deps: upgrade fumadocs trio to 16.15.1/15.3.1 and migrate theme variables - #70
Merged
Conversation
…bles Problem: The fumadocs packages were exact-pinned at fumadocs-core 16.7.9, fumadocs-ui 16.7.9, and fumadocs-mdx 14.2.11 because 16.8 renamed the theme CSS variables, and a naive bump would silently drop the Codex palette. Meanwhile the pinned versions carried 5 of main's audit findings: two image-size DoS advisories (via fumadocs-core) and the js-yaml quadratic-CPU advisories reachable through fumadocs-mdx. Change: - package.json: fumadocs-core and fumadocs-ui to 16.15.1, fumadocs-mdx to 15.3.1 (still exact-pinned). 16.15.1 replaces image-size with the @fumari/image-size fork and mdx 15 no longer depends on js-yaml, so every fumadocs-path audit finding is gone (local audit: 13 -> 8; the remaining 8 are eslint-chain brace-expansion/js-yaml, next PR). mdx 15's breaking changes don't bite: it requires an ESM next.config (ours is .mjs) and fumadocs-core >=16.7. - app/global.css: migrated the Codex palette to the 16.8+ token scheme. Old scheme: bare HSL triplets in --fd-* consumed via hsl(var(...)). New scheme: full color values in --color-fd-* declared in a Tailwind v4 @theme block (light) with .dark overrides, mirroring the shipped fumadocs-ui css/lib/default-colors.css. Alpha usages became color-mix. --fd-destructive/--fd-warning map to the tokens the new Callouts read (--color-fd-error / --color-fd-warning). --fd-radius is dropped: nothing in fumadocs-ui 16.15 reads it. Component classnames (text-fd-primary etc.) are unchanged; Tailwind v4 generates them from the same tokens. Verified: pnpm build green; light and dark themes eyeballed in the dev server via Playwright (Codex teal/parchment/navy all render; a full-viewport screenshot artifact after toggling the theme class was ruled out by inspecting computed styles and an element-level capture).
✅ Deploy Preview for codex-documentation ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview for classy-clafoutis-ff4fd0 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
KaladinX
added a commit
that referenced
this pull request
Aug 24, 2026
…deps (#71) Problem: package.json had accumulated 14 pnpm overrides and a direct minimatch devDependency, all added over time to silence pnpm audit findings in build-time tooling. Overrides rot: several pinned versions (brace-expansion 1.1.12/2.0.2, js-yaml ^4.1.1 frozen at 4.1.1 in the lockfile) had themselves become the vulnerable versions, so the apparatus was generating the very findings it existed to suppress. Meanwhile the audit CI job failed on advisories in eslint's dependency chain: code no visitor can ever reach, since it runs once per build on input the team wrote. Change: - package.json: remove the whole pnpm.overrides block and the direct minimatch devDependency (nothing imports it; it existed only to force a resolution). Update eslint within its range (9.39.5), which pulls patched js-yaml 4.3.1 and current minimatch/brace-expansion on its own, no overrides needed. - ci.yml: the audit gate becomes pnpm audit --prod --audit-level high. Production dependencies are the tree that builds the site and serves the one real server-side surface (/api/search); advisories there still fail CI. Dev-tool advisories no longer gate merges; Dependabot keeps bumping those packages regardless. After this change every remaining audit finding (prod and dev alike) is a fumadocs path fixed by the trio upgrade in PR #70. Merge #70 first; once this branch is rebased on it, the audit job is green with no suppression list at all. Verified: pnpm build green, CI-scoped eslint clean, tsc --noEmit clean.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The fumadocs trio was deliberately frozen (core/ui
16.7.9, mdx14.2.11) because 16.8 renamed the theme CSS variables and a naive bump silently drops the Codex palette. The frozen versions also carried 5 of main's 13 audit findings: twoimage-sizeDoS advisories via fumadocs-core, and thejs-yamladvisories reachable through fumadocs-mdx.Change
Versions (still exact-pinned): fumadocs-core and fumadocs-ui
16.15.1, fumadocs-mdx15.3.1.image-sizewith the@fumari/image-sizefork; mdx 15 dropsjs-yamlentirely. Localpnpm audit --audit-level high: 13 findings → 8. The remaining 8 are the eslint-chainbrace-expansion/js-yamlitems, coming in a separate PR.next.config(ours is.mjs) and fumadocs-core ≥16.7.Theme migration (
app/global.css), done in the same PR per the warning independabot.yml:--fd-*, consumed viahsl(var(--fd-*)).--color-fd-*, declared in a Tailwind v4@themeblock with.darkoverrides — the same structure as the shippedfumadocs-ui/css/lib/default-colors.css.color-mix;--fd-destructive/--fd-warningmap to--color-fd-error/--color-fd-warning, which the new Callouts read;--fd-radiusis dropped (nothing in 16.15 reads it).text-fd-primary,bg-fd-border/50, …) are untouched: Tailwind v4 generates them from the same tokens.Verification
pnpm buildgreen.pnpm audit --audit-level highlocally confirms the fumadocs-path findings are gone. TheauditCI job will still be red from the eslint-chain items until the follow-up PR.