Release v2.4.0

[yogeshchoudhary147]

Added

• feat: add DPoP support with fetcher API #732 (yogeshchoudhary147)

In general, to fix "expression has no effect" issues, either remove the expression if it is truly unused, or, if it is intentionally executed for side effects, wrap it with void or otherwise make the side effect explicit. Here, the second 'use strict' is not treated as a directive and has no effect, while a valid "use strict" directive already exists at the top of the file. The best fix is simply to delete the no-op expression statement.

Concretely, in docs/assets/main.js, remove line 37 containing ('use strict'); and leave the surrounding IIFE starting on line 38 unchanged. No additional imports, methods, or definitions are needed because we are only deleting dead code and not changing any logic.

General approach: remove the implicit object-to-string coercion by explicitly converting the FieldRef instance to a string before using it as an object key. That way, it is obvious that the key is a string representation of the field reference, and we no longer rely on implicit conversions.

Best concrete fix here: keep creating _ as new t.FieldRef(z, g), but introduce a new variable (for example fieldRefKey) that explicitly stores the string key, e.g. var fieldRefKey = _.toString();, and then use fieldRefKey everywhere we currently index into r with _ (both the read J = r[_] and the write r[_] = ...). This does not change logic: if FieldRef already defines toString(), the generated key is identical to what JavaScript currently uses implicitly. If it does not, .toString() still yields the same '[object Object]' that the implicit coercion would have used.

Changes to make:

• File: docs/assets/main.js.
• In the loop around lines 971–978, right after var _ = new t.FieldRef(z, g), declare a new variable fieldRefKey = _.toString(),.
• Replace J = r[_] with J = r[fieldRefKey].
• Replace r[_] = new t.MatchData(...) with r[fieldRefKey] = new t.MatchData(...).

No new imports or external definitions are required.

---

In general, to fix implicit operand conversions when using objects as property keys, replace implicit conversions with explicit ones, e.g. obj[x] where x is an object becomes obj[x.toString()] (or another explicit serialization) so the intent is clear and collisions are controlled.

Here, the problematic expression is on line 977 in docs/assets/main.js:

973:                         _ = new t.FieldRef(z, g),
974:                         U = j[z],
975:                         J;
976:                       (J = r[_]) === void 0
977:                         ? (r[_] = new t.MatchData(L, g, U))
978:                         : J.add(L, g, U);

_ is a t.FieldRef instance. We should explicitly convert it to a string key once and use that string for indexing into r. The minimal, behavior‑preserving fix within this snippet is:

1. Introduce a new variable for the string key, e.g. var fieldRefKey = _.toString();.
2. Use fieldRefKey instead of _ in both r[_] and r[_] = ....

This assumes t.FieldRef has a sensible toString() implementation, which is standard for lunr. If for some reason it did not, the previous code was already relying on its implicit conversion; making the call explicit does not change semantics.

No new imports or external methods are required; we just add a local variable and adjust the property accesses.

In general, to fix a "useless assignment to local variable" you either (1) remove the assignment (and possibly the variable) if the value truly is not needed, or (2) start using the assigned value in subsequent logic if it was meant to be used but was forgotten. Here, within the if (n.isNegated()) block, k is assigned from t.FieldRef.fromString(_) and then never read, while a new k is declared and used later in a different loop. There is no logic that could make use of this earlier k, so the best fix is to delete the unnecessary declaration/assignment.

Concretely, in docs/assets/main.js, inside the if (n.isNegated()) block, in the for (var c = 0; c < u.length; c++) loop, remove the line k = t.FieldRef.fromString(_) and the associated var declaration, leaving only the creation of a new t.MatchData for each key. No new imports, methods, or definitions are required, and this does not change existing functionality because the value of k was never used.

In general, to fix implicit operand conversion when using objects as keys, convert them explicitly to the intended key type (usually a string) before indexing into an object. That means replacing code like map[obj] = ... with map[obj.toString()] = ... (or another explicit conversion) so the behavior is clear.

Here, f is a FieldRef object used as a key in several maps: fieldTermFrequencies[f], fieldLengths[f], and the corresponding reads. The minimal and safest fix is to normalize f into an explicit string key once, then use that key consistently. We can do this by introducing a new variable (for example, var frKey = f.toString();) immediately after f is constructed, and then use frKey everywhere we currently use f as an object key. This preserves the behavior (because JavaScript would have called toString anyway for the object key) but removes the implicit conversion, making the intent explicit.

Concretely, in docs/assets/main.js around lines 1125–1129:

• After var f = new t.FieldRef(r, o), add frKey = f.toString();.
• Replace this.fieldTermFrequencies[f] with this.fieldTermFrequencies[frKey].
• Replace this.fieldLengths[f] (both assignments) with this.fieldLengths[frKey].

No new imports or methods are needed; toString is available on all objects. We do not touch any other lines.

General approach: remove the reliance on implicit object‑key coercion by explicitly converting FieldRef instances to strings before using them as keys. This makes it clear that the map is keyed by the string representation of the FieldRef, and it avoids hidden dependencies on JavaScript’s coercion rules.

Concrete fix: in t.Builder.prototype.add, after constructing f = new t.FieldRef(r, o), introduce a local variable (for example var frKey = f.toString();) and then use frKey instead of f whenever accessing this.fieldTermFrequencies and this.fieldLengths. This preserves the exact semantics (since object property access was already using the stringified form of f) but makes the conversion explicit. No imports or additional methods are required; we only add a local variable and adjust the property accesses inside this function. All other code remains unchanged.

Specifically:

• In docs/assets/main.js, around lines 1125–1129, add a new line defining frKey immediately after var f = new t.FieldRef(r, o);.
• Replace this.fieldTermFrequencies[f] with this.fieldTermFrequencies[frKey].
• Replace both occurrences of this.fieldLengths[f] with this.fieldLengths[frKey].

In general, to fix “duplicate character in character class” issues, you remove redundant occurrences of the same character or escape sequence so that each character appears only once in the character class, preserving the intended matching behavior.

Here, the function te escapes special HTML characters by replacing them with their corresponding entities using:

return t.replace(/[&<>"'"]/g, (e) => lt[e]);

The character class [&<>"'"] currently includes the double quote twice: once as " and once as \" (because inside a JavaScript string literal, \" becomes " in the regex). We should keep only one occurrence. The best fix without changing behavior is to remove the escaped version and leave a single, clear literal " inside the class, resulting in:

return t.replace(/[&<>"']/g, (e) => lt[e]);

This maintains the same set of matched characters (&, <, >, ", ') and keeps the mapping to lt[e] unchanged. Only line 2170 in docs/assets/main.js needs to be modified; no new imports, methods, or other definitions are required.

In general, to fix a “useless assignment to local variable” you either (a) remove the redundant assignment if the value is never needed, or (b) introduce a read/use of the variable before it is overwritten if there was intended logic that is currently missing. Here, there is no evidence that the initial false value of dt is needed before it is potentially set to true for touch devices, so the best fix is to keep the declaration of dt but remove its initial value.

Concretely, in docs/assets/main.js around line 2196, adjust the multi-variable var declaration so that dt is declared without an initializer: change dt = !1 to just dt. This preserves dt as a declared variable with its existing semantics (it will be undefined until the conditional touch-code sets it) while eliminating the pointless initialization that CodeQL has flagged. No additional imports or helper methods are required.

In general, the way to fix a useless assignment is either to remove the variable/assignment entirely (if it truly isn’t needed) or to add the missing logic that actually uses the value (if a logic error left it unused). Here, dt is only ever set to false at declaration and to true in the mobile/touch branch, and never read. The other control variables (D, Me, $, Qe, ce, F) are used later in event handlers, but dt is not, so the simplest, behavior-preserving fix is to remove dt completely.

Concretely, in docs/assets/main.js:

• Remove dt = !1, from the multi-variable var declaration starting at line 2196.
• Remove the (dt = !0), part of the expression at line 2210, leaving only the reassignments of D, Me, and $.

No new imports, methods, or definitions are required; we only delete the unused variable and its assignment.

In general, a “useless conditional” should be fixed either by (a) removing it if the guarded code is genuinely unreachable and not needed, or (b) correcting the condition or ensuring the variable can meaningfully change at runtime. Here, within the shown snippet, Qe is never changed from its initial false value, so the guarded body in the 'click' event listener is never executed. As we must not assume additional writes elsewhere in the bundle, the safest fix that does not change observable behavior is to remove the Qe condition and its associated side effects.

Concretely, in docs/assets/main.js around line 2227, replace the 'click' event listener:

document.addEventListener('click', (t) => {
  Qe && (t.preventDefault(), t.stopImmediatePropagation(), (Qe = !1));
});

with an empty no-op listener (or remove the listener entirely, but that might change semantics if something relies on its presence). Keeping an empty handler preserves any subtle ordering or registration effects while eliminating the dead conditional and its unused state variable. We do not need any new imports or helpers for this; we just simplify the callback.