deps(deps): Bump fuse.js from 7.2.0 to 7.4.2

[dependabot]

Bumps fuse.js from 7.2.0 to 7.4.2.

Release notes

Sourced from fuse.js's releases.

v7.4.2

Bug Fixes

• types: ship CommonJS type declarations (.d.cts) so consumers on moduleResolution: node16/nodenext no longer hit TS1479 ("masquerading as ESM") when importing the package from a CommonJS project. The lib entries now resolve to a runtime-accurate export = declaration and the worker to its named declaration, via the require exports condition. (#780)

Full Changelog: krisk/Fuse@v7.4.1...v7.4.2

v7.4.1

Bug Fixes

• types: ship TypeScript declarations for fuse.js/worker (572ad1e), closes #828
• types: add TypeScript declarations for fuse.js/worker-script (6ef6c33), closes #828

Both worker subpaths now resolve types under node16/nodenext and bundler module resolution.

v7.4.0

First stable on the 7.4 line. Aggregates everything from the 7.4.0-beta.1 → 7.4.0-beta.8 cycle. See CHANGELOG.md for the per-beta breakdown.

Features

• FuseWorker — parallel search via Web Workers (9ba192c). New FuseWorker class shards the collection across workers, runs searches in parallel, and preserves the same result ordering as Fuse. See the Web Workers guide.
• token-search: tokenMatch: 'all' | 'any' option for AND/OR semantics (#827, 9f979d0). Default 'any' preserves existing behavior; 'all' requires every query word to match somewhere in a record (term-centric AND), useful for filter-style queries.
• token-search: customizable tokenizer with unicode-aware default (#821, 8e55cae). New tokenize?: RegExp | (text: string) => string[] option; the default regex now segments CJK, Cyrillic, Greek, Arabic, etc. out of the box.

Bug Fixes

• matches: report array-path keys as dotted strings (acd54e8). Previously match.key leaked a raw string[] for keys declared as path arrays (e.g. keys: [['author', 'firstName']]), contradicting the documented FuseResultMatch.key: string type. Now emits the canonical dotted string ('author.firstName'). Behavior change: consumers relying on the array shape need to update.
• bitap: restrict highlight indices to matched window (#792, 622f105). Closes #505, #611, #691, #793.
• index: correct doc-index alignment for Fuse<string> with blank docs (0b8e3ca).
• core: invalidate searcher cache on collection mutation (fcf4228).
• token-search: renumber inverted index after doc removal (ea9356d).
• workers: preserve global refIndex across shards (e4217f9), match Fuse ordering and reject non-cloneable options (d571390), reject useTokenSearch in FuseWorker (8c6183d).
• match: explicitly reject useTokenSearch in Fuse.match (3959d91).
• correct fieldCount accounting and add reverse lookup in inverted index (54e702c).
• guard against empty-string crash in fieldNorm (e550ab1); skip consecutive spaces in fieldNorm word counting (5929af6).
• types: resolve typecheck errors and align KeyStore types (dbc115d).
• docs: reflect data edits in playground demo (#825, 6eff909).

Performance

• reuse bit arrays in Bitap search instead of allocating per error level (ec9b446)
• replace forEach with for loops in search hot paths (1945f49)
• fast-path Math.pow when exponent is 1 in computeScore (c82de57)
• pre-allocate records array and use for loops in FuseIndex.create (5800036)
• replace regex with loop for word counting in fieldNorm (5517a9b)
• use filter instead of reverse-splice in removeAll / remove (c74823b, 8372b0a)
• token-search: drop unused postings from inverted index (5ea216f)

Internal

... (truncated)

Changelog

Sourced from fuse.js's changelog.

7.4.2 (2026-06-05)

Bug Fixes

• types: emit CommonJS declarations (.d.cts) for node16/nodenext (#780) (33f5d29)

7.4.1 (2026-06-02)

Bug Fixes

• types: add TypeScript declarations for fuse.js/worker-script (6ef6c33), closes #828
• types: ship TypeScript declarations for fuse.js/worker (572ad1e), closes #828

7.4.0 (2026-05-30)

7.4.0-beta.8 (2026-05-25)

Bug Fixes

• matches: report array-path keys as dotted strings (acd54e8)

7.4.0-beta.7 (2026-05-22)

Features

• token-search: add tokenMatch 'all' | 'any' for AND/OR (#827) (9f979d0)

Bug Fixes

• docs: reflect data edits in playground demo (#825) (6eff909)

7.4.0-beta.6 (2026-05-14)

Bug Fixes

• bitap: restrict highlight indices to matched window (622f105), closes #792 #505 #611 #691 #793

7.4.0-beta.5 (2026-05-10)

Features

• token-search: add customizable tokenizer with unicode-aware default (8e55cae), closes #821

... (truncated)

Commits

• 9e63058 chore(release): 7.4.2
• 33f5d29 fix(types): emit CommonJS declarations (.d.cts) for node16/nodenext (#780)
• 7c6af4e build: replace rollup/babel/terser build with tsdown
• 50f6b24 chore(deps): pin fast-uri to ^3.1.2 via overrides
• 9e6ec22 chore(build): exit non-zero when a build step fails
• ff51f6b chore: source docs version from package.json, not npm view
• 08b77d9 chore: bump doc versions to 7.4.1
• ce75998 chore(release): 7.4.1
• e842baf test(types): guard that every exports subpath resolves to declarations
• 6ef6c33 fix(types): add TypeScript declarations for fuse.js/worker-script
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Summary by cubic

Upgrade fuse.js from 7.2.0 to 7.4.2 to bring Web Worker search (FuseWorker), improved token search (tokenMatch, customizable tokenize), performance gains, and TypeScript fixes. No app code changes in this PR.

• Migration
  • If you read match.key for keys declared as path arrays, it now returns a dotted string (e.g., author.firstName).
  • TypeScript CJS projects using node16/nodenext resolve cleanly via .d.cts; no action needed.

^{Written for commit eb31fe7. Summary will update on new commits.}

Note

Bump fuse.js from 7.2.0 to 7.4.2

Updates the fuse.js dependency in package.json from ^7.2.0 to ^7.4.2 and refreshes the lockfile entry with the new integrity hash.

^{Macroscope summarized eb31fe7.}

[dependabot]

Labels

The following labels could not be found: bun. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 1 package(s) with unknown licenses.

See the Details below.

License Issues

package.json

Package	Version	License	Issue Type
fuse.js	^7.4.2	Null	Unknown License

Allowed Licenses:

MIT, ISC, Apache-2.0, BSD-2-Clause, BSD-3-Clause, 0BSD, CC0-1.0, CC-BY-3.0, CC-BY-4.0, Unlicense, Python-2.0, BlueOak-1.0.0, Artistic-2.0, Zlib, MPL-2.0

OpenSSF Scorecard

Package	Version	Score	Details
npm/fuse.js	^7.4.2	Unknown	Unknown

Scanned Files

• package.json