deps: bump fumadocs 16.15.8 and lucide-react 1.43.0

[AdamEXu]

What & why

Daily frontend-only dependency bump for 2026-09-15. Supply-chain vetted packages published at least ~7 days ago as of 2026-09-15.

Bumped

• fumadocs-core: ^16.15.7 / lock 16.15.7 → ^16.15.8 / lock 16.15.8
• fumadocs-ui: ^16.15.7 / lock 16.15.7 → ^16.15.8 / lock 16.15.8
• lucide-react: ^1.41.0 / lock 1.41.0 → ^1.43.0 / lock 1.43.0

Lockfile under frontend/pnpm-lock.yaml updated to match. No other files changed (backend/ untouched).

Deferred (not bumped)

• fumadocs-core / fumadocs-ui 16.15.9+ — too fresh (newer than the ~7-day publish floor; 16.15.11 is already on npm)
• fumadocs-mdx major 15 — historically deferred; stays on ^14.3.2
• posthog-js — leave the existing constraint >=1.422.1 <1.425.0 untouched (lock remains 1.424.1)
• next / eslint-config-next 16.3.5 — too fresh; stay on 16.3.4
• TypeScript 7, ESLint 10 — major upgrades, not in scope
• backend Python deps — Dependabot already handled today (#62)

Area

• Frontend
• Backend
• Scraper
• Convex
• Infra / tooling

How tested

• pnpm add fumadocs-core@16.15.8 fumadocs-ui@16.15.8 lucide-react@1.43.0 in frontend/
• Lockfile resolved to fumadocs-core@16.15.8, fumadocs-ui@16.15.8, lucide-react@1.43.0
• pnpm typecheck passed
• pnpm build passed (Next.js 16.3.4 / Turbopack)
• pnpm lint still fails on pre-existing app issues (setState-in-effect, unused vars, generated .source/ files); none of those files changed in this PR. CI already treats lint as a non-blocking ratchet.

Security checklist

• Endpoints returning user data enforce ownership / authorization (no IDOR — a user cannot read another user's data). N/A — frontend dependency versions only.
• @auth_required is applied to routes that need authentication. N/A — no backend route changes.
• No SSRF: any outbound/scraped URL is validated (scheme + host) before it is fetched. N/A — no fetch/scraper changes.
• No secrets committed — no .env, *.db, keys, or credentials in the diff.
• Flask debug mode is not forced on in a production code path. N/A — no Flask changes.
• OAuth tokens stay encrypted at rest and are never logged or returned in responses. N/A — no auth/token changes.

Checks

• cd frontend && pnpm lint passes. (pre-existing failures; not introduced here)
• Backend still starts and affected endpoints work (make dev-backend). N/A — backend/ untouched.

  

[greptile-apps]

Greptile Summary

This PR updates three frontend dependencies and synchronizes their lockfile records.

• Updates fumadocs-core and fumadocs-ui from 16.15.7 to 16.15.8.
• Updates lucide-react from 1.41.0 to 1.43.0.
• Preserves compatible peer resolution across Fumadocs, Next.js, React, and lucide-react.
• Contains no application-code or backend changes.

Confidence Score: 5/5

The PR appears safe to merge because the dependency graph is internally consistent and no actionable regression was identified.

The changed manifest constraints and lockfile resolutions agree, declared peer requirements remain satisfied, and the reviewed build paths consume the frozen lockfile.

Important Files Changed

Filename	Overview
frontend/package.json	Raises the minimum compatible versions for fumadocs-core, fumadocs-ui, and lucide-react without changing dependency-range strategy.
frontend/pnpm-lock.yaml	Consistently updates importer resolutions, package metadata, integrity hashes, peer links, and snapshots for the three dependency upgrades.

_{Reviews (1): Last reviewed commit: "deps: bump fumadocs 16.15.8 and lucide-r..." | Re-trigger Greptile}