build(deps): bump the npm-root group with 5 updates

[dependabot]

Bumps the npm-root group with 5 updates:

Package	From	To
fast-glob	3.3.1	3.3.3
pagefind	1.4.0	1.5.0
picomatch	2.3.2	4.0.4
vite	8.0.3	8.0.5
zod	3.25.76	4.3.6

Updates fast-glob from 3.3.1 to 3.3.3

Release notes

Sourced from fast-glob's releases.

3.3.3

Full Changelog: mrmlnc/fast-glob@3.3.2...3.3.3

💬 Common

• Refer to micromatch@4.0.8 to avoid annoying npm audit spam (#443, #444, #454, #456, #457, #461)

🐛 Bug fixes

• Apply absolute negative patterns to full path instead of file path (#441, thanks @​webpro)

3.3.2

Full Changelog: mrmlnc/fast-glob@3.3.1...3.3.2

🐛 Bug fixes

• Handle square brackets as a special character on Windows in escape functions (#425)
• Keep escaping after brace expansion (#422)

Commits

• 4868789 3.3.3
• 73be367 Merge pull request #464 from mrmlnc/3.3.3
• 55c7b33 perf: optimizing the patterns set matching by exiting early
• ea113fd docs: add information about enumerable properties for the fs option
• 41e4730 fix: apply absolute negative patterns to full path instead of file path
• 54ad12d build: fix watch command
• 7410547 chore: refer to micromatch@4.0.8 to avoid annoying npm audit spam
• ca61085 build: freeze fdir dependency to avoid tsc issues
• e60a9f5 3.3.2
• 8638dc6 fix: escape square braces on Windows platform
• Additional commits viewable in compare view

Updates pagefind from 1.4.0 to 1.5.0

Release notes

Sourced from pagefind's releases.

v1.5.0

Hey! This is a big one. Pagefind 1.5.0 has been fermenting for a while, and addresses a lot of long-standing issues and feature requests. This release brings an entirely new search UI built on web components, major improvements to search relevance and ranking, diacritics support, automatic CJK segmentation, Web Worker search, notably smaller indexes, and a much faster indexing binary. Enormous thanks to everyone who contributed features and fixes, as well as to everyone who tested the beta releases and provided feedback ❤️ - @​bglw

If you only read this far, I should mention up front: The existing Default UI and Modular UI remain available and supported for now, so you can upgrade your sites to Pagefind v1.5.0 without migrating to the Component UI.

Pagefind Component UI

Pagefind ships a brand new UI system built entirely on web components. The Component UI gives you searchboxes, modals, result lists, and filter controls as composable <pagefind-*> elements that you can mix, match, and style with CSS variables.

The Component UI is available as vendored files in your /pagefind/ output directory, or as an npm package to install and import.

The best way to get a feel for the new components is on the 📘 Pagefind Component UI page of the docs, where interactive examples of various components are shown.

Extra goodies with the Component UI:

• Greatly improved accessibility over the Default UI
• Keyboard navigation through search results
• Configurable keyboard shortcuts (thanks @​miketheman !)
• Full custom templates for rendering results and placeholders
• Exported types for Component UI npm consumers (thanks @​vanruesc !)
• Support for multiple scoped Pagefind instances on one page
• A range of CSS variables available for light-touch customization (thanks @​miketheman for some of these!)
• Improved RTL and locale-specific rendering

Search Relevance, and Searching Metadata

Pagefind now searches metadata by default! Importantly, this means it now searches the title metadata. Matches in titles are now taken into account, and search results are very hard to shake from prime positions if all (or much) of the title matches the search query.

You can configure the weight of any metadata field. See 📘 Configuring Metadata Weights to change the title boost or apply custom weights to your own metadata fields.

Beyond metadata searching, a bunch of weird and wonderful ranking bugs were resolved:

• Metadata-only matches now return results. Previously, if a page matched the search query only in its metadata (e.g. the title) but not in the body content, it would be missed. These pages now correctly appear in results.
• Word splitting and indexing was revisited to properly handle diacritics, stemming, and compound words together. This fixes a broad set of edge cases where compound word parts weren't indexed correctly.
• Loading index chunks now correctly uses stemmed terms. This was a discrepancy in how chunks were identified, and could cause some hard to pin down issues where the wrong chunk would be loaded for a search term, leaving you with no (or fewer) results.
• A couple of pathways left you with only the first matching chunk loaded, which would also give you fewer results. Words that straddle multiple chunks now behave better.
• Fancy-pants unicode characters in words could really mess up the chunk loading, which has been fixed.

Diacritics Support

We finally properly support matching across diacritics. You can now find your cafés without remembering how to type é.

By default, exact diacritic matches are preferred. So if you're searching "cafe", pages with "cafe" will rank higher than pages with "café". Getting this relevance right by default was the final piece of the puzzle for shipping this, which is why it took a while to land. See 📘 Configuring Diacritic Similarity to adjust how this plays out on your site.

If you need strict matching, set exactDiacritics: true to disable normalization entirely — "cafe" will only match "cafe", and "café" will only match "café". 📘 Exact Diacritics

Multilingual Improvements

Thanks browsers! Pagefind now taps into Intl.Segmenter to chop search queries in CJK (Chinese, Japanese, Korean) non-whitespace-delimited languages. This was already done during indexing by Pagefind, but users searching still had to delimit their queries. Now searching "这是一段简单的测试文本" searches for the words "这", "是", "一段", "简单", "的", "测试", and "文本", which is also how that sentence was indexed.

... (truncated)

Changelog

Sourced from pagefind's changelog.

v1.5.0 (April 6, 2026)

Hey! This is a big one. Pagefind 1.5.0 has been fermenting for a while, and addresses a lot of long-standing issues and feature requests. This release brings an entirely new search UI built on web components, major improvements to search relevance and ranking, diacritics support, automatic CJK segmentation, Web Worker search, notably smaller indexes, and a much faster indexing binary. Enormous thanks to everyone who contributed features and fixes, as well as to everyone who tested the beta releases and provided feedback ❤️ - @​bglw

If you only read this far, I should mention up front: The existing Default UI and Modular UI remain available and supported for now, so you can upgrade your sites to Pagefind v1.5.0 without migrating to the Component UI.

Pagefind Component UI

Pagefind ships a brand new UI system built entirely on web components. The Component UI gives you searchboxes, modals, result lists, and filter controls as composable <pagefind-*> elements that you can mix, match, and style with CSS variables.

The Component UI is available as vendored files in your /pagefind/ output directory, or as an npm package to install and import.

The best way to get a feel for the new components is on the 📘 Pagefind Component UI page of the docs, where interactive examples of various components are shown.

Extra goodies with the Component UI:

• Greatly improved accessibility over the Default UI
• Keyboard navigation through search results
• Configurable keyboard shortcuts (thanks @​miketheman !)
• Full custom templates for rendering results and placeholders
• Exported types for Component UI npm consumers (thanks @​vanruesc !)
• Support for multiple scoped Pagefind instances on one page
• A range of CSS variables available for light-touch customization (thanks @​miketheman for some of these!)
• Improved RTL and locale-specific rendering

Search Relevance, and Searching Metadata

Pagefind now searches metadata by default! Importantly, this means it now searches the title metadata. Matches in titles are now taken into account, and search results are very hard to shake from prime positions if all (or much) of the title matches the search query.

You can configure the weight of any metadata field. See 📘 Configuring Metadata Weights to change the title boost or apply custom weights to your own metadata fields.

Beyond metadata searching, a bunch of weird and wonderful ranking bugs were resolved:

• Metadata-only matches now return results. Previously, if a page matched the search query only in its metadata (e.g. the title) but not in the body content, it would be missed. These pages now correctly appear in results.
• Word splitting and indexing was revisited to properly handle diacritics, stemming, and compound words together. This fixes a broad set of edge cases where compound word parts weren't indexed correctly.
• Loading index chunks now correctly uses stemmed terms. This was a discrepancy in how chunks were identified, and could cause some hard to pin down issues where the wrong chunk would be loaded for a search term, leaving you with no (or fewer) results.
• A couple of pathways left you with only the first matching chunk loaded, which would also give you fewer results. Words that straddle multiple chunks now behave better.
• Fancy-pants unicode characters in words could really mess up the chunk loading, which has been fixed.

Diacritics Support

We finally properly support matching across diacritics. You can now find your cafés without remembering how to type é.

By default, exact diacritic matches are preferred. So if you're searching "cafe", pages with "cafe" will rank higher than pages with "café". Getting this relevance right by default was the final piece of the puzzle for shipping this, which is why it took a while to land. See 📘 Configuring Diacritic Similarity to adjust how this plays out on your site.

If you need strict matching, set exactDiacritics: true to disable normalization entirely — "cafe" will only match "cafe", and "café" will only match "café". 📘 Exact Diacritics

Multilingual Improvements

Thanks browsers! Pagefind now taps into Intl.Segmenter to chop search queries in CJK (Chinese, Japanese, Korean) non-whitespace-delimited languages. This was already done during indexing by Pagefind, but users searching still had to delimit their queries. Now searching "这是一段简单的测试文本" searches for the words "这", "是", "一段", "简单", "的", "测试", and "文本", which is also how that sentence was indexed.

... (truncated)

Commits

• 0c6d2fe Release tidy-ups (#1094)
• 162d756 v1.5.0 Changelog (#1093)
• d5973c2 A collection of docs fixes (#1092)
• 84a46ef Improve flaky keyboard shortcuts test (#1091)
• 883df72 Add highlightParam and exactDiacritics attributes to <pagefind-config> (#1090)
• 259ca49 Add plain_excerpt field to search results (#1089)
• 7347d5f Fix box-sizing for pseudo-elements in component UI (#1088)
• 23d03e5 Fix relative image URLs breaking in search results (#1087)
• 3bc1bd5 Add scoped instances to initialize properly separate configurations (#1085)
• 778c873 Improve RTL layouts in the component UI (#1086)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for pagefind since your current version.

Updates picomatch from 2.3.2 to 4.0.4

Release notes

Sourced from picomatch's releases.

4.0.4

This is a security release fixing several security relevant issues.

What's Changed

• Fix for CVE-2026-33671
• Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@4.0.3...4.0.4

4.0.3

What's Changed

• fix: exception when glob pattern contains constructor by @​Jason3S in micromatch/picomatch#144

New Contributors

• @​Jason3S made their first contribution in micromatch/picomatch#144

Full Changelog: micromatch/picomatch@4.0.2...4.0.3

3.0.2

This is a security release fixing several security relevant issues.

What's Changed

• fix: exception when glob pattern contains constructor by @​Jason3S in micromatch/picomatch#144
• Fix for CVE-2026-33671
• Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@3.0.1...3.0.2

Changelog

Sourced from picomatch's changelog.

Release history

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

• Changelogs are for humans, not machines.
• There should be an entry for every single version.
• The same types of changes should be grouped.
• Versions and sections should be linkable.
• The latest version comes first.
• The release date of each versions is displayed.
• Mention whether you follow Semantic Versioning.

Changelog entries are classified using the following labels (from keep-a-changelog):

• Added for new features.
• Changed for changes in existing functionality.
• Deprecated for soon-to-be removed features.
• Removed for now removed features.
• Fixed for any bug fixes.
• Security in case of vulnerabilities.

4.0.0 (2024-02-07)

Fixes

• Fix bad text values in parse #126, thanks to @​connor4312

Changed

• Remove process global to work outside of node #129, thanks to @​styfle
• Add sideEffects to package.json #128, thanks to @​frandiox
• Removed os, make compatible browser environment. See #124, thanks to @​gwsbhqt

3.0.1

Fixes

... (truncated)

Commits

• e5474fc Publish 4.0.4
• 4516eb5 Merge commit from fork
• 5eceecd Merge commit from fork
• 0db7dd7 Run benchmark again against latest minimatch version (#161)
• 9500377 docs: clarify what brace expansion syntax is and isn't supported (#134)
• 2661f23 fix typo in globstars.js test name (#138)
• 1798b07 docs: fix makeRe example (#143)
• 9d76bc5 chore: undocument removed options (#146)
• e4d718b Remove unused time-require (#160)
• 38dffeb chore(deps): pin dependencies (#158)
• Additional commits viewable in compare view

Updates vite from 8.0.3 to 8.0.5

Release notes

Sourced from vite's releases.

v8.0.5

Please refer to CHANGELOG.md for details.

v8.0.4

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.0.5 (2026-04-06)

Bug Fixes

• apply server.fs check to env transport (#22159) (f02d9fd)
• avoid path traversal with optimize deps sourcemap handler (#22161) (79f002f)
• check server.fs after stripping query as well (#22160) (a9a3df2)
• disallow referencing files outside the package from sourcemap (#22158) (f05f501)

8.0.4 (2026-04-06)

Features

• allow esbuild 0.28 as peer deps (#22155) (b0da973)
• hmr: truncate list of files on hmr update (#21535) (d00e806)
• optimizer: log when dependency scanning or bundling takes over 1s (#21797) (f61a1ab)

Bug Fixes

• hasBothRollupOptionsAndRolldownOptions should return false for proxy case (#22043) (99897d2)
• add types for vite/modulepreload-polyfill (#22126) (17330d2)
• deps: update all non-major dependencies (#22073) (6daa10f)
• deps: update all non-major dependencies (#22143) (22b0166)
• resolve: resolve tsconfig paths starting with # (#22038) (3460fc5)
• ssr: use browser platform for webworker SSR builds (fix #21969) (#21963) (364c227)

Documentation

• add environment.fetchModule documentation (#22035) (54229e7)

Miscellaneous Chores

• deps: update rolldown-related dependencies (#21989) (0ded627)

Code Refactoring

• upgrade to typescript 6 (#22110) (cc41398)

Commits

• 1a12d4c release: v8.0.5
• 79f002f fix: avoid path traversal with optimize deps sourcemap handler (#22161)
• a9a3df2 fix: check server.fs after stripping query as well (#22160)
• f02d9fd fix: apply server.fs check to env transport (#22159)
• f05f501 fix: disallow referencing files outside the package from sourcemap (#22158)
• 7339bdc release: v8.0.4
• 54229e7 docs: add environment.fetchModule documentation (#22035)
• b0da973 feat: allow esbuild 0.28 as peer deps (#22155)
• 22b0166 fix(deps): update all non-major dependencies (#22143)
• 17330d2 fix: add types for vite/modulepreload-polyfill (#22126)
• Additional commits viewable in compare view

Updates zod from 3.25.76 to 4.3.6

Release notes

Sourced from zod's releases.

v4.3.6

Commits:

• 9977fb0868432461de265a773319e80a90ba3e37 Add brand.dev to sponsors
• f4b7bae3468f6188b8f004e007d722148fc91d77 Update pullfrog.yml (#5634)
• 251d7163a0ac7740fee741428d913e3c55702ace Clean up workflow_call
• edd4132466da0f5065a8e051b599d01fdd1081d8 fix: add missing User-agent to robots.txt and allow all (#5646)
• 85db85e9091d0706910d60c7eb2e9c181edd87bd fix: typo in codec.test.ts file (#5628)
• cbf77bb12bdfda2e054818e79001f5cb3798ce76 Avoid non null assertion (#5638)
• dfbbf1c1ae0c224b8131d80ddf0a264262144086 Avoid re-exported star modules (#5656)
• 762e911e5773f949452fd6dd4e360f2362110e8e Generalize numeric key handling
• ca3c8629c0c2715571f70b44c2433cad3db7fe4e v4.3.6

v4.3.5

Commits:

• 21afffdb42ccab554036312e33fed0ea3cb8f982 [Docs] Update migration guide docs for deprecation of message (#5595)
• e36743e513aadb307b29949a80d6eb0dcc8fc278 Improve mini treeshaking
• 0cdc0b8597999fd9ca99767b912c1e82c1ff2d6c 4.3.5

v4.3.4

Commits:

• 1a8bea3b474eada6f219c163d0d3ad09fadabe72 Add integration tests
• e01cd02b2f23d7e9078d3813830b146f8a2258b4 Support patternProperties for looserecord (#5592)
• 089e5fbb0f58ce96d2c4fb34cd91724c78df4af5 Improve looseRecord docs
• decef9c418d9a598c3f1bada06891ba5d922c5cd Fix lint
• 9443aab00d44d5d5f4a7eada65fc0fc851781042 Drop iso time in fromJSONSchema
• 66bda7491a1b9eab83bdeec0c12f4efc7290bd48 Remove .refine() from ZodMiniType
• b4ab94ca608cd5b581bfc12b20dd8d95b35b3009 4.3.4

v4.3.3

Commits:

• f3b2151959d215d405f54dff3c7ab3bf1fd887ca v4.3.3

v4.3.2

Commits:

• bf96635d243118de6e4f260077aa137453790bf6 Loosen strictObjectinside intersection (#5587)
• f71dc0182ab0f0f9a6be6295b07faca269e10179 Remove Juno (#5590)
• 0f41e5a12a43e6913c9dcb501b2b5136ea86500d 4.3.2

v4.3.1

Commits:

• 0fe88407a4149c907929b757dc6618d8afe998fc allow non-overwriting extends with refinements. 4.3.1

v4.3.0

This is Zod's biggest release since 4.0. It addresses several of Zod's longest-standing feature requests.

... (truncated)

Commits

• ca3c862 v4.3.6
• 762e911 Generalize numeric key handling
• dfbbf1c Avoid re-exported star modules (#5656)
• cbf77bb Avoid non null assertion (#5638)
• 85db85e fix: typo in codec.test.ts file (#5628)
• edd4132 fix: add missing User-agent to robots.txt and allow all (#5646)
• 251d716 Clean up workflow_call
• f4b7bae Update pullfrog.yml (#5634)
• 9977fb0 Add brand.dev to sponsors
• 0cdc0b8 4.3.5
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies, javascript. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.