chore(deps): bump the website-dependencies group across 1 directory with 6 updates

[dependabot]

Bumps the website-dependencies group with 6 updates in the /website directory:

Package	From	To
fumadocs-core	16.12.1	16.14.0
fumadocs-mdx	15.2.1	15.2.2
fumadocs-ui	16.12.1	16.14.0
lucide-react	1.27.0	1.28.0
next	16.2.12	16.3.0
postcss	8.5.25	8.5.26

Updates fumadocs-core from 16.12.1 to 16.14.0

Release notes

Sourced from fumadocs-core's releases.

fumadocs@16.14.0

• @​fumadocs/base-ui@​16.14.0
• fumadocs-core@16.14.0
• fumadocs-ui@16.14.0

Replace Orama with ZBSearch, zero-config i18n search

The built-in search engine moved from @orama/orama to ZBSearch, a near drop-in successor. All module paths and APIs are unchanged, and search now works with every language out of the box: the new default multilingual mode uses Unicode word segmentation, so i18n search needs zero config.

import { createFromSource } from 'fumadocs-core/search/server';
// no localeMap, no @orama/tokenizers, CJK included
export const { GET } = createFromSource(source);

All locales now share a single search database — results are filtered by the locale of your pages at query time. Same for static mode:

import { staticClient } from 'fumadocs-core/search/client/orama-static';
const client = staticClient({ locale });

Renames

• oramaStaticClient → staticClient (old name kept as deprecated alias)
• initOrama → initDB, it now creates a ZBSearch instance and is optional — the exported data restores the tokenizer on load

Deprecated

• localeMap is no longer needed. It still works for language-specific stemming/stop-words and keeps the legacy per-locale databases when specified.

Notes for advanced usage

• language, components, plugins and search options are now typed against ZBSearch instead of @orama/orama — custom tokenizers or plugins written for Orama must be swapped to their ZBSearch equivalents.
• The exported static search data is now a ZBSearch database (i18n exports became a single unified database), so server and client should be on the same fumadocs-core version.
• @orama/orama and @orama/tokenizers can be removed from your dependencies unless you use them directly. Orama Cloud integrations (fumadocs-core/search/orama-cloud) are unaffected.

fumadocs@16.13.0

• @​fumadocs/base-ui@​16.13.0
• fumadocs-core@16.13.0
• fumadocs-ui@16.13.0

Add hotkey for toggling light/dark mode

Press D to toggle between light and dark mode. It is ignored while typing in an editable element or when a dialog (e.g. search) is opened.

Customise it with the theme.hotKey option of <RootProvider />, or pass false to disable.

... (truncated)

Commits

• 81c88c6 Version Packages (#3445)
• 4108f03 chore: fix example builds
• a279c17 fix(mdx): workaround for base ui issues
• f29a484 refactor(*): migrate non-rsc examples to macro api
• f845513 feat(mdx): browser helpers for macro
• e0d374c refactor(*): migrate examples & docs to macro API
• 4047bf7 feat(mdx): improve vite plugin usage
• b1636d5 chore: bump deps
• d1245c4 refactor(ui): build tailwind css via tsdown hooks
• 693bb19 docs: mention MDX macro usage
• Additional commits viewable in compare view

Updates fumadocs-mdx from 15.2.1 to 15.2.2

Release notes

Sourced from fumadocs-mdx's releases.

fumadocs-mdx@15.2.2

Support thenable Next.js config

Allow the promises to be awaited.

Commits

• 1025ff3 Version Packages (#3451)
• 5f1a185 fix(mdx): support thenable Next.js config
• See full diff in compare view

Updates fumadocs-ui from 16.12.1 to 16.14.0

Release notes

Sourced from fumadocs-ui's releases.

fumadocs@16.14.0

• @​fumadocs/base-ui@​16.14.0
• fumadocs-core@16.14.0
• fumadocs-ui@16.14.0

Replace Orama with ZBSearch, zero-config i18n search

The built-in search engine moved from @orama/orama to ZBSearch, a near drop-in successor. All module paths and APIs are unchanged, and search now works with every language out of the box: the new default multilingual mode uses Unicode word segmentation, so i18n search needs zero config.

import { createFromSource } from 'fumadocs-core/search/server';
// no localeMap, no @orama/tokenizers, CJK included
export const { GET } = createFromSource(source);

All locales now share a single search database — results are filtered by the locale of your pages at query time. Same for static mode:

import { staticClient } from 'fumadocs-core/search/client/orama-static';
const client = staticClient({ locale });

Renames

• oramaStaticClient → staticClient (old name kept as deprecated alias)
• initOrama → initDB, it now creates a ZBSearch instance and is optional — the exported data restores the tokenizer on load

Deprecated

• localeMap is no longer needed. It still works for language-specific stemming/stop-words and keeps the legacy per-locale databases when specified.

Notes for advanced usage

• language, components, plugins and search options are now typed against ZBSearch instead of @orama/orama — custom tokenizers or plugins written for Orama must be swapped to their ZBSearch equivalents.
• The exported static search data is now a ZBSearch database (i18n exports became a single unified database), so server and client should be on the same fumadocs-core version.
• @orama/orama and @orama/tokenizers can be removed from your dependencies unless you use them directly. Orama Cloud integrations (fumadocs-core/search/orama-cloud) are unaffected.

fumadocs@16.13.0

• @​fumadocs/base-ui@​16.13.0
• fumadocs-core@16.13.0
• fumadocs-ui@16.13.0

Add hotkey for toggling light/dark mode

Press D to toggle between light and dark mode. It is ignored while typing in an editable element or when a dialog (e.g. search) is opened.

Customise it with the theme.hotKey option of <RootProvider />, or pass false to disable.

... (truncated)

Commits

• 81c88c6 Version Packages (#3445)
• 4108f03 chore: fix example builds
• a279c17 fix(mdx): workaround for base ui issues
• f29a484 refactor(*): migrate non-rsc examples to macro api
• f845513 feat(mdx): browser helpers for macro
• e0d374c refactor(*): migrate examples & docs to macro API
• 4047bf7 feat(mdx): improve vite plugin usage
• b1636d5 chore: bump deps
• d1245c4 refactor(ui): build tailwind css via tsdown hooks
• 693bb19 docs: mention MDX macro usage
• Additional commits viewable in compare view

Updates lucide-react from 1.27.0 to 1.28.0

Release notes

Sourced from lucide-react's releases.

Version 1.28.0

What's Changed

• feat(icons): improve calendar icons centre of gravity by @​karsa-mistmere in lucide-icons/lucide#4614

Full Changelog: lucide-icons/lucide@1.27.0...1.28.0

Commits

• See full diff in compare view

Updates next from 16.2.12 to 16.3.0

Release notes

Sourced from next's releases.

v16.3.0

Core Changes

• Update vendored lodash to 4.17.23 to fix CVE-2025-13465: #91558
• Fix invalid HTML response for route-level RSC requests in deployment adapter: #91541
• Normalize encoded dynamic placeholders in app routes: #91603
• Fix(pages-router): restore Content-Length and ETag for /_next/data/ JSON responses: #90304
• Update tokio from 1.43.0 to 1.47.3: #90945
• [turbopack] Simplify snapshotting logic: #91178
• Turbopack: enable server HMR for app route handlers: #91466
• turbo-tasks-backend: batch find_and_schedule_dirty using for_each_task_meta: #91497
• [turbopack] Use bail! instead of panic! for duplicate module ident error: #91636
• Skip loadBindings() Lightning CSS check during next start: #91538
• turbo-tasks-backend: batch schedule dirty tasks in aggregation_update: #91461
• Turbopack: Add importModule() support to webpack loaders: #89630
• turbo-persistence: fix mmap page alignment and improve error context in MetaFile::open_internal: #91640
• turbopack-css: demote recoverable CSS parse warnings to Warning severity: #91524
• feat(node-streams): add config flag, define-env, and env precedence test: #90427
• Rename /_next/webpack-hmr to /_next/hmr: #91415
• Add per-slot error attribution for instant validation using slot markers and config depth preference: #91610
• Handle encoded params further: #91627
• [turbopack] Respect {eval:true} in worker_threads constructors: #91666
• Fix missing route in otel spans without base-server: #91665
• [turbopack] Optimize compaction cpu usage: #91468
• Fix layout segment optimization: move app-page imports to server-utility transition: #91701
• Fix server actions in standalone mode with cacheComponents: #91711
• turbo-persistence: remove Unmergeable mmap advice: #91713
• turbopack: move "compact database" tracing span to backend layer: #91693
• Turbopack: lazy require metadata and handle TLA: #91705
• Fix adapter outputs for dynamic metadata routes: #91680
• Turbopack: fix webpack loader runner layer: #91727
• [turbopack] Remove incorrect debug_assert in try_read_task_cell: #91699
• Add module count field to module graph tracing spans: #91697
• turbopack-cli: add --persistent-caching flag for filesystem-backed cache: #91657
• Turbopack: pull in updated vercel/nft tests: #91651
• [turbopack] Improve regressed build speed on cross-compiled MUSL: #91477
• [Segment Bundling] [Scaffolding] Ensure inlining hint correctness: #91320
• [Segment Bundling] [Scaffolding] Track which segments can be omitted from prefetch: #91438
• Avoid deprecated TS node10 moduleResolution defaults: #91847
• [turbopack] Rebuild the docker build scripts: #91799
• Fix TS6 baseUrl deprecation for extended tsconfig: #91855
• Add next internal post-build CLI command for Turbopack database compaction: #91336
• Turbopack: Define Effect as a trait instead of a closure: #89080
• Turbopack: Implement TraceRawVcs and NonLocalValue correctly for Effects: #89133
• turbo-tasks-backend: improve print_cache_item_size instrumentation: #91742
• Turbopack: switch from base40 to base38 hash encoding (remove ~ and . from charset): #91832
• Use charCodeAt for normalizePathTrailingSlash: #91380
• Turbopack: Only patch lockfile when bindings fails to load: #91379
• [create-next-app] Skip interactive prompts when CLI flags are provided: #91840
• [devtools] Make instant navs panel draggable: #91914
• [Segment Bundling] Bundle static prefetches based on size: #91439

... (truncated)

Commits

• d73f562 v16.3.0
• 2e0d4cb Edits to turbopackFileSystemCache (#96531)
• 86df9c7 docs: cover direct visits and client navigations in the instant() e2e example...
• 47a52c0 [turbopack / next.js] Add an end-to-end test for new root detection (#96544)
• 8e878d4 Remove implicit Partial Prefetching opt-in from instant (#96539)
• e37ddd1 Fix deploy test TypeScript exclusions (#96545)
• 8a4920c docs: clarify first-party Skills workflows (#96495)
• 4344b83 Flag newly disabled deploy tests (#96505)
• 459617a fix: double fragment on navigation (#93132)
• cbf0cef Enable TypeScript CLI by default (#96497)
• Additional commits viewable in compare view

Updates postcss from 8.5.25 to 8.5.26

Release notes

Sourced from postcss's releases.

8.5.26

• Fixed list.split() regression (by @​lazerg).
• Track symlinks in path protection in source map loading (by @​drengir1).

Changelog

Sourced from postcss's changelog.

8.5.26

• Fixed list.split() regression (by @​lazerg).
• Track symlinks in path protection in source map loading (by @​drengir1).

Commits

• 07b2577 Release 8.5.26 version
• 47de6b9 Update CI
• 1493a83 Fix Rule#selectors losing the empty selector (#2129)
• 180db16 Typo
• 29e9e00 Resolve symlinks before the previous-source-map containment check (#2125)
• 3ba8f84 Update dependencies
• 87e72f6 Update lock file
• caaeeb9 Upgrade nanoid to fix infinite loop on zero size (#2124)
• 3609b6f Explain how to type plugin options
• fbad419 docs: show ESM and TypeScript plugin declaration (#2118)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[cloudflare-workers-and-pages]

Deploying openspec-docs with    Cloudflare Pages

Latest commit:	7c13fe4
Status:	🚫  Build failed.

View logs

[clay-good]

Applied the same one-line fix #1620 needed before dependabot superseded it: website/pnpm-workspace.yaml allowBuilds esbuild 0.28.1→0.28.2 to match the lockfile the grouped bump resolved. Verified pnpm@9.15.9 install --frozen-lockfile passes at the root and test/pnpm-workspace-config.test.ts is green (3/3), which unblocks the full Test matrix + Cloudflare.

[alfred-openspec]

Fumadocs 16.14 switches static search to ZBSearch, but this head still passes an Orama database through initOrama. Exact-head pnpm run types:check fails in components/search.tsx with Orama not assignable to AnyZBSearch, matching the red Cloudflare build. Please migrate the search client to staticClient/ZBSearch, remove the now-unused @orama/orama dependency, regenerate the website lockfile, and get type-check/build green before approval.

[clay-good]

Superseded by #1634, which ships the non-breaking website bumps (fumadocs-mdx, lucide-react, next, postcss). The fumadocs-core/ui 16.14 bump is deferred to a dedicated PR because 16.14 replaces Orama with ZBSearch and needs a components/search.tsx migration. Closing in favor of the split.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml