Skip to content

chore(deps): bump js-yaml, fumadocs-mdx, fumadocs-openapi and fumadocs-ui - #7

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-f5190b5f6d
Open

chore(deps): bump js-yaml, fumadocs-mdx, fumadocs-openapi and fumadocs-ui#7
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-f5190b5f6d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 28, 2026

Copy link
Copy Markdown

Bumps js-yaml to 4.3.0 and updates ancestor dependencies js-yaml, fumadocs-mdx, fumadocs-openapi and fumadocs-ui. These dependencies need to be updated together.

Updates js-yaml from 4.1.1 to 4.3.0

Changelog

Sourced from js-yaml's changelog.

4.3.0, 3.15.0 - 2026-06-27

Security

  • Backported maxTotalMergeKeys option.

[5.2.0] - 2026-06-26

Added

  • Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.
  • Added maxAliases (-1) loader option to limit the number of YAML aliases per document.

Removed

  • maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

Fixed

  • Round-trip of integers with exponential form (>= 1e21)

[5.1.0] - 2026-06-23

Added

  • Collection tags can finalize an incrementally populated carrier into a different result value.

Changed

  • [breaking] quoteStyle now selects the preferred quote style; use the restored forceQuotes option to force quoting non-key strings.

[5.0.0] - 2026-06-20

Added

  • Added named exports for schemas, tags, parser events and AST utilities.
  • Reworked JSON_SCHEMA and CORE_SCHEMA with spec-compliant scalar resolution rules, and added YAML11_SCHEMA.
  • Added realMapTag for lossless mappings with non-string and complex keys. Object-based mappings now reject complex keys instead of stringifying them.
  • Added dump() transform option for changing the generated AST before rendering.
  • Added dump() options seqInlineFirst, flowBracketPadding, flowSkipCommaSpace, flowSkipColonSpace, quoteFlowKeys, quoteStyle and tagBeforeAnchor.
  • Added formal data layers (events and AST) for modular data pipelines.
    • Added low-level parser (to events), presenter and visitor APIs.
  • Added the YAML Test Suite to the test set.

Changed

  • See the migration guide for upgrade notes.
  • Rewritten in TypeScript and reorganized the public API around flat named exports.

... (truncated)

Commits
  • 33d05b5 4.3.0 released
  • 663bfab Drop demo publish, to not override new v5 one.
  • 1cb8c7b Add v4-legacy tag for publish
  • 02f27af Restore umd builds back to es5
  • 8be84ed Fix es5 compatibility
  • 59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
  • 6842ef6 doc polish
  • 590dbab 4.2.0 released
  • f944dc5 Add package.json funding field
  • f692719 Changelog update
  • Additional commits viewable in compare view

Updates fumadocs-mdx from 14.3.1 to 15.2.0

Release notes

Sourced from fumadocs-mdx's releases.

[email protected]

Support Macro API

Use fumadocs-mdx/macro to define collections, and enable the macro-style API from bundler plugin (e.g. createMDX) using the include option.

[email protected]

Migrate from js-yaml to yaml

[email protected]

Default to Base UI

Internal packages & templates now use Base UI rather than Radix UI.

[email protected]

Require collection query param at regex matching

Instead of passing through all JSON/YAML files, the meta loader now requires collection query param to be triggered.

Commits
  • 52af6cf Merge pull request #3416 from fuma-nama/tegami/version-packages
  • efc9d18 chore(mdx): bake passthroughs into runtime module
  • 368a92e feat(mdx): macro collection-level last modified time
  • 13dfdbc feat(mdx): no longer require include for macros
  • 6362332 test macro API on vite
  • 126a74d fix(ui): fix accessibility of sidebar components
  • 430254c fix(mdx): fix file check
  • 1862822 feat(mdx): redesign macro infrastructure
  • d3710a9 fix(openapi): fix invalid generated request
  • ba78b01 fix(ui): correct prop types
  • Additional commits viewable in compare view

Updates fumadocs-openapi from 10.8.0 to 11.2.2

Release notes

Sourced from fumadocs-openapi's releases.

[email protected]

Harden createProxy() against SSRF

  • allowedOrigins now defaults to the proxy route's own origin, so an unconfigured proxy is same-origin only instead of an open proxy. A warning is logged when neither allowedOrigins nor filterRequest is set.
  • The allowlist is now enforced on redirects: an allowed upstream can no longer redirect the proxy to a disallowed origin.

allowedOrigins regex support

allowedOrigins entries can now be a RegExp in addition to an exact origin string.

Fix proxy decoding

Fix ERR_CONTENT_DECODING_FAILED for compressed upstream responses: the stale content-encoding/content-length headers are now dropped, since fetch() already decodes the body before it is proxied back.

[email protected]

Fix invalid data in generated request examples

Remove invalid data from generated request body example.

[email protected]

�Use @scalar/json-magic for dereferencing

This will affect all raw access to OpenAPI/AsyncAPI documents, ensure to use dereferenceShallow() public API.

Migrate from js-yaml to yaml

[email protected]

Fix minor UI inconsistencies

More aligned with original styles.

[email protected]

Add Rust codegen for OpenAPI examples

Default to Base UI

Internal packages & templates now use Base UI rather than Radix UI.

[email protected]

Migrate to cnfast

Drop tailwind-merge.

[email protected]

Fix style warning in usage tabs

Fix TypeScript definitions name

The type name now reflect on the actual meaning.

... (truncated)

Commits
  • d2ee483 Version Packages (#3420)
  • 446ffc4 docs: require allowed origins
  • ddc2cab fix(openapi): decoding error
  • 6c949cb fix(openapi): warn on missing allowedOrigins for security
  • 67dfba4 fix(api-docs): rewrite union detector
  • 9eb7bf6 fix lint
  • 52af6cf Merge pull request #3416 from fuma-nama/tegami/version-packages
  • efc9d18 chore(mdx): bake passthroughs into runtime module
  • 368a92e feat(mdx): macro collection-level last modified time
  • 13dfdbc feat(mdx): no longer require include for macros
  • Additional commits viewable in compare view

Updates fumadocs-ui from 16.8.3 to 16.13.0

Release notes

Sourced from fumadocs-ui's releases.

[email protected]

Patch Changes

[email protected]

Patch Changes

  • e977acf: Change the TOC variants

    The "clerk" TOC variant will revert to the original Clerk-like style, the redesigned TOC (the one you see on official docs) will be the new default.

  • 0997dd6: Deprecate type: "xxx" usage of useDocsSearch(), pass the client object instead. The allows a smaller bundle size with improved performance.

  • Updated dependencies [7e9548b]

  • Updated dependencies [0997dd6]

  • Updated dependencies [71d58b8]

Commits
  • b939cc7 Version Packages (#3439)
  • 5929a5c fix(core): better negotation for Markdown
  • 3085a02 fix(ui): registry build error
  • ef27805 feat(notion): support notion content source
  • 6cbfe21 feat(ui): shortcut for theme toggle
  • 417caa5 feat(obsidian): css preset
  • ff32724 Merge pull request #3435 from fuma-nama/tegami/version-packages
  • 6d7ba92 fix react router
  • 31435c9 Merge pull request #3432 from fuma-nama/tegami/version-packages
  • e7de9a4 fix(obsidian): fix bugs for v1
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump js-yaml, fumadocs-mdx, fumadocs-openapi and fumadoc…
45444fc 
…s-ui

Bumps [js-yaml](https://github.com/nodeca/js-yaml) to 4.3.0 and updates ancestor dependencies [js-yaml](https://github.com/nodeca/js-yaml), [fumadocs-mdx](https://github.com/fuma-nama/fumadocs), [fumadocs-openapi](https://github.com/fuma-nama/fumadocs) and [fumadocs-ui](https://github.com/fuma-nama/fumadocs). These dependencies need to be updated together.


Updates `js-yaml` from 4.1.1 to 4.3.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.1...4.3.0)

Updates `fumadocs-mdx` from 14.3.1 to 15.2.0
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/[email protected]@15.2.0)

Updates `fumadocs-openapi` from 10.8.0 to 11.2.2
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/[email protected]@11.2.2)

Updates `fumadocs-ui` from 16.8.3 to 16.13.0
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/[email protected]@16.13.0)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.3.0
  dependency-type: indirect
- dependency-name: fumadocs-mdx
  dependency-version: 15.2.0
  dependency-type: direct:production
- dependency-name: fumadocs-openapi
  dependency-version: 11.2.2
  dependency-type: direct:production
- dependency-name: fumadocs-ui
  dependency-version: 16.13.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 28, 2026
@dependabot dependabot Bot mentioned this pull request Jul 28, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants