build(deps): bump @cloudflare/nimbus-docs from 0.9.0 to 0.11.0 in /website

[dependabot]

Bumps @cloudflare/nimbus-docs from 0.9.0 to 0.11.0.

Release notes

Sourced from @​cloudflare/nimbus-docs's releases.

@​cloudflare/nimbus-docs@​0.10.0

Minor Changes

• #71 e5d74f9 Thanks @​MohamedH1998! - Enable MDX optimization by default to reduce large-site build memory usage. Sites can opt out with mdx: { optimize: false }.

  Verified the generated starter with optimization on and with mdx: { optimize: false } forced; the rendered HTML is structurally equivalent for element names, attributes, and non-whitespace text. AC#3 is treated as semantic/structural render parity rather than byte identity: raw bytes differ due to serializer escaping and inter-block whitespace, but the rendered document is lossless.

  Spot-checked the starter components page, which includes JSX tags in prose, inline code with <...>, quoted code, and package names. The optimized and opt-out renders preserve those special-character text probes and match structurally.

  Constrain the supported Astro peer range to >=7.0.0 <7.1.0 || >=7.2.0 <8.0.0: the 7.1.x line is excluded while its static-build regression is open upstream, but 7.2.x is admitted (verified against a sub-path build). Generated templates and the dev pin stay on the verified 7.0.x line.

• #76 acfac20 Thanks @​mvvmm! - Replace astro-icon with a built-in icon system. This is a breaking change for any project using astro-icon directly.

  Why: astro-icon stamped a generated lastModified timestamp into its virtual module on every build, invalidating thousands of cached pages in Astro's incremental build cache. The package is unmaintained so an upstream fix isn't coming.

  What's new: Nimbus now provides virtual:nimbus/icons (a Vite plugin) and @cloudflare/nimbus-docs/components/Icon.astro. The plugin auto-detects installed @iconify-json/* packages and loads local SVGs from src/icons/. The component API is compatible with astro-icon (name, size, width, height, is:inline, title, desc, and all <svg> attributes). SVG bodies are passed through replaceIDs so internal IDs (clipPath, mask, gradient defs) are unique per render — preventing collisions when the same icon appears more than once on a page.

  Breaking changes:

  • Remove astro-icon from your package.json and astro.config.ts
  • Replace import { Icon } from "astro-icon/components" with import Icon from "@cloudflare/nimbus-docs/components/Icon.astro"
  • SVG output structure changed: SVGs are always inlined; the previous <symbol>/<use> pattern produced duplicate DOM IDs when the same icon was used more than once on a page, so it has been removed. Any CSS or JS targeting symbol or use elements will need updating.

  Migration:

  - import { Icon } from "astro-icon/components";
  + import Icon from "@cloudflare/nimbus-docs/components/Icon.astro";

  Starter templates updated: removed astro-icon dependency and icon() integration from astro.config.ts; all component imports updated to the new path.

Patch Changes

• #77 1c49268 Thanks @​MohamedH1998! - Fix NimbusHead emitting base-less SEO URLs on sub-path deployments (e.g. base: '/docs').

  new URL(path, Astro.site) resolves against the origin only and drops the configured base, so the rel=sitemap link, the LLM-index rel=alternate, og:image/twitter:image, the JSON-LD isPartOf.url, the versioned canonical, and the cross-version rel=alternate all pointed at the origin root and 404'd under a sub-path. Every internal path handed to new URL(..., Astro.site) is now base-prefixed via a withBase helper, matching the existing BASE_URL handling for the favicon and Shiki stylesheet.

  Root deployments (base: '/') are unaffected: the helper is a no-op when no base is configured, and already-based paths pass through unchanged (idempotent).

• #80 ec71a7b Thanks @​MohamedH1998! - Fix syntax-highlighted code rendering uncoloured in dev on sites with a non-root base (e.g. base: "/docs"). The dev middleware that serves _nimbus/shiki.css compared the request path exactly against the based asset path, but Vite strips base from req.url at a non-root base, so the request 404'd and tokens fell back to their inherited colour. It now matches by suffix, serving the stylesheet regardless of how Vite presents base. Production was unaffected — the stylesheet is written statically at build time.

Changelog

Sourced from @​cloudflare/nimbus-docs's changelog.

0.11.0

Minor Changes

• #86 b4b0dc3 Thanks @​MohamedH1998! - makeDisclosure now marks closed content inert so collapsed regions leave the tab order, keeping keyboard focus out of hidden disclosure panels. Add a manageInert option (default true) to opt out for consumers that manage their own focus.

• #90 74702e0 Thanks @​mvvmm! - getDocsStaticPaths and getCollectionStaticPaths now include a cacheKey (derived from the entry's digest) on each returned path. This enables Astro's experimental incremental build cache to skip re-rendering unchanged pages. No-op when experimental.incrementalBuild is not enabled in astro.config.ts.

Patch Changes

• #95 79a8448 Thanks @​mvvmm! - Bump nanoid to 3.3.18 to resolve GHSA-2v37-7h3g-55p8 (CVE-2026-67213): custom generators can loop indefinitely when size is zero.

0.10.0

Minor Changes

• #71 e5d74f9 Thanks @​MohamedH1998! - Enable MDX optimization by default to reduce large-site build memory usage. Sites can opt out with mdx: { optimize: false }.

  Verified the generated starter with optimization on and with mdx: { optimize: false } forced; the rendered HTML is structurally equivalent for element names, attributes, and non-whitespace text. AC#3 is treated as semantic/structural render parity rather than byte identity: raw bytes differ due to serializer escaping and inter-block whitespace, but the rendered document is lossless.

  Spot-checked the starter components page, which includes JSX tags in prose, inline code with <...>, quoted code, and package names. The optimized and opt-out renders preserve those special-character text probes and match structurally.

  Constrain the supported Astro peer range to >=7.0.0 <7.1.0 || >=7.2.0 <8.0.0: the 7.1.x line is excluded while its static-build regression is open upstream, but 7.2.x is admitted (verified against a sub-path build). Generated templates and the dev pin stay on the verified 7.0.x line.

• #76 acfac20 Thanks @​mvvmm! - Replace astro-icon with a built-in icon system. This is a breaking change for any project using astro-icon directly.

  Why: astro-icon stamped a generated lastModified timestamp into its virtual module on every build, invalidating thousands of cached pages in Astro's incremental build cache. The package is unmaintained so an upstream fix isn't coming.

  What's new: Nimbus now provides virtual:nimbus/icons (a Vite plugin) and @cloudflare/nimbus-docs/components/Icon.astro. The plugin auto-detects installed @iconify-json/* packages and loads local SVGs from src/icons/. The component API is compatible with astro-icon (name, size, width, height, is:inline, title, desc, and all <svg> attributes). SVG bodies are passed through replaceIDs so internal IDs (clipPath, mask, gradient defs) are unique per render — preventing collisions when the same icon appears more than once on a page.

  Breaking changes:

  • Remove astro-icon from your package.json and astro.config.ts
  • Replace import { Icon } from "astro-icon/components" with import Icon from "@cloudflare/nimbus-docs/components/Icon.astro"
  • SVG output structure changed: SVGs are always inlined; the previous <symbol>/<use> pattern produced duplicate DOM IDs when the same icon was used more than once on a page, so it has been removed. Any CSS or JS targeting symbol or use elements will need updating.

  Migration:

  - import { Icon } from "astro-icon/components";
  + import Icon from "@cloudflare/nimbus-docs/components/Icon.astro";

  Starter templates updated: removed astro-icon dependency and icon() integration from astro.config.ts; all component imports updated to the new path.

Patch Changes

• #77 1c49268 Thanks @​MohamedH1998! - Fix NimbusHead emitting base-less SEO URLs on sub-path deployments (e.g. base: '/docs').

  new URL(path, Astro.site) resolves against the origin only and drops the configured base, so the rel=sitemap link, the LLM-index rel=alternate, og:image/twitter:image, the JSON-LD isPartOf.url, the versioned canonical, and the cross-version rel=alternate all pointed at the origin root and 404'd under a sub-path. Every internal path handed to new URL(..., Astro.site) is now base-prefixed via a withBase helper, matching the existing BASE_URL handling for the favicon and Shiki stylesheet.

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	kxen	c7e5574	Sep 01 2026, 10:01 PM