deps: bump fumadocs-core/ui to 16.15.5

[AdamEXu]

What & why

Frontend-only dependency bump for fumadocs packages that are aged (≥7 days) and OSV-clean. Caret ranges in frontend/package.json are preserved; the frontend lockfile is refreshed.

Changes

• fumadocs-core: ^16.15.4 → ^16.15.5
• fumadocs-ui: ^16.15.4 → ^16.15.5

Age gate / deferred

• Age gate: only packages aged ≥7 days are bumped.
• Deferred: fumadocs 16.15.6–16.15.8 (still <7 days).
• Deferred: fumadocs-mdx 15.x major.
• Not in scope: katex 0.18.6+, lucide-react ≥1.40, posthog-js beyond the existing <1.425.0 cap, openai/Python backend packages, ESLint 10, TypeScript 7.

Area

• Frontend
• Backend
• Scraper
• Convex
• Infra / tooling

How tested

• cd frontend && pnpm typecheck — pass
• cd frontend && pnpm build — pass (Next.js 16.3.4 turbopack; /help routes SSG)
• cd frontend && pnpm lint — fails with pre-existing violations (CI is continue-on-error; not introduced by this bump)
• Production server (pnpm start on :3112): /help, /help/roadmap, /help/bugs all HTTP 200
• Browser: fumadocs sidebar, search, and page nav render on those three help routes

Help welcome page after fumadocs 16.15.5 bump
Help roadmap page after fumadocs 16.15.5 bump
Help bugs page after fumadocs 16.15.5 bump

Security checklist

• Endpoints returning user data enforce ownership / authorization (no IDOR — a user cannot read another user's data). N/A — frontend dep bump only.
• @auth_required is applied to routes that need authentication. N/A — frontend dep bump only.
• No SSRF: any outbound/scraped URL is validated (scheme + host) before it is fetched. N/A — frontend dep bump only.
• No secrets committed — no .env, *.db, keys, or credentials in the diff.
• Flask debug mode is not forced on in a production code path. N/A — frontend dep bump only.
• OAuth tokens stay encrypted at rest and are never logged or returned in responses. N/A — frontend dep bump only.

Checks

• cd frontend && pnpm lint — run; pre-existing failures only (CI non-blocking).
• Backend still starts and affected endpoints work (make dev-backend). N/A — frontend-only lockfile/package.json change.

_{To show artifacts inline, enable in settings.}

  

[greptile-apps]

Greptile Summary

The PR updates fumadocs-core and fumadocs-ui from 16.15.4 to 16.15.5 while preserving their caret ranges.

• Refreshes the frontend lockfile with matching fumadocs peer resolutions.
• Deduplicates several Markdown/AST transitive dependencies and removes deprecated @ungap/structured-clone 1.3.0.

Confidence Score: 5/5

The PR appears safe to merge with no concrete blocking or non-blocking defects identified.

The manifest and lockfile updates remain synchronized, fumadocs peer requirements resolve consistently, and no changed dependency path was shown to violate an existing build or runtime contract.

Important Files Changed

Filename	Overview
frontend/package.json	Raises the minimum compatible fumadocs core and UI versions to 16.15.5 without widening their existing semver ranges.
frontend/pnpm-lock.yaml	Pins both fumadocs packages to 16.15.5 with a consistent peer graph and refreshes compatible transitive resolutions.

_{Reviews (1): Last reviewed commit: "deps: bump fumadocs-core/ui to 16.15.5" | Re-trigger Greptile}