chore(deps): bump the website-dependencies group in /website with 5 updates

[clay-good]

Status: ready for review.

What was missing / the motivation: Dependabot's #1812 fails Test on every platform. It bumps the postcss override in website/package.json (^8.5.26 → ^8.5.28) but has no knowledge of website/pnpm-workspace.yaml, which declares the same overrides for pnpm 10. test/pnpm-workspace-config.test.ts asserts that all three copies — package.json, pnpm-workspace.yaml, and the lockfile — agree, so the drift fails the suite. Dependabot cannot fix it, and pushing the fix onto its branch would make dependabot close the PR and delete the branch.

What it does: takes dependabot's bumps verbatim (fumadocs-core/ui 16.15.2 → 16.15.5, next 16.3.3 → 16.3.4, @types/react-dom 19.2.5 → 19.2.7, postcss 8.5.26 → 8.5.28) and adds the one-line website/pnpm-workspace.yaml override sync they require.

Proof it works:

• test/pnpm-workspace-config.test.ts — 3/3 pass locally (it was the failing test on chore(deps): bump the website-dependencies group in /website with 5 updates #1812).
• pnpm install --frozen-lockfile in website/ succeeds with pnpm 10.34.5, so the lockfile matches the manifest.
• Full CI on this branch, including the Cloudflare Pages build.

Notes / nits: supersedes #1812, which will be closed as superseded. flake.nix is unaffected — its pinned pnpmDeps hash covers the root lockfile only, and the website is excluded from the flake source. Closes no issue.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated website tooling and platform components to newer versions.
  • These maintenance updates improve compatibility and stability without changing the website’s user-facing features or functionality.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 4665e996-a214-4987-8abe-9be1886ac5e5

📥 Commits

Reviewing files that changed from the base of the PR and between e062b95 and 12f7b1d.

⛔ Files ignored due to path filters (1)

• website/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (2)

• website/package.json
• website/pnpm-workspace.yaml

Included review availability: Your plan provides up to 10 included reviews per hour; 8 remain after this review.

---

📝 Walkthrough

Walkthrough

The website dependency ranges are updated for Fumadocs, Next.js, React DOM types, and PostCSS. PostCSS override ranges are aligned in both website package configuration files.

Changes

Website dependency updates

Layer / File(s)	Summary
Align website dependency versions website/package.json, website/pnpm-workspace.yaml	Updates fumadocs-core, fumadocs-ui, next, @types/react-dom, and postcss version ranges. Aligns the postcss overrides with the updated version.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Merge Risk: ⚪ Minimal · up to 12f7b

This updates website dependencies and synchronizes the PostCSS override declarations, with no remaining concrete merge-blocking risk identified.

Suggested reviewers: alfred-openspec

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately and concisely describes the five website dependency updates. It matches the main change in the pull request.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/deps-website-bumps

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cloudflare-workers-and-pages]

Deploying openspec-docs with    Cloudflare Pages

Latest commit:	12f7b1d
Status:	✅  Deploy successful!
Preview URL:	https://729ba82c.openspec-docs.pages.dev
Branch Preview URL:	https://chore-deps-website-bumps.openspec-docs.pages.dev

View logs

[openspec-cloud]

No PR-relevant drift confirmed.

AI-generated · A citation proves the line exists, not that it makes the case — verify before acting.
Checked the 0 requirements selected for this PR at 12f7b1d (255 total).
This is not a full-repository clean result; see the check for coverage and any broader findings.
View results · Click Refresh, then Scan again in the check. Or comment /openspec-cloud.

[clay-good]

Verified locally with the repo's own pnpm (10.34.5), plus a merge-order note.

• pnpm install --frozen-lockfile succeeds in website/, and the resolved versions are the intended ones: next 16.3.4, fumadocs-core 16.15.5, fumadocs-ui 16.15.5, postcss 8.5.28.
• pnpm install --lockfile-only leaves website/pnpm-lock.yaml byte-identical, so the lockfile is settled rather than merely committed.
• pnpm build completes: the full static export renders, all 20 doc pages plus the OG images, llms.txt and the sitemap. Exit 0.
• The postcss bump is carried in both places it is currently declared (website/package.json pnpm.overrides and website/pnpm-workspace.yaml), so the advisory pin stays intact and does not silently narrow.

Merge-order note. This conflicts with #1816, which deletes the pnpm.overrides block from website/package.json entirely (it turns out a block there replaces the workspace list rather than merging with it, so the mirror can silently drop the other advisory pins). The two touch the same lines.

Merging this one first is the easier order: #1816 then just deletes a block whose postcss line already reads ^8.5.28. In the other order, this PR needs its website/package.json hunk dropped, keeping only the pnpm-workspace.yaml bump.