html-minifier-next 7.5.3 → 8.0.0

package/src/lib/fragments.js

@@ -0,0 +1,274 @@
+/**
+ * Custom fragment matching
+ *
+ * `ignoreCustomFragments` patterns nearly always describe the same shape: a literal
+ * opening delimiter, an any-character or negated-class body, and a literal closing
+ * delimiter, as in `<%[\s\S]*?%>` or `\{\{[^}]*?\}\}`. Such a fragment can be found
+ * with `indexOf` in linear time, where running the pattern as a regex costs O(n²)
+ * on input that opens fragments it never closes—and can cost far more than that when
+ * the pattern itself backtracks. Patterns of other shapes keep running as regexes,
+ * one per pattern, so each keeps its own flags.
+ */
+
+const RE_WHITESPACE = /\s/;
+
+// Any-character and negated-class bodies; without the `s` flag, `.` is itself a
+// negated class, excluding line terminators
+const RE_DELIMITED = /^(.*?)(?:\[\\s\\S\]|\[\\S\\s\]|\[\^\]|(\.)|\[\^((?:\\[^]|[^\]\\])+)\])(?:([*+])|\{(\d+)(?:,(\d*))?\})\?(.*)$/;
+
+// Flags that leave literal matching alone, so a pattern carrying them can still be
+// scanned for; `i` in particular cannot, since case folding moves character indexes
+const RE_LITERAL_FLAGS = /^[gds]*$/;
+
+/**
+ * @typedef {{open: string, close: string, min: number, max: number, excluded: RegExp | null}} DelimitedFragment
+ *  Literal delimiters around a body, found by scanning; `excluded` holds the
+ *  characters a negated-class body cannot cross, null when the body spans every
+ *  character
+ * @typedef {{search: RegExp, anchored: RegExp}} PatternFragment
+ *  Everything else, found by running the pattern itself
+ */
+
+/**
+ * Read a regex source as a literal string, so it can be matched with `indexOf`
+ * @param {string} source
+ * @returns {string | null} Null when the source is more than literal characters
+ */
+function toLiteral(source) {
+  let literal = '';
+
+  for (let i = 0; i < source.length; i++) {
+    const char = source[i] ?? '';
+    if (char === '\\') {
+      const escaped = source[++i];
+      // A trailing backslash is half an escape the body token was split out of,
+      // as in `<%\.*?%>`, where the `.` is literal and not a body
+      if (escaped === undefined) return null;
+      // `\n` and friends are literal characters, `\s` and `\1` are not
+      if (escaped === 'n') literal += '\n';
+      else if (escaped === 't') literal += '\t';
+      else if (escaped === 'r') literal += '\r';
+      else if (escaped === 'f') literal += '\f';
+      else if (escaped === 'v') literal += '\v';
+      else if (/[A-Za-z0-9]/.test(escaped)) return null;
+      else literal += escaped;
+    } else if ('.*+?()[]{}|^$'.includes(char)) {
+      return null;
+    } else {
+      literal += char;
+    }
+  }
+
+  return literal;
+}
+
+/**
+ * Describe a fragment pattern as literal delimiters around an any-character body
+ * @param {RegExp} pattern
+ * @returns {DelimitedFragment | null} Null when the pattern has another shape, which
+ *  the caller answers by running it as a regex
+ */
+function toDelimitedFragment(pattern) {
+  if (!RE_LITERAL_FLAGS.test(pattern.flags)) return null;
+
+  const match = RE_DELIMITED.exec(pattern.source);
+  if (!match) return null;
+
+  const [, rawOpen, dot, negated, simple, exact, upper, rawClose] = match;
+  const open = toLiteral(rawOpen ?? '');
+  const close = toLiteral(rawClose ?? '');
+  // Both delimiters have to be there: without them a match has no boundary to scan to
+  if (!open || !close) return null;
+
+  // The class content doubles as the search for characters the body cannot cross;
+  // a `.` body spans every character under the `s` flag, and excludes line
+  // terminators without it
+  const inner = dot ? (pattern.flags.includes('s') ? null : '\\n\\r\\u2028\\u2029') : negated ?? null;
+
+  const min = simple ? (simple === '+' ? 1 : 0) : Number(exact);
+  const max = simple || upper === '' ? Infinity : Number(upper ?? exact);
+
+  return { open, close, min, max, excluded: inner === null ? null : new RegExp('[' + inner + ']', 'g') };
+}
+
+/**
+ * Prepare a fragment pattern for matching, by scanning where the shape allows it
+ * @param {RegExp} pattern
+ * @returns {DelimitedFragment | PatternFragment}
+ */
+function toFragment(pattern) {
+  const delimited = toDelimitedFragment(pattern);
+  if (delimited) return delimited;
+
+  // `g` and `y` are ours to set, the rest belong to the pattern
+  const flags = pattern.flags.replace(/[gy]/g, '');
+  return { search: new RegExp(pattern.source, flags + 'g'), anchored: new RegExp(pattern.source, flags + 'y') };
+}
+
+/**
+ * Replace runs of custom fragments, and the whitespace padding them
+ * @param {string} value - Document to scan
+ * @param {(DelimitedFragment | PatternFragment)[]} fragments - In the order the patterns
+ *  were given, since the earliest match wins and ties go to the pattern listed first
+ * @param {(match: string) => string} replacer - Called with each match, as `replace` would
+ * @returns {string}
+ */
+function replaceCustomFragments(value, fragments, replacer) {
+  // Where each fragment's next match may start, its next closing delimiter may be
+  // found, and its next excluded character sits; all only ever move forward, which
+  // is what keeps the whole scan linear
+  const found = fragments.map(() => /** @type {{start: number, end: number} | null} */ (null));
+  const closesAt = fragments.map(() => -1);
+  const excludedAt = fragments.map(() => -1);
+  const exhausted = fragments.map(() => false);
+
+  /**
+   * Whether a body region holds a character its class excludes
+   * @param {DelimitedFragment} fragment
+   * @param {number} index - Which fragment, for the forward-only bookkeeping
+   * @param {number} bodyStart
+   * @param {number} close
+   * @returns {boolean}
+   */
+  const bodyBlocked = (fragment, index, bodyStart, close) => {
+    if (!fragment.excluded) return false;
+    if (/** @type {number} */ (excludedAt[index]) < bodyStart) {
+      fragment.excluded.lastIndex = bodyStart;
+      const blocked = fragment.excluded.exec(value);
+      excludedAt[index] = blocked ? blocked.index : Infinity;
+    }
+    return /** @type {number} */ (excludedAt[index]) < close;
+  };
+
+  /**
+   * Earliest match of one delimited fragment at or after `from`
+   * @param {DelimitedFragment} fragment
+   * @param {number} index - Which fragment, for the forward-only bookkeeping
+   * @param {number} from
+   * @param {boolean} anchored - Whether the match has to start exactly at `from`
+   * @returns {{start: number, end: number} | null}
+   */
+  const scan = (fragment, index, from, anchored) => {
+    let openFrom = from;
+
+    for (;;) {
+      const open = anchored
+        ? (value.startsWith(fragment.open, from) ? from : -1)
+        : value.indexOf(fragment.open, openFrom);
+      if (open === -1) {
+        if (!anchored) exhausted[index] = true;
+        return null;
+      }
+
+      const bodyStart = open + fragment.open.length;
+      if (/** @type {number} */ (closesAt[index]) < bodyStart + fragment.min) {
+        closesAt[index] = value.indexOf(fragment.close, bodyStart + fragment.min);
+      }
+      const close = /** @type {number} */ (closesAt[index]);
+      if (close === -1) {
+        exhausted[index] = true;
+        return null;
+      }
+
+      if (close - bodyStart <= fragment.max && !bodyBlocked(fragment, index, bodyStart, close)) {
+        return { start: open, end: close + fragment.close.length };
+      }
+      // The body is longer than the pattern allows, or holds a character its class
+      // excludes, so the match has to start later
+      if (anchored) return null;
+      openFrom = open + 1;
+    }
+  };
+
+  /**
+   * Earliest match of one regex fragment at or after `from`
+   * @param {PatternFragment} fragment
+   * @param {number} from
+   * @param {boolean} anchored
+   * @returns {{start: number, end: number} | null}
+   */
+  const run = (fragment, from, anchored) => {
+    const pattern = anchored ? fragment.anchored : fragment.search;
+    pattern.lastIndex = from;
+
+    for (;;) {
+      const match = pattern.exec(value);
+      if (!match) return null;
+      // A pattern that matches nothing would leave the run in place forever
+      if (match[0].length > 0) return { start: match.index, end: match.index + match[0].length };
+      if (anchored) return null;
+      pattern.lastIndex = match.index + 1;
+    }
+  };
+
+  /**
+   * @param {number} from
+   * @param {boolean} anchored
+   * @returns {{start: number, end: number} | null}
+   */
+  const find = (from, anchored) => {
+    /** @type {{start: number, end: number} | null} */
+    let earliest = null;
+
+    for (let i = 0; i < fragments.length; i++) {
+      if (exhausted[i]) continue;
+      const fragment = /** @type {DelimitedFragment | PatternFragment} */ (fragments[i]);
+
+      /** @type {{start: number, end: number} | null} */
+      let match;
+      if (anchored) {
+        match = 'open' in fragment ? scan(fragment, i, from, true) : run(fragment, from, true);
+      } else {
+        // Matches only ever move forward, so the last one found still stands
+        const previous = found[i];
+        match = previous && previous.start >= from
+          ? previous
+          : ('open' in fragment ? scan(fragment, i, from, false) : run(fragment, from, false));
+        found[i] = match;
+        // Nothing ahead now means nothing ahead later either
+        if (!match) exhausted[i] = true;
+      }
+
+      // Ties go to the fragment listed first, the way alternation would resolve them
+      if (match && (!earliest || match.start < earliest.start)) earliest = match;
+    }
+
+    return earliest;
+  };
+
+  let out = '';
+  let copied = 0;
+  let search = 0;
+
+  while (search <= value.length) {
+    const first = find(search, false);
+    if (!first) break;
+
+    // Fragments running straight into each other are one match
+    let end = first.end;
+    for (;;) {
+      const next = find(end, true);
+      if (!next) break;
+      end = next.end;
+    }
+
+    // …as is the whitespace on either side, back to where the last match left off
+    let start = first.start;
+    while (start > copied && RE_WHITESPACE.test(value[start - 1] ?? '')) start--;
+    while (end < value.length && RE_WHITESPACE.test(value[end] ?? '')) end++;
+
+    out += value.slice(copied, start) + replacer(value.slice(start, end));
+    copied = end;
+    search = end;
+  }
+
+  return copied === 0 ? value : out + value.slice(copied);
+}
+
+// Exports
+
+export {
+  toDelimitedFragment,
+  toFragment,
+  replaceCustomFragments
+};

package/src/lib/option-definitions.js

@@ -1,5 +1,13 @@
 // Single source of truth for minifier option names, descriptions, types, and shared defaults
 
+/**
+ * @typedef {object} OptionDefinition
+ * @property {string} description Help text, phrased for the option’s primary CLI form
+ * @property {string} [descriptionAffirmative] Help text for what enabling the option does, where `description` describes the negated form
+ * @property {string} type Key into the parser and JSON Schema type maps in cli.js and scripts/build-schema.js
+ */
+
+/** @type {Record<string, OptionDefinition>} */
 const optionDefinitions = {
   cacheCSS: {
     description: 'Set CSS minification cache size (number of entries, default: 500)',
@@ -62,10 +70,6 @@ const optionDefinitions = {
     description: 'Array of regexes that allow to support custom event attributes for minifyJS (e.g., `ng-click`)',
     type: 'regexpArray'
   },
-  customFragmentQuantifierLimit: {
-    description: 'Set maximum quantifier limit for custom fragments to prevent ReDoS attacks (default: 200)',
-    type: 'int'
-  },
   decodeEntities: {
     description: 'Use direct Unicode characters whenever possible',
     type: 'boolean'
@@ -104,15 +108,15 @@ const optionDefinitions = {
   },
   minifyCSS: {
     description: 'Minify CSS in `style` elements and attributes (uses Lightning CSS)',
-    type: 'json'
+    type: 'jsonObject'
   },
   minifyJS: {
     description: 'Minify JavaScript in `script` elements and event attributes (uses Terser or SWC; pass `{"engine": "swc"}` for SWC)',
-    type: 'json'
+    type: 'jsonObject'
   },
   minifySVG: {
     description: 'Minify SVG elements (uses SVGO)',
-    type: 'json'
+    type: 'jsonObject'
   },
   minifyURLs: {
     description: 'Minify URLs in various attributes',
@@ -178,6 +182,10 @@ const optionDefinitions = {
     description: 'Remove space between attributes whenever possible; note that this will result in invalid HTML',
     type: 'boolean'
   },
+  removeUnusedCSS: {
+    description: 'Remove rules from `style` elements whose class or ID selectors the document never references (requires `--minify-css`); note that class names only applied by external scripts cannot be detected—use `{"safelist": […]}` for those',
+    type: 'jsonObject'
+  },
   sortAttributes: {
     description: 'Sort attributes by frequency',
     type: 'boolean'
@@ -190,6 +198,10 @@ const optionDefinitions = {
     description: 'Trim whitespace around custom fragments (`--ignore-custom-fragments`)',
     type: 'boolean'
   },
+  strictCustomFragments: {
+    description: 'Reject `ignoreCustomFragments` patterns that risk catastrophic backtracking (rather than warning about them)',
+    type: 'boolean'
+  },
   useShortDoctype: {
     description: 'Replaces the doctype with the short HTML doctype',
     type: 'boolean'

package/src/lib/options.js

@@ -1,8 +1,9 @@
 import { createUrlMinifier } from './urls.js';
-import { LRU, MAX_CACHE_ENTRY_SIZE, stableStringify, hashContent, identity, lowercase, replaceAsync, parseRegExp } from './utils.js';
+import { LRU, MAX_CACHE_ENTRY_SIZE, stableStringify, hashContent, identity, lowercase, replaceAsync, parseRegExp, describeQuantifierRisk } from './utils.js';
 import { RE_TRAILING_SEMICOLON } from './constants.js';
 import { canCollapseWhitespace, canTrimWhitespace } from './whitespace.js';
 import { wrapCSS, unwrapCSS } from './content.js';
+import { findUnusedSymbols, normalizeUnusedCSSOptions } from './unused-css.js';
 import { getPreset, getPresetNames } from '../presets.js';
 import { optionDefinitions, optionDefaults } from './option-definitions.js';
 
@@ -10,23 +11,40 @@ import { optionDefinitions, optionDefaults } from './option-definitions.js';
 
 // Type definitions
 
+/**
+ * Per-document state handed to `minifyCSS`. Its closure hangs off the memoized
+ * options object that every `minify()` call with those options shares, so state
+ * belonging to one document has to be passed in rather than captured.
+ *
+ * @typedef {{usedSymbols?: Set<string>, warned: Set<string>}} CSSContext
+ */
+
+/**
+ * Minified style sheet plus the warnings its transform produced, cached together
+ * so that a cache hit can report what the transform reported
+ *
+ * @typedef {{css: string, warnings: string[]}} CSSResult
+ */
+
 /**
  * Options object produced by `processOptions` and consumed by `minifyHTML` and
- * the `lib/` helpers; normalization guarantees that the function-valued options
+ * the lib/ helpers; normalization guarantees that the function-valued options
  * below are always present (defaulting to identity/built-in functions), and
  * minification adds writable internal state on top of the public options
  * (set on prototype-chain forks during SVG/MathML namespace transitions)
  *
- * @typedef {Omit<MinifierOptions, 'preset' | 'canCollapseWhitespace' | 'canTrimWhitespace' | 'ignoreCustomComments' | 'log' | 'minifyCSS' | 'minifyJS' | 'minifyURLs' | 'minifySVG'> & {
+ * @typedef {Omit<MinifierOptions, 'preset' | 'canCollapseWhitespace' | 'canTrimWhitespace' | 'ignoreCustomComments' | 'log' | 'minifyCSS' | 'minifyJS' | 'minifyURLs' | 'minifySVG' | 'removeUnusedCSS'> & {
  *   name: (name: string) => string,
  *   log: (message: any) => unknown,
  *   ignoreCustomComments: RegExp[],
  *   canCollapseWhitespace: (tag: string, attrs: HTMLAttribute[], defaultFn: (tag: string) => boolean) => boolean,
  *   canTrimWhitespace: (tag: string, attrs: HTMLAttribute[], defaultFn: (tag: string) => boolean) => boolean,
- *   minifyCSS: (text: string, type?: string) => string | Promise<string>,
+ *   minifyCSS: (text: string, type?: string, context?: CSSContext) => string | Promise<string>,
  *   minifyJS: (text: string, inline?: boolean, isModule?: boolean) => string | Promise<string>,
  *   minifyURLs: (text: string) => string | Promise<string>,
  *   minifySVG: ((svgContent: string) => string | Promise<string>) | null,
+ *   removeUnusedCSS: {safelist: Array<string | RegExp>, scripts: boolean} | null,
+ *   cssContext?: CSSContext,
  *   nameParent?: (name: string) => string,
  *   nameHTML?: (name: string) => string,
  *   insideSVG?: boolean,
@@ -79,9 +97,11 @@ const optionKeysExtra = new Set(['preset', 'log', 'canCollapseWhitespace', 'canT
 // key per process, so repeated `minify` calls (e.g., batch runs) don’t flood STDERR
 const optionKeysWarned = new Set();
 const presetNamesWarned = new Set();
-// The custom-fragment ReDoS warning is security-relevant, so it reaches the
-// console even without a `log` hook—once per process, like the warnings above
-let customFragmentQuantifierWarned = false;
+// Custom fragments whose shape risks ReDoS, warned about once per pattern per process
+const customFragmentsWarned = new Set();
+const unusedCSSWarned = new Set();
+// Object-valued options handed a string, warned about once per distinct value
+const stringValuesWarned = new Set();
 
 // Main options processor
 
@@ -101,7 +121,8 @@ const processOptions = (inputOptions, { getLightningCSS, getTerser, getSwc, getS
     minifyCSS: identity,
     minifyJS: identity,
     minifyURLs: identity,
-    minifySVG: null
+    minifySVG: null,
+    removeUnusedCSS: null
   };
 
   const parseRegExpArray = (/** @type {unknown} */ arr) => {
@@ -136,7 +157,7 @@ const processOptions = (inputOptions, { getLightningCSS, getTerser, getSwc, getS
   Object.keys(inputOptions).forEach(function (key) {
     if (!Object.hasOwn(optionDefinitions, key) && !optionKeysExtra.has(key) && !optionKeysWarned.has(key)) {
       optionKeysWarned.add(key);
-      warn(`HTML Minifier Next: Ignoring unknown or deprecated option “${key}” (see README for available options)`);
+      warn(`HTML Minifier Next: Ignoring unknown or deprecated option \`${key}\` (see README for available options)`);
     }
   });
 
@@ -166,10 +187,30 @@ const processOptions = (inputOptions, { getLightningCSS, getTerser, getSwc, getS
       return;
     }
 
+    // A string carries no configuration for these options. The CLI parses config
+    // values as JSON first, so only a value that is not JSON reaches this from
+    // there. (`minifyURLs` is deliberately excluded—there, a string names the site.)
+    const definition = optionDefinitions[key];
+    if (typeof option === 'string' && definition?.type === 'jsonObject') {
+      const message = `HTML Minifier Next: Ignoring \`${key}\`—it takes a boolean or an object, not a string (“${option}”)`;
+      if (!stringValuesWarned.has(message)) {
+        stringValuesWarned.add(message);
+        warn(message);
+      }
+      return;
+    }
+
     if (key === 'caseSensitive') {
       if (option) {
         options.name = identity;
       }
+    } else if (key === 'removeUnusedCSS') {
+      optionsDynamic.removeUnusedCSS = normalizeUnusedCSSOptions(option, message => {
+        if (!unusedCSSWarned.has(message)) {
+          unusedCSSWarned.add(message);
+          warn(`HTML Minifier Next: ${message}`);
+        }
+      });
     } else if (key === 'log') {
       if (typeof option === 'function') {
         options.log = option;
@@ -184,12 +225,34 @@ const processOptions = (inputOptions, { getLightningCSS, getTerser, getSwc, getS
       const cssLoader = getLightningCSS;
       const cssCache = cssMinifyCache;
 
-      options.minifyCSS = async function (/** @type {string} */ text, /** @type {string | undefined} */ type) {
+      options.minifyCSS = async function (/** @type {string} */ text, /** @type {string | undefined} */ type, /** @type {CSSContext | undefined} */ context) {
         // Fast path: Nothing to minify
         if (!text || !text.trim()) {
           return text;
         }
 
+        // Warnings are stored with the minified result and replayed on every hit, so a
+        // second document with the same defect hears about it, too; `context.warned`
+        // then keeps one document from repeating itself. Reporting from the cache
+        // rather than only from the transform keeps the output independent of cache
+        // size and eviction. They are built and cached even when `log` is the default
+        // no-op, so a later document that does pass a `log` hook still gets them.
+        const report = (/** @type {string[]} */ messages) => {
+          if (!messages.length || options.log === identity) {
+            return;
+          }
+          const warned = context?.warned;
+          for (const message of messages) {
+            if (warned) {
+              if (warned.has(message)) {
+                continue;
+              }
+              warned.add(message);
+            }
+            options.log(message);
+          }
+        };
+
         // Optimization: Only process URLs if minification is enabled (not identity function)
         // This avoids expensive `replaceAsync` when URL minification is disabled
         if (options.minifyURLs !== identity) {
@@ -213,9 +276,22 @@ const processOptions = (inputOptions, { getLightningCSS, getTerser, getSwc, getS
           );
         }
 
-        // Cache key: Content + type + options signature; large inputs are hashed to avoid huge Map keys
+        // Unused-symbol removal applies to style sheets only
+        const unusedCSSConfig = type === undefined ? options.removeUnusedCSS : undefined;
+        const unusedSymbols = (unusedCSSConfig && context?.usedSymbols)
+          ? findUnusedSymbols(text, context.usedSymbols, unusedCSSConfig.safelist)
+          : undefined;
+
+        // Cache key: Content + type + options signature; large inputs are hashed to avoid huge Map keys.
+        // The symbol list belongs in the signature: The cache outlives a single `minify()` call, so
+        // identical style sheets in differently marked-up documents must not share an entry.
         const inputCSS = wrapCSS(text, type);
-        const cssSig = stableStringify({ type, opts: lightningCssOptions, cont: !!options.continueOnMinifyError });
+        const cssSig = stableStringify({
+          type,
+          opts: lightningCssOptions,
+          cont: !!options.continueOnMinifyError,
+          unused: unusedSymbols && unusedSymbols.length ? unusedSymbols.slice().sort() : undefined
+        });
         const isCacheable = inputCSS.length <= MAX_CACHE_ENTRY_SIZE;
         const cssKey = isCacheable
           ? (inputCSS.length > 2048
@@ -225,10 +301,12 @@ const processOptions = (inputOptions, { getLightningCSS, getTerser, getSwc, getS
 
         try {
           if (cssKey !== undefined) {
-            const cached = /** @type {string | Promise<string> | undefined} */ (cssCache.get(cssKey));
+            const cached = /** @type {CSSResult | Promise<CSSResult> | undefined} */ (cssCache.get(cssKey));
             if (cached !== undefined) {
               // Support both resolved values and in-flight promises
-              return await cached;
+              const settled = await cached;
+              report(settled.warnings);
+              return settled.css;
             }
           }
 
@@ -242,9 +320,26 @@ const processOptions = (inputOptions, { getLightningCSS, getTerser, getSwc, getS
               code: Buffer.from(inputCSS),
               minify: true,
               errorRecovery: !!options.continueOnMinifyError,
-              ...lightningCssOptions
+              ...lightningCssOptions,
+              // Union, so that a manually supplied `unusedSymbols` list survives
+              ...(unusedSymbols && unusedSymbols.length
+                ? { unusedSymbols: lightningCssOptions.unusedSymbols ? [...new Set([...lightningCssOptions.unusedSymbols, ...unusedSymbols])] : unusedSymbols }
+                : {})
             });
 
+            // With `errorRecovery` enabled, Lightning CSS reports what it takes issue
+            // with instead of throwing—dropping the rule in some cases (`@property`
+            // with a bad `syntax`) and passing it through in others (an unknown
+            // at-rule), which is why the wording stops at “reported”
+            /** @type {string[]} */
+            const warnings = [];
+            if (result.warnings) {
+              for (const warning of result.warnings) {
+                const at = warning.loc ? ` (line ${warning.loc.line}, column ${warning.loc.column})` : '';
+                warnings.push(`Warning: Lightning CSS reported invalid CSS${at}: ${warning.message}`);
+              }
+            }
+
             const outputCSS = unwrapCSS(result.code.toString(), type);
 
             // If Lightning CSS removed significant content that looks like template syntax or UIDs, return original
@@ -259,13 +354,15 @@ const processOptions = (inputOptions, { getLightningCSS, getTerser, getSwc, getS
 
             // Preserve if output is empty and input had template syntax or UIDs
             // This catches cases where Lightning CSS removed content that should be preserved
-            return (text.trim() && !outputCSS.trim() && (looksLikeTemplate || hasUID)) ? text : outputCSS;
+            const css = (text.trim() && !outputCSS.trim() && (looksLikeTemplate || hasUID)) ? text : outputCSS;
+            return { css, warnings };
           })();
 
           if (cssKey !== undefined) cssCache.set(cssKey, inFlight);
           const resolved = await inFlight;
           if (cssKey !== undefined) cssCache.set(cssKey, resolved);
-          return resolved;
+          report(resolved.warnings);
+          return resolved.css;
         } catch (err) {
           if (cssKey !== undefined) cssCache.delete(cssKey);
           if (!options.continueOnMinifyError) {
@@ -500,21 +597,47 @@ const processOptions = (inputOptions, { getLightningCSS, getTerser, getSwc, getS
     } else if (['customAttrAssign', 'customEventAttributes', 'ignoreCustomComments', 'ignoreCustomFragments'].includes(key)) {
       // Array of regex patterns
       optionsDynamic[key] = parseRegExpArray(option);
-      // Warn about potential ReDoS when user-provided fragments use unlimited
-      // quantifiers; only explicitly passed fragments are checked
-      if (key === 'ignoreCustomFragments' && !customFragmentQuantifierWarned) {
-        for (const re of /** @type {RegExp[]} */ (optionsDynamic[key])) {
-          if (/[*+]/.test(re.source)) {
-            customFragmentQuantifierWarned = true;
-            warn('HTML Minifier Next: Custom fragment contains unlimited quantifiers (“*” or “+”) which may cause ReDoS vulnerability');
-            break;
-          }
-        }
-      }
     } else {
       optionsDynamic[key] = option;
     }
   });
+
+  // Fragments that compound quantifiers or alternation under unbounded repetition
+  // are the shapes that backtrack catastrophically, and they are also the ones a
+  // linear scan cannot stand in for; so are patterns too long or too deeply
+  // nested to read, which are refused for that rather than for a shape. A lone
+  // `[\s\S]*?` up to a literal terminator is linear and passes; HMN’s default
+  // fragments have exactly that shape, so the check flagging it would mean
+  // warning about the defaults themselves.
+  for (const re of options.ignoreCustomFragments || []) {
+    const risk = describeQuantifierRisk(re.source);
+    if (!risk) continue;
+    const problem = `Custom fragment \`/${re.source}/\` ${risk}`;
+    if (options.strictCustomFragments) {
+      throw new Error(`HTML Minifier Next: ${problem}`);
+    }
+    if (!customFragmentsWarned.has(re.source)) {
+      customFragmentsWarned.add(re.source);
+      warn(`HTML Minifier Next: ${problem}`);
+    }
+  }
+
+  // Unused-CSS removal rides along with Lightning CSS, so it silently does nothing
+  // when `minifyCSS` is off or replaced by a function—say so rather than let it pass
+  if (options.removeUnusedCSS) {
+    const cssOption = /** @type {Record<string, any>} */ (effectiveInput).minifyCSS;
+    const reason = typeof cssOption === 'function'
+      ? 'it does not apply when `minifyCSS` is a function'
+      : (options.minifyCSS === identity ? 'it requires `minifyCSS` (`--minify-css`)' : '');
+    if (reason) {
+      if (!unusedCSSWarned.has(reason)) {
+        unusedCSSWarned.add(reason);
+        warn(`HTML Minifier Next: Ignoring \`removeUnusedCSS\`—${reason}`);
+      }
+      options.removeUnusedCSS = null;
+    }
+  }
+
   return options;
 };