[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Bumps the infrastructure group with 19 updates:

Package	From	To
@j178/prek	0.5.3	0.5.4
@tauri-apps/cli	2.11.5	2.12.0
@types/node	26.6.2	26.6.3
smol-toml	1.8.0	1.9.0
wrangler	4.135.0	4.142.0
fumadocs-core	16.15.12	16.15.15
fumadocs-mdx	15.4.3	15.4.5
fumadocs-ui	16.15.12	16.15.15
vite	8.3.0	8.3.1
@tauri-apps/api	2.11.1	2.12.0
@tauri-apps/plugin-dialog	2.7.3	2.8.0
@tauri-apps/plugin-fs	2.5.2	2.6.0
@tauri-apps/plugin-shell	2.3.6	2.4.0
@tauri-apps/plugin-updater	2.12.0	2.13.0
lucide-react	1.47.0	1.48.0
marked	18.0.13	18.0.14
monaco-editor	0.56.0	0.57.0
react-hook-form	7.88.0	7.89.0
react-i18next	17.0.14	17.0.15

Updates @j178/prek from 0.5.3 to 0.5.4

Release notes

Sourced from @​j178/prek's releases.

0.5.4

Release Notes

Released on 2026-09-28.

Highlights

Faster builtin hooks

In our end-to-end benchmark, prek is about 38% faster than 0.5.3, with some builtin hooks up to 273% faster (check-yaml: 273%, check-json: 80%, check-merge-conflict: 71%).

Enhancements

• Add include_deleted to allow hooks to include deleted files (#2733)
• Add --check and simplify end-of-file-fixer (#2764)
• Add --check to file-contents-sorter (#2765)
• Add --check to requirements-txt-fixer (#2766)
• Add --check to trailing-whitespace (#2763)
• Expose and document prek util generate-shell-completion (#2727)
• Support hide_status in project and user configuration (#2760)
• Support look-around regex in builtin pattern hooks (#2732)

Performance

• Cache the resolved Git executable on macOS (#2726)
• Combine and cache Git repository path queries (#2724)
• Optimize common builtin hook execution (#2768)
• Optimize scanning in mixed-line-ending and trailing-whitespace (#2769)
• Scan check-merge-conflict files in fixed-size blocks (#2781)
• Use SIMD UTF-8 validation in check-json, check-toml, and check-yaml (#2770)

Bug fixes

• Retry transient rename failures on Windows (#2756)
• Use PATH to resolve prek in completion scripts (#2719)

Documentation

• Clarify the flow and scope of usage guides (#2710)
• Reorganize usage guides and reference documentation (#2709)

Other changes

• Sync latest identify tags (#2762)

Contributors

• @​github-actions

... (truncated)

Changelog

Sourced from @​j178/prek's changelog.

0.5.4

Released on 2026-09-28.

Highlights

Faster builtin hooks

In our end-to-end benchmark, prek is about 38% faster than 0.5.3, with some builtin hooks up to 273% faster (check-yaml: 273%, check-json: 80%, check-merge-conflict: 71%).

Enhancements

• Add include_deleted to allow hooks to include deleted files (#2733)
• Add --check and simplify end-of-file-fixer (#2764)
• Add --check to file-contents-sorter (#2765)
• Add --check to requirements-txt-fixer (#2766)
• Add --check to trailing-whitespace (#2763)
• Expose and document prek util generate-shell-completion (#2727)
• Support hide_status in project and user configuration (#2760)
• Support look-around regex in builtin pattern hooks (#2732)

Performance

• Cache the resolved Git executable on macOS (#2726)
• Combine and cache Git repository path queries (#2724)
• Optimize common builtin hook execution (#2768)
• Optimize scanning in mixed-line-ending and trailing-whitespace (#2769)
• Scan check-merge-conflict files in fixed-size blocks (#2781)
• Use SIMD UTF-8 validation in check-json, check-toml, and check-yaml (#2770)

Bug fixes

• Retry transient rename failures on Windows (#2756)
• Use PATH to resolve prek in completion scripts (#2719)

Documentation

• Clarify the flow and scope of usage guides (#2710)
• Reorganize usage guides and reference documentation (#2709)

Other changes

• Sync latest identify tags (#2762)

Contributors

• @​github-actions
• @​j178

Commits

• 77c4056 Summarize builtin hook speedups
• 7a6b8d1 Bump version to 0.5.4
• c7ec693 Update ubuntu:26.04 Docker digest to da6fc2b (#2772)
• eee5822 Scan check-merge-conflict files in fixed-size blocks (#2781)
• 4c579dc Update dependency uv to v0.12.17 (#2773)
• 1f2a621 Update Rust crate clap to v4.6.7 (#2775)
• aeea7a5 Update GitHub Actions (#2778)
• 51ca2db Update Rust crate rustix to v1.1.5 (#2777)
• 80e8bcc Update Rust crate clap_complete to v4.6.11 (#2776)
• 0f23764 Update Rust crate async-compression to v0.4.48 (#2774)
• Additional commits viewable in compare view

Updates @tauri-apps/cli from 2.11.5 to 2.12.0

Release notes

Sourced from @​tauri-apps/cli's releases.

@​tauri-apps/cli v2.12.0

[2.12.0]

New Features

• f6c1eb253 (#15401) Added bundle.windows.bundleVCRuntime to copy the Visual C++ runtime DLLs into Windows MSI and NSIS installers. The bundler locates the runtime through VCTOOLS_REDIST_DIR or the bundled vswhere.exe.

• f76b1d3ae (#15644) The bundler now prints the size of each generated bundle next to its path in the Finished N bundles at: output (directories such as macOS .app bundles are measured recursively).

• af465eae1 (#15619) Add a --no-binary-patching flag to tauri build and tauri bundle. When set, the bundler skips patching the main executable with bundle type information (and the subsequent re-signing), leaving an already-signed binary untouched. Patching is only required when shipping multiple bundle types per platform that should each update with their own installer format.

• 0646cc162 (#15620) Add a --fit option to tauri icon to accept non-square source images. --fit cover center-crops the source to a square (clipping the longer side) and --fit contain pads the shorter side with transparency. Non-square sources without --fit keep erroring, now with a hint pointing to the flag.

• f6c1eb253 (#15401) Added build.windows.staticVCRuntime to control MSVC static runtime linking. The STATIC_VCRUNTIME environment variable is now deprecated and emits a migration warning when used.

• f45ec0dcf Record the app version in the trusted comment of updater signatures, so a signed artifact is bound to the version it was released as.

  An update endpoint response is not signed, and the signature only covers the downloaded artifact, so the announced version on its own does not prove which release the url and signature point at. minisign covers the trusted comment with its global signature, which lets the updater plugin compare the two and reject a response that pairs a version number with a different release. Enable requireSignedVersion in the updater plugin configuration to enforce this.

  tauri build fills the version in automatically, and tauri plugin add updater now enables requireSignedVersion for the project it is adding the plugin to. tauri signer sign gains an --app-version flag for signing updater artifacts by hand, and warns when it is omitted.

Enhancements

• e19121427 (#15993) Don't always rewrite Cargo.toml file from CRLF line endings to LF

• aebf38c84 (#15694) Migrate the Android Gradle scripts from the deprecated kotlinOptions DSL to compilerOptions, which is accepted by both Kotlin Gradle Plugin 1.9.x and 2.x. This lets projects move to Kotlin 2.x without hitting the hard error that 2.3+ raises on the old DSL.

  This increased the minimum supported Gradle version to 8.13, if your gradle is on an earlier version, delete src-tauri/gen/android/gradle/wrapper/gradle-wrapper.properties and re-run tauri android init to update it.

• d89d8fa62 (#15780) Warn during Android commands (init/dev/build) when the active Java version is too new for the Gradle version the project uses (e.g. Java 27 against the Gradle 9.6.1 the template ships, or Java 25 against a project still on Gradle 8.14), instead of letting the build fail later with a cryptic error. The warning points to the Gradle/Java compatibility matrix and suggests a supported JDK.

• c3d21bd60 (#15730) Use Theme.Material3.DayNight.NoActionBar instead of Theme.MaterialComponents.DayNight.NoActionBar when running tauri android init

• f654f470c (#15862) Update template to use targetSdk = 37

• cdaf7eab6 (#15765) Clarify that the tauri init frontend commands run before tauri dev and tauri build, and can be left empty when they are not needed.

• d0f38df06 (#15997) When stdin is not a terminal, tauri init now automatically skips prompts, avoiding IO errors in CI and scripts. This eliminates the need to pass --ci explicitly in non-interactive environments.

• ca160ad48 (#15895) tauri build now warns when productName is still set to the default tauri-app, since it names the generated bundles and is written into install paths and metadata that are expected to be unique to your application. The config documentation for productName now lists what the field controls on each platform, and identifier's documentation notes that the default value is rejected.

• 010f06bae (#15737) Document the TAURI_SIGNING_PRIVATE_KEY_PATH environment variable and clarify that TAURI_SIGNING_PRIVATE_KEY accepts a string or a path for the build and bundle command but must be the literal key string for the signer sign command, both in ENVIRONMENT_VARIABLES.md and in the signer generate command output.

Bug Fixes

• 9bad06b9f (#16096) tauri capability new and tauri permission new now accept an --out path to a file that does not exist yet, trim comma-separated prompt answers (so fs:default, core:default works), report invalid permissions as errors instead of panicking, and reject identifiers that are not valid file names (such as ../../x), which previously let them write outside of the capabilities or permissions directory.
• 9642b3087 (#16117) tauri add now honors --tag, --rev and --branch for official plugins instead of silently installing the registry version, and rejects passing more than one of them. With npm, the JS package requirement is now ~<version> like the other package managers, instead of >=<version> which allowed a later major version.
• cada1cd4f (#16105) Fix Android dev server port forwarding: adb reverse --list is now matched on the exact port (so tcp:80 no longer matches tcp:8080), stale forwards on other connected devices are actually removed, and the forward verification gives up with a warning after a few attempts instead of retrying forever.
• d5bd04658 (#16111) Fix bundle > android > debugApplicationIdSuffix being written to the signingConfigs debug block instead of the buildTypes one, and keep the existing content of single-line debug blocks such as getByName("debug") { isDebuggable = true } instead of dropping it.
• ba17da2e5 (#16101) tauri icon now generates 72x72 Android hdpi launcher icons (previously 49x49) and writes the Android launcher background color in #RRGGBB/#AARRGGBB notation instead of the raw CSS color string, which Android rejected or misread. Invalid SVG sources and --png 0 now return an error instead of panicking.
• 272842a57 (#16128) Fix error messages that printed placeholders such as {t} literally instead of the value, e.g. "Could not find an Android device matching {t}".
• 10ad4e54e (#16127) The Bash completions generated by tauri completions no longer replace the completions of cargo, npm, pnpm, yarn, bun and deno. They now define a _tauri_cli function registered only for the tauri and cargo-tauri commands. Generating completions when running the cargo-tauri binary directly no longer panics.
• 0e4ded72a (#16107) Fix binaries in src/bin and src/main.rs being left out of bundles when Cargo.toml declares a [[bin]] target without a path.
• 8e0fa2e2f (#16097) Fix the bundler using the host target triple when --target is not passed but build.target is set in .cargo/config.toml. The CLI now also accepts build.target as an array and honors the CARGO_BUILD_TARGET environment variable.
• 7bb0a5421 (#16120) Fix the Cargo.toml feature rewrite corrupting a string dependency version that has a trailing comment or uses single quotes (e.g. tauri = "2" # pin became "2#pin"). The version value is now kept as-is and the comment is preserved.
• e4630258e (#16114) Fix the CLI's working directory being left changed to the config directory when the Tauri configuration fails to parse, for example when tauri dev reloads an invalid config.
• 1b91b7b7b (#16102) tauri info now logs a warning when it cannot check the latest crate version on crates.io instead of silently ignoring the failure, and no longer panics if crates.io returns a version it cannot parse.
• 1b91b7b7b (#16102) tauri info now lists every locked version of a Rust crate when Cargo.lock contains more than one, and no longer panics when the crates.io response cannot be parsed.
• 6507d0b8b (#16124) tauri dev now reports an error instead of panicking when the beforeDevCommand cannot be spawned or the devUrl host cannot be resolved, and no longer risks stopping the beforeDevCommand process tree twice when Ctrl+C and the app exit race.
• c1ea96ad6 (#16110) Fix tauri dev not reacting to the app exiting when a process spawned by the app kept its stderr open, and stop keeping the whole app stderr output in memory. Also fix command output capture that could return empty output when the command finished before its output was read.
• d61fbdc3e (#16109) Fix Cargo.toml feature injection and the v1 migration only updating either [dependencies] or [target.'cfg(..)'.dependencies], whichever came first in the file. Both the main and all target-specific dependency tables are now updated.
• 5d995ed35 (#16017) Normalize gen/android/gradlew CRLF line endings to LF on all host platforms, not only Unix. A gradlew checked out with CRLF broke sh ./gradlew on Windows hosts using Git Bash. The rewrite only runs when a CRLF is actually present. A failure to rewrite aborts on Unix, where the script is executed directly; on Windows the CLI invokes gradlew.bat, so failures there only warn.
• 6d943c420 (#16065) Fix the tauri capability new command description, which said "Create a new permission file", and the --skip-stapling help text on tauri build and tauri bundle, whose first line described the opposite of what the flag does.

... (truncated)

Commits

• 447fa9f fix(core): tauri-utils publish
• 4f46cfc fix(ci): pnpm publish should use "debug" loglevel instead of "silly"
• 726822c apply version updates (#15634)
• 9f8922a docs(core): extend app_directories_override documentation (#16139)
• dc894d4 chore: remove change file for unreleased fix (#16140)
• 152529e Revert "feat(core): add android activityEmbedding config (#15255)" (#16138)
• 7456ddd Revert "fix(core): proper unique identifier for menu items on channels store"...
• 15468de fix(bundler): recognize deb and rpm as self-contained updater targets (#16064)
• 8e70283 fix(bundler): update linuxdeploy and linuxdeploy-plugin-gtk (#16062)
• 1b91b7b fix(cli): list all locked crate versions in tauri info (#16102)
• Additional commits viewable in compare view

Updates @types/node from 26.6.2 to 26.6.3

Commits

• See full diff in compare view

Updates smol-toml from 1.8.0 to 1.9.0

Release notes

Sourced from smol-toml's releases.

v1.9.0

Huge update!!! This is most likely the largest update the library received since its release, with lots of new features and improvements.

Performance improvements

Significant parts of the internal parse logic have been rewritten, improving performance by 1.5x-2x. The library was already comfortably ahead of the others, but it is now faster than ever, sitting at 4x faster parse performance than the closest maintained implementation.

Problematic code paths have also been replaced by safer implementations, solving potential DoS vectors. See GHSA-r4xh-jqrq-34v2.

Note: the objects returned by the library now have a null prototype. This is a transparent change for 99.9% of users, and is one of the most significant contributors to the major performance gains in this version.

Full Temporal support

Version 1.8.0 brought support for Temporal in stringify; now the library is also able to emit Temporal objects instead of its own ad-hoc TomlDate object. It is not enabled by default, but it will become the default in v2. Enable by setting useLegacyDate: false in the parser's options.

Better Temporal support in stringify

Temporal support has been improved since it released: Temporal objects that cannot be represented (such as Temporal.PlainMonthDay) now throw an error (instead of silently emitting a bogus object).

A new option has been added to stringify to disallow Temporal objects that cannot be fully represented in TOML. This includes ZonedDateTime objects with a IANA timezone attached instead of a plain offset, and dates with a specific calendar value set. Enable by setting strictTemporal: true in the options.

Handling of unsafe keys

Since its release the library has been protected against prototype pollution attacks, setting properties like __proto__ using safe mechanisms that do not trigger prototype pollution. However, while the returned objects are safe on their own, they may become problematic if used carelessly.

Inspired by secure-json-parse, the library now offers a way to either drop unsafe properties from the returned object, or to throw an error and reject documents altogether. By default, these potentially unsafe keys are preserved and returned.

Miscellaneous updates

• Unicode BOM is now gracefully accepted and ignored.
• Table array headers are now properly checked again. Reported in #65.
• Closed certain gaps where invalid whitespace would be accepted. Reported in #61.
• Bogus local date and local time values with a UTC offset are no longer accepted.
• Certain error messages are more accurate and handle errors at line boundaries better.
• The default export of the lib is now formally deprecated; use a import * instead. Proposed in #50.
• On Node 20+, strings that contain lone surrogates are now normalised to well-formed strings.
• On Node 20+, keys that contain lone surrogates are now rejected.

Full Changelog: squirrelchat/smol-toml@v1.8.0...v1.9.0

Commits

• 6f9739a fix: gate [is|to]WellFormed (Node 18 compat)
• a73ca32 fix: no Temporal with toml-test when Node < 26
• 7727890 chore: version bump
• 641903d chore: rewrite README.md
• 2df14c5 fix(types): make it work if Temporal doesn't exist
• 3eaa44e chore: update benchmark harness
• cd3ba60 feat: safety option for dangerous properties
• 6746a7f perf: refactor TomlDate to avoid regex path
• 16fa64f chore: move benchmarks and test harness under 0BSD
• bbd14b1 fix: correct sign for single-char numbers
• Additional commits viewable in compare view

Updates wrangler from 4.135.0 to 4.142.0

Release notes

Sourced from wrangler's releases.

wrangler@4.142.0

Minor Changes

• #15856 4c2993b Thanks @​Naapperas! - Support Workflows declared in exports on ctx.exports in local development

  A Workflow declared in a Worker's exports is now available on ctx.exports in wrangler dev, the Vite plugin and the Vitest plugin, with the same API as a Workflow binding:

  const instance = await ctx.exports.MyWorkflow.create({
    params: { name: "World" },
  });

  ctx.exports and workflows bindings with the same Workflow name share their instances, including instances created before the Workflow was declared in exports. Two Workers can't export the same Workflow name, and a binding to an exported Workflow must refer to the Worker and class that export it. getPlatformProxy() ignores Workflows declared in exports, since it doesn't run the Worker's code.

  wrangler workflows commands run with --local also work with Workflows declared only in exports, without a workflows binding.

  In the Vitest plugin, introspectWorkflow() and introspectWorkflowInstance() still need a Workflow binding, and now explain how to add one when passed a Workflow from ctx.exports. Instances created through ctx.exports are introspected too. A workflows binding whose script_name is the Worker's own name now resolves to the Worker itself again.

Patch Changes

• #15891 8dc53ae Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260925.1	^5.20260926.1
  workerd	1.20260925.1	1.20260926.1

• Updated dependencies [8dc53ae, 4c2993b]:

  • miniflare@5.20260926.0-alpha

wrangler@4.141.0

Minor Changes

• #15658 8280086 Thanks @​jqmmes! - Add Durable Objects code update strategies to Worker deployments

  Use --durable-objects-code-update-mode immediate with wrangler deploy, wrangler versions deploy, and wrangler rollback to update code without waiting for active instances to hibernate. Use --durable-objects-code-update-mode deferred 30s to set a maximum delay, or configure durable_objects.code_update_strategy with mode and max_delay. When unset, the strategy defaults to deferred with a 5-minute maximum delay; delays cannot exceed 24 hours and must use millisecond precision.

• #15800 bd56b98 Thanks @​Refaerds! - Add Browser Run as an event source for Queue subscriptions

  You can now create Queue subscriptions with --source browserRun.

Patch Changes

• #15864 ee2b200 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

... (truncated)

Commits

• f96458c Version Packages (#15882)
• 4c2993b Emit new Worker config for same-worker Workflows (#15856)
• 8d61ca8 Version Packages (#15867)
• 8280086 [wrangler] Add Durable Objects hibernation timeout option (#15658)
• 805af2f [wrangler] Log ProxyWorker request error details at debug level (#15207)
• bd56b98 [wrangler] Add browserRun event source type for queue subscriptions (#15800)
• 72056b7 [wrangler] Clean up retired Container image binding tests (#15787)
• 84c819f Version Packages (#15857)
• 8f7916c [deploy-helpers] Containers support for Worker Preview deployments in the Bui...
• c59dae6 Version Packages (#15828)
• Additional commits viewable in compare view

Updates fumadocs-core from 16.15.12 to 16.15.15

Release notes

Sourced from fumadocs-core's releases.

fumadocs@16.15.15

• @​fumadocs/base-ui@​16.15.15
• fumadocs-core@16.15.15
• fumadocs-ui@16.15.15

Fix infinite recursion in the MDX stringifier with mdast-util-to-markdown@2.1.3

The stringifier wraps every toMarkdown handler but dropped their attention and peek properties, which mdast-util-to-markdown@2.1.3 relies on to serialize bold and italic text. Pages containing them overflowed the stack during build.

fumadocs@16.15.14

• @​fumadocs/base-ui@​16.15.14
• fumadocs-core@16.15.14
• fumadocs-ui@16.15.14

Announce copy confirmation to screen readers

Copy buttons are polite live regions whose label switches to "Copied" after a successful copy, so screen readers announce it. The code block's copy button no longer reports success when the clipboard write fails.

Expose the search dialog as a combobox

The search input is now a combobox that controls a listbox of option results and reports the highlighted result through aria-activedescendant, so screen readers announce results as you move through them. Hidden result buttons are removed from the tab order, and the empty state is announced as a status message.

Remove hidden sidebar controls from the tab order

The collapsed sidebar and its floating pill are now inert while hidden, and toggling the sidebar moves focus to the trigger that becomes visible.

Add block TOC style

A TOC style without the track line: headings are indented by depth, and a block slides behind the active headings.

<DocsPage tableOfContent={{ style: 'block' }} />

Wrap page footer descriptions instead of truncating

The previous/next page footer cards now wrap long descriptions instead of cutting them off with an ellipsis.

fumadocs@16.15.13

• @​fumadocs/base-ui@​16.15.13
• fumadocs-core@16.15.13
• fumadocs-ui@16.15.13

Keep the collapsed sidebar's controls off the page title

With the sidebar collapsed, the docs layout floats the reopen and search buttons in a fixed pill at the top-left of the page and starts the article at the same row. Wherever the article is not centered with room to spare, every viewport below about 1280px, the pill covered the page title. The article now leaves room for the pill while the sidebar is collapsed.

AI page actions name the page by the URL the reader is on

... (truncated)

Commits

• 1bc5374 Version Packages (#3603)
• 7b83e88 fix(core): fix infinite recursion in the MDX stringifier with `mdast-util-to-...
• c481705 fix(api-docs): label schema property copy button (#3602)
• d48fa91 docs: preview toc variants
• cb6f3d6 Version Packages (#3600)
• 6676327 perf(mdx): reduce duplicated file reads
• f1186d9 fix(openapi): normalize fetch methods
• a8438dc Version Packages (#3595)
• 539bada feat(ui): support block toc variant
• 23bef0b docs: correct stale info
• Additional commits viewable in compare view

Updates fumadocs-mdx from 15.4.3 to 15.4.5

Release notes

Sourced from fumadocs-mdx's releases.

fumadocs-mdx@15.4.5

Stop recrawling node_modules on every Vite config resolution

The config hook of fumadocs-mdx/vite walked the dependency tree below Fumadocs packages once per chain reaching a package, so a docs app with a few Fumadocs packages read ~10k package.json files (~0.9s) each time Vite resolved its config, which it does once per build environment.

The crawl now visits each package once, breadth-first, and still records the shortest chain to every CommonJS dependency (fumadocs-ui > @base-ui/react > use-sync-external-store/shim and friends). The result is memoized for the process until the package manager's install state changes, so a build with several environments crawls once.

fumadocs-mdx@15.4.4

Sort glob results for deterministic codegen

fumadocs-mdx's Node codegen now sorts glob-matched files before generating collections, so the output (and anything derived from getPages()) is stable across builds of unchanged content. The Vite codegen path was checked separately: Vite's own import.meta.glob already sorts matched files internally, so it did not need the same fix.

Commits

• cb6f3d6 Version Packages (#3600)
• 6676327 perf(mdx): reduce duplicated file reads
• f1186d9 fix(openapi): normalize fetch methods
• a8438dc Version Packages (#3595)
• 539bada feat(ui): support block toc variant
• 23bef0b docs: correct stale info
• e988e54 fix(ui): announce copy confirmation to screen readers
• 583e2ca fix(ui): keep search dialog active state inside the list
• 11bc9dc fix(ui): expose the search dialog as a combobox
• d7fa38c fix(ui): remove hidden sidebar controls from the tab order
• Additional commits viewable in compare view

Updates fumadocs-ui from 16.15.12 to 16.15.15

Release notes

Sourced from fumadocs-ui's releases.

fumadocs@16.15.15

• @​fumadocs/base-ui@​16.15.15
• fumadocs-core@16.15.15
• fumadocs-ui@16.15.15

Fix infinite recursion in the MDX stringifier with mdast-util-to-markdown@2.1.3

The stringifier wraps every toMarkdown handler but dropped their attention and peek properties, which mdast-util-to-markdown@2.1.3 relies on to serialize bold and italic text. Pages containing them overflowed the stack during build.

fumadocs@16.15.14

• @​fumadocs/base-ui@​16.15.14
• fumadocs-core@16.15.14
• fumadocs-ui@16.15.14

Announce copy confirmation to screen readers

Copy buttons are polite live regions whose label switches to "Copied" after a successful copy, so screen readers announce it. The code block's copy button no longer reports success when the clipboard write fails.

Expose the search dialog as a combobox

The search input is now a combobox that controls a listbox of option results and reports the highlighted result through aria-activedescendant, so screen readers announce results as you move through them. Hidden result buttons are removed from the tab order, and the empty state is announced as a status message.

Remove hidden sidebar controls from the tab order

The collapsed sidebar and its floating pill are now inert while hidden, and toggling the sidebar moves focus to the trigger that becomes visible.

Add block TOC style

A TOC style without the track line: headings are indented by depth, and a block slides behind the active headings.

<DocsPage tableOfContent={{ style: 'block' }} />

Wrap page footer descriptions instead of truncating

The previous/next page footer cards now wrap long descriptions instead of cutting them off with an ellipsis.

fumadocs@16.15.13

• @​fumadocs/base-ui@​16.15.13
• fumadocs-core@16.15.13
• fumadocs-ui@16.15.13

Keep the collapsed sidebar's controls off the page title

With the sidebar collapsed, the docs layout floats the reopen and search buttons in a fixed pill at the top-left of the page and starts the article at the same row. Wherever the article is not centered with room to spare, every viewport below about 1280px, the pill covered the page title. The article now leaves room for the pill while the sidebar is collapsed.

AI page actions name the page by the URL the reader is on

... (truncated)

Commits

• 1bc5374 Version Packages (#3603)
• 7b83e88 fix(core): fix infinite recursion in the MDX stringifier with `mdast-util-to-...
• c481705 fix(api-docs): label schema property copy button (#3602)
• d48fa91 docs: preview toc variants
• cb6f3d6 Version Packages (#3600)
• 6676327 perf(mdx): reduce duplicated file reads
• f1186d9 fix(openapi): normalize fetch methods
• a8438dc Version Packages (#3595)
• 539bada feat(ui): support block toc variant
• 23bef0b docs: correct stale info
• Additional commits viewable in compare view

Updates vite from 8.3.0 to 8.3.1

Release notes

Sourced from vite's releases.

v8.3.1

Bug Fixes

• deps: update all non-major dependencies (#23482) (3c752c8)
• deps: update all non-major dependencies (#23537) (e8990c4)
• deps: update rolldown-related dependencies (#23483) (9aecbbf)
• handle server.ws: false in mergeConfig (#23511) (f68c0d5)
• merge build.rolldownOptions.output.comments correctly (#23514) (4aba8d8)
• optimizer: don't skip imports whose binding starts with type (#23540) (39330f4)
• optimizer: resolve pending discovered dep processing on close before init (#23567) (5f89433)
• server: avoid reinitializing watcher when adding file after server close (#23572) (6f831f9)
• sourcemap: skip URL source roots when injecting sources content (#23519) (04fc30a)

Miscellaneous Chores

• merge prereleases in changelog (#23466) (99bd9d1)
• optimizer: add debug log when waiting for dep before init (#23566) (63567c7)
• update optimizeDeps.include comment (#23489) (6a84c72)

Code Refactoring

• assets regexp use non-capture (#23491) (f4b4431)
• remove duplicate configurations (#23532) (9abd99b)
• replace find with some (#23554) (af7cdf6)

Changelog

Sourced from vite's changelog.

8.3.1 (2026-09-24)

Bug Fixes

• deps: update all non-major dependencies (#23482) (3c752c8)
• deps: update all non-major dependencies (#23537) (e8990c4)
• deps: update rolldown-related dependencies (#23483) (9aecbbf)<...

  Description has been truncated

[github-actions]

📦 Semifold release plan

Plan calculated through commit 3a03938.

Note

This pull request does not introduce any changesets.

After this pull request is merged into main, the release workflow will run and publish any prepared package versions that are not yet available in their registry.

This comment updates automatically as the pull request changes.

[cloudflare-workers-and-pages]

🚀 Deploying Preview to Cloudflare 🚀

Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: Failed ❌ View logs ↗		573b07d	2026-10-01T11:02:12.226Z	View logs ↗

[hydroroll-bot]

总体

这组 dependabot 更新在 npm 侧本身是自洽的（pnpm-lock.yaml 的 importer/解析都跟着改了，CI 的 --frozen-lockfile 能兜住）。我顺手核了几处风险点，都没问题：

• monaco-editor 0.56.0 → 0.57.0：monaco-json-editor.tsx 里用到的 editor/editor.api、editor/editor.worker、language/json/json.worker、languages/features/json/register 在 0.57.0 的包里都还在，0.57 的 changelog 只有新增 API。
• fumadocs-core 16.15.15 多出来的 zod peer 在 peerDependenciesMeta 里是 optional，packages/docs 不声明也没关系。
• lucide-react 只从 lock 里的 1.47.0 到 1.48.0（package.json 的 ^1.31.0 → ^1.48.0 只是范围刷新），vite 8.3.1、marked 都是 patch。

但有一处必须先处理，否则打包后的应用会在运行时和 Rust 侧对不上。

P1｜Tauri 的 npm 包和 Rust crate 版本失配（阻塞合并）

PR 之后两侧的声明变成：

包	package.json（本 PR 后）	src-tauri/Cargo.toml
@tauri-apps/api	2.12.0	tauri = "2.11.5"
@tauri-apps/cli	2.12.0	tauri-build = "2.6.3"
@tauri-apps/plugin-dialog	2.8.0	2.7.2
@tauri-apps/plugin-fs	2.6.0	2.5.1
@tauri-apps/plugin-shell	2.4.0	2.3.5
@tauri-apps/plugin-updater	2.13.0	2.10.1

Tauri v2 的《Updating Dependencies》文档要求：npm 侧与 Cargo 侧要"一起更新" —— @tauri-apps/api 与 tauri crate 保持同一个 minor（2.12 ↔ 2.11 已经不满足了），插件的 @tauri-apps/plugin-* 与对应 tauri-plugin-* crate 要版本一致（现在是 2.8/2.7、2.6/2.5、2.13/2.10 各差一截）。插件 JS 包负责拼 invoke('plugin:fs|...') 的命令名和参数，参数/命令签名跟着 Rust 侧走，所以偏差的表现是运行时 invalid args / command not found，而不是编译报错。

风险最集中的是更新器：packages/ui/src/components/updater.tsx 用 check() 和 downloadAndInstall，而 updater 的 JS 侧已经跳到 2.13、crate 还停在 2.10.1，这一路正好是发版后才会被真正触发的代码。而 .github/workflows/check.yml 只跑前端 lint/tsc/vitest/Playwright（Tauri IPC 是 mock 的），paths 也只监听 packages/**，所以这个偏差在 CI 里是看不见的。

建议二选一：

1. 在同一个 PR 里把 src-tauri/Cargo.toml 提到对齐版本并提交新的 Cargo.lock。这些版本都已发布：crates.io 上 tauri 已到 2.12.4，tauri-plugin-fs 2.6.0、tauri-plugin-shell 2.4.0、tauri-plugin-updater 2.13.0 均存在（dialog 2.8.x 同理），tauri-build 一并提。
2. 或者把 @tauri-apps/api / @tauri-apps/cli / @tauri-apps/plugin-* 从这个 infrastructure 组里拆到单独的组，等 cargo 侧的更新一起进来，别让 npm 先跑。

另外一个细节：Cargo.toml 里写的是 caret 约束（"2.7.2" 即 ^2.7.2），所以实际构建版本由 Cargo.lock 决定，我这边没法读到锁文件确认它落在哪个版本。如果锁文件其实已经浮到 2.6/2.13 这一档，那么 Cargo.toml 里这些偏低的声明同样应该提上去，否则清 Cargo.lock 或 cargo update 就会漂移；如果锁文件也还是旧的，那就是实打实的前后端不一致。

P2｜"多生态组"这次只落地了一半

.github/dependabot.yml 里 infrastructure 组同时挂了 npm（/）和 cargo（/src-tauri），但本 PR 只有 4 个 npm 文件、Cargo.lock/Cargo.toml 完全没动。按配置这两侧本该进同一个 PR，说明 cargo 那一半没成功（很可能是 lock 冲突或 fetch 失败）。建议看一下 dependabot 的 job 日志并重新触发，或者干脆按上面第 2 条把 Tauri 相关包单独分组，避免以后总是出现"半套更新"。

建议（可选）

scripts/parity-audit.test.mjs 已经在做前后端一致性检查了，可以顺手加一条：解析 src-tauri/Cargo.toml 的 tauri / tauri-plugin-* 版本，与 package.json 的 @tauri-apps/api、@tauri-apps/plugin-* 比对，不一致就 fail。这类 PR 以后就不会再漏过去。

（判断依据：Tauri v2 官方 Updating Dependencies 文档；版本信息取自 crates.io 索引与 npm 包元数据，取数时间为 2026-10-20。）

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml