc/.zshrc inside double quotes, so a `$(...)` or backtick in HOME/XDG_DATA_HOME became command execution on every future shell start. Both installers now single-quote the path through a shared helper. `feedback` shelled out for two probes (`which gh`, `gh auth status`) directly alongside free-form user title and body text - the most plausible site for a future injection regression. Both are execFileSync now, behavior unchanged. Git subprocesses inherited the default 1 MB maxBuffer with no timeout, so a large dirty tree made `git status --porcelain` throw ENOBUFS, which gitProbe's bare catch turned into "no git facts" - `openspec doctor` then silently stopped reporting uncommitted changes. They now share GIT_EXEC_OPTIONS (15s timeout, 16 MB buffer) the way readCliVersion already did, and the catch distinguishes a resource failure from "git absent" so the degraded path is no longer silent. The GITHUB_OUTPUT heredoc in validate-changesets used a fixed EOF delimiter over a list of PR-authored paths; it is now run-unique. Finally, both package.json files still carried a `pnpm` block. pnpm 10 uses that block *instead of* pnpm-workspace.yaml rather than merging with it, which is exactly the override-displacement trap dependabot.yml documents as #1812 - and it is where Dependabot writes when it bumps an overridden package. The block only duplicated `allowBuilds`, so removing it leaves both lockfiles byte-identical with every advisory override intact, and denies Dependabot the block to write into. The workspace test now asserts `pnpm` is absent entirely. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 7, 2026

dependabot Bot requested a review from a team as a code owner September 7, 2026 01:46

dependabot Bot removed the request for review from a team September 7, 2026 01:46

dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 7, 2026

dependabot Bot requested a review from alfred-openspec September 7, 2026 01:46

dependabot Bot added the javascript Pull requests that update javascript code label Sep 7, 2026

clay-good mentioned this pull request Sep 7, 2026

chore(deps): bump the website-dependencies group in /website with 5 updates #1815

Merged

clay-good closed this Sep 7, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/website/website-dependencies-c44e9a26bd branch September 7, 2026 14:33

clay-good mentioned this pull request Sep 7, 2026

chore(deps): declare pnpm overrides only in pnpm-workspace.yaml #1816

Merged

clay-good mentioned this pull request Sep 10, 2026

fix(security): harden CLI against hostile-repository inputs and clear dependency advisories #1835

Open

Navigation Menu

Uh oh!

chore(deps): bump the website-dependencies group in /website with 5 updates - #1812

chore(deps): bump the website-dependencies group in /website with 5 updates#1812
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/website/website-dependencies-c44e9a26bd

dependabot Bot commented on behalf of github Sep 7, 2026

Uh oh!

cloudflare-workers-and-pages Bot commented Sep 7, 2026 •

edited

Loading

Uh oh!

openspec-cloud Bot commented Sep 7, 2026

Uh oh!

clay-good commented Sep 7, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 7, 2026

fumadocs@16.15.5

Root types: version your docs with root: "<type>"

Tabs are grouped by root folder

findProjection() in fumadocs-core/page-tree

fumadocs@16.15.4

fumadocs@16.15.5

Root types: version your docs with root: "<type>"

Tabs are grouped by root folder

findProjection() in fumadocs-core/page-tree

fumadocs@16.15.4

v16.3.4

Credits

8.5.28

8.5.27

8.5.28

8.5.27

Uh oh!

cloudflare-workers-and-pages Bot commented Sep 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying openspec-docs with Cloudflare Pages

Uh oh!

openspec-cloud Bot commented Sep 7, 2026

No PR-relevant drift confirmed.

Uh oh!

clay-good commented Sep 7, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Root types: version your docs with `root: "<type>"`

`findProjection()` in `fumadocs-core/page-tree`

Root types: version your docs with `root: "<type>"`

`findProjection()` in `fumadocs-core/page-tree`

cloudflare-workers-and-pages Bot commented Sep 7, 2026 •

edited

Loading