Bump blume from 1.5.3 to 1.6.0

[dependabot]

Bumps blume from 1.5.3 to 1.6.0.

Release notes

Sourced from blume's releases.

blume@1.6.0

Minor Changes

• 089f0d2: Native GraphQL API reference. Point the new top-level graphql config block at a schema — SDL text or an introspection JSON result, local or remote — and Blume generates one real page per root field (grouped as Queries, Mutations, and Subscriptions) plus one page per named type (Objects, Input Objects, Enums, Interfaces, Unions, and custom Scalars), all in the sidebar, search, llms.txt, and OG images like any hand-written doc. Operation pages show arguments with defaults and deprecations, a generated example operation with typed variables and a matching example response, live code samples, and the same Try it playground the OpenAPI reference ships — a plain JSON POST of { query, variables } against the configured endpoint, with playground.proxy support for CORS-restricted APIs. Type pages cross-link every type reference and list where each type is used.

• 65e3853: Add github.host so docs hosted on a GitHub Enterprise instance get working repo links. Every repo-derived URL — the header mark, per-page edit links, the agent manifest's repository, the OG card's slug, and <GithubInfo> — was built against a hardcoded github.com, so an Enterprise repo produced links into the public site. host defaults to https://github.com, must be an HTTP(S) URL, and is normalized to its origin so nothing lands mid-link. The REST base <GithubInfo> queries is derived from it (an api. subdomain for an Enterprise Cloud data-residency tenant, /api/v3 for Enterprise Server) or set outright with github.api, and a host prop points one card at a different instance. <GithubInfo> withholds its token from a cleartext-HTTP API base rather than sending it over the wire, and warns once per base so a private repo's missing counts are explained.

• 2fa67b8: Custom heading anchors and table-of-contents markers, matching Fumadocs' syntax so migrated content works verbatim. Append [#custom-id] to any heading to pin its anchor id — the marker never renders, links keep working after a heading is reworded, and pinned anchors stay identical across translated locales, where auto-generated ids differ per language. [!toc] keeps a heading on the page but out of the table of contents; [toc] does the reverse, adding a TOC-only entry that renders as an invisible anchor target so its link still scrolls somewhere — useful for labeling sections built from components rather than prose. Markers chain in any order (## Heading [toc] [#id]), work in Markdown and MDX, are stripped from search indexing, and blume validate resolves anchor links against pinned ids (including case-sensitive ones). Marker parsing is always on: a heading that previously ended in literal marker-shaped text now parses as marked — wrap the bracket text in inline code (## Using `[toc]`) to render it literally. The one exception is CommonMark's own: a trailing bracket whose label has a link-reference definition on the page ([toc]: /url, including one nested in a block quote or list item) is a shortcut reference link and stays in the heading text; a bare [toc]: with no destination defines nothing.

• beec2d2: Add navigation.actions and navigation.cta — plain links in the header, and the one filled button. navigation.featured pins secondary links to the top of the sidebar and there was no header slot at all, so a docs site arriving from a hosted platform lost whatever its old top bar asked the reader to do. cta is singular by contract. Both hide below the sm breakpoint, where the header has room for the logo and the drawer toggle and nothing else — except cta on a page with no navigation toggle, where it stays, since nothing else can surface it on a phone.

• beec2d2: navigation.repo now takes a URL as well as a boolean. github drives the per-page edit link, the header mark and the agent manifest's repository together, so a project whose docs repo is private had to unset all three — and then had no way to show a mark at all. An absolute URL points it anywhere on GitHub, an organization for instance, while true keeps deriving it from github and false still hides it.

• a669f80: The Notion source now targets @notionhq/client v5 and Notion's data source API: a database is read through its first data source. Upgrade the peer dependency with npm install @notionhq/client@^5.

• 9ec4de4: Add a built-in obsidian content source. Point it at an Obsidian vault and Blume reads the notes in place — no export step, and nothing generated into your repo:

  export default defineConfig({
    content: {
      sources: [{ type: "obsidian", vault: "vault", prefix: "notes" }],
    },
  });

  • [[Wikilinks]] become route links, addressed by note name across the whole vault the way Obsidian addresses notes: custom link text ([[Note|label]], and [[Note\|label]] inside a table), heading anchors ([[Note#Install]], [[#Install]]), block references ([[Note#^id]]), full and partial paths ([[folder/Note]], [[Note.md]]), and a frontmatter slug. A name two notes share resolves to an exact path match first, then to the first note in vault order, and warns only when a link actually resolves through the collision.
  • Heading anchors resolve against the target note's real headings, matched the way Obsidian writes them (inline formatting stripped) and slugged by the same pass that fills the page manifest.
  • Frontmatter keeps Blume's page meta plus any key declared in frontmatter.extend or, for notes of that type, in a content type's frontmatter; every other Obsidian property (including tags, aliases, and cssclasses) is dropped, so a vault written with the Properties UI builds cleanly.
  • Locale directories and version snapshots inside the vault publish under their locale and version like filesystem content.
  • An unresolved wikilink degrades to plain text with a warning, and one to a missing heading keeps the page link; single-line %%comments%% are stripped and a wikilink inside an HTML comment is left alone; fenced, indented, and inline code pass through verbatim; symlinked folders are followed; untitled notes take their filename as the title; dot-folders (.obsidian, .trash, plugin caches) and the usual never-content directories are skipped by both the scan and the dev watcher; blume version cut leaves a vault inside content.root out of the snapshot.
  • Vault notes get git "Last updated" dates when the vault is inside the repository, and "Edit this page" links through github.dir for a vault beside a monorepo docs app.

  blume init offers the source and seeds a first note. Not yet lowered: callouts, embeds, multi-line comments, aliases as link targets, and backlinks.

  Also in this release: frontmatter's stringify no longer re-parses a string body (a body opening with a --- divider was read as a second front matter block), and git last-modified dating now skips the scan entirely when no local source exposes a content root — a custom staged source that sets sourcePath without a contentRoot is no longer dated — set contentRoot on the source to date its pages.

• 20a5da5: Content includes: <include>./path.mdx</include> splices another file into a page at build time — the same syntax Fumadocs ships, so migrated content works unchanged. Markdown/MDX targets are embedded as content (front matter stripped, nested includes with cycle detection, relative images rebased onto the including page); any other extension — or an explicit lang attribute — embeds the file as a fenced code block, with meta for the fence meta string. Paths resolve relative to the including file, or from the content root with a leading /. Spliced content flows through every surface: headings join the page's table of contents and anchor index, search indexes the included text, the .md/.mdx mirrors and llms-full.txt serve the expanded document, broken links inside a partial are reported against the partial file, and editing a partial in blume dev reloads the pages that include it. Underscore-prefixed files (_snippets/) are already excluded from routing, so partials need no configuration. Unresolvable statements surface as BLUME_INCLUDE_NOT_FOUND, BLUME_INCLUDE_CYCLE, and BLUME_INCLUDE_OUTSIDE_ROOT diagnostics.

Patch Changes

• 68f48c1: Downlevel components in the Ask AI grounding corpus, the way the .md mirror, llms-full.txt and MCP get_page already do. Ask AI was built from the search documents' verbatim Markdown, so a page whose body is a <CardGroup> of <Card>s reached the model as JSX with no prose in it — and section landing pages, which are exactly that shape, rank first for section-level questions. prop={frontmatter.*} expressions now resolve here too.
• fd08e26: Require Astro 7.2.3+, which renames the dev SSR entry to virtual:astro:server-app so full reloads no longer re-request it with a spurious .js suffix — and drop the serverAppResolvePlugin shim that worked around the old id corrupting the dev server on content renames.
• 1715b14: Give each AsyncAPI channel or operation that references the same component its own copy before traits merge. The aliases shared one object, so the first merge leaked into the second and stripped traits from the component table entry itself.
• 0fe3d43: Darken the green and orange text that misses WCAG AA in light mode. Both drew at -700 over a 15% tint of their own hue, landing at 4.32:1 and 4.44:1 against the 4.5:1 bar for text that size, while every other hue already cleared it (teal 4.69:1, red 5.17:1, blue 5.71:1, purple 5.82:1, violet 6.00:1, yellow 6.02:1). At -800 they reach 6.20:1 and 6.25:1, with the fill weight unchanged. This covers the GET and PUT method badges (and GraphQL QUERY), the matching badges in a reference's sidebar, 2xx and 4xx response status chips, and <Badge>'s success and warning variants. The deprecated label on an operation moves too: at orange-600 on the page background it was 3.59:1, the worst of the set. Dark mode was already passing and is unchanged.
• 0fe3d43: Darken the callout icons that miss the WCAG 1.4.11 non-text contrast bar in light mode. A callout's icon names its type, so it is meaningful UI rather than decorative: check/success and warning sat at 2.94:1 and 2.95:1 against their own tint and now take -700 (4.52:1 and 4.67:1), and note's icon was muted-foreground at 70% over the muted surface (2.68:1) and is now full strength (4.64:1). Dark mode was already passing.
• 4c0fdfc: Keep camelCase word boundaries in API reference operation routes. An operationId went through the generic slugger, which lowercases before it replaces non-slug characters, so processSlackInteraction collapsed to /reference/integrations/processslackinteraction. Operation ids are usually camelCase because OpenAPI generators reuse them as SDK method names, and renaming them just to get readable URLs couples SDK naming to presentation. The key now hyphenates the boundaries first: a lower-case letter or digit followed by a capital, and the last capital of an acronym before a capitalized word, so processSlackInteraction becomes process-slack-interaction and getHTTPResponse becomes get-http-response. Already kebab-case ids and the method-plus-path fallback are unchanged. GraphQL field and type names and AsyncAPI operation ids derive their routes through the same key, so a GraphQL addPet mutation moves from /graphql/mutations/addpet to /graphql/mutations/add-pet and an AsyncAPI publishUserSignedup operation from publishusersignedup to publish-user-signedup.
• 0fe3d43: Darken the typed <Card> icons and the stroked <Badge> variants that still missed the light-mode contrast bar. A card's check, warning, and note icons carried the same values the callout icons moved off (2.94:1, 2.95:1, and 2.68:1 against their tint) and now share the callout table. A stroked badge has no fill of its own and inherits whatever surface it sits on — inside a note callout, success at -700 was 4.47:1 — so success and warning now take -800 whether filled or stroked.
• 68f48c1: Downlevel <Card> and <CardGroup> to Markdown on the agent-facing surfaces. Both are Blume's own components and neither had a serializer, so a section landing page — the shape blume init scaffolds and the Mintlify migrator emits — published raw JSX to /<route>.md, llms-full.txt, MCP get_page and the Ask AI corpus. A card becomes its title as a link over its body, with the cta last; a group becomes everything it holds, block by block. Serializers in ai.markdownComponents gain childBlocks() — every direct child of the element in order, each already downleveled — which is what CardGroup is built on.
• e823872: Harden two scanners against pathological input: HTML comments stripped before anchor detection are replaced with a space so their neighbors can't splice into new markup, and github.dir plus source/meta route prefixes trim slashes linearly instead of with a regex that was quadratic on a run of /.
• ce20984: Make room for the copy button in code blocks that have no language bar to hold it. Inside a component whose chrome is not-prose — <Tabs>, <CodeGroup>, <Steps>, <Callout>, <Card>, <Accordion> and the rest — the bar is cleared but the button is not, and the block's padding-top was the 1rem chosen for a block with no chrome at all, so the button painted over the first line of code. The same applied to an untitled <CodeBlock> in plain prose, which renders no bar. Both now reserve the button's strip, as does a raw <pre><code> block written in prose, which gets a button but has no language bar either; the clearance is keyed on the docs layout that injects the button, so a custom page layout without it keeps the plain inset.
• 35b5c6a: Support trailing {#custom-id} heading markers as an equivalent of [#custom-id] — verbatim in .md, and as the escape \{#custom-id\} in .mdx, where a bare {…} is a JSX expression. blume check now reports a bare {#id} in an .mdx page (or in a partial it includes) as BLUME_MDX_CURLY_ANCHOR instead of leaving it to fail at compile time, and blume translate is told to preserve the marker. Fragment-link validation also recognizes ids on raw HTML elements (<a id="…">, including tags wrapped over several lines) as anchor targets, ignoring ids inside code, inline code, HTML comments, <Prompt> blocks, and component props.
• ce20984: Drop the page-actions divider when the rail has no table of contents. The actions block carries its own top border as a separator under the contents, but the contents only render when a page has a heading within toc.minHeadingLevel–toc.maxHeadingLevel — so on a page without one the block drew a rule across the top of an empty column. The rail now decides once whether an outline renders and passes that to the block (divider prop, default on), so the two cannot disagree.
• 1715b14: Keep a spaced Shiki line range (```ts {1, 3-5}) as one fence-meta token. The range used to split on its whitespace, and the 3-5} fragment was promoted to the code block's title.
• ce20984: Cap the search dialog's section-filter row so the results keep the dialog. The dialog is a fixed height and the filter chips wrapped without a bound, so on a site with many sections the chips took the height and the results list got the remainder — measured on an 18-section corpus, the row wanted 266px of the 480 and left about one visible result. The row now shows two rows of chips plus the top of a third as the scroll cue, chips no longer wrap on long section names, the selected chip is scrolled into view when the chips reorder as the query narrows, and each chip exposes its selected state as aria-pressed.
• 6d4ffec: Load the font subsets your locales need. Remote fonts used to load only the Latin subset, so Vietnamese, Central European, Cyrillic, and Greek text fell back to the system font. Blume now derives subsets from i18n.locales, and remote families accept a subsets option to pin the list.
• 1715b14: Treat an empty graphql.endpoint like an omitted one. The playground and code samples fall back to the endpoint placeholder instead of targeting an empty URL.
• ceb7a9f: Fix the image lightbox becoming impossible to close after the first in-page navigation. medium-zoom injected its stylesheet into <head> once, when its module first loaded, and the client router's head swap discarded it on the next navigation; with the transition rule gone, the close animation's transitionend never fired, so Escape, a backdrop click, and scrolling all left the zoomed image open (and the zoom-in cursor disappeared) until a hard reload. The stylesheet now ships in the layout's page CSS, which the router carries across swaps, and the library loads as its pure build with no runtime injection.

... (truncated)

Changelog

Sourced from blume's changelog.

1.6.0

Minor Changes

• 089f0d2: Native GraphQL API reference. Point the new top-level graphql config block at a schema — SDL text or an introspection JSON result, local or remote — and Blume generates one real page per root field (grouped as Queries, Mutations, and Subscriptions) plus one page per named type (Objects, Input Objects, Enums, Interfaces, Unions, and custom Scalars), all in the sidebar, search, llms.txt, and OG images like any hand-written doc. Operation pages show arguments with defaults and deprecations, a generated example operation with typed variables and a matching example response, live code samples, and the same Try it playground the OpenAPI reference ships — a plain JSON POST of { query, variables } against the configured endpoint, with playground.proxy support for CORS-restricted APIs. Type pages cross-link every type reference and list where each type is used.

• 65e3853: Add github.host so docs hosted on a GitHub Enterprise instance get working repo links. Every repo-derived URL — the header mark, per-page edit links, the agent manifest's repository, the OG card's slug, and <GithubInfo> — was built against a hardcoded github.com, so an Enterprise repo produced links into the public site. host defaults to https://github.com, must be an HTTP(S) URL, and is normalized to its origin so nothing lands mid-link. The REST base <GithubInfo> queries is derived from it (an api. subdomain for an Enterprise Cloud data-residency tenant, /api/v3 for Enterprise Server) or set outright with github.api, and a host prop points one card at a different instance. <GithubInfo> withholds its token from a cleartext-HTTP API base rather than sending it over the wire, and warns once per base so a private repo's missing counts are explained.

• 2fa67b8: Custom heading anchors and table-of-contents markers, matching Fumadocs' syntax so migrated content works verbatim. Append [#custom-id] to any heading to pin its anchor id — the marker never renders, links keep working after a heading is reworded, and pinned anchors stay identical across translated locales, where auto-generated ids differ per language. [!toc] keeps a heading on the page but out of the table of contents; [toc] does the reverse, adding a TOC-only entry that renders as an invisible anchor target so its link still scrolls somewhere — useful for labeling sections built from components rather than prose. Markers chain in any order (## Heading [toc] [#id]), work in Markdown and MDX, are stripped from search indexing, and blume validate resolves anchor links against pinned ids (including case-sensitive ones). Marker parsing is always on: a heading that previously ended in literal marker-shaped text now parses as marked — wrap the bracket text in inline code (## Using `[toc]`) to render it literally. The one exception is CommonMark's own: a trailing bracket whose label has a link-reference definition on the page ([toc]: /url, including one nested in a block quote or list item) is a shortcut reference link and stays in the heading text; a bare [toc]: with no destination defines nothing.

• beec2d2: Add navigation.actions and navigation.cta — plain links in the header, and the one filled button. navigation.featured pins secondary links to the top of the sidebar and there was no header slot at all, so a docs site arriving from a hosted platform lost whatever its old top bar asked the reader to do. cta is singular by contract. Both hide below the sm breakpoint, where the header has room for the logo and the drawer toggle and nothing else — except cta on a page with no navigation toggle, where it stays, since nothing else can surface it on a phone.

• beec2d2: navigation.repo now takes a URL as well as a boolean. github drives the per-page edit link, the header mark and the agent manifest's repository together, so a project whose docs repo is private had to unset all three — and then had no way to show a mark at all. An absolute URL points it anywhere on GitHub, an organization for instance, while true keeps deriving it from github and false still hides it.

• a669f80: The Notion source now targets @notionhq/client v5 and Notion's data source API: a database is read through its first data source. Upgrade the peer dependency with npm install @notionhq/client@^5.

• 9ec4de4: Add a built-in obsidian content source. Point it at an Obsidian vault and Blume reads the notes in place — no export step, and nothing generated into your repo:

  export default defineConfig({
    content: {
      sources: [{ type: "obsidian", vault: "vault", prefix: "notes" }],
    },
  });

  • [[Wikilinks]] become route links, addressed by note name across the whole vault the way Obsidian addresses notes: custom link text ([[Note|label]], and [[Note\|label]] inside a table), heading anchors ([[Note#Install]], [[#Install]]), block references ([[Note#^id]]), full and partial paths ([[folder/Note]], [[Note.md]]), and a frontmatter slug. A name two notes share resolves to an exact path match first, then to the first note in vault order, and warns only when a link actually resolves through the collision.
  • Heading anchors resolve against the target note's real headings, matched the way Obsidian writes them (inline formatting stripped) and slugged by the same pass that fills the page manifest.
  • Frontmatter keeps Blume's page meta plus any key declared in frontmatter.extend or, for notes of that type, in a content type's frontmatter; every other Obsidian property (including tags, aliases, and cssclasses) is dropped, so a vault written with the Properties UI builds cleanly.
  • Locale directories and version snapshots inside the vault publish under their locale and version like filesystem content.
  • An unresolved wikilink degrades to plain text with a warning, and one to a missing heading keeps the page link; single-line %%comments%% are stripped and a wikilink inside an HTML comment is left alone; fenced, indented, and inline code pass through verbatim; symlinked folders are followed; untitled notes take their filename as the title; dot-folders (.obsidian, .trash, plugin caches) and the usual never-content directories are skipped by both the scan and the dev watcher; blume version cut leaves a vault inside content.root out of the snapshot.
  • Vault notes get git "Last updated" dates when the vault is inside the repository, and "Edit this page" links through github.dir for a vault beside a monorepo docs app.

  blume init offers the source and seeds a first note. Not yet lowered: callouts, embeds, multi-line comments, aliases as link targets, and backlinks.

  Also in this release: frontmatter's stringify no longer re-parses a string body (a body opening with a --- divider was read as a second front matter block), and git last-modified dating now skips the scan entirely when no local source exposes a content root — a custom staged source that sets sourcePath without a contentRoot is no longer dated — set contentRoot on the source to date its pages.

• 20a5da5: Content includes: <include>./path.mdx</include> splices another file into a page at build time — the same syntax Fumadocs ships, so migrated content works unchanged. Markdown/MDX targets are embedded as content (front matter stripped, nested includes with cycle detection, relative images rebased onto the including page); any other extension — or an explicit lang attribute — embeds the file as a fenced code block, with meta for the fence meta string. Paths resolve relative to the including file, or from the content root with a leading /. Spliced content flows through every surface: headings join the page's table of contents and anchor index, search indexes the included text, the .md/.mdx mirrors and llms-full.txt serve the expanded document, broken links inside a partial are reported against the partial file, and editing a partial in blume dev reloads the pages that include it. Underscore-prefixed files (_snippets/) are already excluded from routing, so partials need no configuration. Unresolvable statements surface as BLUME_INCLUDE_NOT_FOUND, BLUME_INCLUDE_CYCLE, and BLUME_INCLUDE_OUTSIDE_ROOT diagnostics.

Patch Changes

• 68f48c1: Downlevel components in the Ask AI grounding corpus, the way the .md mirror, llms-full.txt and MCP get_page already do. Ask AI was built from the search documents' verbatim Markdown, so a page whose body is a <CardGroup> of <Card>s reached the model as JSX with no prose in it — and section landing pages, which are exactly that shape, rank first for section-level questions. prop={frontmatter.*} expressions now resolve here too.
• fd08e26: Require Astro 7.2.3+, which renames the dev SSR entry to virtual:astro:server-app so full reloads no longer re-request it with a spurious .js suffix — and drop the serverAppResolvePlugin shim that worked around the old id corrupting the dev server on content renames.
• 1715b14: Give each AsyncAPI channel or operation that references the same component its own copy before traits merge. The aliases shared one object, so the first merge leaked into the second and stripped traits from the component table entry itself.
• 0fe3d43: Darken the green and orange text that misses WCAG AA in light mode. Both drew at -700 over a 15% tint of their own hue, landing at 4.32:1 and 4.44:1 against the 4.5:1 bar for text that size, while every other hue already cleared it (teal 4.69:1, red 5.17:1, blue 5.71:1, purple 5.82:1, violet 6.00:1, yellow 6.02:1). At -800 they reach 6.20:1 and 6.25:1, with the fill weight unchanged. This covers the GET and PUT method badges (and GraphQL QUERY), the matching badges in a reference's sidebar, 2xx and 4xx response status chips, and <Badge>'s success and warning variants. The deprecated label on an operation moves too: at orange-600 on the page background it was 3.59:1, the worst of the set. Dark mode was already passing and is unchanged.
• 0fe3d43: Darken the callout icons that miss the WCAG 1.4.11 non-text contrast bar in light mode. A callout's icon names its type, so it is meaningful UI rather than decorative: check/success and warning sat at 2.94:1 and 2.95:1 against their own tint and now take -700 (4.52:1 and 4.67:1), and note's icon was muted-foreground at 70% over the muted surface (2.68:1) and is now full strength (4.64:1). Dark mode was already passing.
• 4c0fdfc: Keep camelCase word boundaries in API reference operation routes. An operationId went through the generic slugger, which lowercases before it replaces non-slug characters, so processSlackInteraction collapsed to /reference/integrations/processslackinteraction. Operation ids are usually camelCase because OpenAPI generators reuse them as SDK method names, and renaming them just to get readable URLs couples SDK naming to presentation. The key now hyphenates the boundaries first: a lower-case letter or digit followed by a capital, and the last capital of an acronym before a capitalized word, so processSlackInteraction becomes process-slack-interaction and getHTTPResponse becomes get-http-response. Already kebab-case ids and the method-plus-path fallback are unchanged. GraphQL field and type names and AsyncAPI operation ids derive their routes through the same key, so a GraphQL addPet mutation moves from /graphql/mutations/addpet to /graphql/mutations/add-pet and an AsyncAPI publishUserSignedup operation from publishusersignedup to publish-user-signedup.
• 0fe3d43: Darken the typed <Card> icons and the stroked <Badge> variants that still missed the light-mode contrast bar. A card's check, warning, and note icons carried the same values the callout icons moved off (2.94:1, 2.95:1, and 2.68:1 against their tint) and now share the callout table. A stroked badge has no fill of its own and inherits whatever surface it sits on — inside a note callout, success at -700 was 4.47:1 — so success and warning now take -800 whether filled or stroked.
• 68f48c1: Downlevel <Card> and <CardGroup> to Markdown on the agent-facing surfaces. Both are Blume's own components and neither had a serializer, so a section landing page — the shape blume init scaffolds and the Mintlify migrator emits — published raw JSX to /<route>.md, llms-full.txt, MCP get_page and the Ask AI corpus. A card becomes its title as a link over its body, with the cta last; a group becomes everything it holds, block by block. Serializers in ai.markdownComponents gain childBlocks() — every direct child of the element in order, each already downleveled — which is what CardGroup is built on.
• e823872: Harden two scanners against pathological input: HTML comments stripped before anchor detection are replaced with a space so their neighbors can't splice into new markup, and github.dir plus source/meta route prefixes trim slashes linearly instead of with a regex that was quadratic on a run of /.
• ce20984: Make room for the copy button in code blocks that have no language bar to hold it. Inside a component whose chrome is not-prose — <Tabs>, <CodeGroup>, <Steps>, <Callout>, <Card>, <Accordion> and the rest — the bar is cleared but the button is not, and the block's padding-top was the 1rem chosen for a block with no chrome at all, so the button painted over the first line of code. The same applied to an untitled <CodeBlock> in plain prose, which renders no bar. Both now reserve the button's strip, as does a raw <pre><code> block written in prose, which gets a button but has no language bar either; the clearance is keyed on the docs layout that injects the button, so a custom page layout without it keeps the plain inset.
• 35b5c6a: Support trailing {#custom-id} heading markers as an equivalent of [#custom-id] — verbatim in .md, and as the escape \{#custom-id\} in .mdx, where a bare {…} is a JSX expression. blume check now reports a bare {#id} in an .mdx page (or in a partial it includes) as BLUME_MDX_CURLY_ANCHOR instead of leaving it to fail at compile time, and blume translate is told to preserve the marker. Fragment-link validation also recognizes ids on raw HTML elements (<a id="…">, including tags wrapped over several lines) as anchor targets, ignoring ids inside code, inline code, HTML comments, <Prompt> blocks, and component props.
• ce20984: Drop the page-actions divider when the rail has no table of contents. The actions block carries its own top border as a separator under the contents, but the contents only render when a page has a heading within toc.minHeadingLevel–toc.maxHeadingLevel — so on a page without one the block drew a rule across the top of an empty column. The rail now decides once whether an outline renders and passes that to the block (divider prop, default on), so the two cannot disagree.
• 1715b14: Keep a spaced Shiki line range (```ts {1, 3-5}) as one fence-meta token. The range used to split on its whitespace, and the 3-5} fragment was promoted to the code block's title.
• ce20984: Cap the search dialog's section-filter row so the results keep the dialog. The dialog is a fixed height and the filter chips wrapped without a bound, so on a site with many sections the chips took the height and the results list got the remainder — measured on an 18-section corpus, the row wanted 266px of the 480 and left about one visible result. The row now shows two rows of chips plus the top of a third as the scroll cue, chips no longer wrap on long section names, the selected chip is scrolled into view when the chips reorder as the query narrows, and each chip exposes its selected state as aria-pressed.
• 6d4ffec: Load the font subsets your locales need. Remote fonts used to load only the Latin subset, so Vietnamese, Central European, Cyrillic, and Greek text fell back to the system font. Blume now derives subsets from i18n.locales, and remote families accept a subsets option to pin the list.
• 1715b14: Treat an empty graphql.endpoint like an omitted one. The playground and code samples fall back to the endpoint placeholder instead of targeting an empty URL.

... (truncated)

Commits

• a76fecf Version Packages (#206)
• fe966ca feat: redesign the default 404 page
• dff7930 fix: scan link-reference definitions in linear time
• 1715b14 fix: address the unresolved CodeRabbit review threads
• fc24f9d fix: keep the Scalar reference on the page's theme
• ceb7a9f fix: keep the image-zoom stylesheet across client-router swaps
• d009a19 fix: keep data-theme through client-router swaps
• 6d4ffec fix(theme): load font subsets for the configured locales
• 72c9abe Parse tsconfig aliases with the TypeScript API, drop get-tsconfig
• a1bc441 Pin get-tsconfig to Astro's release so installs carry one copy
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[greptile-apps]

PR author is in the excluded authors list.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​blume@​1.5.3 ⏵ 1.6.0	+1		+1	+1

View full report