build(deps): bump fumadocs-core from 16.8.12 to 16.15.2

[dependabot]

Bumps fumadocs-core from 16.8.12 to 16.15.2.

Release notes

Sourced from fumadocs-core's releases.

fumadocs@16.15.2

• @​fumadocs/base-ui@​16.15.2
• fumadocs-core@16.15.2
• fumadocs-ui@16.15.2

Improve Vitepress theme

More contrast & aligned to Vitepress.

fumadocs@16.15.1

• @​fumadocs/base-ui@​16.15.1
• fumadocs-core@16.15.1
• fumadocs-ui@16.15.1

Forward dynamic loader from fumadocs-core/source

Read structured data from page.data.structuredData()

Search indexing no longer falls back to (await page.data.load()).structuredData. Runtime content sources expose structuredData() on page data instead, sharing the compile with load():

const structuredData = await page.data.structuredData();

The renderer returned by load() still carries structuredData, existing code keeps working.

fumadocs@16.15.0

• @​fumadocs/base-ui@​16.15.0
• fumadocs-core@16.15.0
• fumadocs-ui@16.15.0

Redesign source API

Content sources can hook into the static loader they are attached to, and dynamic sources can opt out of the loader's in-memory file cache.

configureStatic runs when a source is attached to loader(), and again whenever dynamicLoader() builds a new static loader:

export function createMySource(): DynamicSource {
  return {
    cache: 'custom',
    async files() {
      return loadFiles();
    },
    configureStatic({ loader, source }) {
      // `loader` is the created static loader
      // `source` is the record key when using named sources
    },
    configure(loader, { source }) {
      loader.invalidate();
</tr></table> 

... (truncated)

Commits

• 0687a8b Version Packages (#3507)
• cc53d34 internal(core): drop negotiator
• c03b9d7 fix(ui): improve vitepress theme
• 3587272 fix(satteri): bump satteri & fix tab name parser
• 41f13d1 chore: bump deps
• 80fbabf fix(api-docs): Base UI select alignment
• a4306fc feat(openapi): support http basic client in playground
• f59152d Merge pull request #3505 from fuma-nama/tegami/version-packages
• 4ce185a fix(openapi): result url
• 697c7a5 Version Packages (#3502)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[os-bill]

⛔ This PR will not be mergeable on green once #197 lands

Carrying an operational consequence that was recorded on the wrong PR. #197's decision comment says it was "noted on #160 already" — but #160 is closed: Dependabot superseded it on 08-29 with this PR, to a different target (16.15.2, not 16.14.5). So the note reached nobody. Here it is where the merge would happen.

What is landing. #197 is dispatched right now on Route A: pin a one-line fix to fumadocs-core with pnpm.patchedDependencies plus a patches/ file. The defect is in dist/mdx-plugins/stringifier.js — defaultStringifier does not carry Handle.peek onto the wrapper it builds in modHandler, so mdast-util-to-markdown loses its side-effect-free lookahead and applies one node's encode flags to its neighbour. Measured effect of repairing it: 67 stray HTML numeric character references → 0, and 4 of 650 markdown link targets stop being delivered malformed.

Why that breaks this PR. The patch is generated against 16.8.12. The prior investigation measured the target function in a newer release as byte-identical apart from a brace reformat — which means a patch pinned today will fail to apply, loudly, on this bump rather than silently mis-apply. That is the behaviour you want from a pin. It also means:

This PR becomes a regeneration task, not a merge. The patch must be regenerated against 16.15.2 in this same PR, or pnpm install fails.

One thing that could retire the patch instead. The defect was measured present in 16.8.12 and 16.15.1. Whether 16.15.2 still carries it has not been measured — #197's dev is checking. If 16.15.2 carries the upstream fix, this bump deletes the patch rather than regenerating it, and that is the better outcome. Either way the answer has to be read out of the 16.15.2 tarball, not assumed from the version number.

Sequencing: behind #197. Merging this first only moves the same work earlier and loses the measured before/after on a stable version.

Not touching this PR's state — recording, not claiming. Dependabot owns the branch.

---

Generated by Claude Code

[os-bill]

The pin is now on main — and this PR would silently remove it

Following up on my earlier note. #197 landed as 6505ac1 (PR #281): patches/fumadocs-core@16.8.12.patch plus pnpm.patchedDependencies in the root package.json.

Two corrections to what I wrote before, both measured on the card rather than assumed:

1. The patch will not fail loudly on this bump. I said a patch generated against 16.8.12 would "fail to apply, loudly". That is the behaviour when the file stops matching a version that is still pinned. This pin is keyed to the exact string fumadocs-core@16.8.12, so when the version moves to 16.15.2 the pin simply does not match: no patch is applied, pnpm install succeeds, and nothing is red. Quieter and worse than what I described.
2. 16.15.2 still carries the defect. Checked by unpacking the published tarballs: the anchor line is present exactly once and the string peek is absent from dist/mdx-plugins/stringifier.js in 16.8.12, 16.15.1, 16.15.2 and 16.15.8 (latest as of 2026-09-08). So this bump does not retire the patch — the better outcome I flagged as possible is ruled out. The patch must be regenerated against 16.15.2 in this PR.

What merging this PR unfixed would cost

Exactly what #197 measured, restored: 67 HTML numeric character references and 4 of 661 malformed markdown link targets, in /llms-full.txt and in each of the 79 per-page /llms.mdx bodies. Two of those broken targets also hide from the absolute-URL rewrite in llms-full.txt/route.ts, so they go back to being served relative in files whose whole purpose is to be read elsewhere.

Sequencing

⛔ Not mergeable on green as it stands. Behind #282, which adds the CI gate that makes this class of regression visible at all — with it, a bump that drops the patch reddens; without it, the only defence is a person remembering this comment.

When this PR is worked: regenerate the patch against 16.15.2 (the 16.15.x line reformats an if two hunks above the anchor, so the file cannot be reused verbatim), then re-measure the counts above and quote them here.

Recording, not claiming — Dependabot owns the branch.

---

Generated by Claude Code

[dependabot]

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.