chore(deps): bump the production-minor group across 1 directory with 6 updates

[dependabot]

Bumps the production-minor group with 6 updates in the / directory:

Package	From	To
fumadocs-core	16.14.3	16.14.5
fumadocs-mdx	15.2.3	15.3.0
lucide-react	1.31.0	1.33.0
next	16.3.0	16.3.1
@hono/node-server	2.1.0	2.1.1
hono	4.13.1	4.13.3

Updates fumadocs-core from 16.14.3 to 16.14.5

Release notes

Sourced from fumadocs-core's releases.

fumadocs@16.14.5

• @​fumadocs/base-ui@​16.14.5
• fumadocs-core@16.14.5
• fumadocs-ui@16.14.5

Add a main landmark to docs, notebook and flux pages

The page container slot now wraps <article id="nd-page"> in a <main class="contents"> in the docs, notebook and flux layouts. All props, id="nd-page" and the layout classes stay on the <article>, so existing selectors and refs keep working.

Loader: next parameter for custom slugs function

The slugs option now receives a next function as its second argument, which generates the default slugs from the file path. This lets custom slug functions build on the default generation instead of reimplementing it:

loader({
  slugs(file, next) {
    if (file.path.startsWith('blog/')) return ['blog', ...next()];
    // return `undefined` to generate default slugs
  },
});

Behavior change: conflicting cases like dir/index.mdx vs dir.mdx are now resolved for custom slugs functions as well. Index files are always processed after other pages, and receive an index suffix when their slugs (custom or default) collide with an existing page — previously, custom slugs functions that produced such collisions threw a Duplicated slugs error.

fumadocs@16.14.4

• @​fumadocs/base-ui@​16.14.4
• fumadocs-core@16.14.4
• fumadocs-ui@16.14.4

Introduce @fumari/image-size, replacing image-size in remarkImage

A fork of probe-image-size with no dependencies of its own.

import { probe, imageSize } from '@fumari/image-size';
await probe('./public/banner.png'); // { width: 1200, height: 630, type: 'png', mime: 'image/png' }
await probe('https://example.com/banner.png', { timeout: 5000 });
imageSize(bytes); // the same result, or null

remarkImage now uses it in both fumadocs-core and @fumadocs/satteri. Remote images are no longer downloaded in full just to be measured, and redirects are followed. Sizes are always in pixels, so an SVG sized in em or pt is converted instead of being skipped. Remote requests also time out after 30 seconds by default.

One behaviour difference worth knowing: the supported formats are avif/heic/heif, bmp, gif, ico, jpeg, png, psd, svg, tiff and webp. Sizes for jxl, tga, pnm, dds, icns, cur, ktx and jp2 can no longer be resolved and go through onError instead.

Sequential scanning stops after 512 KB, but that never loses an image: the one format that stores its dimensions past that point — TIFF with a trailing IFD — is resolved by following the header's pointer with a targeted read, using an HTTP Range request for remote files (and skipping through the body when the server ignores ranges).

Commits

• 3043da2 Version Packages (#3486)
• 671bd83 feat(core): support baseSlugs option
• 2899bc1 fix(ui): add a main landmark to docs, notebook and flux pages (#3483)
• 14f9eaf feat(core): support next param for custom slugs function
• ddccb91 docs: improve local-html section
• 43f4006 Version Packages (#3478)
• d1c99ad chore(local-html): improve DX
• 7fd880d example: add for html content source
• 4d8ac85 feat: add @​fumadocs/local-html content source (#3477)
• 78b6641 Version Packages (#3473)
• Additional commits viewable in compare view

Updates fumadocs-mdx from 15.2.3 to 15.3.0

Release notes

Sourced from fumadocs-mdx's releases.

fumadocs-mdx@15.3.0

Sätteri 0.10

@fumadocs/satteri now requires satteri ^0.10.3, and the plugins were rewritten on its new capabilities:

• Exports (frontmatter, toc, structuredData, …) are emitted by an after document hook instead of an anchor marker appended to the source, so plugins no longer see (or need to skip) the anchor node.
• remark-steps, remark-admonition and remark-code-tab still detect their targets through node visitors (so documents without the construct cost nothing), but process each parent exactly once in an after hook, replacing the per-visit dedup workarounds.
• remark-llms stringifies the document root from a before hook instead of subscribing to 19 node types to find it.
• Markdown documents compile through Sätteri's own markdownToJs; the hand-assembled pipeline is gone. Raw HTML in .md files is still dropped, matching the previous behavior.
• rehype-katex parses KaTeX output with Sätteri's htmlToHast, dropping the hast-util-from-html dependency.
• No plugin reads node.position, so Sätteri now skips source-position tracking entirely (~15% faster parse).

Breaking: ExtraPluginHooks.beforeToJs was removed. Seed ctx.data from a Sätteri before hook on the plugin definition instead — it also receives the document root:

import { defineMdastPlugin } from 'satteri';
defineMdastPlugin({
name: 'my-plugin',
before(root, ctx) {
ctx.data.myValue ??= [];
},
});

Commits

• 3cfb127 Merge pull request #3488 from fuma-nama/tegami/version-packages
• e46a700 feat(mdx,satteri): use satteri 0.10
• 3043da2 Version Packages (#3486)
• 671bd83 feat(core): support baseSlugs option
• 2899bc1 fix(ui): add a main landmark to docs, notebook and flux pages (#3483)
• 14f9eaf feat(core): support next param for custom slugs function
• ddccb91 docs: improve local-html section
• 43f4006 Version Packages (#3478)
• d1c99ad chore(local-html): improve DX
• 7fd880d example: add for html content source
• Additional commits viewable in compare view

Updates lucide-react from 1.31.0 to 1.33.0

Release notes

Sourced from lucide-react's releases.

Version 1.33.0

What's Changed

• feat(icons): add list-clock icon by @​lazerg in lucide-icons/lucide#4636
• feat(icons): add square-dimensions by @​samuelalake in lucide-icons/lucide#4547
• feat(icons): added usb-c-port icon by @​karsa-mistmere in lucide-icons/lucide#4556
• docs(site): correct Vanilla icon import casing by @​hugosmoreira in lucide-icons/lucide#4597
• feat(icons): added audio-lines-off icon by @​karsa-mistmere in lucide-icons/lucide#4589
• chore(icon-discussions): add icon design template by @​jguddas in lucide-icons/lucide#4691
• feat(icons): added mop icon by @​karsa-mistmere in lucide-icons/lucide#4682
• chore(scripts): Potential fix for code scanning alert no. 31: Inefficient regular expression by @​ericfennis in lucide-icons/lucide#4723
• chore(deps-dev): bump the svelte-deps group with 3 updates by @​dependabot[bot] in lucide-icons/lucide#4720
• feat(icon-discussions): close discussions with banned phrases by @​jguddas in lucide-icons/lucide#4692
• feat(icons): added midi-port icon by @​simoncoudeville in lucide-icons/lucide#3754

New Contributors

• @​hugosmoreira made their first contribution in lucide-icons/lucide#4597
• @​simoncoudeville made their first contribution in lucide-icons/lucide#3754

Full Changelog: lucide-icons/lucide@1.32.0...1.33.0

Version 1.32.0

What's Changed

• feat(icons): added car-battery icon by @​andreynaz4renko in lucide-icons/lucide#4088
• fix(categories): fixes emoji.json by @​karsa-mistmere in lucide-icons/lucide#4697
• chore(deps): bump vue from 3.5.40 to 3.5.41 in the vue-deps group across 1 directory by @​dependabot[bot] in lucide-icons/lucide#4695
• chore(dev): upgrade ESLint to latest compatible stack (v10) by @​ericfennis with @​Copilot in lucide-icons/lucide#4378
• feat(icons): add square-text by @​samuelalake in lucide-icons/lucide#4609

New Contributors

• @​andreynaz4renko made their first contribution in lucide-icons/lucide#4088

Full Changelog: lucide-icons/lucide@1.31.0...1.32.0

Commits

• 75b5516 chore(dev): upgrade ESLint to latest compatible stack (v10) (#4378)
• See full diff in compare view

Updates next from 16.3.0 to 16.3.1

Release notes

Sourced from next's releases.

v16.3.1

What's Changed

• [16.x] Turbopack: don't strip async-module runtime from shared runtime chunks by @​lukesandberg in vercel/next.js#96653
• [16.x] [turbopack] Add turbopack_ecmascript and turbopack_wasm's embeded FS to internal_assets_conditions by @​lukesandberg in vercel/next.js#96655
• [16.x] [turbopack] Collapse nested promises in the analyzer by @​sampoder in vercel/next.js#96675
• [16.x] fix(next/image): preserve image response after optimization by @​styfle in vercel/next.js#96733
• [16.3.x] Default deploy e2e tests to the repo next version by @​eps1lon in vercel/next.js#96900
• [backport] Bump @​swc/helpers by @​mischnic in vercel/next.js#96885
• [backport] [turbopack] Raise registration calls in hoisted modules to the top by @​lukesandberg in vercel/next.js#97308
• [backport] Fix missing styled-jsx styles in Pages Router SSR on adapter builds by @​lukesandberg in vercel/next.js#97302
• [backport] [turbopack] Fix HMR for dynamic imports evaluated from layouts by @​lukesandberg in vercel/next.js#97317
• [backport] Restore the live headers() view of the incoming request by @​unstubbable in vercel/next.js#97311
• [backport] Allow literal exports in 'use cache' files by @​unstubbable in vercel/next.js#97312
• [backport] Keep the dev validation worker alive across HMR updates by @​unstubbable in vercel/next.js#97315
• [backport] Discard only cache entries that predate a tag revalidation, and reuse completed entries by @​unstubbable in vercel/next.js#97314
• [backport] Encode the cache item name built by unstable_cache by @​unstubbable in vercel/next.js#97313
• [16.3] [ci] Use OIDC tokens to read private preview builds by @​eps1lon in vercel/next.js#97258
• [backport] [test] Compile the middleware redirect routes up front in dev by @​lukesandberg in vercel/next.js#97328
• [backport] Fix Nav Inspector request loop on repeat captures by @​acdlite in vercel/next.js#97326
• [backport] Fix: Optimistic routing bugs leading to repeated prefetch loops by @​acdlite in vercel/next.js#97325
• [backport] Retain fewer stale cache versions and use a TTL, plus the mtime fallback by @​lukesandberg in vercel/next.js#97304
• [backport] Revert i18n localization change for dynamic Pages API routes (#94905) by @​gaojude in vercel/next.js#97330

Full Changelog: vercel/next.js@v16.3.0...v16.3.1

v16.3.1-canary.26

Misc Changes

• docs: document deploymentId build ID override and Pages Router skew in 16.2: #97645
• Upgrade React from eb8feb71-20260814 to eafeac09-20260819: #97636
• Turbopack: rename to use turbopack: no side effects: #94427
• refactor: move useDynamic{Route,Search}Params to reduce snapshot churn: #97360
• [PPF] unstable_navigation(): #96908
• [PPF] Scaffold unstable_navigation(): #97236
• docs: Explicit cache output description: #97548
• Improve Cache Components sync IO migration guidance: #97572
• [test] Use a non-native stub for the server externals list test: #97614
• Avoid GitHub API rate limits for create-next-app examples: #97612
• [test] Cover the prerender worker-thread backend with an addon we control: #97543
• [test] Convert the prerender-native-module suite to local fixture packages: #97542
• [test] Replace the turbopack-reports sqlite3 dependency with a local addon fixture: #97541
• [test] Drop the dead sqlite3 build approval from the sharp-basic suite: #97540
• [ci] Authenticate Turborepo remote caching with OIDC instead of a static PAT: #97590
• Remove HmrTarget: #97253
• Keep HMR instructions typed until serialization: #96569
• Serialize frozen collections by value only: #96686

Credits

... (truncated)

Commits

• 3d32eb8 v16.3.1
• 2b4b1ec [backport] Revert i18n localization change for dynamic Pages API routes (#949...
• 228df5f [backport] Retain fewer stale cache versions and use a TTL, plus the mtime fa...
• 16eab3a [backport] Fix: Optimistic routing bugs leading to repeated prefetch loops (#...
• 75548c9 [backport] Fix Nav Inspector request loop on repeat captures (#97326)
• f6bd714 [backport] [test] Compile the middleware redirect routes up front in dev (#97...
• 43c1c60 [16.3] [ci] Use OIDC tokens to read private preview builds (#97258)
• 9dbb357 [backport] Encode the cache item name built by unstable_cache (#97313)
• 323a17c [backport] Discard only cache entries that predate a tag revalidation, and re...
• 6d67f46 [backport] Keep the dev validation worker alive across HMR updates (#97315)
• Additional commits viewable in compare view

Updates @hono/node-server from 2.1.0 to 2.1.1

Release notes

Sourced from @​hono/node-server's releases.

v2.1.1

What's Changed

• perf: lazily materialize request headers by @​BlankParticle in honojs/node-server#389

Full Changelog: honojs/node-server@v2.1.0...v2.1.1

Commits

• 73c03ad 2.1.1
• 5515aa0 perf: lazily materialize request headers (#389)
• See full diff in compare view

Updates hono from 4.13.1 to 4.13.3

Release notes

Sourced from hono's releases.

v4.13.3

What's Changed

• fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in honojs/hono#5227
• fix(etag): copy pending stream bytes in honojs/hono#5239
• fix(etag): avoid skipping headers when filtering 304 response headers in honojs/hono#5234
• fix(cors): append Origin to Vary header on OPTIONS preflight in honojs/hono#5235
• docs(context): add custom headers append option example to Context JSDoc in honojs/hono#5248
• fix(trie-router): match suffix wildcard routes in honojs/hono#5236
• fix(pattern-router/linear-router): prevent prefix overmatch on wildcard routes in honojs/hono#5252
• fix(csrf): exempt OPTIONS request from CSRF validation in honojs/hono#5250
• fix(utils/ipaddr): avoid truncation on embedded IPv4 addresses in expand IPv6 in honojs/hono#5247
• feat(pretty-json): support structured JSON content-types (+json) in honojs/hono#5226

Full Changelog: honojs/hono@v4.13.2...v4.13.3

v4.13.2

What's Changed

• fix(secure-headers): output standard empty parentheses () instead of none for disabled Permissions-Policy directives in honojs/hono#5197
• fix(jsx): render async children of document metadata tags instead of [object Promise] in honojs/hono#5204
• fix(etag): resolve incorrect incremental hashing for chunked responses in honojs/hono#5199
• fix(client): serialize multiple cookies correctly in honojs/hono#5202
• fix(etag): stabilize digest across stream chunks in honojs/hono#5205
• fix(url): strip trailing question mark correctly for optional params with regex quantifiers in honojs/hono#5209
• perf(cors): pre-join static array header options during initialization in honojs/hono#5210
• fix(client): send falsy JSON bodies in honojs/hono#5215
• feat(secure-headers): add missing W3C Permissions-Policy directives in honojs/hono#5214

Full Changelog: honojs/hono@v4.13.1...v4.13.2

Commits

• 0293343 4.13.3
• 5ad469a feat(pretty-json): support structured JSON content-types (+json) (#5226)
• c91ec9b fix(utils/ipaddr): avoid truncation on embedded IPv4 addresses in expandIPv6 ...
• eea9735 fix(csrf): exempt OPTIONS request from CSRF validation (#5250)
• a194628 fix(pattern-router/linear-router): prevent prefix overmatch on wildcard route...
• 63bbcf5 fix(trie-router): match suffix wildcard routes (#5236)
• ef0739d docs(context): add custom headers append option example to Context JSDoc (#5248)
• 8bf03c3 fix(cors): append Origin to Vary header on OPTIONS preflight (#5235)
• 546eca0 fix(etag): avoid skipping headers when filtering 304 response headers (#5234)
• 7195c24 fix(etag): copy pending stream bytes (#5239)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions