fix(docs): upgrade next to 16.2.6 security release + fumadocs-mdx 14.2.9 by toddgeist · Pull Request #279 · proofsh/proofkit

toddgeist · 2026-05-21T17:06:03Z

Summary

Upgrades Next.js from 16.1.1 to 16.2.6 (mandatory security release fixing 13 CVEs — see https://vercel.com/changelog/next-js-may-2026-security-release)
Upgrades fumadocs-mdx from 14.2.4 to 14.2.9 (fixes a Turbopack loader hang introduced in Next.js 16.2.6)
Adds @varlock/nextjs-integration and varlock deps required by next.config.ts

Test plan

next dev with Turbopack compiles /docs/[[...slug]] successfully (verified locally, 200 response in ~12s)
Binary search confirmed 16.2.5 works, 16.2.6 hangs, fumadocs-mdx 14.2.9 fixes the hang on 16.2.6

Summary by CodeRabbit

Chores
- Updated documentation and build tool dependencies to latest versions
- Adjusted documentation build configuration workflow

Next.js 16.2.6 is a mandatory security release (13 CVEs). It introduced a Turbopack regression that hangs the fumadocs-mdx loader; bumping fumadocs-mdx to 14.2.9 fixes the hang. Also adds varlock deps required by next.config.ts.

vercel · 2026-05-21T17:06:09Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
proofkit-docs	Ready	Preview, Comment	May 21, 2026 5:08pm

changeset-bot · 2026-05-21T17:06:11Z

⚠️ No Changeset found

Latest commit: 298f4f6

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

coderabbitai · 2026-05-21T17:07:24Z

📝 Walkthrough

Walkthrough

The docs package configuration is updated to simplify the build pipeline by removing the varlock execution wrapper from the build script. Dependencies are concurrently updated: varlock is bumped to ^1.2.0 and fumadocs-mdx to 14.2.9.

Changes

Build Configuration

Layer / File(s)	Summary
Build script and dependency updates `apps/docs/package.json`	Build script removes `pnpm exec varlock run --` wrapper, running next build directly after typegen. Dependencies updated: `varlock` from `^1.1.0` to `^1.2.0` and `fumadocs-mdx` from `14.2.4` to `14.2.9`.

🎯 1 (Trivial) | ⏱️ ~2 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title mentions upgrading Next.js to 16.2.6 and fumadocs-mdx to 14.2.9, but the actual changes show only fumadocs-mdx dependency update and build script modifications; Next.js upgrade is not reflected in the provided package.json changes.	Clarify whether Next.js was actually upgraded in this PR or if the title should be adjusted to accurately reflect only the fumadocs-mdx and build script changes shown in package.json.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/next-16.2.6-security-upgrade

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@apps/docs/package.json`:
- Line 7: Confirm and run the repository-level CI checks by executing "pnpm run
ci" from the repo root after updating the apps/docs package.json (the modified
"build" script), then commit only after the CI completes successfully; ensure
you mention this confirmation in the PR description or squash/merge checklist.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: dc0716d0-7b8c-4d2b-90b4-3a10ffc399b5

📥 Commits

Reviewing files that changed from the base of the PR and between ff85065 and 298f4f6.

⛔ Files ignored due to path filters (1)

pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

apps/docs/package.json

coderabbitai · 2026-05-21T17:07:27Z

  "private": true,
  "scripts": {
-    "build": "pnpm --filter @proofkit/typegen build && pnpm exec varlock run -- next build",
+    "build": "pnpm --filter @proofkit/typegen build && next build",


⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Confirm the required repo-root CI run before merge.

Please confirm pnpm run ci was executed from the repo root after this change, per the repo rule for JSON-file updates.

As per coding guidelines, **/*.{ts,tsx,js,jsx,json}: Always run pnpm run ci from repo root after task completion and before committing.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@apps/docs/package.json` at line 7, Confirm and run the repository-level CI checks by executing "pnpm run ci" from the repo root after updating the apps/docs package.json (the modified "build" script), then commit only after the CI completes successfully; ensure you mention this confirmation in the PR description or squash/merge checklist.

pkg-pr-new · 2026-05-21T17:09:17Z

Open in StackBlitz

@proofkit/better-auth

pnpm add https://pkg.pr.new/proofsh/proofkit/@proofkit/better-auth@279

@proofkit/cli

pnpm add https://pkg.pr.new/proofsh/proofkit/@proofkit/cli@279

create-proofkit

pnpm add https://pkg.pr.new/proofsh/proofkit/create-proofkit@279

@proofkit/fmdapi

pnpm add https://pkg.pr.new/proofsh/proofkit/@proofkit/fmdapi@279

@proofkit/fmodata

pnpm add https://pkg.pr.new/proofsh/proofkit/@proofkit/fmodata@279

@proofkit/typegen

pnpm add https://pkg.pr.new/proofsh/proofkit/@proofkit/typegen@279

@proofkit/webviewer

pnpm add https://pkg.pr.new/proofsh/proofkit/@proofkit/webviewer@279

commit: 298f4f6

coderabbitai Bot reviewed May 21, 2026

View reviewed changes

vercel Bot deployed to Preview May 21, 2026 17:08 View deployment

toddgeist merged commit 035a9cb into main May 21, 2026
20 checks passed

toddgeist deleted the fix/next-16.2.6-security-upgrade branch May 21, 2026 17:10

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(docs): upgrade next to 16.2.6 security release + fumadocs-mdx 14.2.9#279

fix(docs): upgrade next to 16.2.6 security release + fumadocs-mdx 14.2.9#279
toddgeist merged 1 commit into
mainfrom
fix/next-16.2.6-security-upgrade

toddgeist commented May 21, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

vercel Bot commented May 21, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented May 21, 2026

Uh oh!

coderabbitai Bot commented May 21, 2026

Walkthrough

Changes

❌ Failed checks (1 inconclusive)

Uh oh!

coderabbitai Bot left a comment

Uh oh!

coderabbitai Bot May 21, 2026

Uh oh!

pkg-pr-new Bot commented May 21, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

toddgeist commented May 21, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Summary by CodeRabbit

Uh oh!

vercel Bot commented May 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot Bot commented May 21, 2026

⚠️ No Changeset found

Uh oh!

coderabbitai Bot commented May 21, 2026

Walkthrough

Changes

❌ Failed checks (1 inconclusive)

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot May 21, 2026

Choose a reason for hiding this comment

Uh oh!

pkg-pr-new Bot commented May 21, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

toddgeist commented May 21, 2026 •

edited by coderabbitai Bot

Loading

vercel Bot commented May 21, 2026 •

edited

Loading