chore(deps): bump postcss, next, fumadocs-core and fumadocs-ui in /site

[dependabot]

Bumps postcss to 8.5.23 and updates ancestor dependencies postcss, next, fumadocs-core and fumadocs-ui. These dependencies need to be updated together.

Updates postcss from 8.5.8 to 8.5.23

Release notes

Sourced from postcss's releases.

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

8.5.15

• Fixed declaration parsing performance (by @​homanp).

8.5.14

• Fixed custom syntax regression (by @​43081j).

8.5.13

• Fixed postcss-scss commend regression.

8.5.12

• Fixed reading any file via user-generated CSS.
• Added opts.unsafeMap to disable checks.

8.5.11

• Fixed nested brackets parsing performance (by @​offset).

8.5.10

• Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

8.5.15

• Fixed declaration parsing performance (by @​homanp).

8.5.14

• Fixed custom syntax regression (by @​43081j).

8.5.13

... (truncated)

Commits

• eb9e1fe Release 8.5.23 version
• 9d19c78 Update dependencies
• 7beca13 Does no load source map file without opts.from
• decea51 Typo
• c18e30d Update EM banner
• 98a39ad Update EM banner
• a3e48c4 Release 8.5.22 version
• f49d691 Fix custom property losing its semicolon before a comment (#2117)
• 28e0daf Release 8.5.21 version
• 3d2b4e4 Update dependencies
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates next from 15.5.14 to 16.3.2

Release notes

Sourced from next's releases.

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [backport] Scope app-entry export validation to files inside the app directory (#97357)
• [backport] Fix catch-all index page being served for every other slug (#97416)
• [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
• [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
• [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
• [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @​lubieowoce, @​unstubbable, @​timneutkens, @​mischnic, and @​eps1lon for helping!

v16.3.1

What's Changed

• [16.x] Turbopack: don't strip async-module runtime from shared runtime chunks by @​lukesandberg in vercel/next.js#96653
• [16.x] [turbopack] Add turbopack_ecmascript and turbopack_wasm's embeded FS to internal_assets_conditions by @​lukesandberg in vercel/next.js#96655
• [16.x] [turbopack] Collapse nested promises in the analyzer by @​sampoder in vercel/next.js#96675
• [16.x] fix(next/image): preserve image response after optimization by @​styfle in vercel/next.js#96733
• [16.3.x] Default deploy e2e tests to the repo next version by @​eps1lon in vercel/next.js#96900
• [backport] Bump @​swc/helpers by @​mischnic in vercel/next.js#96885
• [backport] [turbopack] Raise registration calls in hoisted modules to the top by @​lukesandberg in vercel/next.js#97308
• [backport] Fix missing styled-jsx styles in Pages Router SSR on adapter builds by @​lukesandberg in vercel/next.js#97302
• [backport] [turbopack] Fix HMR for dynamic imports evaluated from layouts by @​lukesandberg in vercel/next.js#97317
• [backport] Restore the live headers() view of the incoming request by @​unstubbable in vercel/next.js#97311
• [backport] Allow literal exports in 'use cache' files by @​unstubbable in vercel/next.js#97312
• [backport] Keep the dev validation worker alive across HMR updates by @​unstubbable in vercel/next.js#97315
• [backport] Discard only cache entries that predate a tag revalidation, and reuse completed entries by @​unstubbable in vercel/next.js#97314
• [backport] Encode the cache item name built by unstable_cache by @​unstubbable in vercel/next.js#97313
• [16.3] [ci] Use OIDC tokens to read private preview builds by @​eps1lon in vercel/next.js#97258
• [backport] [test] Compile the middleware redirect routes up front in dev by @​lukesandberg in vercel/next.js#97328
• [backport] Fix Nav Inspector request loop on repeat captures by @​acdlite in vercel/next.js#97326
• [backport] Fix: Optimistic routing bugs leading to repeated prefetch loops by @​acdlite in vercel/next.js#97325
• [backport] Retain fewer stale cache versions and use a TTL, plus the mtime fallback by @​lukesandberg in vercel/next.js#97304
• [backport] Revert i18n localization change for dynamic Pages API routes (#94905) by @​gaojude in vercel/next.js#97330

Full Changelog: vercel/next.js@v16.3.0...v16.3.1

v16.3.1-canary.26

Misc Changes

• docs: document deploymentId build ID override and Pages Router skew in 16.2: #97645
• Upgrade React from eb8feb71-20260814 to eafeac09-20260819: #97636
• Turbopack: rename to use turbopack: no side effects: #94427
• refactor: move useDynamic{Route,Search}Params to reduce snapshot churn: #97360

... (truncated)

Commits

• d0ac882 v16.3.2
• 81deb92 [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static ...
• cd714d9 [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
• 5ac2327 [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
• 0ccb3e7 [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
• f4dc7c8 [backport] Fix catch-all index page being served for every other slug (#97416)
• eba236b [backport] Scope app-entry export validation to files inside the app director...
• 3d32eb8 v16.3.1
• 2b4b1ec [backport] Revert i18n localization change for dynamic Pages API routes (#949...
• 228df5f [backport] Retain fewer stale cache versions and use a TTL, plus the mtime fa...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.

Updates fumadocs-core from 15.8.5 to 16.15.1

Release notes

Sourced from fumadocs-core's releases.

fumadocs@16.15.1

• @​fumadocs/base-ui@​16.15.1
• fumadocs-core@16.15.1
• fumadocs-ui@16.15.1

Forward dynamic loader from fumadocs-core/source

Read structured data from page.data.structuredData()

Search indexing no longer falls back to (await page.data.load()).structuredData. Runtime content sources expose structuredData() on page data instead, sharing the compile with load():

const structuredData = await page.data.structuredData();

The renderer returned by load() still carries structuredData, existing code keeps working.

fumadocs@16.15.0

• @​fumadocs/base-ui@​16.15.0
• fumadocs-core@16.15.0
• fumadocs-ui@16.15.0

Redesign source API

Content sources can hook into the static loader they are attached to, and dynamic sources can opt out of the loader's in-memory file cache.

configureStatic runs when a source is attached to loader(), and again whenever dynamicLoader() builds a new static loader:

export function createMySource(): DynamicSource {
  return {
    cache: 'custom',
    async files() {
      return loadFiles();
    },
    configureStatic({ loader, source }) {
      // `loader` is the created static loader
      // `source` is the record key when using named sources
    },
    configure(loader, { source }) {
      loader.invalidate();
    },
  };
}

• cache: 'memory' (default): files() is called once until invalidate().
• cache: 'custom': the source caches itself. dynamicLoader() re-runs files() on get() and rebuilds only when the file list is shallowly different (by identity).

Integrations

... (truncated)

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for fumadocs-core since your current version.

Updates fumadocs-ui from 15.8.5 to 16.15.1

Release notes

Sourced from fumadocs-ui's releases.

fumadocs@16.15.1

• @​fumadocs/base-ui@​16.15.1
• fumadocs-core@16.15.1
• fumadocs-ui@16.15.1

Forward dynamic loader from fumadocs-core/source

Read structured data from page.data.structuredData()

Search indexing no longer falls back to (await page.data.load()).structuredData. Runtime content sources expose structuredData() on page data instead, sharing the compile with load():

const structuredData = await page.data.structuredData();

The renderer returned by load() still carries structuredData, existing code keeps working.

fumadocs@16.15.0

• @​fumadocs/base-ui@​16.15.0
• fumadocs-core@16.15.0
• fumadocs-ui@16.15.0

Redesign source API

Content sources can hook into the static loader they are attached to, and dynamic sources can opt out of the loader's in-memory file cache.

configureStatic runs when a source is attached to loader(), and again whenever dynamicLoader() builds a new static loader:

export function createMySource(): DynamicSource {
  return {
    cache: 'custom',
    async files() {
      return loadFiles();
    },
    configureStatic({ loader, source }) {
      // `loader` is the created static loader
      // `source` is the record key when using named sources
    },
    configure(loader, { source }) {
      loader.invalidate();
    },
  };
}

• cache: 'memory' (default): files() is called once until invalidate().
• cache: 'custom': the source caches itself. dynamicLoader() re-runs files() on get() and rebuilds only when the file list is shallowly different (by identity).

Integrations

... (truncated)

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for fumadocs-ui since your current version.

[c-1k]

Holding this rather than merging, and recording why — the green checks above are real, but they describe a tree that no longer exists.

What this bumps: two coordinated majors — next 15.3.3 → 16.3.0, and fumadocs-core / fumadocs-ui 15.8.5 → 16.14.3.

Why the green doesn't settle it. The last CI run on this branch completed 2026-08-11. Since this branch's merge-base, master has moved 12 commits touching site/ — 110 files, 98 of them under site/app/r/ — including the verify page itself (#92), the R38 correctness fix and delegationPosture fixture corpus (#96), and the receipt-card rework (#109, #120, #121, and a153f26). The site-build job runs npm test and npm run build (which fires the prebuild check-facts gate) inside site/. So that green is a statement about the site as it stood on 11 Aug, not as it stands today.

The branch does still merge cleanly. But the only files it changes are site/package.json and site/package-lock.json, and a clean lockfile merge says nothing about whether Next 16 renders the current receipt card.

What this needs before it can land:

1. A rebase onto current master and a fresh full CI run, judged on that run rather than this one.
2. Preferably a split. next 15→16 and fumadocs 15→16 are each a deliberate upgrade with their own migration steps; landing them as one indivisible unit means a failure in either one bisects to the same commit.

Requesting the rebase in the next comment. Worth noting the peer side is already fine — react/react-dom are on ^19.1.0, which Next 16 wants — so the open question is purely runtime and render behaviour against the current site, which only a fresh run can answer.

[c-1k]

@dependabot rebase

[c-1k]

Re-gated after the rebase — the stale-green objection above is discharged.

The branch rebased to a7375cf on current master, and all seven checks passed on that exact SHA (dco, lint, typecheck, test, site-build, openclaw-contract, tb-integration). Both workflow runs bound to a7375cf report completed/success — neither skipped nor cancelled. So site-build — npm test plus npm run build with the prebuild check-facts gate — now passes against the current site, the 110 changed site/ files included. That is the measurement the earlier green couldn't supply.

Revised recommendation: mergeable. The remaining suggestion to split next from fumadocs is a bisectability preference, not a blocker, and I'd rather not spend another rebase cycle on it now that both are green together.

One residual worth naming rather than leaving implicit: a green suite on a major framework upgrade covers what the tests cover. The site/app/r/ rendering, integration, and component tests are reasonably thorough here, but Next 15→16 can shift runtime and hydration behaviour in ways a passing build won't surface. A look at the preview deployment before merge would close that gap cheaply.