chore(deps): bump blume from 1.1.3 to 1.1.4

[dependabot]

Bumps blume from 1.1.3 to 1.1.4.

Release notes

Sourced from blume's releases.

blume@1.1.4

Patch Changes

• e4506a0: Keep the Ask AI panel open when Escape dismisses the search dialog stacked on top of it. The panel's window-level Escape listener fired alongside the dialog's native cancel, closing both surfaces when the user only meant to close search.
• e4506a0: Stop reporting every blume audit --claude/--codex launch failure as "not found on PATH". Only a missing executable (ENOENT) gets the install hint now; any other spawn failure (EACCES, EMFILE, …) surfaces as itself instead of being masked by an irrelevant install suggestion.
• e4506a0: Strip deployment.base before comparing canonical and sitemap URLs in blume audit. Canonicals and <loc>s are emitted as site + base + route while page URLs come from the base-less file tree, so on a subpath deployment every page false-fired CANONICAL_BAD_TARGET, NON_CANONICAL_IN_SITEMAP, and INDEXABLE_PAGE_NOT_IN_SITEMAP — and the duplicate-content checks silently skipped every page (each one looked like it canonicalized elsewhere).
• e4506a0: Percent-decode pathnames before comparing them against the built file tree in blume audit. Sitemap <loc>s are encodeURI'd and URL#pathname re-encodes non-ASCII, while page URLs and file-index keys are raw on-disk names — so a non-ASCII route (e.g. a Japanese slug) false-fired SITEMAP_BAD_URL, and a percent-encoded href false-fired LINK_TO_BROKEN.
• e4506a0: Probe live URLs under deployment.base in blume audit --url. Page URLs come from the base-less build tree, but the deployed site serves everything (pages, robots.txt, sitemap.xml) under the base — so auditing a healthy subpath deployment produced a wall of HTTP_4XX findings from probing the wrong URLs.
• e4506a0: Strip query strings and fragments from redirect destinations before blume audit checks them against the build. A working redirect to /guide#setup or /search?q=x was reported REDIRECT_BROKEN because the suffixed path is not a file-tree member.
• e4506a0: Apply basePath to configured redirects before blume audit resolves them. Redirects are authored as if mounted at root and gain the base at build time, but the audit compared them raw against built page URLs that carry the base — so every redirect on a basePath site was reported REDIRECT_BROKEN, while LINK_TO_REDIRECT and REDIRECT_SOURCE_IS_PAGE could never fire.
• e4506a0: Keep / separators in Sanity and Notion slugs. Slugging deleted slashes along with other punctuation, so a guides/setup slug was mashed into guidessetup — and two documents whose slugs differ only by a slash silently overwrote each other. Segments are now slugged individually.
• e4506a0: Stop promoting a title="…" embedded in another code-fence meta attribute's quoted value (caption='set title="X" here' file.ts) to the block title. Other quoted attributes are blanked before the explicit-title scan, so the bare-token title (file.ts) wins as intended.
• 4294b00: Carry the resolved dateFormat config into the runtime data and its BlumeDataConfig type. A configured dateFormat was silently dropped from the serialized site data, so the date stamps always rendered the default long style, and blume check failed with ts(2339) on data.config.dateFormat in the generated catch-all page.
• e4506a0: Fall through to the next platform env var when one is set but empty. VERCEL_PROJECT_PRODUCTION_URL="" dead-ended the chain before VERCEL_URL (same for Netlify's URL/DEPLOY_PRIME_URL/DEPLOY_URL), leaving deployment.site unset so canonicals, OG images, and the sitemap silently switched off for that deploy.
• e4506a0: Leave the .blume/node_modules junction alone when it already points at the right target. It was deleted and re-created on every dev regeneration in the split-install layout, opening a window in which the dev server's module resolution raced a missing node_modules and intermittently failed with "Cannot find package".
• e4506a0: Watch blume.config.ts, theme.css, and components.ts via their parent directory in blume dev. Watching the file path tracks the inode, so a rename-replace save (vim and most "atomic save" editors) orphaned the watcher after the first save — every later edit was silently ignored until the server restarted.
• e4506a0: Localize internal navigation.featured hrefs per locale, like header tabs. A pinned /changelog link rendered on /fr/… pages always targeted the default-locale route, kicking the reader out of their language.
• e4506a0: Stop opening a phantom code fence on a line-leading inline backtick span. A paragraph line like ```inline``` is not a fence opener (CommonMark forbids backticks in a backtick fence's info string), but the heading/link scanner treated it as one and silently dropped every heading and link after it from the TOC, search index, and anchor validation.
• e4506a0: Stop misreading a body-leading thematic break as front matter in heading extraction. A stripped body opening with --- followed by a blank line lost every heading up to the next --- line — missing TOC and search entries, and false BLUME_BROKEN_ANCHOR findings from blume validate.
• e4506a0: Strip the locale directory from a shared .$ file's nav path with the dir parser. fr/changelog.$.mdx kept its fr/ segment, silently routing the default locale's record inside the French URL namespace, the French copy to /fr/fr/changelog, and conjuring a spurious "Fr" sidebar group.
• e4506a0: Skip images that are themselves links when wiring click-to-zoom. A linked image ([![alt](https://github.com/haydenbleasel/blume/tree/HEAD/packages/blume/blob/HEAD/shot.png)](https://example.com)) navigates on click, so the zoom binding only flashed an overlay in the instant before navigation while the cursor-zoom-in affordance promised a zoom that never happened.
• e4506a0: Extract markdown link targets with balanced parentheses and image-wrapped labels intact. [wiki](https://en.wikipedia.org/wiki/Foo_(bar)) was truncated at the inner ) and reported as a broken link, and the outer target of [![alt](https://github.com/haydenbleasel/blume/tree/HEAD/packages/blume/blob/HEAD/img.png)](/target) was never validated at all (the nested image's own target still is).
• e4506a0: Make the MCP tools' contract hold together: search_docs hits now include the route the tool description promises (alongside url), and get_page accepts a full URL or a base-prefixed path — an agent following "pass a route from search_docs" no longer gets "No page found" for a page that exists on a site with deployment.site or deployment.base configured.
• ff0b2b0: Fix .md pages serving stale content in blume dev. The generated dev config kept Vite's watcher out of Astro's cache dir, which suppressed the data-store.json change events Astro relies on to invalidate content in a running dev server — so edited Markdown bodies (rendered into the data store at load time) kept serving the old HTML even after a hard reload, while .mdx pages (rendered through their own module) updated fine. The watcher ignore is now scoped to migrated (content.root: ".") projects, the only layout whose glob loader would otherwise churn on Astro's own cache writes.
• e4506a0: Pair backtick code in OpenAPI descriptions the way CommonMark does — a run only closes on an equal-length run. A lone inline backtick followed by a code fence used to "close" on the fence's first backtick, leaving {/< in the surrounding prose unescaped (an MDX compile error that fails the operation page's build) and entity-escaping the fence body.
• e4506a0: Stop escaping > in OpenAPI descriptions rendered to MDX. It isn't MDX-special on its own, and escaping it turned a common > **Note:** … blockquote into a literal "> Note:" paragraph.
• e4506a0: Give every distinct OpenAPI tag a unique slug. Slugging strips all non-ASCII, so two non-Latin tags (ペット, 注文) both collapsed to operations — merging their routes and sidebar groups and dropping the second tag's overview section. Colliding slugs now gain -2, -3, … in first-seen order.
• e4506a0: Leave shifted and alted keyboard chords to the browser. Ctrl+Shift+I (DevTools) toggled the Ask AI panel and Ctrl+Shift+K (Firefox web console) opened the search dialog, because the ⌘I/⌘K matchers ignored the Shift and Alt modifiers.
• e4506a0: Resolve explicit sidebar refs written with a trailing slash. A hand-written "guides/" normalized to /guides/, missed the slashless /guides route, and the item was silently dropped from the sidebar with no diagnostic.
• 6554485: Keep the docs sidebar scrolled to the current page across navigations. Each page load previously reset the sidebar's own scroll container to the top, so on long sidebars the viewport visibly jumped away from the link you just clicked. A pre-paint inline script now centers the active link when it would otherwise be out of view — this also fixes deep links landing with the current page's link below the fold. Short sidebars, and pages whose active link is already visible, are untouched.
• e4506a0: Only unwrap a single rendered paragraph in <Prompt>, <Frame>, and <Tooltip>. The greedy unwrap matched across multiple paragraphs, injecting unbalanced </p>/<p> tags via set:html — a multi-paragraph description, caption, or tooltip label broke the surrounding layout when the parser re-parented the stray tags.
• e4506a0: Dedupe repeated <Update> ids on a page, mirroring the accordion id dedupe. Two entries labeled "Bug fixes" produced duplicate DOM ids, so the second entry's self-anchor permalink jumped to the first one; later duplicates now gain -2, -3, … and their header anchors follow.
• e4506a0: Make useAskAI().reset() revoke the in-flight stream, matching the built-in island. Resetting mid-answer used to let the next chunk re-append an orphaned assistant bubble onto the emptied conversation, and a fetch error after reset resurrected the entire pre-reset history. The request is now aborted and stale writes are discarded.

Changelog

Sourced from blume's changelog.

1.1.4

Patch Changes

• e4506a0: Keep the Ask AI panel open when Escape dismisses the search dialog stacked on top of it. The panel's window-level Escape listener fired alongside the dialog's native cancel, closing both surfaces when the user only meant to close search.
• e4506a0: Stop reporting every blume audit --claude/--codex launch failure as "not found on PATH". Only a missing executable (ENOENT) gets the install hint now; any other spawn failure (EACCES, EMFILE, …) surfaces as itself instead of being masked by an irrelevant install suggestion.
• e4506a0: Strip deployment.base before comparing canonical and sitemap URLs in blume audit. Canonicals and <loc>s are emitted as site + base + route while page URLs come from the base-less file tree, so on a subpath deployment every page false-fired CANONICAL_BAD_TARGET, NON_CANONICAL_IN_SITEMAP, and INDEXABLE_PAGE_NOT_IN_SITEMAP — and the duplicate-content checks silently skipped every page (each one looked like it canonicalized elsewhere).
• e4506a0: Percent-decode pathnames before comparing them against the built file tree in blume audit. Sitemap <loc>s are encodeURI'd and URL#pathname re-encodes non-ASCII, while page URLs and file-index keys are raw on-disk names — so a non-ASCII route (e.g. a Japanese slug) false-fired SITEMAP_BAD_URL, and a percent-encoded href false-fired LINK_TO_BROKEN.
• e4506a0: Probe live URLs under deployment.base in blume audit --url. Page URLs come from the base-less build tree, but the deployed site serves everything (pages, robots.txt, sitemap.xml) under the base — so auditing a healthy subpath deployment produced a wall of HTTP_4XX findings from probing the wrong URLs.
• e4506a0: Strip query strings and fragments from redirect destinations before blume audit checks them against the build. A working redirect to /guide#setup or /search?q=x was reported REDIRECT_BROKEN because the suffixed path is not a file-tree member.
• e4506a0: Apply basePath to configured redirects before blume audit resolves them. Redirects are authored as if mounted at root and gain the base at build time, but the audit compared them raw against built page URLs that carry the base — so every redirect on a basePath site was reported REDIRECT_BROKEN, while LINK_TO_REDIRECT and REDIRECT_SOURCE_IS_PAGE could never fire.
• e4506a0: Keep / separators in Sanity and Notion slugs. Slugging deleted slashes along with other punctuation, so a guides/setup slug was mashed into guidessetup — and two documents whose slugs differ only by a slash silently overwrote each other. Segments are now slugged individually.
• e4506a0: Stop promoting a title="…" embedded in another code-fence meta attribute's quoted value (caption='set title="X" here' file.ts) to the block title. Other quoted attributes are blanked before the explicit-title scan, so the bare-token title (file.ts) wins as intended.
• 4294b00: Carry the resolved dateFormat config into the runtime data and its BlumeDataConfig type. A configured dateFormat was silently dropped from the serialized site data, so the date stamps always rendered the default long style, and blume check failed with ts(2339) on data.config.dateFormat in the generated catch-all page.
• e4506a0: Fall through to the next platform env var when one is set but empty. VERCEL_PROJECT_PRODUCTION_URL="" dead-ended the chain before VERCEL_URL (same for Netlify's URL/DEPLOY_PRIME_URL/DEPLOY_URL), leaving deployment.site unset so canonicals, OG images, and the sitemap silently switched off for that deploy.
• e4506a0: Leave the .blume/node_modules junction alone when it already points at the right target. It was deleted and re-created on every dev regeneration in the split-install layout, opening a window in which the dev server's module resolution raced a missing node_modules and intermittently failed with "Cannot find package".
• e4506a0: Watch blume.config.ts, theme.css, and components.ts via their parent directory in blume dev. Watching the file path tracks the inode, so a rename-replace save (vim and most "atomic save" editors) orphaned the watcher after the first save — every later edit was silently ignored until the server restarted.
• e4506a0: Localize internal navigation.featured hrefs per locale, like header tabs. A pinned /changelog link rendered on /fr/… pages always targeted the default-locale route, kicking the reader out of their language.
• e4506a0: Stop opening a phantom code fence on a line-leading inline backtick span. A paragraph line like ```inline``` is not a fence opener (CommonMark forbids backticks in a backtick fence's info string), but the heading/link scanner treated it as one and silently dropped every heading and link after it from the TOC, search index, and anchor validation.
• e4506a0: Stop misreading a body-leading thematic break as front matter in heading extraction. A stripped body opening with --- followed by a blank line lost every heading up to the next --- line — missing TOC and search entries, and false BLUME_BROKEN_ANCHOR findings from blume validate.
• e4506a0: Strip the locale directory from a shared .$ file's nav path with the dir parser. fr/changelog.$.mdx kept its fr/ segment, silently routing the default locale's record inside the French URL namespace, the French copy to /fr/fr/changelog, and conjuring a spurious "Fr" sidebar group.
• e4506a0: Skip images that are themselves links when wiring click-to-zoom. A linked image ([![alt](https://github.com/haydenbleasel/blume/blob/main/packages/blume/shot.png)](https://example.com)) navigates on click, so the zoom binding only flashed an overlay in the instant before navigation while the cursor-zoom-in affordance promised a zoom that never happened.
• e4506a0: Extract markdown link targets with balanced parentheses and image-wrapped labels intact. [wiki](https://en.wikipedia.org/wiki/Foo_(bar)) was truncated at the inner ) and reported as a broken link, and the outer target of [![alt](https://github.com/haydenbleasel/blume/blob/main/packages/blume/img.png)](/target) was never validated at all (the nested image's own target still is).
• e4506a0: Make the MCP tools' contract hold together: search_docs hits now include the route the tool description promises (alongside url), and get_page accepts a full URL or a base-prefixed path — an agent following "pass a route from search_docs" no longer gets "No page found" for a page that exists on a site with deployment.site or deployment.base configured.
• ff0b2b0: Fix .md pages serving stale content in blume dev. The generated dev config kept Vite's watcher out of Astro's cache dir, which suppressed the data-store.json change events Astro relies on to invalidate content in a running dev server — so edited Markdown bodies (rendered into the data store at load time) kept serving the old HTML even after a hard reload, while .mdx pages (rendered through their own module) updated fine. The watcher ignore is now scoped to migrated (content.root: ".") projects, the only layout whose glob loader would otherwise churn on Astro's own cache writes.
• e4506a0: Pair backtick code in OpenAPI descriptions the way CommonMark does — a run only closes on an equal-length run. A lone inline backtick followed by a code fence used to "close" on the fence's first backtick, leaving {/< in the surrounding prose unescaped (an MDX compile error that fails the operation page's build) and entity-escaping the fence body.
• e4506a0: Stop escaping > in OpenAPI descriptions rendered to MDX. It isn't MDX-special on its own, and escaping it turned a common > **Note:** … blockquote into a literal "> Note:" paragraph.
• e4506a0: Give every distinct OpenAPI tag a unique slug. Slugging strips all non-ASCII, so two non-Latin tags (ペット, 注文) both collapsed to operations — merging their routes and sidebar groups and dropping the second tag's overview section. Colliding slugs now gain -2, -3, … in first-seen order.
• e4506a0: Leave shifted and alted keyboard chords to the browser. Ctrl+Shift+I (DevTools) toggled the Ask AI panel and Ctrl+Shift+K (Firefox web console) opened the search dialog, because the ⌘I/⌘K matchers ignored the Shift and Alt modifiers.
• e4506a0: Resolve explicit sidebar refs written with a trailing slash. A hand-written "guides/" normalized to /guides/, missed the slashless /guides route, and the item was silently dropped from the sidebar with no diagnostic.
• 6554485: Keep the docs sidebar scrolled to the current page across navigations. Each page load previously reset the sidebar's own scroll container to the top, so on long sidebars the viewport visibly jumped away from the link you just clicked. A pre-paint inline script now centers the active link when it would otherwise be out of view — this also fixes deep links landing with the current page's link below the fold. Short sidebars, and pages whose active link is already visible, are untouched.
• e4506a0: Only unwrap a single rendered paragraph in <Prompt>, <Frame>, and <Tooltip>. The greedy unwrap matched across multiple paragraphs, injecting unbalanced </p>/<p> tags via set:html — a multi-paragraph description, caption, or tooltip label broke the surrounding layout when the parser re-parented the stray tags.
• e4506a0: Dedupe repeated <Update> ids on a page, mirroring the accordion id dedupe. Two entries labeled "Bug fixes" produced duplicate DOM ids, so the second entry's self-anchor permalink jumped to the first one; later duplicates now gain -2, -3, … and their header anchors follow.
• e4506a0: Make useAskAI().reset() revoke the in-flight stream, matching the built-in island. Resetting mid-answer used to let the next chunk re-append an orphaned assistant bubble onto the emptied conversation, and a fetch error after reset resurrected the entire pre-reset history. The request is now aborted and stale writes are discarded.

Commits

• 76fbfbe Version Packages (#113)
• e4506a0 fix: resolve 27 bugs across audit, content pipeline, i18n, openapi, component...
• f1e8fe7 test(astro): cover generate.ts error and warning fallback paths
• 4294b00 fix(config): carry dateFormat into the runtime data and its type
• ff0b2b0 fix(dev): serve fresh .md content after edits in blume dev
• 6554485 fix(theme): keep the sidebar scrolled to the current page across navigations
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[changeset-bot]

⚠️ No Changeset found

Latest commit: 78c374a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR