chore(deps): bump fumadocs-mdx and @eslint/eslintrc

[AdamEXu]

What & why

Bump two well-aged frontend packages within their existing majors:

• fumadocs-mdx: ^14.2.6 → ^14.3.2 (resolved 14.3.2). Stays on 14.x; 15.x is deferred (major, not in scope).
• @eslint/eslintrc: ^3.3.6 → ^3.3.7 (resolved 3.3.7).

Supply-chain: both targets are well-aged (fumadocs-mdx@14.3.2 published 2026-04-27; @eslint/eslintrc@3.3.7 published 2026-09-01). No other direct dependencies were bumped (Next, React, lucide-react, fumadocs-core/ui, posthog-js, TypeScript, ESLint, katex, highlight.js left as-is).

Lockfile updates are those two packages plus fumadocs-mdx 14.3.x transitive changes (including dropping @fumadocs/mdx-remote).

Area

• Frontend
• Backend
• Scraper
• Convex
• Infra / tooling

How tested

Local, from frontend/:

• pnpm typecheck — passed
• pnpm build — passed (next build --turbopack, dummy NEXT_PUBLIC_* env)
• pnpm lint — same pre-existing violations as on main (CI lint is non-blocking). No new generated .source diffs from this bump.

Security checklist

• Endpoints returning user data enforce ownership / authorization (no IDOR — a user cannot read another user's data). N/A — dependency versions only.
• @auth_required is applied to routes that need authentication. N/A — frontend deps only.
• No SSRF: any outbound/scraped URL is validated (scheme + host) before it is fetched. N/A — no fetch/scrape changes.
• No secrets committed — no .env, *.db, keys, or credentials in the diff.
• Flask debug mode is not forced on in a production code path. N/A — frontend deps only.
• OAuth tokens stay encrypted at rest and are never logged or returned in responses. N/A — frontend deps only.

Checks

• cd frontend && pnpm lint runs (pre-existing non-blocking backlog; CI continue-on-error).
• Backend still starts and affected endpoints work (make dev-backend). N/A — frontend-only bump.

  

[greptile-apps]

Greptile Summary

Updates two frontend dependencies within their existing major versions and refreshes their resolved transitive dependency graph.

• Upgrades fumadocs-mdx from 14.2.6 to 14.3.2, including esbuild and related MDX tooling updates.
• Upgrades @eslint/eslintrc from 3.3.6 to 3.3.7 and refreshes its js-yaml resolution.
• Keeps the manifest and pnpm lockfile synchronized.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete changed-code failure identified.

The upgraded packages satisfy the repository’s declared Node and peer requirements, frozen installations consume the committed resolutions, and no repository usage depends on the removed transitive package.

Important Files Changed

Filename	Overview
frontend/package.json	Updates the fumadocs-mdx runtime dependency and @eslint/eslintrc development dependency within their current major versions; no incompatible repository usage was identified.
frontend/pnpm-lock.yaml	Consistently resolves the requested versions and their transitive updates with compatible peers and platform-specific esbuild packages.

_{Reviews (1): Last reviewed commit: "chore(deps): bump fumadocs-mdx and @esli..." | Re-trigger Greptile}