pi-lens 3.8.36 → 3.8.37

package/CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to pi-lens will be documented in this file.
 
 ## [Unreleased]
 
+## [3.8.37] - 2026-05-02
+
+### Fixed
+
+- **ReDoS: 3 compiler output parsers in `/lens-booboo`** — `csRe` trailing optional group `(?:\s+\[[^\]]+\])?` dropped (message capture already stops at `[`); `gleamRe` narrowed `[^:]+` → `[^:\n]+` to prevent cross-line backtracking; `zigRe` replaced `(.+)$` with `([^\n]+)` and dropped the redundant end anchor. All three flagged by SonarCloud S5852.
+
 ## [3.8.36] - 2026-05-02
 
 ### Changed

package/commands/booboo.ts

@@ -1331,7 +1331,7 @@ export async function handleBooboo(
 				);
 				const output = (result.stdout || "") + (result.stderr || "");
 				const csRe =
-					/^([^\s(]+\.cs)\((\d+),(\d+)\):\s+(error|warning)\s+([A-Z]+\d+):\s+([^[]+)(?:\s+\[[^\]]+\])?/gm;
+					/^([^\s(]+\.cs)\((\d+),(\d+)\):\s+(error|warning)\s+([A-Z]+\d+):\s+([^\[]+)/gm;
 				for (const m of output.matchAll(csRe)) {
 					const [, file, line, col, sev, code, msg] = m;
 					const absFile = path.isAbsolute(file)
@@ -1395,7 +1395,7 @@ export async function handleBooboo(
 				});
 				const output = (result.stdout || "") + (result.stderr || "");
 				const gleamRe =
-					/^([^:]+):(\d+):(\d+)\s*(?:error|warning)[^\n]*\n([^\n]+)/gm;
+					/^([^:\n]+):(\d+):(\d+)\s*(?:error|warning)[^\n]*\n([^\n]+)/gm;
 				for (const m of output.matchAll(gleamRe)) {
 					const [, file, line, col, msg] = m;
 					const absFile = path.isAbsolute(file)
@@ -1426,7 +1426,7 @@ export async function handleBooboo(
 					timeout: 120_000,
 				});
 				const output = (result.stdout || "") + (result.stderr || "");
-				const zigRe = /^([^:]+):(\d+):(\d+):\s*(error|warning|note):\s*(.+)$/gm;
+				const zigRe = /^([^:\n]+):(\d+):(\d+):\s*(error|warning|note):\s*([^\n]+)/gm;
 				for (const m of output.matchAll(zigRe)) {
 					const [, file, line, col, sev, msg] = m;
 					const absFile = path.isAbsolute(file)

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-lens",
-	"version": "3.8.36",
+	"version": "3.8.37",
 	"type": "module",
 	"description": "Real-time code feedback for pi \u2014 LSP, linters, formatters, type-checking, structural analysis & booboo",
 	"repository": {