chore(deps): bump the npm group across 1 directory with 5 updates

[dependabot]

Bumps the npm group with 5 updates in the /ui directory:

Package	From	To
@cccsaurora/clue-ui	1.2.8	1.3.0
dompurify	3.4.11	3.4.12
fuse.js	7.4.2	7.5.0
msw	2.14.6	2.15.0
prettier	3.9.4	3.9.5

Updates @cccsaurora/clue-ui from 1.2.8 to 1.3.0

Release notes

Sourced from @​cccsaurora/clue-ui's releases.

Clue UI v1.3.0

• Clue UI Plugins (new feature): Added support for UI plugins, including a route for testing plugin integrations (#73, #79).
• Data Replication (new feature): Added replication and local storage support for synchronizing Clue data (#47).
• Action Failure Handling (bugfix): Actions now stop executing after a failure instead of continuing unexpectedly (#62).
• Pending Request Handling (bugfix): Fixed duplicate pending requests (#74).
• Dashboard and Database Stability (bugfix): Fixed dashboard display issues and database warnings (#69, #71).
• Telemetry Value Handling (bugfix): Corrected handling of telemetry selector values.
• Query Links and Email Layout (improvement): Query links now target their associated verdict documents, and email rendering no longer overflows (#60).
• Dependency Updates (technical update): Updated UI dependencies, including Vite and picomatch.

Clue API 1.3.0

Features

• Added extension initialization support via init module hooks
• Added custom type registration system with add_supported_type() function
  • Supports custom types with regex validation
  • Supports namespaced types
  • Supports case-insensitive type handling
• Added asynchronous action support
  • New /actions/<plugin_id>/<action_id>/status/<task_id> endpoint for checking action status
  • Added async_result flag for actions
  • Added "pending" outcome status for ActionResult
  • Added ActionContextInformation model for contextual action execution
• Added TESTING environment variable for improved test environment detection
• Added DISABLE_CACHE environment variable to disable caching when needed
• Normalized selector values to lowercase (except telemetry type) for consistent matching
• Added logging for number of configured types including custom types

Improvements

• Improved error logging in cache operations
• Enhanced app discovery with better error handling and timeout support
• Added timeout parameter to discovery HTTP requests
• Renamed "plugins" to "extensions" throughout the codebase
  • Environment variable CLUE_PLUGIN_DIRECTORY deprecated in favor of CLUE_EXTENSION_PATH (backward compatible with deprecation warning)
  • Extension path now defaults to /etc/clue/extensions
• Migrated from clue.patched to clue.app module for application entry point
• Replaced geventhttpclient with requests library for HTTP operations

Bug Fixes

• Fixed cache error logging message (was "Error on retrieval", now correctly "Error on cache set")
• Improved test environment detection using TESTING flag

Documentation

• Added French README translation
• Updated CI/CD workflow to trigger on develop branch

Commits

• See full diff in compare view

Updates dompurify from 3.4.11 to 3.4.12

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.12

• Fixed an issue where a hook would not get called for custom elements, thanks @​Rikuxx0
• Hardened the handling of hooks removing elements, @​mkrause-bee360
• Added support for a few new SVG attributes, thanks @​cbn-falias & @​Develop-KIM
• Hardened the handling of declarative partial updates
• Updated the documentation is several spots, README, wiki, etc.
• Bumped several dependencies where possible

Commits

• a9ca1e5 release: 3.4.12 (#1537)
• See full diff in compare view

Updates fuse.js from 7.4.2 to 7.5.0

Release notes

Sourced from fuse.js's releases.

v7.5.0

⚠️ Behavior changes

Every change in this release is a bug fix, but each one corrects a scoring or ranking bug. Scores and result ordering will shift for some queries. That is why this ships as a minor rather than a patch: the public API is unchanged and upgrading is a drop-in, but the results you get back can differ, and that should not arrive silently in a patch bump.

If you assert on exact score values or on a specific result order, expect those assertions to need updating. Re-baseline them against 7.5.0 rather than pinning to 7.4.x, since the 7.4.x behavior was wrong in the cases below.

• Field-length normalisation now counts words correctly. Tabs and newlines were not treated as word separators, so a multi-line or tab-delimited field was scored as though it were one long word, making it look far shorter than it is. Fields containing \t, \n, or \r now score differently (#830).
• Key weights are now normalised in object and keyless-logical search. Weights that did not sum to 1 were applied unnormalised, skewing the relative influence of each key. If your keys weights do not already sum to 1, your relative ranking changes (#833).
• limit now returns the correct top-N when scores tie. A tie at the cutoff boundary could evict a result that should have been kept, so limit could return the wrong items, not merely the right items in a different order (#835).
• Bitap respects minMatchCharLength in the exact-match shortcut. Matches shorter than minMatchCharLength were still reported via the exact-match fast path, so the matches array could contain entries it was configured to exclude (#831).

Bug Fixes

• bitap: respect minMatchCharLength in exact-match shortcut (dbb98b6), closes #831
• fieldNorm: count tabs and newlines as word separators (6fe85b0), closes #830
• fieldNorm: count word-starts instead of space transitions (2946f97)
• scoring: normalise key weights in object and keyless-logical search (e164b61), closes #833
• search: keep the correct top-N under limit when scores tie (437f8f3), closes #835, thanks @​spokodev for the report and the fix

Full Changelog: krisk/Fuse@v7.4.2...v7.5.0

Changelog

Sourced from fuse.js's changelog.

7.5.0 (2026-07-13)

⚠️ Behavior changes

Every change in this release is a bug fix, but each one corrects a scoring or ranking bug. Scores and result ordering will shift for some queries. That is why this ships as a minor rather than a patch: the public API is unchanged and upgrading is a drop-in, but the results you get back can differ, and that should not arrive silently in a patch bump.

If you assert on exact score values or on a specific result order, expect those assertions to need updating. Re-baseline them against 7.5.0 rather than pinning to 7.4.x, since the 7.4.x behavior was wrong in the cases below.

• Field-length normalisation now counts words correctly. Tabs and newlines were not treated as word separators, so a multi-line or tab-delimited field was scored as though it were one long word, making it look far shorter than it is. Fields containing \t, \n, or \r now score differently (#830).
• Key weights are now normalised in object and keyless-logical search. Weights that did not sum to 1 were applied unnormalised, skewing the relative influence of each key. If your keys weights do not already sum to 1, your relative ranking changes (#833).
• limit now returns the correct top-N when scores tie. A tie at the cutoff boundary could evict a result that should have been kept, so limit could return the wrong items, not merely the right items in a different order (#835).
• Bitap respects minMatchCharLength in the exact-match shortcut. Matches shorter than minMatchCharLength were still reported via the exact-match fast path, so the matches array could contain entries it was configured to exclude (#831).

Bug Fixes

• bitap: respect minMatchCharLength in exact-match shortcut (dbb98b6), closes #831
• fieldNorm: count tabs and newlines as word separators (6fe85b0), closes #830
• fieldNorm: count word-starts instead of space transitions (2946f97)
• scoring: normalise key weights in object and keyless-logical search (e164b61), closes #833
• search: keep the correct top-N under limit when scores tie (437f8f3), closes #835, thanks @​spokodev for the report and the fix

Commits

• 45bac9f chore(release): 7.5.0
• 437f8f3 fix(search): keep the correct top-N under limit when scores tie
• b8142cf test(fieldNorm): cover full separator set; narrow "any whitespace" comment
• 6fe85b0 fix(fieldNorm): count tabs and newlines as word separators
• e164b61 fix(scoring): normalise key weights in object and keyless-logical search
• dbb98b6 fix(bitap): respect minMatchCharLength in exact-match shortcut
• e2ee793 chore: rebuild dist for #830 (fieldNorm whitespace fix)
• 2946f97 fix(fieldNorm): count word-starts instead of space transitions
• 2fadbfa chore: bump doc versions to 7.4.2
• See full diff in compare view

Updates msw from 2.14.6 to 2.15.0

Release notes

Sourced from msw's releases.

v2.15.0 (2026-07-08)

Features

• sse: invoke finalize on response stream end (#2741) (7fae0cc0954b20c739ae8e95a24eefc8a78710e8) @​kettanaito

v2.14.7 (2026-07-07)

Bug Fixes

• sse: proper logging for concurrent requests (#2762) (5c0ae1c334a0cbe52638bd2949540372be3d46ba) @​kettanaito

Commits

• 49d9d47 chore(release): v2.15.0
• ed88583 test(finalize): use expect.poll vs waitFor
• 7fae0cc feat(sse): invoke finalize on response stream end (#2741)
• db818ee chore(release): v2.14.7
• 418854a chore: upgrade @ossjs/release
• 5c0ae1c fix(sse): proper logging for concurrent requests (#2762)
• 3016bda test: fix flaky ws.clients.browser.test.ts
• 0df6d6a test: fix flaky in-flight-request.test.ts
• ff6836b chore: pin github actions to commit sha, update pnpm (#2761)
• 8a19d54 chore: improve github actions security (#2747)
• Additional commits viewable in compare view

Updates prettier from 3.9.4 to 3.9.5

Release notes

Sourced from prettier's releases.

3.9.5

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.5

diff

Markdown: Cap ordered list mark at 999,999,999 (#19351 by @​tats-u)

CommonMark parsers only support ordered list item numbers up to 999,999,999.

With this change, Prettier now caps the ordered list item number at 999,999,999 to ensure that the output is correctly parsed as an ordered list by CommonMark parsers. Numbers larger than 999,999,999 are not parsed as list item numbers and are left unchanged in the output:

<!-- Input -->
999999998. text
999999998. text
999999998. text
999999998. text
1234567890123456789012) text
<!-- Prettier 3.9.4 -->
999999998. text
999999999. text
1000000000. text
1000000001. text
1234567890123456789012) text
<!-- Prettier 3.9.5 -->
999999998. text
999999999. text
999999999. text
999999999. text
1234567890123456789012) text

Markdown: Avoid corrupting empty link with title (#19487 by @​andersk)

Do not remove <> from an inline link or image with an empty URL and a title, as this removal would change its interpretation.

<!-- Input -->
[link](https://github.com/prettier/prettier/blob/main/<> "title")
<!-- Prettier 3.9.4 -->
[link](https://github.com/prettier/prettier/blob/main/ "title")
<!-- Prettier 3.9.5 -->
</tr></table>

... (truncated)

Commits

• b6c7d18 Release 3.9.5
• cd54ccc Avoid corrupting empty Markdown link with title (#19487)
• 2bb67ce Preserving comments' placement property (#19567)
• 91bcac8 Add more tests for comment-only object type (#19587)
• cbee737 Remove space in empty object type (#19583)
• 6394c73 Align empty module declaration with TS (#19568)
• a4e6f7a Prevent the addition of space in type() with + (#19516)
• 3d063b5 Ignore dangling comments when checking type parameter comments (#19572)
• 908503e Handle dangling comments in SwitchStatement (#19581)
• 943a475 Angular: Support expression for exhaustive typechecking (#19571)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	30.31%	9657 / 31858
🔵	Statements	30.31%	9657 / 31858
🔵	Functions	46.17%	404 / 875
🔵	Branches	78.95%	2030 / 2571

File Coverage

No changed files found.

Generated in workflow #1257 for commit 9ee4bb4 by the Vitest Coverage Report Action