build(deps): bump fumadocs-core from 16.8.12 to 16.14.5

[dependabot]

Bumps fumadocs-core from 16.8.12 to 16.14.5.

Release notes

Sourced from fumadocs-core's releases.

fumadocs@16.14.5

• @​fumadocs/base-ui@​16.14.5
• fumadocs-core@16.14.5
• fumadocs-ui@16.14.5

Add a main landmark to docs, notebook and flux pages

The page container slot now wraps <article id="nd-page"> in a <main class="contents"> in the docs, notebook and flux layouts. All props, id="nd-page" and the layout classes stay on the <article>, so existing selectors and refs keep working.

Loader: next parameter for custom slugs function

The slugs option now receives a next function as its second argument, which generates the default slugs from the file path. This lets custom slug functions build on the default generation instead of reimplementing it:

loader({
  slugs(file, next) {
    if (file.path.startsWith('blog/')) return ['blog', ...next()];
    // return `undefined` to generate default slugs
  },
});

Behavior change: conflicting cases like dir/index.mdx vs dir.mdx are now resolved for custom slugs functions as well. Index files are always processed after other pages, and receive an index suffix when their slugs (custom or default) collide with an existing page — previously, custom slugs functions that produced such collisions threw a Duplicated slugs error.

fumadocs@16.14.4

• @​fumadocs/base-ui@​16.14.4
• fumadocs-core@16.14.4
• fumadocs-ui@16.14.4

Introduce @fumari/image-size, replacing image-size in remarkImage

A fork of probe-image-size with no dependencies of its own.

import { probe, imageSize } from '@fumari/image-size';
await probe('./public/banner.png'); // { width: 1200, height: 630, type: 'png', mime: 'image/png' }
await probe('https://example.com/banner.png', { timeout: 5000 });
imageSize(bytes); // the same result, or null

remarkImage now uses it in both fumadocs-core and @fumadocs/satteri. Remote images are no longer downloaded in full just to be measured, and redirects are followed. Sizes are always in pixels, so an SVG sized in em or pt is converted instead of being skipped. Remote requests also time out after 30 seconds by default.

One behaviour difference worth knowing: the supported formats are avif/heic/heif, bmp, gif, ico, jpeg, png, psd, svg, tiff and webp. Sizes for jxl, tga, pnm, dds, icns, cur, ktx and jp2 can no longer be resolved and go through onError instead.

Sequential scanning stops after 512 KB, but that never loses an image: the one format that stores its dimensions past that point — TIFF with a trailing IFD — is resolved by following the header's pointer with a targeted read, using an HTTP Range request for remote files (and skipping through the body when the server ignores ranges).

fumadocs@16.14.3

• @​fumadocs/base-ui@​16.14.3

... (truncated)

Commits

• 3043da2 Version Packages (#3486)
• 671bd83 feat(core): support baseSlugs option
• 2899bc1 fix(ui): add a main landmark to docs, notebook and flux pages (#3483)
• 14f9eaf feat(core): support next param for custom slugs function
• ddccb91 docs: improve local-html section
• 43f4006 Version Packages (#3478)
• d1c99ad chore(local-html): improve DX
• 7fd880d example: add for html content source
• 4d8ac85 feat: add @​fumadocs/local-html content source (#3477)
• 78b6641 Version Packages (#3473)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[hotlong]

Do not merge this on green CI alone. Not an objection to the bump — a note that its blast radius changed today, and that the gates on this PR cannot see the change.

Three commits landed on main in the last hour that depend on fumadocs-core behaviour that is not part of its documented API, all measured against the pinned 16.8.12. This PR crosses six minor versions.

1. translatedLocales() in apps/docs/lib/seo.ts (from #169, 93a366c) discriminates a real translation from an inherited English fallback by comparing page.path, relying on the fact that a locale's in-memory file system is built by copying the English files in while each page keeps the original locale-suffixed filename it was authored under. This is the load-bearing assumption of the whole sitemap and hreflang surface. It was chosen precisely because getPages(lang) and getLanguages() could not do the job — they report 79 pages for all seven locales and cannot tell a translation from a fallback.

2. getPages() with no argument returns every locale's set concatenated — relied on (by passing the default language explicitly) in both apps/docs/app/sitemap.ts (#169) and apps/docs/app/llms.txt/route.ts (#170, 9c29df6). If 16.14.5 changed that default, both surfaces regress silently in opposite directions depending on which way it moved.

3. llms() from fumadocs-core/source/llms now renders the llms.txt tree (#170).

Two more PRs in flight touch the same APIs: #183 and #186.

Why green CI is not evidence here

#175 documents this exactly: type-check, build and test were all green on the tree that emitted 3892 sitemap entries over 574 distinct URLs. Nothing in this repo asserts anything about the generated sitemap or llms.txt. A behaviour change in any of the three points above produces a wrong-but-well-formed output that every gate on this PR passes.

What to run before merging

Build this branch and diff the generated artefacts against main's. Post-#169 the expected values on main are:

• apps/docs/.next/server/app/sitemap.xml.body — 346 entries over 346 distinct URLs; docs entries per locale en 79, zh-Hans 62, ja 39, de 38, es 39, fr 39, ko 39.
• /llms.txt — 116 lines, 79 link lines, 9 headings, 0 links to a non-default-locale prefix.
• Spot check: /docs/operate/backup emits only hreflang en plus x-default; /docs/configure/permissions/positions and its /ja/ counterpart emit the identical eight-element cluster.

Any drift in those numbers is this bump changing behaviour, not noise. If they hold, the bump is clean and this note costs one build.

Sequencing suggestion: let #183 and #186 land first (both are already based on 8feb90d, this PR is still based on ee74379 and will need a base merge regardless), then run the above once against a settled main.

cc #175 — this is the concrete case for pinning the generated output.

---

Generated by Claude Code

[hotlong]

Update to my earlier note — most of the manual diffing it asked for is now automated, and the residual risk is smaller and better defined.

Since that comment, .github/scripts/check-locale-surface.mjs landed (#193, d6355de) and was extended to the two llms endpoints (#202, 01b29d9). It runs as a post-build step in ci.yml, so it will run on this PR. It asserts, against an oracle derived every run from content/docs/ and apps/docs/lib/i18n.ts with nothing read from app code:

artifact	asserted
sitemap.xml	every advertised URL has a source file; every source file is advertised; no duplicates
llms.txt	carries every en-exclusive page title, and none from the other six locales
llms-full.txt	same

That covers three of the points my note listed by hand. If this bump changes what any of those three enumerate, CI now goes red and names the URL or title. No diffing required.

What the gate does not cover, and is still worth checking by hand

1. translatedLocales() in apps/docs/lib/seo.ts — the page.path file-identity discriminator that distinguishes a real translation from an inherited English fallback. The gate would catch a wrong answer from it via the sitemap composition, so this is now belt-and-braces rather than the only line of defence — but it depends on undocumented behaviour (each locale's file system is built by copying the English files in, with each page keeping its authored filename), and six minor versions is a lot of room for that to change shape.
2. getPageTree() defaulting to the default language. Measured on 16.8.12 as byte-identical with and without the argument ([finding] the locale-pin comment in llms.txt/route.ts names getPageTree() as a leaking call — measured, it is not #203). If 16.14.5 changes that, the routes are pinned explicitly and stay correct — the gate would catch it either way — but the behaviour is worth knowing about.
3. llms() from fumadocs-core/source/llms, which renders the llms.txt tree. The gate asserts which titles appear, not how the bullets are formatted.
4. Build reproducibility. [finding] the generated sitemap's entry order is not reproducible — two builds of an unchanged tree emit different bytes #194 (453cdba) and [finding] llms-full.txt page order is not reproducible either — same root cause as #194, second surface #196 (1ebd7b7) made sitemap.xml and llms-full.txt pure functions of the content. Two consecutive builds of an untouched tree should now be byte-identical for both. If this bump reintroduces cross-build variation, that is a regression the gate will not see — it compares sets, deliberately.

Expected values after today's fourteen merges, if you do want to diff:

• sitemap.xml — 346 entries over 346 distinct URLs; docs entries per locale en 79, zh-Hans 62, ja 39, de 38, es 39, fr 39, ko 39.
• llms.txt — 79 link lines, 0 links to a non-default-locale prefix.
• llms-full.txt — 79 page blocks, 646 link targets, pages in navigation-tree order.

Sequencing suggestion stands: this PR is still based on ee74379 and needs a base merge regardless. Let the two in-flight cards land first, then merge main in and let the gate do the work.

---

Generated by Claude Code

[hotlong]

Interaction with #197 — this bump may become a regeneration task, not a merge.

#197 traced a defect in llms-full.txt and /llms.mdx output to a one-line omission in fumadocs-core itself: defaultStringifier wraps every serializer handler through modHandler and does not carry Handle.peek onto the wrapper, so mdast-util-to-markdown loses its side-effect-free lookahead and misapplies attention-encoding state from the next node to the current one. 67 characters in the built body, four malformed markdown link targets, and two links silently exempted from the absolute-URL rewrite #178 shipped.

Two things about it bear directly on this bump:

The bug is present in 16.15.1, the current latest — not only in the installed 16.8.12. The dev read the function in both: byte-identical apart from a brace reformat. So 16.14.5 does not fix it, and upgrading is not a route to fixing it.

If the maintainer takes option A on #197 (pin the upstream one-liner with pnpm.patchedDependencies), that brace reformat means a patch generated against 16.8.12 will fail to apply on this bump rather than mis-apply silently. That is the behaviour you want from a patch pin, but it converts this PR from "merge when green" into "regenerate the patch, then merge."

Sequencing: #197 is with the maintainer for the route decision. Hold this bump until that lands either way — if the answer is B or C, no patch exists and this merges normally; if it is A, the patch must be regenerated against the new version in the same PR.

The existing do-not-merge-on-green note stands, and the reason for it has narrowed: the locale-surface gate (.github/scripts/check-locale-surface.mjs) now covers sitemap.xml, llms.txt and llms-full.txt composition automatically, so a fumadocs bump that changes which pages or locales are emitted will be caught by CI. What the gate does not cover is the characters inside page bodies — which is exactly the surface this bump would move.

---

Generated by Claude Code

[dependabot]

Superseded by #239.