deps(deps): Bump fuse.js from 7.2.0 to 7.4.1

[dependabot]

Bumps fuse.js from 7.2.0 to 7.4.1.

Release notes

Sourced from fuse.js's releases.

v7.4.1

Bug Fixes

• types: ship TypeScript declarations for fuse.js/worker (572ad1e), closes #828
• types: add TypeScript declarations for fuse.js/worker-script (6ef6c33), closes #828

Both worker subpaths now resolve types under node16/nodenext and bundler module resolution.

v7.4.0

First stable on the 7.4 line. Aggregates everything from the 7.4.0-beta.1 → 7.4.0-beta.8 cycle. See CHANGELOG.md for the per-beta breakdown.

Features

• FuseWorker — parallel search via Web Workers (9ba192c). New FuseWorker class shards the collection across workers, runs searches in parallel, and preserves the same result ordering as Fuse. See the Web Workers guide.
• token-search: tokenMatch: 'all' | 'any' option for AND/OR semantics (#827, 9f979d0). Default 'any' preserves existing behavior; 'all' requires every query word to match somewhere in a record (term-centric AND), useful for filter-style queries.
• token-search: customizable tokenizer with unicode-aware default (#821, 8e55cae). New tokenize?: RegExp | (text: string) => string[] option; the default regex now segments CJK, Cyrillic, Greek, Arabic, etc. out of the box.

Bug Fixes

• matches: report array-path keys as dotted strings (acd54e8). Previously match.key leaked a raw string[] for keys declared as path arrays (e.g. keys: [['author', 'firstName']]), contradicting the documented FuseResultMatch.key: string type. Now emits the canonical dotted string ('author.firstName'). Behavior change: consumers relying on the array shape need to update.
• bitap: restrict highlight indices to matched window (#792, 622f105). Closes #505, #611, #691, #793.
• index: correct doc-index alignment for Fuse<string> with blank docs (0b8e3ca).
• core: invalidate searcher cache on collection mutation (fcf4228).
• token-search: renumber inverted index after doc removal (ea9356d).
• workers: preserve global refIndex across shards (e4217f9), match Fuse ordering and reject non-cloneable options (d571390), reject useTokenSearch in FuseWorker (8c6183d).
• match: explicitly reject useTokenSearch in Fuse.match (3959d91).
• correct fieldCount accounting and add reverse lookup in inverted index (54e702c).
• guard against empty-string crash in fieldNorm (e550ab1); skip consecutive spaces in fieldNorm word counting (5929af6).
• types: resolve typecheck errors and align KeyStore types (dbc115d).
• docs: reflect data edits in playground demo (#825, 6eff909).

Performance

• reuse bit arrays in Bitap search instead of allocating per error level (ec9b446)
• replace forEach with for loops in search hot paths (1945f49)
• fast-path Math.pow when exponent is 1 in computeScore (c82de57)
• pre-allocate records array and use for loops in FuseIndex.create (5800036)
• replace regex with loop for word counting in fieldNorm (5517a9b)
• use filter instead of reverse-splice in removeAll / remove (c74823b, 8372b0a)
• token-search: drop unused postings from inverted index (5ea216f)

Internal

• refactor: replace extended-search matcher classes with plain functions (f8d61c9)
• bench: consolidate benchmark/ into bench/ and add npm scripts (3b3a4c6)
• ci: update Node matrix to 20, 22, 24 (b906906)
• chore(deps): pin secure versions via npm overrides (3a1b118)

Docs

... (truncated)

Changelog

Sourced from fuse.js's changelog.

7.4.1 (2026-06-02)

Bug Fixes

• types: add TypeScript declarations for fuse.js/worker-script (6ef6c33), closes #828
• types: ship TypeScript declarations for fuse.js/worker (572ad1e), closes #828

7.4.0 (2026-05-30)

7.4.0-beta.8 (2026-05-25)

Bug Fixes

• matches: report array-path keys as dotted strings (acd54e8)

7.4.0-beta.7 (2026-05-22)

Features

• token-search: add tokenMatch 'all' | 'any' for AND/OR (#827) (9f979d0)

Bug Fixes

• docs: reflect data edits in playground demo (#825) (6eff909)

7.4.0-beta.6 (2026-05-14)

Bug Fixes

• bitap: restrict highlight indices to matched window (622f105), closes #792 #505 #611 #691 #793

7.4.0-beta.5 (2026-05-10)

Features

• token-search: add customizable tokenizer with unicode-aware default (8e55cae), closes #821

Bug Fixes

• index: correct doc-index alignment for Fuse with blank docs (0b8e3ca)

7.4.0-beta.4 (2026-04-28)

... (truncated)

Commits

• ce75998 chore(release): 7.4.1
• e842baf test(types): guard that every exports subpath resolves to declarations
• 6ef6c33 fix(types): add TypeScript declarations for fuse.js/worker-script
• ef3e96d refactor(workers): type workerUrl as string | URL
• 572ad1e fix(types): ship TypeScript declarations for fuse.js/worker
• 0db224b chore: ignore .antigravitycli/
• 6f40ee5 docs(site): show current version in navbar
• c83a9c2 docs: drop stale TOKEN_SEARCH.md, link README to fusejs.io/token-search
• 7e16249 docs: drop beta callouts after 7.4.0 stable release
• b576446 chore: bump doc versions to 7.4.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Summary by cubic

Upgrade fuse.js from 7.2.0 to 7.4.1 to pick up performance improvements, bug fixes, and optional Web Worker support. No app code changes included.

• Dependencies

  • fuse.js: 7.2.0 → 7.4.1

• Migration

  • results[].matches[].key now returns a dotted string for array-path keys (not a string[]). Update any type checks/parsing.
  • Highlight indices are restricted to the matched window. Verify any custom highlighter logic.

^{Written for commit f5d8937. Summary will update on new commits.}

Note

Bump fuse.js dependency from 7.2.0 to 7.4.1

Updates the fuse.js version constraint in package.json from ^7.2.0 to ^7.4.1 and refreshes the lockfile accordingly.

^{Macroscope summarized f5d8937.}

[dependabot]

Labels

The following labels could not be found: bun. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 1 package(s) with unknown licenses.

See the Details below.

License Issues

package.json

Package	Version	License	Issue Type
fuse.js	^7.4.1	Null	Unknown License

Allowed Licenses:

MIT, ISC, Apache-2.0, BSD-2-Clause, BSD-3-Clause, 0BSD, CC0-1.0, CC-BY-3.0, CC-BY-4.0, Unlicense, Python-2.0, BlueOak-1.0.0, Artistic-2.0, Zlib, MPL-2.0

OpenSSF Scorecard

Package	Version	Score	Details
npm/fuse.js	^7.4.1	Unknown	Unknown

Scanned Files

• package.json

[dependabot]

Superseded by #61.