chore(deps): bump blume from 1.6.3 to 1.6.4

[dependabot]

Bumps blume from 1.6.3 to 1.6.4.

Release notes

Sourced from blume's releases.

blume@1.6.4

Patch Changes

• 623fe85: Remove the extra vertical space at the bottom of code blocks. The scrolling code element carries a small bottom inset so a horizontal scrollbar thumb stays off the last line's descenders, but that inset was added on top of the block's padding, so every block, including a one-line install command, sat 0.375rem taller than the space above the text. The block now gives up the same amount below the code element, so the text sits an even 1rem from the top and bottom edges and the scrollbar gap is unchanged.

• 6edd17b: Fix a ReferenceError: rafThrottle is not defined thrown on pages that render <Component>: the script block used rafThrottle without importing it. Preview panes now cap at the viewport with CSS (max-height: 100lvh) instead of a resize listener, so a pane capped by a small window grows back when the window does, mobile toolbar collapse no longer resizes it, and the docs page asks already-loaded frames to re-report their height so a report sent before the listener registered isn't lost.

• ec879ad: Keep content links inside the reader's language on multi-locale sites. Markdown links and Card, Tile, Tooltip, and Update hrefs written as /guides/setup rendered verbatim on translated pages, so a reader on /fr/… was sent back to the default locale on the first click. Root-relative page links now resolve to the same-locale route when one is served — a translation or a fallback page — and keep their authored target otherwise, so custom pages and explicit cross-locale links are untouched. blume check resolves links the same way, so an anchor is validated against the translated page a reader actually lands on.

  Because anchors now travel with the link, blume translate pins every translated heading to its source heading's anchor id with a trailing [#id] marker (unless the translation already pins one), so #fragment links resolve identically in every language.

• 5efd05e: Fix the language switcher's fallback target under a basePath. A switcher entry for a locale with no real translation derives its href by stripping the page's own locale from its route and re-adding the target locale, but route arrives with the base path already applied (/docs/ja/reference) while locale prefixes are base-less (/ja) — so the strip matched nothing and the re-add produced a second prefix, linking /docs/ja/reference at /ja/docs/ja/reference, /ko/docs/ja/reference and so on. None of those routes are built, so every affected entry was a dead link, and an audit that follows them reported the page as linking to broken routes. The route is now moved into base-less space before the locale is swapped and the base is re-applied to the result, using the same helpers the manifest composes real routes with. This affects any locale without a real translation of the page: a partially translated hand-written page for its missing locales, and, most visibly, a generated OpenAPI or GraphQL reference under a base path for every locale but its own.

• 4de1d37: Downlevel <Operation>, <ApiTagOperations> and <ApiOverview> on the agent-facing surfaces. A generated reference page is its description as Markdown plus one of those components, so with no serializer for them an operation page reached /<route>.md, llms-full.txt, MCP get_page and the Ask AI corpus as its description followed by a bare tag — no method, no path, nowhere to go. On a site whose reference is most of the corpus, that is most of the corpus: measured on one 449-page site, 266 pages and 266 raw <Operation> in llms-full.txt, so "which endpoint do I call?" had no answer anywhere an agent could read. An operation now downlevels to its endpoint in the spec kind's own notation — GET /pets/{id}, SEND user/signup, query pets or type Pet — plus a deprecation marker; a tag section to its operations as links with their summaries; and the overview to the version and base URLs the rendered page shows. Site search indexes the same text, so a query for an endpoint's path now matches its page. Parameters and schemas stay with the component, which owns that rendering. The components and the serializers also share one own-property lookup, so a source or id that names an inherited property like toString renders the not-found state instead of throwing.

• 830bd4e: Update the oxfmt directive-preservation patch documented in the FAQ for oxfmt 0.67.0. The patch body is unchanged; it now targets the renamed Markdown formatter chunk so ::: container directives keep their fences on their own lines under the latest oxfmt, oxlint 1.82, and Ultracite 7.11.

• a919bac: Add nub and aube tabs to the package-install block, alongside npm, pnpm, yarn, and bun. The commands come from the same maintained agent tables as the existing tabs, so npx … becomes nubx … and aube dlx …, npm ci becomes a frozen install, and global installs keep their -g form. An install block may also be written with a nub, nubx, or aube command as its input.

• ecbb199: Stop the llms.txt audit reporting the MCP route as a stale entry. llms.txt advertises ai.mcp.route whenever the MCP server is on, but that endpoint is streamable HTTP — a route the server answers, not a file the build writes — so it appears in neither the page snapshots nor the static file index and the stale-entry check read the site's own index as broken. Every server-output site with ai.mcp enabled raised BLUME_AUDIT_LLMS_TXT_STALE_ENTRY for a file that was never meant to exist, and under --fail-on warning that failed the audit and blocked publishing. The configured route is now exempt while the server is enabled, and only then: with ai.mcp off, a listed /mcp is as stale as any other dead entry. The other targets llms.txt lists — llms-full.txt, /index.md, agent-readability.json, sitemap.xml — are real files and are unaffected.

  The link, llms.txt, and redirect checks now share one definition of what the build serves, so a page link or a configured redirect that lands on the MCP route is no longer reported as broken either, and an llms.txt entry that points at a directory served from its index.html is accepted the way the link check already did.

• bbb6792: Scope search to the active language on every page of a multi-locale site. The search dialog derived its locale filter from the header's language-switcher entries, which only content pages receive, so custom pages built on PageLayout, the changelog index, the 404 page, and the API reference shell searched every language and hid the "All languages" toggle. The filter now reads the resolved i18n settings directly.

• d7462bf: Update dependencies: Astro 7.3.2 with @astrojs/mdx 8.0.1 and @astrojs/markdown-satteri 0.4.1, plus the latest patch releases of the remaining runtime dependencies (@clack/prompts, @scalar/astro, ai, dompurify, katex, marked, node-html-parser, simple-icons, takumi-js). Astro's default image service already resolves to Sharp 0.35.4, the release that patches the AVIF remote code execution advisory (GHSA-26w7-cxv4-gfx2).

Changelog

Sourced from blume's changelog.

1.6.4

Patch Changes

• 623fe85: Remove the extra vertical space at the bottom of code blocks. The scrolling code element carries a small bottom inset so a horizontal scrollbar thumb stays off the last line's descenders, but that inset was added on top of the block's padding, so every block, including a one-line install command, sat 0.375rem taller than the space above the text. The block now gives up the same amount below the code element, so the text sits an even 1rem from the top and bottom edges and the scrollbar gap is unchanged.

• 6edd17b: Fix a ReferenceError: rafThrottle is not defined thrown on pages that render <Component>: the script block used rafThrottle without importing it. Preview panes now cap at the viewport with CSS (max-height: 100lvh) instead of a resize listener, so a pane capped by a small window grows back when the window does, mobile toolbar collapse no longer resizes it, and the docs page asks already-loaded frames to re-report their height so a report sent before the listener registered isn't lost.

• ec879ad: Keep content links inside the reader's language on multi-locale sites. Markdown links and Card, Tile, Tooltip, and Update hrefs written as /guides/setup rendered verbatim on translated pages, so a reader on /fr/… was sent back to the default locale on the first click. Root-relative page links now resolve to the same-locale route when one is served — a translation or a fallback page — and keep their authored target otherwise, so custom pages and explicit cross-locale links are untouched. blume check resolves links the same way, so an anchor is validated against the translated page a reader actually lands on.

  Because anchors now travel with the link, blume translate pins every translated heading to its source heading's anchor id with a trailing [#id] marker (unless the translation already pins one), so #fragment links resolve identically in every language.

• 5efd05e: Fix the language switcher's fallback target under a basePath. A switcher entry for a locale with no real translation derives its href by stripping the page's own locale from its route and re-adding the target locale, but route arrives with the base path already applied (/docs/ja/reference) while locale prefixes are base-less (/ja) — so the strip matched nothing and the re-add produced a second prefix, linking /docs/ja/reference at /ja/docs/ja/reference, /ko/docs/ja/reference and so on. None of those routes are built, so every affected entry was a dead link, and an audit that follows them reported the page as linking to broken routes. The route is now moved into base-less space before the locale is swapped and the base is re-applied to the result, using the same helpers the manifest composes real routes with. This affects any locale without a real translation of the page: a partially translated hand-written page for its missing locales, and, most visibly, a generated OpenAPI or GraphQL reference under a base path for every locale but its own.

• 4de1d37: Downlevel <Operation>, <ApiTagOperations> and <ApiOverview> on the agent-facing surfaces. A generated reference page is its description as Markdown plus one of those components, so with no serializer for them an operation page reached /<route>.md, llms-full.txt, MCP get_page and the Ask AI corpus as its description followed by a bare tag — no method, no path, nowhere to go. On a site whose reference is most of the corpus, that is most of the corpus: measured on one 449-page site, 266 pages and 266 raw <Operation> in llms-full.txt, so "which endpoint do I call?" had no answer anywhere an agent could read. An operation now downlevels to its endpoint in the spec kind's own notation — GET /pets/{id}, SEND user/signup, query pets or type Pet — plus a deprecation marker; a tag section to its operations as links with their summaries; and the overview to the version and base URLs the rendered page shows. Site search indexes the same text, so a query for an endpoint's path now matches its page. Parameters and schemas stay with the component, which owns that rendering. The components and the serializers also share one own-property lookup, so a source or id that names an inherited property like toString renders the not-found state instead of throwing.

• 830bd4e: Update the oxfmt directive-preservation patch documented in the FAQ for oxfmt 0.67.0. The patch body is unchanged; it now targets the renamed Markdown formatter chunk so ::: container directives keep their fences on their own lines under the latest oxfmt, oxlint 1.82, and Ultracite 7.11.

• a919bac: Add nub and aube tabs to the package-install block, alongside npm, pnpm, yarn, and bun. The commands come from the same maintained agent tables as the existing tabs, so npx … becomes nubx … and aube dlx …, npm ci becomes a frozen install, and global installs keep their -g form. An install block may also be written with a nub, nubx, or aube command as its input.

• ecbb199: Stop the llms.txt audit reporting the MCP route as a stale entry. llms.txt advertises ai.mcp.route whenever the MCP server is on, but that endpoint is streamable HTTP — a route the server answers, not a file the build writes — so it appears in neither the page snapshots nor the static file index and the stale-entry check read the site's own index as broken. Every server-output site with ai.mcp enabled raised BLUME_AUDIT_LLMS_TXT_STALE_ENTRY for a file that was never meant to exist, and under --fail-on warning that failed the audit and blocked publishing. The configured route is now exempt while the server is enabled, and only then: with ai.mcp off, a listed /mcp is as stale as any other dead entry. The other targets llms.txt lists — llms-full.txt, /index.md, agent-readability.json, sitemap.xml — are real files and are unaffected.

  The link, llms.txt, and redirect checks now share one definition of what the build serves, so a page link or a configured redirect that lands on the MCP route is no longer reported as broken either, and an llms.txt entry that points at a directory served from its index.html is accepted the way the link check already did.

• bbb6792: Scope search to the active language on every page of a multi-locale site. The search dialog derived its locale filter from the header's language-switcher entries, which only content pages receive, so custom pages built on PageLayout, the changelog index, the 404 page, and the API reference shell searched every language and hid the "All languages" toggle. The filter now reads the resolved i18n settings directly.

• d7462bf: Update dependencies: Astro 7.3.2 with @astrojs/mdx 8.0.1 and @astrojs/markdown-satteri 0.4.1, plus the latest patch releases of the remaining runtime dependencies (@clack/prompts, @scalar/astro, ai, dompurify, katex, marked, node-html-parser, simple-icons, takumi-js). Astro's default image service already resolves to Sharp 0.35.4, the release that patches the AVIF remote code execution advisory (GHSA-26w7-cxv4-gfx2).

Commits

• 9e811a0 Version Packages (#246)
• ec879ad fix: keep content links and anchors inside the reader's locale
• 5efd05e fix: swap the switcher's fallback locale in base-less space (#249)
• d7462bf chore: update dependencies
• 623fe85 fix: fold the code scroller's bottom inset into the block padding
• a919bac feat: add nub and aube tabs to the package-install block
• ecbb199 Stop the llms.txt audit flagging the MCP route as stale (#248)
• bbb6792 fix: scope search to the active language on every page shell
• 6edd17b fix: import rafThrottle in Component script block (#245)
• 4de1d37 Downlevel the OpenAPI components on the agent surfaces (#244)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[changeset-bot]

⚠️ No Changeset found

Latest commit: 9415369

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: b8f5fb1d-8c35-4d2e-b263-d7f02e8757fe

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[dependabot]

Superseded by #256.