safe-regex2 is a JavaScript utility that detects potentially catastrophic, exponential-time regular expressions by limiting regex star height to 1. It returns a boolean (true for likely safe, false for possibly unsafe) and is meant as a basic checker rather than a complete solution.
Project status
- Actively maintained: The repo shows recent updates in 2026 (v5.1.1 on 2026-04-19, v5.1.0 on 2026-03-12) and an upstream push as recently as 2026-08-06, indicating ongoing development rather than long dormancy.
- Update cadence (apparent): Tagged updates arrive roughly every 1 to 2 months in early 2026 (Mar 12 to Apr 19). After v5.1.1 there are no new tagged versions in the provided list, though activity continues (upstream push on 2026-08-06), so cadence looks “recent and intermittent” rather than strictly periodic.
AI summary generated
Recent updates
v5.1.1
v5.1.1 mainly updates CI tooling and a development style dependency, and includes a bug fix in the core regex analysis logic. The functional change appears centered on how the AST is traversed when handling repetition-like structures containing alternation.
v5.1.0
v5.1.0 refactors the core regex-walking logic into a standalone `walk` function and adds a CLI binary (`safe-regex2`) so the package can be executed directly via npx. The test suite was migrated from `tape` to Node's built-in `node:test`, and CI configuration was adjusted (permissions, concurrency).
Featuresv5.0.0
v5.0.0 contains mostly maintenance work, primarily documentation and CI configuration updates. There are no application or library code changes indicated in the diff beyond the package version bump and README updates.
v4.0.1
v4.0.1 primarily updates development tooling (switching from StandardJS to Neostandard, adding ESLint, and bumping dev dependencies) plus minor internal code cleanups. It also refreshes the README formatting and metadata (badges, renamed to README.md, homepage/repository/bugs URLs).
v4.0.0
v4.0.0 primarily consists of repository and tooling updates: CI workflow changes, stricter repo hygiene (.gitignore, .gitattributes, use strict), and dependency bumps. The only runtime file change (index.js) appears to add coverage ignore directives, while package.json updates alter test execution behavior and dev tooling.
v3.1.0
v3.1.0 focuses on compatibility and tooling updates, including CI license checking and NodeNext/ESM interop adjustments. The code change also adds TypeScript declaration files and related type-test coverage, but these are not described in the release notes.
Featuresv3.0.0
v3.0.0 is largely a tooling and CI maintenance release. It bumps several development dependencies (tape, standard, ret), and migrates the GitHub Actions workflow to Fastify's reusable workflow, plus updates action versions and Dependabot cadence.