@mh-alikhani/bunready 0.3.0 → 0.3.1

package/CHANGELOG.md

@@ -9,6 +9,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 Nothing yet.
 
+## [0.3.1] - 2026-09-19
+
+### Fixed
+
+- Three polynomial-time regular expressions, reported by CodeQL as
+  `js/polynomial-redos`. bunready parses files it does not control - a
+  `pnpm-workspace.yaml` from a repository being scanned, a semver range in its
+  `engines` - so a pathological string could have made a scan take quadratic
+  time. The pnpm list item and the semver operator split are now parsed
+  directly, and trailing-slash stripping is a linear loop instead of `/+$`.
+  Behaviour is unchanged; `tests/workspaces.test.ts` and `tests/semver.test.ts`
+  cover the affected paths.
+
 ## [0.3.0] - 2026-09-18
 
 ### Added
@@ -188,7 +201,8 @@ Nothing yet.
   and that claim needs a primary source. Until then the rule reports what the
   repository imports and cites the compatibility table.
 
-[Unreleased]: https://github.com/MHAlikhani/bunready/compare/v0.3.0...HEAD
+[Unreleased]: https://github.com/MHAlikhani/bunready/compare/v0.3.1...HEAD
+[0.3.1]: https://github.com/MHAlikhani/bunready/releases/tag/v0.3.1
 [0.3.0]: https://github.com/MHAlikhani/bunready/releases/tag/v0.3.0
 [0.2.0]: https://github.com/MHAlikhani/bunready/releases/tag/v0.2.0
 [0.1.0]: https://github.com/MHAlikhani/bunready/releases/tag/v0.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mh-alikhani/bunready",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Bun-readiness scanner: one command that shows what will break before you move a Node/TS repo to Bun.",
   "keywords": [
     "bun",

package/src/scanner/semver.ts

@@ -92,12 +92,12 @@ function comparatorsForToken(token: string): Comparator[] | undefined {
     return [];
   }
 
-  const operatorMatch = /^(>=|<=|>|<|=|\^|~)?\s*(.*)$/.exec(trimmed);
-  if (operatorMatch === null) {
-    return undefined;
-  }
-  const operator = operatorMatch[1];
-  const rest = operatorMatch[2] ?? "";
+  // Anchored-prefix parse rather than a trailing \s*(.*)$, which backtracks
+  // quadratically on a long run of spaces - and the range comes from a
+  // repository bunready does not control.
+  const operatorMatch = /^(>=|<=|>|<|=|\^|~)?/.exec(trimmed);
+  const operator = operatorMatch?.[1];
+  const rest = trimmed.slice(operatorMatch?.[0].length ?? 0).trim();
   if (rest === "" || rest === "*" || rest === "x") {
     return [];
   }

package/src/scanner/workspaces.ts

@@ -54,9 +54,22 @@ export function patternsFromPnpmWorkspace(text: string): string[] {
     if (!inPackages) {
       continue;
     }
-    const entry = /^-+\s*(.+?)\s*$/.exec(trimmed);
-    if (entry?.[1] !== undefined) {
-      patterns.push(entry[1].replace(/^['"]|['"]$/g, ""));
+    // Walked rather than matched: a pattern mixing a dash run, a space run and a
+    // catch-all is ambiguous, and CodeQL is right that it backtracks on a string
+    // of dashes and spaces. The value is trimmed here instead.
+    let cursor = 0;
+    while (cursor < trimmed.length && trimmed[cursor] === "-") {
+      cursor += 1;
+    }
+    const value =
+      cursor === 0
+        ? ""
+        : trimmed
+            .slice(cursor)
+            .trim()
+            .replace(/^['"]|['"]$/g, "");
+    if (value !== "") {
+      patterns.push(value);
     }
   }
 
@@ -123,6 +136,15 @@ async function expandGlob(root: string, segments: string[], fs: FileSystem): Pro
   return prefixes.filter((prefix) => prefix !== "" && prefix !== ".");
 }
 
+/** Linear replacement for `/+$`, which backtracks on a run of slashes. */
+function stripTrailingSlashes(value: string): string {
+  let end = value.length;
+  while (end > 0 && value[end - 1] === "/") {
+    end -= 1;
+  }
+  return value.slice(0, end);
+}
+
 export async function findWorkspacePackages(
   root: string,
   patterns: readonly string[],
@@ -131,7 +153,7 @@ export async function findWorkspacePackages(
   const found = new Map<string, WorkspacePackage>();
 
   for (const pattern of patterns) {
-    const cleaned = pattern.replace(/\\/g, "/").replace(/\/+$/, "").replace(/^\.\//, "");
+    const cleaned = stripTrailingSlashes(pattern.replace(/\\/g, "/")).replace(/^\.\//, "");
     if (cleaned === "" || cleaned === ".") {
       continue;
     }
@@ -165,6 +187,6 @@ export async function readPnpmWorkspace(root: string, fs: FileSystem): Promise<s
 
 /** Keep only the packages matching a scope string, by relative path or name. */
 export function scopeMatches(relative: string, scope: string): boolean {
-  const needle = scope.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+$/, "");
+  const needle = stripTrailingSlashes(scope.replace(/\\/g, "/")).replace(/^\.\//, "");
   return relative === needle || relative.includes(needle);
 }