fix: upgrade RE2JS assertion matching and public reset

@asafyish is attempting to deploy a commit to the Vercel Labs Team on Vercel.

A member of the Team first needs to authorize it.

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

View full report

🤖 auto-maintain review

Automated, advisory triage for @asafyish's PR. Facts below are read from the GitHub API.

Review panel: 🟡 medium highest severity

just-bash maintainer code review: 🟢 low

No actionable defects found in the complete base-to-head diff.

General code review: 🟢 low

No actionable correctness or maintainability issues found in the complete diff.

Adversarial security: 🟢 low

No actionable adversarial security issues found in the complete diff.

Adversarial security (second opinion): 🟡 medium

No backdoor, exfiltration, install-script, or CI tampering found; the diff is confined to a re2js bump, a public matcher reset, and a narrowed escape translator, but the hand-rolled `\Q…\E` scan diverges from RE2's own quoting rules and can silently change what a pattern matches.

• packages/just-bash/src/regex/user-regex.ts:79 — The new `\Q…\E` scan in `translatePattern` does not mirror RE2's quoted-region rules: RE2 consumes `\` inside a `\Q` region as one literal backslash, while `[\s\S]*?(?:\E|$)` stops at the first two-char `\E` it sees. For a pattern like `\Qfoo\E\u0041`, the tokenizer treats the region as ended and rewrites `\u0041` to `\x{41}`, but RE2 is still inside the quoted region at that point, so the compiled pattern silently matches the literal text `foo\E\x{41}` instead of `foo\E\u0041`. Escapes should not be rewritten in spans RE2 still treats as quoted.

Standard Bash and host portability: 🟡 medium

The shared translation change introduces a concrete compatibility regression for escaped ordinary characters.

• packages/just-bash/src/regex/user-regex.ts:79 — Preserving every unsupported escape globally breaks Bash/host regex compatibility. GNU Bash `[[ Z =~ \Z ]]`, GNU grep, and gawk treat `\Z` as literal `Z`, but this change makes shared `UserRegex("\Z")` throw, so previously valid scripts now fail. Normalize dialect-specific ordinary escapes before RE2 compilation.

_{Posted by auto-maintain. This automated code review is advisory; a human maintainer makes the call.}

Verified both reported examples against RE2JS itself and the current wrapper; neither is a regression introduced here.

• Quoting: RE2JS 2.8.8's parser finds the terminator with lit.indexOf("\E"); it does not consume escaped-backslash pairs inside the quoted region as the review claims. For the supplied pattern \Qfoo\E\u0041, the wrapper matches foo\A, and does not match either literal foo\E\u0041 or foo\E\x{41}. This is consistent with RE2's quoted span ending at the first \E.
• \Z: RE2JS 1.3.3's existing translateRegExp preserves \Z, and compiling it already throws invalid escape sequence. The changed translator preserves that behavior. A GNU dialect compatibility change could be considered separately, but this upgrade does not turn a previously supported \Z into an error.

The targeted example check and the existing translation suite pass. No production change is needed for these two findings.