html-minifier-next 8.0.0 → 8.1.0

package/README.md

@@ -547,6 +547,14 @@ For partial HTML fragments (such as template includes, SSI fragments, or closing
 
 To validate complete HTML markup, use [the W3C validator](https://validator.w3.org/) or one of [several validator packages](https://meiert.com/blog/html-validator-packages/).
 
+### Regex options and flags
+
+`customAttrAssign` and `customAttrSurround` patterns are merged into one attribute pattern which carries no flags of its own. `i` and `s` are written into each pattern’s source instead, so they survive the merge. `u`, `v`, and `m` cannot be, and none of them fails loudly when dropped: `u` and `v` only narrow what syntax is legal, so a source valid under either stays valid without it and quietly matches something else—a dropped `u` leaves `\p{L}` matching the literal text `p{L}`—while a dropped `m` leaves `^` and `$` matching at the ends of the input rather than of each line.
+
+A pattern is therefore refused with an error where the flag changes what its source matches—a property or code point escape, a character past the BMP, a character `i` folds by Unicode rules only while `u` is there (`/s/iu` matches `\u017F`, `/k/iu` matches `\u212A`), a `v` class that nests, subtracts, intersects, or holds strings, or—under `m`—an anchor whose meaning moves. A flag the source does not depend on, as in `/x=/u`, is left alone.
+
+Patterns given as strings, in a configuration file or on the command line, may be written either bare (`ng-class`) or delimited with flags (`/ng-class/i`).
+
 ## Security
 
 ### ReDoS protection
@@ -555,7 +563,11 @@ You can use `ignoreCustomFragments` to hand HTML Minifier Next a regular express
 
 * Matching without backtracking: A pattern that wraps an any-character or negated-class body in literal delimiters—`<%[\s\S]*?%>` or `\{\{[^}]*?\}\}`, and every other shape below—is matched by scanning for those delimiters in linear time, with no regular expression involved. Patterns of other shapes run as regular expressions, one per pattern, so each keeps its own flags.
 
-* Pattern detection: HMN warns about the shapes that backtrack catastrophically—an unlimited quantifier over a group that itself contains a quantifier that can vary (`(a+)+`, `(a?)+`) or alternation (`(a|b)*`), and the same atom repeated unboundedly twice in a row (`.*.*`). A fixed count does not vary, so `(?:a{4})+` passes. These are also shapes a linear scan cannot stand in for. `strictCustomFragments` refuses them with an error instead, which is worth enabling where the patterns or the input are not entirely under your control. A pattern longer than 10,000 characters or nested more than 50 groups deep is judged risky without being analyzed further, so that reading the pattern cannot itself become the expensive step.
+* Pattern detection: HMN warns about the shapes that backtrack catastrophically—an unlimited quantifier over a group that itself contains a quantifier that can vary (`(a+)+`, `(a?)+`) or alternation (`(a|b)*`), and two unbounded repeats that can consume the same character with only atoms matching empty between them (`.*.*`, `[a]*a*`, `\w*\d*`, `a*b*a*`).
+
+  A group is no wall: It counts by what its body can match, and repeats meet across its boundary, so `\s*(\w*)\s*` and `(a*)a*` are flagged like `\s*\w*\s*` and `a*a*`. A lookaround backtracks nothing, so `(?=a*)a*` passes. A fixed count does not vary, so `(?:a{4})+` passes; repeats that share no character leave nothing ambiguous to split, so `\s*\S*` passes. A pattern is read the way its own flags make it match, so `/.*\n*/s` and `/[a]*A*/i` are flagged where those same sources without the flags are not. Under `v`, a class that nests reads as the union it is, while one that subtracts (`--`) or intersects (`&&`) is left unread and passes.
+
+  These are also shapes a linear scan cannot stand in for. `strictCustomFragments` refuses them with an error instead, which is worth enabling where the patterns or the input are not entirely under your control. A pattern longer than 10,000 characters or nested more than 50 groups deep is judged risky without being analyzed further, so that reading the pattern cannot itself become the expensive step. The check reads shapes, not languages: It warns about the common ones rather than proving a pattern linear, and misses repeats that overlap only across whole subexpressions (`(ab)*(abab)*`). **Treat a pattern that passes as unflagged, not as vetted.**
 
 * Input length limits: The `maxInputLength` option allows you to set a maximum input size to prevent processing of excessively large inputs that could cause performance issues.
 
@@ -579,7 +591,8 @@ ignoreCustomFragments: [
 ignoreCustomFragments: [
   /<%(\s|\S)*?%>/,               // Unlimited quantifier over an alternating group
   /\{\{([^}]+)+\}\}/,            // Nested unlimited quantifiers
-  /<!--[\s\S]*[\s\S]*-->/        // The same atom repeated unboundedly twice
+  /<!--[\s\S]*[\s\S]*-->/,       // Two unbounded repeats in a row
+  /<%\w*\d*%>/                   // Two unbounded repeats over overlapping sets
 ]
 ```
 

package/dist/types/lib/options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../../../src/lib/options.js"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAA8H,MAAM,YAAY,CAAC;AAQzJ,OAAQ,KAAA,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AASrE,YAA4D,UAAU,GAA5D;IAAC,WAAW,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAAC,CAAY;AAOtE,YAA6C,SAAS,GAA5C;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAC,CAAW;AAUtD,YAgBG,gBAAgB,GAhBT,IAAI,CAAC,eAAe,EAAE,QAAQ,GAAG,uBAAuB,GAAG,mBAAmB,GAAG,sBAAsB,GAAG,KAAK,GAAG,WAAW,GAAG,UAAU,GAAG,YAAY,GAAG,WAAW,GAAG,iBAAiB,CAAC,GAAG;IACvM,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IAC/B,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,OAAO,CAAC;IAC/B,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,qBAAqB,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,KAAK,OAAO,CAAC;IAC7G,iBAAiB,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,KAAK,OAAO,CAAC;IACzG,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3F,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,OAAO,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3F,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,SAAS,EAAE,CAAC,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,CAAC;IACrE,eAAe,EAAE;QAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAC,GAAG,IAAI,CAAC;IAC7E,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACtC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACpC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B,CAAkB;AA1CtB,2EAA2E;AAI3E;;;;;;GAMG;AAEH;;;;;GAKG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,wCAAwC;AACxC,iBAAS,qBAAqB,CAAC,OAAO,EAD1B,gBAC0B,WAUrC;AAwCD;;;;GAIG;AACH,QAAA,MAAM,cAAc,iBAJT,eAAe,mGACf;IAAC,eAAe,CAAC,EAAE,WAAW,SAAS,CAAC;IAAC,SAAS,CAAC,EAAE,WAAW,SAAS,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,SAAS,CAAC;IAAC,OAAO,CAAC,EAAE,WAAW,SAAS,CAAC;IAAC,cAAc,CAAC,EAAE,GAAG,GAAG,SAAS,CAAC;IAAC,aAAa,CAAC,EAAE,GAAG,GAAG,SAAS,CAAC;IAAC,cAAc,CAAC,EAAE,GAAG,GAAG,SAAS,CAAA;CAAC,KAC5O,gBAmhBZ,CAAC;AAIF,OAAO,EACL,qBAAqB,EACrB,cAAc,EACf,CAAC"}
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../../../src/lib/options.js"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAwI,MAAM,YAAY,CAAC;AAQnK,OAAQ,KAAA,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AASrE,YAA4D,UAAU,GAA5D;IAAC,WAAW,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAAC,CAAY;AAOtE,YAA6C,SAAS,GAA5C;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAC,CAAW;AAUtD,YAgBG,gBAAgB,GAhBT,IAAI,CAAC,eAAe,EAAE,QAAQ,GAAG,uBAAuB,GAAG,mBAAmB,GAAG,sBAAsB,GAAG,KAAK,GAAG,WAAW,GAAG,UAAU,GAAG,YAAY,GAAG,WAAW,GAAG,iBAAiB,CAAC,GAAG;IACvM,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IAC/B,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,OAAO,CAAC;IAC/B,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,qBAAqB,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,KAAK,OAAO,CAAC;IAC7G,iBAAiB,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,KAAK,OAAO,CAAC;IACzG,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3F,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,OAAO,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3F,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,SAAS,EAAE,CAAC,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,CAAC;IACrE,eAAe,EAAE;QAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAC,GAAG,IAAI,CAAC;IAC7E,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACtC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACpC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B,CAAkB;AA1CtB,2EAA2E;AAI3E;;;;;;GAMG;AAEH;;;;;GAKG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,wCAAwC;AACxC,iBAAS,qBAAqB,CAAC,OAAO,EAD1B,gBAC0B,WAUrC;AAwCD;;;;GAIG;AACH,QAAA,MAAM,cAAc,iBAJT,eAAe,mGACf;IAAC,eAAe,CAAC,EAAE,WAAW,SAAS,CAAC;IAAC,SAAS,CAAC,EAAE,WAAW,SAAS,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,SAAS,CAAC;IAAC,OAAO,CAAC,EAAE,WAAW,SAAS,CAAC;IAAC,cAAc,CAAC,EAAE,GAAG,GAAG,SAAS,CAAC;IAAC,aAAa,CAAC,EAAE,GAAG,GAAG,SAAS,CAAC;IAAC,cAAc,CAAC,EAAE,GAAG,GAAG,SAAS,CAAA;CAAC,KAC5O,gBAsiBZ,CAAC;AAIF,OAAO,EACL,qBAAqB,EACrB,cAAc,EACf,CAAC"}

package/dist/types/lib/unused-css.d.ts

@@ -2,7 +2,7 @@
  * Collect the class names and IDs a document references.
  *
  * Style sheet contents are excluded, so that a style sheet never counts as
- * evidence for its own selectors. An `iframe srcdoc` value is not scanned
+ * evidence for its own selectors. An `iframe srcdoc` value is not scanned,
  * either: It holds a document of its own, minified against its own symbol set.
  * Over-collecting is safe here (a symbol wrongly considered used is merely
  * kept), under-collecting is not.

package/dist/types/lib/utils.d.ts

@@ -51,6 +51,17 @@ declare function lowercase(value: string): string;
 declare function replaceAsync(str: string, regex: RegExp, asyncFn: Function): Promise<string>;
 /** @param {string | RegExp} value */
 declare function parseRegExp(value: string | RegExp): RegExp | undefined;
+/**
+ * Which flag changes what a source matches, so that embedding the source where the
+ * flag cannot follow would silently match something else. `u` and `v` only narrow
+ * what syntax is legal, so a source valid under either stays valid without it—the
+ * difference never surfaces as a syntax error, and this stands in for the one that
+ * would otherwise be raised.
+ * @param {RegExp} pattern
+ * @returns {'u' | 'v' | 'm' | null} The flag the source depends on, or `null` where
+ *   every flag it carries would leave the source matching the same
+ */
+declare function lostFlag(pattern: RegExp): 'u' | 'v' | 'm' | null;
 /**
  * A pattern’s source, rewritten to match the way its own flags make it match, for
  * embedding in a larger regex that cannot carry them. `i` and `s` fit into a
@@ -62,12 +73,17 @@ declare function parseRegExp(value: string | RegExp): RegExp | undefined;
  * @returns {string}
  */
 declare function embedSource(pattern: RegExp): string;
+export type Repeat = {
+    text: string;
+    ranges: [number, number][] | null;
+};
 /**
- * @param {string} source - Regex source to judge
+ * @param {RegExp | string} pattern - Pattern to judge, or a bare source to read
+ *   as it stands
  * @returns {string | null} What makes the pattern a backtracking risk, phrased
  *   to follow the pattern itself, or `null` where it is none
  */
-declare function describeQuantifierRisk(source: string): string | null;
+declare function describeQuantifierRisk(pattern: RegExp | string): string | null;
 /**
  * Find the index of the `>` that closes an opening tag, correctly skipping
  * over quoted attribute values (which may contain `>`).
@@ -76,5 +92,5 @@ declare function describeQuantifierRisk(source: string): string | null;
  * @returns {number} Index of the closing `>`, or -1 if not found
  */
 declare function findTagEnd(html: string, pos: number): number;
-export { stableStringify, findTagEnd, LRU, MAX_CACHE_ENTRY_SIZE, hashContent, uniqueId, identity, isThenable, lowercase, replaceAsync, parseRegExp, embedSource, describeQuantifierRisk };
+export { stableStringify, findTagEnd, LRU, MAX_CACHE_ENTRY_SIZE, hashContent, uniqueId, identity, isThenable, lowercase, replaceAsync, parseRegExp, embedSource, lostFlag, describeQuantifierRisk };
 //# sourceMappingURL=utils.d.ts.map

package/dist/types/lib/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../src/lib/utils.js"],"names":[],"mappings":"AAEA;;;GAGG;AACH,iBAAS,eAAe,CAAC,GAAG,EAHjB,OAGiB,GAFf,MAAM,CAYlB;AAID,cAAM,GAAG;IAEA,KAAK;IACL,IAAI;IACJ,IAAI;IACT,mCAAmC;IAC9B,GAAG,EADG,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC;IAJjC,YAAY,KAAK,SAAM,EAMtB;IACD,0BAA0B;IAC1B,GAAG,CAAC,GAAG,EADK,MACL,WAUN;IACD;;;OAGG;IACH,GAAG,CAAC,GAAG,EAHI,MAGJ,EAAE,KAAK,EAFH,OAEG,QAOb;IACD,0BAA0B;IAC1B,MAAM,CAAC,GAAG,EADE,MACF,QAA2B;IACrC,6EAA6E;IAC7E,KAAK,IADS;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAGxE;CACF;AAKD,QAAA,MAAM,oBAAoB,QAAc,CAAC;AAIzC,0BAA0B;AAC1B,iBAAS,WAAW,CAAC,GAAG,EADZ,MACY,UAOvB;AAID,4BAA4B;AAC5B,iBAAS,QAAQ,CAAC,KAAK,EADX,MACW,UAMtB;AAID,4BAA4B;AAC5B,iBAAS,QAAQ,CAAC,KAAK,EADX,MACW,UAEtB;AAED;;;GAGG;AACH,iBAAS,UAAU,CAAC,KAAK,EAHd,OAGc,GAFZ,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC,CAIrC;AAED,4BAA4B;AAC5B,iBAAS,SAAS,CAAC,KAAK,EADZ,MACY,UAEvB;AAID;;;;;;GAMG;AACH,iBAAe,YAAY,CAAC,GAAG,EALpB,MAKoB,EAAE,KAAK,EAJ3B,MAI2B,EAAE,OAAO,UAAA,GAFlC,OAAO,CAAC,MAAM,CAAC,CAe3B;AAID,qCAAqC;AACrC,iBAAS,WAAW,CAAC,KAAK,EADd,MAAM,GAAG,MACK,sBAUzB;AAqLD;;;;;;;;;GASG;AACH,iBAAS,WAAW,CAAC,OAAO,EAHjB,MAGiB,GAFf,MAAM,CAOlB;AAyFD;;;;GAIG;AACH,iBAAS,sBAAsB,CAAC,MAAM,EAJ3B,MAI2B,GAHzB,MAAM,GAAG,IAAI,CAezB;AAED;;;;;;GAMG;AACH,iBAAS,UAAU,CAAC,IAAI,EAJb,MAIa,EAAE,GAAG,EAHlB,MAGkB,GAFhB,MAAM,CAelB;AAID,OAAO,EACL,eAAe,EACf,UAAU,EACV,GAAG,EACH,oBAAoB,EACpB,WAAW,EACX,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,SAAS,EACT,YAAY,EACZ,WAAW,EACX,WAAW,EACX,sBAAsB,EACvB,CAAC"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../src/lib/utils.js"],"names":[],"mappings":"AAEA;;;GAGG;AACH,iBAAS,eAAe,CAAC,GAAG,EAHjB,OAGiB,GAFf,MAAM,CAYlB;AAID,cAAM,GAAG;IAEA,KAAK;IACL,IAAI;IACJ,IAAI;IACT,mCAAmC;IAC9B,GAAG,EADG,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC;IAJjC,YAAY,KAAK,SAAM,EAMtB;IACD,0BAA0B;IAC1B,GAAG,CAAC,GAAG,EADK,MACL,WAUN;IACD;;;OAGG;IACH,GAAG,CAAC,GAAG,EAHI,MAGJ,EAAE,KAAK,EAFH,OAEG,QAOb;IACD,0BAA0B;IAC1B,MAAM,CAAC,GAAG,EADE,MACF,QAA2B;IACrC,6EAA6E;IAC7E,KAAK,IADS;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAGxE;CACF;AAKD,QAAA,MAAM,oBAAoB,QAAc,CAAC;AAIzC,0BAA0B;AAC1B,iBAAS,WAAW,CAAC,GAAG,EADZ,MACY,UAOvB;AAID,4BAA4B;AAC5B,iBAAS,QAAQ,CAAC,KAAK,EADX,MACW,UAMtB;AAID,4BAA4B;AAC5B,iBAAS,QAAQ,CAAC,KAAK,EADX,MACW,UAEtB;AAED;;;GAGG;AACH,iBAAS,UAAU,CAAC,KAAK,EAHd,OAGc,GAFZ,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC,CAIrC;AAED,4BAA4B;AAC5B,iBAAS,SAAS,CAAC,KAAK,EADZ,MACY,UAEvB;AAID;;;;;;GAMG;AACH,iBAAe,YAAY,CAAC,GAAG,EALpB,MAKoB,EAAE,KAAK,EAJ3B,MAI2B,EAAE,OAAO,UAAA,GAFlC,OAAO,CAAC,MAAM,CAAC,CAe3B;AAID,qCAAqC;AACrC,iBAAS,WAAW,CAAC,KAAK,EADd,MAAM,GAAG,MACK,sBAUzB;AAyYD;;;;;;;;;GASG;AACH,iBAAS,QAAQ,CAAC,OAAO,EAJd,MAIc,GAHZ,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,IAAI,CAqDlC;AAED;;;;;;;;;GASG;AACH,iBAAS,WAAW,CAAC,OAAO,EAHjB,MAGiB,GAFf,MAAM,CAOlB;AAGE,YAA6D,MAAM,GAAzD;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,IAAI,CAAA;CAAC,CAE7D;AAqKD;;;;;GAKG;AACH,iBAAS,sBAAsB,CAAC,OAAO,EAL5B,MAAM,GAAG,MAKmB,GAH1B,MAAM,GAAG,IAAI,CAqBzB;AAED;;;;;;GAMG;AACH,iBAAS,UAAU,CAAC,IAAI,EAJb,MAIa,EAAE,GAAG,EAHlB,MAGkB,GAFhB,MAAM,CAelB;AAID,OAAO,EACL,eAAe,EACf,UAAU,EACV,GAAG,EACH,oBAAoB,EACpB,WAAW,EACX,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,SAAS,EACT,YAAY,EACZ,WAAW,EACX,WAAW,EACX,QAAQ,EACR,sBAAsB,EACvB,CAAC"}

package/package.json

@@ -95,5 +95,5 @@
   },
   "type": "module",
   "types": "dist/types/htmlminifier.d.ts",
-  "version": "8.0.0"
+  "version": "8.1.0"
 }

package/src/lib/fragments.js

@@ -225,7 +225,7 @@ function replaceCustomFragments(value, fragments, replacer) {
           ? previous
           : ('open' in fragment ? scan(fragment, i, from, false) : run(fragment, from, false));
         found[i] = match;
-        // Nothing ahead now means nothing ahead later either
+        // Nothing ahead now means nothing ahead later, either
         if (!match) exhausted[i] = true;
       }
 

package/src/lib/options.js

@@ -1,5 +1,5 @@
 import { createUrlMinifier } from './urls.js';
-import { LRU, MAX_CACHE_ENTRY_SIZE, stableStringify, hashContent, identity, lowercase, replaceAsync, parseRegExp, describeQuantifierRisk } from './utils.js';
+import { LRU, MAX_CACHE_ENTRY_SIZE, stableStringify, hashContent, identity, lowercase, replaceAsync, parseRegExp, describeQuantifierRisk, lostFlag } from './utils.js';
 import { RE_TRAILING_SEMICOLON } from './constants.js';
 import { canCollapseWhitespace, canTrimWhitespace } from './whitespace.js';
 import { wrapCSS, unwrapCSS } from './content.js';
@@ -602,6 +602,25 @@ const processOptions = (inputOptions, { getLightningCSS, getTerser, getSwc, getS
     }
   });
 
+  // The parser merges these into one attribute pattern, and a merged pattern
+  // carries no flags of its own. `i` and `s` are written into the source instead,
+  // but `u` and `v` change how a source reads and cannot be: dropped, `\p{L}`
+  // stops being a property escape and matches the literal text `p{L}`, silently
+  // and without failing to compile. Refusing them beats matching the wrong thing.
+  /** @type {[string, RegExp[]][]} */
+  const merged = [
+    ['customAttrAssign', options.customAttrAssign || []],
+    ['customAttrSurround', (options.customAttrSurround || []).flat()]
+  ];
+  for (const [key, patterns] of merged) {
+    for (const re of patterns) {
+      if (!(re instanceof RegExp)) continue;
+      const flag = lostFlag(re);
+      if (!flag) continue;
+      throw new Error(`HTML Minifier Next: \`${key}\` pattern \`/${re.source}/${re.flags}\` carries \`${flag}\`, which the merged attribute pattern cannot carry—rewrite it without \`${flag}\``);
+    }
+  }
+
   // Fragments that compound quantifiers or alternation under unbounded repetition
   // are the shapes that backtrack catastrophically, and they are also the ones a
   // linear scan cannot stand in for; so are patterns too long or too deeply
@@ -610,7 +629,7 @@ const processOptions = (inputOptions, { getLightningCSS, getTerser, getSwc, getS
   // fragments have exactly that shape, so the check flagging it would mean
   // warning about the defaults themselves.
   for (const re of options.ignoreCustomFragments || []) {
-    const risk = describeQuantifierRisk(re.source);
+    const risk = describeQuantifierRisk(re);
     if (!risk) continue;
     const problem = `Custom fragment \`/${re.source}/\` ${risk}`;
     if (options.strictCustomFragments) {

package/src/lib/unused-css.js

@@ -170,7 +170,7 @@ function findRawTextElements(haystack, tagName) {
  * Collect the class names and IDs a document references.
  *
  * Style sheet contents are excluded, so that a style sheet never counts as
- * evidence for its own selectors. An `iframe srcdoc` value is not scanned
+ * evidence for its own selectors. An `iframe srcdoc` value is not scanned,
  * either: It holds a document of its own, minified against its own symbol set.
  * Over-collecting is safe here (a symbol wrongly considered used is merely
  * kept), under-collecting is not.

package/src/lib/utils.js

@@ -145,6 +145,67 @@ function parseRegExp(value) {
   return value;
 }
 
+// Regex source reading, shared by the analysis and the rewriting below
+
+const RE_ASCII_LETTER = /^[a-zA-Z]$/;
+const RE_HEX_PAIR = /^[0-9a-fA-F]{2}$/;
+const RE_HEX_QUAD = /^[0-9a-fA-F]{4}$/;
+
+/**
+ * @param {string} source @param {number} index - Index of the opening `[`
+ * @param {boolean} [nested] - Whether the pattern carries `v`, where a class nests
+ *   inside a class and the first `]` need not be the one that closes it
+ * @returns {number} Index just past the closing `]`
+ */
+function skipCharacterClass(source, index, nested = false) {
+  let i = index + 1;
+  let open = 1;
+  while (i < source.length && open > 0) {
+    const char = source[i];
+    if (char === '\\') i += tokenLength(source, i);
+    else {
+      if (nested && char === '[') open++;
+      else if (char === ']') open--;
+      i++;
+    }
+  }
+  return i;
+}
+
+/**
+ * Length of the token at `index`, so that a multi-character escape is read whole
+ * rather than leaving its tail to be mistaken for literals.
+ * @param {string} source @param {number} index
+ */
+function tokenLength(source, index) {
+  if (source[index] !== '\\') return 1;
+  const next = source[index + 1];
+  if (next === 'x' && RE_HEX_PAIR.test(source.slice(index + 2, index + 4))) return 4;
+  if (next === 'u') {
+    if (source[index + 2] === '{') {
+      const close = source.indexOf('}', index + 3);
+      if (close !== -1) return close - index + 1;
+    }
+    if (RE_HEX_QUAD.test(source.slice(index + 2, index + 6))) return 6;
+  }
+  if (next === 'c' && RE_ASCII_LETTER.test(source[index + 2] ?? '')) return 3;
+  // A `v` class holds string literals, which fold as strings or not at all
+  if (next === 'q' && source[index + 2] === '{') {
+    const close = source.indexOf('}', index + 3);
+    if (close !== -1) return close - index + 1;
+  }
+  // A property name or a group name is syntax, not text to fold
+  if ((next === 'p' || next === 'P') && source[index + 2] === '{') {
+    const close = source.indexOf('}', index + 3);
+    if (close !== -1) return close - index + 1;
+  }
+  if (next === 'k' && source[index + 2] === '<') {
+    const close = source.indexOf('>', index + 3);
+    if (close !== -1) return close - index + 1;
+  }
+  return 2;
+}
+
 // ReDoS risk detection for user-supplied patterns
 
 // Quantifier following an atom, with its optional lazy `?`; the captures hold
@@ -164,14 +225,15 @@ const RE_TRANSPARENT_GROUP = /^\((?:\?:|\?<[^>=!][^>]*>)?([\s\S]*)\)$/;
 // A quantifier of exactly one repetition, which is notation rather than shape
 const RE_EXACT_ONE = /\{1(?:,1)?\}\??$/;
 
-/** @param {string} source @param {number} index - Index of the opening `[` */
-function skipCharacterClass(source, index) {
-  let i = index + 1;
-  while (i < source.length && source[i] !== ']') {
-    i += source[i] === '\\' ? 2 : 1;
-  }
-  return i + 1;
-}
+// An atom that matches without consuming, so what precedes it stays adjacent to
+// what follows; a group that can match empty is left out, being rare enough that
+// missing it costs less than reading every body for it
+const RE_ZERO_WIDTH = /^(?:[$^]|\\[bB]|\((?:\?[=!]|\?<[=!]))/;
+
+// How many repeats an atom may still be adjacent to across atoms matching empty;
+// comparing against every one of them is what the bound keeps from turning
+// quadratic on a pattern that is nothing but repeats
+const MAX_REACHABLE = 50;
 
 /** @param {string} atom - Atom as it reads in the source */
 function unwrapAtom(atom) {
@@ -184,15 +246,156 @@ function unwrapAtom(atom) {
   return inner;
 }
 
+// Two atoms that repeat unboundedly side by side split a run between them in as
+// many ways as the run is long, whenever both can consume the same character.
+// Comparing what they match, rather than how they are spelled, is what catches
+// `[a]*a*` and `\w*\d*` alongside `a*a*`.
+
+const MAX_CODE_POINT = 0x10FFFF;
+
+/** @type {Record<string, [number, number][]>} */
+const CLASS_ESCAPE_RANGES = {
+  d: [[0x30, 0x39]],
+  w: [[0x30, 0x39], [0x41, 0x5A], [0x5F, 0x5F], [0x61, 0x7A]],
+  s: [[0x09, 0x0D], [0x20, 0x20], [0xA0, 0xA0], [0x1680, 0x1680], [0x2000, 0x200A],
+    [0x2028, 0x2029], [0x202F, 0x202F], [0x205F, 0x205F], [0x3000, 0x3000], [0xFEFF, 0xFEFF]]
+};
+
+/** @type {Record<string, number>} */
+const CONTROL_ESCAPE_CODES = { 0: 0x00, f: 0x0C, n: 0x0A, r: 0x0D, t: 0x09, v: 0x0B };
+
+// An escape that stands for something other than one character of text
+const RE_NON_CHARACTER_ESCAPE = /[bBdDkpPsSwW1-9]/;
+
+/** @param {[number, number][]} ranges */
+function complement(ranges) {
+  const sorted = [...ranges].sort((one, other) => one[0] - other[0]);
+  /** @type {[number, number][]} */
+  const out = [];
+  let next = 0;
+  for (const [low, high] of sorted) {
+    if (low > next) out.push([next, low - 1]);
+    next = Math.max(next, high + 1);
+  }
+  if (next <= MAX_CODE_POINT) out.push([next, MAX_CODE_POINT]);
+  return out;
+}
+
+// `.` as a bare source reads it, without the `s` flag the source cannot carry
+const DOT_RANGES = complement([[0x0A, 0x0A], [0x0D, 0x0D], [0x2028, 0x2029]]);
+
+/**
+ * @param {string} token - One token, as `tokenLength` measures it
+ * @param {boolean} [inClass] - Whether the token sits inside a character class
+ * @returns {[number, number][] | null} What it matches, or `null` where it is not
+ *   one character of text
+ */
+function tokenRanges(token, inClass = false) {
+  if (token[0] !== '\\') {
+    const code = token.codePointAt(0) ?? 0;
+    return String.fromCodePoint(code) === token ? [[code, code]] : null;
+  }
+
+  const kind = token[1] ?? '';
+  const named = CLASS_ESCAPE_RANGES[kind.toLowerCase()];
+  if (named) return kind === kind.toLowerCase() ? named : complement(named);
+
+  const control = CONTROL_ESCAPE_CODES[kind];
+  if (control !== undefined) return [[control, control]];
+
+  if (kind === 'x' || kind === 'u') {
+    const code = Number.parseInt(token[2] === '{' ? token.slice(3, -1) : token.slice(2), 16);
+    return Number.isNaN(code) || code > MAX_CODE_POINT ? null : [[code, code]];
+  }
+  if (kind === 'c') {
+    const code = token.charCodeAt(2) % 32;
+    return [[code, code]];
+  }
+  // `\b` asserts a word boundary on its own, and is a backspace inside a class
+  if (kind === 'b' && inClass) return [[0x08, 0x08]];
+  // `\q{…}` stands for whole strings, not for a character
+  if (token.startsWith('\\q{')) return null;
+  if (RE_NON_CHARACTER_ESCAPE.test(kind)) return null;
+
+  // The rest is punctuation escaped to be read as itself
+  const code = token.codePointAt(1) ?? 0;
+  return String.fromCodePoint(code) === token.slice(1) ? [[code, code]] : null;
+}
+
+/** @param {[number, number][] | null} ranges @returns {number | null} The one code point it holds */
+function singleCode(ranges) {
+  const [range] = ranges ?? [];
+  return ranges?.length === 1 && range && range[0] === range[1] ? range[0] : null;
+}
+
+/**
+ * @param {string} atom - Atom as it reads in the source, already unwrapped
+ * @param {boolean} [nested] - Whether the pattern carries `v`
+ * @param {number} [depth] - Class nesting level of this call
+ * @returns {[number, number][] | null} What it matches, or `null` where it is not
+ *   one character of text, or one this does not read
+ */
+function atomRanges(atom, nested = false, depth = 0) {
+  if (depth > MAX_PATTERN_DEPTH) return null;
+  if (atom === '.') return DOT_RANGES;
+  if (atom[0] !== '[') return tokenRanges(atom);
+  if (!atom.endsWith(']')) return null;
+
+  let i = atom[1] === '^' ? 2 : 1;
+  const negated = i === 2;
+  const end = atom.length - 1;
+  /** @type {[number, number][]} */
+  const members = [];
+
+  while (i < end) {
+    // A `v` class nests, and nesting alone is a union to read through
+    if (nested && atom[i] === '[') {
+      const close = skipCharacterClass(atom, i, true);
+      const inner = atomRanges(atom.slice(i, close), true, depth + 1);
+      if (!inner) return null;
+      members.push(...inner);
+      i = close;
+      continue;
+    }
+    // Subtraction and intersection are not unions, and are left unread
+    //
+    // @@ Read `--` and `&&` as set difference and intersection
+    // (so that a `v` class built is compared rather than passed unjudged)
+    if (nested && (atom.startsWith('--', i) || atom.startsWith('&&', i))) return null;
+
+    const fromLength = tokenLength(atom, i);
+    const from = tokenRanges(atom.slice(i, i + fromLength), true);
+    if (!from) return null;
+    i += fromLength;
+
+    // A dash right before the closing `]` is a member, not the start of a range
+    if (atom[i] !== '-' || i + 1 >= end) {
+      members.push(...from);
+      continue;
+    }
+    const toLength = tokenLength(atom, i + 1);
+    // Only single characters bound a range; `\d-z` is not a range at all
+    const low = singleCode(from);
+    const high = singleCode(tokenRanges(atom.slice(i + 1, i + 1 + toLength), true));
+    if (low === null || high === null) return null;
+    members.push([low, high]);
+    i += 1 + toLength;
+  }
+
+  return negated ? complement(members) : members;
+}
+
+/** @param {[number, number][]} ranges @param {[number, number][]} other */
+function rangesIntersect(ranges, other) {
+  return ranges.some(([low, high]) => other.some(([otherLow, otherHigh]) =>
+    low <= otherHigh && otherLow <= high));
+}
+
 // Embedding a pattern in a larger regex drops the flags it carried, so the two
 // a source can carry on its own are rewritten into it
 //
 // @@ Replace with inline `(?i:…)` and `(?s:…)` modifiers once Node floor reaches 24
 
-const RE_ASCII_LETTER = /^[a-zA-Z]$/;
-const RE_HEX_PAIR = /^[0-9a-fA-F]{2}$/;
-const RE_HEX_QUAD = /^[0-9a-fA-F]{4}$/;
-
 /** @param {string} char @returns {boolean} Whether the character has a single-character counterpart */
 function foldsCase(char) {
   const lower = char.toLowerCase();
@@ -206,36 +409,10 @@ function isLower(char) {
 }
 
 /**
- * Length of the token at `index`, so that a multi-character escape is read whole
- * rather than leaving its tail to be mistaken for literals.
- * @param {string} source @param {number} index
+ * @param {string} source - Regex source, assumed syntactically valid
+ * @param {boolean} [nested] - Whether the pattern carries `v`
  */
-function tokenLength(source, index) {
-  if (source[index] !== '\\') return 1;
-  const next = source[index + 1];
-  if (next === 'x' && RE_HEX_PAIR.test(source.slice(index + 2, index + 4))) return 4;
-  if (next === 'u') {
-    if (source[index + 2] === '{') {
-      const close = source.indexOf('}', index + 3);
-      if (close !== -1) return close - index + 1;
-    }
-    if (RE_HEX_QUAD.test(source.slice(index + 2, index + 6))) return 6;
-  }
-  if (next === 'c' && RE_ASCII_LETTER.test(source[index + 2] ?? '')) return 3;
-  // A property name or a group name is syntax, not text to fold
-  if ((next === 'p' || next === 'P') && source[index + 2] === '{') {
-    const close = source.indexOf('}', index + 3);
-    if (close !== -1) return close - index + 1;
-  }
-  if (next === 'k' && source[index + 2] === '<') {
-    const close = source.indexOf('>', index + 3);
-    if (close !== -1) return close - index + 1;
-  }
-  return 2;
-}
-
-/** @param {string} source - Regex source, assumed syntactically valid */
-function expandDotAll(source) {
+function expandDotAll(source, nested = false) {
   let out = '';
   let i = 0;
   while (i < source.length) {
@@ -245,7 +422,7 @@ function expandDotAll(source) {
       out += source.slice(i, i + length);
       i += length;
     } else if (char === '[') {
-      const end = skipCharacterClass(source, i);
+      const end = skipCharacterClass(source, i, nested);
       out += source.slice(i, end);
       i = end;
     } else if (char === '.') {
@@ -259,22 +436,25 @@ function expandDotAll(source) {
   return out;
 }
 
-/** @param {string} source - Regex source, assumed syntactically valid */
-function foldCase(source) {
+/**
+ * @param {string} source - Regex source, assumed syntactically valid
+ * @param {boolean} [nested] - Whether the pattern carries `v`
+ */
+function foldCase(source, nested = false) {
   let out = '';
   let i = 0;
-  let inClass = false;
+  let open = 0;
 
   while (i < source.length) {
     const char = source[i] ?? '';
 
-    if (!inClass) {
+    if (open === 0) {
       if (char === '\\') {
         const length = tokenLength(source, i);
         out += source.slice(i, i + length);
         i += length;
       } else if (char === '[') {
-        inClass = true;
+        open = 1;
         out += char;
         i++;
       } else if (char === '(' && source.startsWith('(?<', i) &&
@@ -291,8 +471,15 @@ function foldCase(source) {
       continue;
     }
 
+    if (nested && char === '[') {
+      open++;
+      out += char;
+      i++;
+      continue;
+    }
+
     if (char === ']') {
-      inClass = false;
+      open--;
       out += char;
       i++;
       continue;
@@ -324,6 +511,93 @@ function foldCase(source) {
   return out;
 }
 
+/**
+ * Whether a source anchors anywhere, so that `m` would move where it matches
+ * @param {string} source @param {boolean} [nested] - Whether the pattern carries `v`
+ */
+function hasAnchor(source, nested = false) {
+  let i = 0;
+  while (i < source.length) {
+    if (source[i] === '\\') i += tokenLength(source, i);
+    // Inside a class `^` negates and `$` is a member, so neither anchors there
+    else if (source[i] === '[') i = skipCharacterClass(source, i, nested);
+    else if (source[i] === '^' || source[i] === '$') return true;
+    else i++;
+  }
+  return false;
+}
+
+// A property escape or a code point escape, both of which read as literal text
+// where the flag that gives them meaning is gone
+const RE_UNICODE_ESCAPE = /\\[pP]\{|\\u\{/;
+
+// The characters `u` folds by Unicode rules and a source without it does not:
+// `/s/iu` matches `\u017F` and `/k/iu` matches `\u212A`, where neither does on its
+// own. Characters past the BMP fold this way, too, and are caught as astral first.
+const RE_UNICODE_FOLDING = /[\u004B\u0053\u006B\u0073\u00C5\u00DF\u00E5\u017F\u0398\u03A9\u03B8\u03C9\u03D1\u03F4\u1E9E\u1F80-\u1FAF\u1FB3\u1FBC\u1FC3\u1FCC\u1FF3\u1FFC\u2126\u212A\u212B]/;
+
+/**
+ * Which flag changes what a source matches, so that embedding the source where the
+ * flag cannot follow would silently match something else. `u` and `v` only narrow
+ * what syntax is legal, so a source valid under either stays valid without it—the
+ * difference never surfaces as a syntax error, and this stands in for the one that
+ * would otherwise be raised.
+ * @param {RegExp} pattern
+ * @returns {'u' | 'v' | 'm' | null} The flag the source depends on, or `null` where
+ *   every flag it carries would leave the source matching the same
+ */
+function lostFlag(pattern) {
+  const { source, unicode, unicodeSets } = pattern;
+  // `m` moves where `^` and `$` match, and only matters where the source has one
+  if (pattern.multiline && hasAnchor(source, unicodeSets)) return 'm';
+  if (!unicode && !unicodeSets) return null;
+  const flag = unicodeSets ? 'v' : 'u';
+  if (RE_UNICODE_ESCAPE.test(source)) return flag;
+  // Case folding under `i` follows Unicode rules only while the flag is there. A
+  // character can be written literally or as an escape, so the source is read
+  // token by token rather than scanned for the characters themselves; `singleCode`
+  // leaves out `\d` and friends, which fold alike with the flag and without it.
+  if (pattern.ignoreCase) {
+    for (let i = 0; i < source.length;) {
+      const length = tokenLength(source, i);
+      const code = singleCode(tokenRanges(source.slice(i, i + length), true));
+      if (code !== null && RE_UNICODE_FOLDING.test(String.fromCodePoint(code))) return flag;
+      i += length;
+    }
+  }
+  // Past the BMP a character is one code point with the flag, two units without,
+  // which is what a quantifier or a class beside it would go on to read wrongly
+  for (const char of source) {
+    if ((char.codePointAt(0) ?? 0) > 0xFFFF) return flag;
+  }
+  if (!unicodeSets) return null;
+
+  // `v` alone lets a class nest, subtract, intersect, and hold whole strings
+  let i = 0;
+  while (i < source.length) {
+    if (source[i] === '\\') {
+      i += tokenLength(source, i);
+      continue;
+    }
+    if (source[i] !== '[') {
+      i++;
+      continue;
+    }
+    const end = skipCharacterClass(source, i, true);
+    for (let j = i + 1; j < end - 1;) {
+      if (source[j] === '\\') {
+        if (source.startsWith('\\q{', j)) return 'v';
+        j += tokenLength(source, j);
+        continue;
+      }
+      if (source[j] === '[' || source.startsWith('--', j) || source.startsWith('&&', j)) return 'v';
+      j++;
+    }
+    i = end;
+  }
+  return null;
+}
+
 /**
  * A pattern’s source, rewritten to match the way its own flags make it match, for
  * embedding in a larger regex that cannot carry them. `i` and `s` fit into a
@@ -336,30 +610,77 @@ function foldCase(source) {
  */
 function embedSource(pattern) {
   let source = pattern.source;
-  if (pattern.dotAll) source = expandDotAll(source);
-  if (pattern.ignoreCase) source = foldCase(source);
+  if (pattern.dotAll) source = expandDotAll(source, pattern.unicodeSets);
+  if (pattern.ignoreCase) source = foldCase(source, pattern.unicodeSets);
   return source;
 }
 
+/**
+ * @typedef {{text: string, ranges: [number, number][] | null}} Repeat - An unbounded
+ *   repeat, as it reads and as the set of characters it matches
+ */
+
+/**
+ * @param {Repeat[]} reachable - Repeats that could still sit adjacent to what comes next
+ * @param {Repeat} repeat
+ * @returns {boolean} Whether the two can consume the same character, and so split
+ *   the same run of input between them
+ */
+function splitsWith(reachable, repeat) {
+  return reachable.some(earlier => earlier.text === repeat.text ||
+    (!!repeat.ranges && !!earlier.ranges && rangesIntersect(repeat.ranges, earlier.ranges)));
+}
+
+/**
+ * @param {Repeat[]} into
+ * @param {Repeat[]} repeats
+ * @returns {void} Adds the repeats, keeping only the most recent ones the walk
+ *   still compares against
+ */
+function collectReachable(into, repeats) {
+  for (const repeat of repeats) {
+    into.push(repeat);
+    if (into.length > MAX_REACHABLE) into.shift();
+  }
+}
+
 /**
  * Walk a regex source for the shapes whose backtracking blows up: an unlimited
  * quantifier over a group that itself contains a variable quantifier (`(a+)+`,
- * `(a?)+`) or alternates, and the same atom repeated unboundedly twice in a
- * row. A lone unlimited quantifier stays linear, so `[\s\S]*?` up to a literal
- * terminator passes.
+ * `(a?)+`) or alternates, and two unbounded repeats that can consume the same
+ * character with only atoms matching empty between them (`.*.*`, `[a]*a*`,
+ * `\w*\d*`, `a*b*a*`, `a*(b*)a*`, `(a*)a*`). A lone unlimited quantifier stays
+ * linear, so `[\s\S]*?` up to a literal terminator passes.
  * @param {string} source - Regex source, assumed syntactically valid
  * @param {number} [depth] - Group nesting level of this call
- * @returns {{risky: boolean, varies: boolean, alternates: boolean, deep: boolean}}
+ * @param {boolean} [nested] - Whether the pattern carries `v`
+ * @returns {{risky: boolean, varies: boolean, alternates: boolean, deep: boolean,
+ *   empty: boolean, leading: Repeat[], trailing: Repeat[]}} What the walk found,
+ *   with the repeats that reach the source’s start and end for a caller to compare
+ *   against what stands beside it
  */
-function analyzeQuantifiers(source, depth = 0) {
-  if (depth > MAX_PATTERN_DEPTH) return { risky: true, varies: true, alternates: true, deep: true };
+function analyzeQuantifiers(source, depth = 0, nested = false) {
+  if (depth > MAX_PATTERN_DEPTH) return { risky: true, varies: true, alternates: true, deep: true, empty: true, leading: [], trailing: [] };
 
   let risky = false;
   let varies = false;
   let alternates = false;
   let deep = false;
-  /** @type {{text: string, repeats: boolean} | null} */
-  let previous = null;
+  // Whether every atom of the branch being read matches empty, and whether any
+  // branch before it did
+  let branchEmpty = true;
+  let anyBranchEmpty = false;
+  // The unbounded repeats that could still sit adjacent to what comes next, most
+  // recent last; an atom matching empty leaves the ones before it reachable
+  /** @type {Repeat[]} */
+  const reachable = [];
+  // The repeats a caller can reach from either end, gathered across branches
+  /** @type {Repeat[]} */
+  const leading = [];
+  /** @type {Repeat[]} */
+  const trailing = [];
+  /** @type {Repeat[]} */
+  let branchLeading = [];
   let i = 0;
 
   while (i < source.length) {
@@ -371,22 +692,27 @@ function analyzeQuantifiers(source, depth = 0) {
     if (char === '|') {
       // Alternatives are separate expressions, so nothing carries across
       alternates = true;
-      previous = null;
+      anyBranchEmpty ||= branchEmpty;
+      branchEmpty = true;
+      collectReachable(leading, branchLeading);
+      collectReachable(trailing, reachable);
+      branchLeading = [];
+      reachable.length = 0;
       i++;
       continue;
     } else if (char === '\\') {
-      i += 2;
+      i += tokenLength(source, i);
     } else if (char === '[') {
-      i = skipCharacterClass(source, i);
+      i = skipCharacterClass(source, i, nested);
     } else if (char === '(') {
       let open = 1;
       i++;
       while (i < source.length && open > 0) {
         const inner = source[i];
         if (inner === '\\') {
-          i += 2;
+          i += tokenLength(source, i);
         } else if (inner === '[') {
-          i = skipCharacterClass(source, i);
+          i = skipCharacterClass(source, i, nested);
         } else {
           if (inner === '(') open++;
           else if (inner === ')') open--;
@@ -394,7 +720,7 @@ function analyzeQuantifiers(source, depth = 0) {
         }
       }
       // Drop the group prefix (`?:`, `?=`, `?<name>`, …) before reading the body
-      group = analyzeQuantifiers(source.slice(start + 1, i - 1).replace(/^\?(?:[:=!]|<[=!]|<[^>]*>)/, ''), depth + 1);
+      group = analyzeQuantifiers(source.slice(start + 1, i - 1).replace(/^\?(?:[:=!]|<[=!]|<[^>]*>)/, ''), depth + 1, nested);
     } else {
       i++;
     }
@@ -410,35 +736,71 @@ function analyzeQuantifiers(source, depth = 0) {
     const exact = !!quantifier && quantifier[0][0] === '{' &&
       (upper === undefined || (upper !== '' && Number(upper) === Number(quantifier[1])));
     const variable = !!quantifier && !exact;
+    // An atom matches empty where it is zero-width, where its quantifier may
+    // repeat none, or where a group body matches empty however often it repeats—
+    // `(b*)`, carrying the quantifier inside the group rather than on it
+    const least = quantifier && (quantifier[0][0] === '+' ? 1
+      : quantifier[0][0] === '{' ? Number(quantifier[1]) : 0);
+    const body = RE_ZERO_WIDTH.test(atom) || (!!group && group.empty);
+    const nullable = body || (!!quantifier && least === 0);
     if (quantifier) i = RE_QUANTIFIER.lastIndex;
 
+    // A lookaround is atomic: It backtracks nothing, so what it holds neither
+    // reaches out of it nor is reached into
+    const opaque = RE_ZERO_WIDTH.test(atom);
     if (group) {
       if (group.risky || (repeats && (group.varies || group.alternates))) risky = true;
       if (group.varies) varies = true;
       // A group alternates whether the `|` sits at its top level or deeper
       if (group.alternates) alternates = true;
       if (group.deep) deep = true;
+      // A group is no wall: What it repeats at its start splits the same run as
+      // what stands unbounded before it
+      if (!opaque && group.leading.some(repeat => splitsWith(reachable, repeat))) risky = true;
     }
     if (variable) varies = true;
     const text = unwrapAtom(atom);
-    if (repeats && previous?.repeats && previous.text === text) risky = true;
-    previous = { text, repeats };
+    const ranges = atomRanges(text, nested);
+    if (repeats && splitsWith(reachable, { text, ranges })) risky = true;
+
+    // Whatever a caller could reach before this atom, it reaches this one, too
+    if (branchEmpty) {
+      if (repeats) collectReachable(branchLeading, [{ text, ranges }]);
+      if (group && !opaque) collectReachable(branchLeading, group.leading);
+    }
+    // Nothing reaches past an atom that has to consume something
+    if (!nullable) {
+      reachable.length = 0;
+      branchEmpty = false;
+    }
+    if (group && !opaque) collectReachable(reachable, group.trailing);
+    if (repeats) collectReachable(reachable, [{ text, ranges }]);
   }
 
-  return { risky, varies, alternates, deep };
+  collectReachable(leading, branchLeading);
+  collectReachable(trailing, reachable);
+
+  return { risky, varies, alternates, deep, empty: anyBranchEmpty || branchEmpty, leading, trailing };
 }
 
 /**
- * @param {string} source - Regex source to judge
+ * @param {RegExp | string} pattern - Pattern to judge, or a bare source to read
+ *   as it stands
  * @returns {string | null} What makes the pattern a backtracking risk, phrased
  *   to follow the pattern itself, or `null` where it is none
  */
-function describeQuantifierRisk(source) {
-  // A pattern too big to read is refused for that, not for a shape nobody saw
+function describeQuantifierRisk(pattern) {
+  const source = typeof pattern === 'string' ? pattern : pattern.source;
+  // A pattern too big to read is refused for that, not for a shape nobody saw;
+  // its own length is what counts, not the length folding case inflates it to
   if (source.length > MAX_PATTERN_LENGTH) {
     return `runs past ${MAX_PATTERN_LENGTH.toLocaleString()} characters, too long to analyze for catastrophic backtracking—shorten it, or split it into several patterns`;
   }
-  const analysis = analyzeQuantifiers(source);
+  // `i` and `s` change what the source matches, so they are written into it
+  // before the shapes are read
+  const analysis = typeof pattern === 'string'
+    ? analyzeQuantifiers(source)
+    : analyzeQuantifiers(embedSource(pattern), 0, pattern.unicodeSets);
   if (analysis.deep) {
     return `nests groups more than ${MAX_PATTERN_DEPTH.toLocaleString()} deep, too deep to analyze for catastrophic backtracking—flatten it, or split it into several patterns`;
   }
@@ -484,5 +846,6 @@ export {
   replaceAsync,
   parseRegExp,
   embedSource,
+  lostFlag,
   describeQuantifierRisk
 };