safe-regex2 is a JavaScript utility that detects potentially catastrophic, exponential-time regular expressions by limiting regex star height to 1. It returns a boolean (true for likely safe, false for possibly unsafe) and is meant as a basic checker rather than a complete solution.
Project status
- Actively maintained: There are recent tagged updates in 2026 (v5.1.0 on 2026-03-12, v5.1.1 on 2026-04-19) and an upstream GitHub push on 2026-08-06, suggesting ongoing development rather than dormancy.
- Update cadence: In 2026, the project shipped two patch/minor updates within about 5 weeks (Mar to Apr), then there is a gap until the last tagged update (v5.1.1). The 2026-08-06 upstream push indicates continued work after that, though no newer tagged update is shown in the provided summaries.
AI summary generated
Recent updates
v5.1.1
v5.1.1 mainly updates CI tooling and a development style dependency, and includes a bug fix in the core regex analysis logic. The functional change appears centered on how the AST is traversed when handling repetition-like structures containing alternation.
v5.1.0
v5.1.0 refactors the core regex-walking logic into a standalone `walk` function and adds a CLI binary (`safe-regex2`) so the package can be executed directly via npx. The test suite was migrated from `tape` to Node's built-in `node:test`, and CI configuration was adjusted (permissions, concurrency).
Featuresv5.0.0
v5.0.0 contains mostly maintenance work, primarily documentation and CI configuration updates. There are no application or library code changes indicated in the diff beyond the package version bump and README updates.
v4.0.1
v4.0.1 primarily updates development tooling (switching from StandardJS to Neostandard, adding ESLint, and bumping dev dependencies) plus minor internal code cleanups. It also refreshes the README formatting and metadata (badges, renamed to README.md, homepage/repository/bugs URLs).
v4.0.0
v4.0.0 primarily consists of repository and tooling updates: CI workflow changes, stricter repo hygiene (.gitignore, .gitattributes, use strict), and dependency bumps. The only runtime file change (index.js) appears to add coverage ignore directives, while package.json updates alter test execution behavior and dev tooling.
v3.1.0
v3.1.0 focuses on compatibility and tooling updates, including CI license checking and NodeNext/ESM interop adjustments. The code change also adds TypeScript declaration files and related type-test coverage, but these are not described in the release notes.
Featuresv3.0.0
v3.0.0 is largely a tooling and CI maintenance release. It bumps several development dependencies (tape, standard, ret), and migrates the GitHub Actions workflow to Fastify's reusable workflow, plus updates action versions and Dependabot cadence.