re2 1.25.0 → 1.25.1

package/README.md

@@ -251,13 +251,7 @@ See the wiki for notes on [yarn](https://github.com/uhop/node-re2/wiki/Using-wit
 
 ### Supported Node.js versions
 
-`re2` supports the Node.js versions declared in its `engines` field:
-
-```
-^22.22.2 || ^24.15.0 || >=26.0.0
-```
-
-As of 1.25.0 this range was narrowed to mirror [`node-gyp`](https://github.com/nodejs/node-gyp) 13, which `re2` builds with (and which fixes a Node 26 build on Windows): **Node 25.x and the older 22.0–22.22.1 / 24.0–24.14 patch ranges are no longer supported.** Use a current release of an active line — Node 22 (≥ 22.22.2), 24 (≥ 24.15.0), or 26 and later.
+`re2` supports every non-EOL Node.js release — current and active LTS lines. As a native (`nan`) addon it runs on Node.js only, not Bun or Deno. The authoritative supported range is the `engines` field in `package.json`; it also pins the minimum patch releases the build toolchain ([`node-gyp`](https://github.com/nodejs/node-gyp) 13) requires. Check `engines` for the exact floor rather than a version repeated here.
 
 ### Install scripts (npm 12+)
 
@@ -442,6 +436,7 @@ Tables are baked in at build time from Unicode 17.0. To target a newer Unicode v
 
 ## Release history
 
+- 1.25.1 *Security fix (GHSA-8hcv-x26h-mcgp): a global `replace()` using an output-amplifying template (`$'` or `` $` ``) on very large input could exceed V8's maximum string length and abort the whole process. It now throws a catchable `RangeError`, matching the built-in engine.*
 - 1.25.0 *Full Unicode 17.0.0 property classes (Fixes #226). New `maxMem` option for `RE2.Set`. Faster matching on pure-ASCII inputs. Narrowed Node support — drops Node 25.x and older patch releases.*
 - 1.24.1 *Support for Node 22, 24, 26 + precompiled binaries.*
 - 1.24.0 *Fixed multi-threaded crash in worker threads (#235). Added named import: `import {RE2} from 're2'`. Added CJS test. Updated docs and dependencies.*

package/lib/replace.cc

@@ -315,7 +315,13 @@ inline Nan::Maybe<std::string> replace(
 			const auto data = item.data();
 			if (data)
 			{
-				argv.push_back(Nan::CopyBuffer(data, item.size()).ToLocalChecked());
+				auto buffer = Nan::CopyBuffer(data, item.size());
+				if (buffer.IsEmpty())
+				{
+					Nan::ThrowRangeError("Invalid string length");
+					return Nan::Nothing<std::string>();
+				}
+				argv.push_back(buffer.ToLocalChecked());
 			}
 			else
 			{
@@ -332,7 +338,13 @@ inline Nan::Maybe<std::string> replace(
 			const auto data = item.data();
 			if (data)
 			{
-				argv.push_back(Nan::New(data, item.size()).ToLocalChecked());
+				auto text = Nan::New(data, item.size());
+				if (text.IsEmpty())
+				{
+					Nan::ThrowRangeError("Invalid string length");
+					return Nan::Nothing<std::string>();
+				}
+				argv.push_back(text.ToLocalChecked());
 			}
 			else
 			{
@@ -551,8 +563,21 @@ NAN_METHOD(WrappedRE2::Replace)
 
 	if (replacee.isBuffer)
 	{
-		info.GetReturnValue().Set(Nan::CopyBuffer(result.data(), result.size()).ToLocalChecked());
+		auto buffer = Nan::CopyBuffer(result.data(), result.size());
+		if (buffer.IsEmpty())
+		{
+			Nan::ThrowRangeError("Invalid string length");
+			return;
+		}
+		info.GetReturnValue().Set(buffer.ToLocalChecked());
+		return;
+	}
+	// over-max-length result -> empty MaybeLocal; ToLocalChecked() would abort()
+	auto text = Nan::New(result);
+	if (text.IsEmpty())
+	{
+		Nan::ThrowRangeError("Invalid string length");
 		return;
 	}
-	info.GetReturnValue().Set(Nan::New(result).ToLocalChecked());
+	info.GetReturnValue().Set(text.ToLocalChecked());
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "re2",
-  "version": "1.25.0",
+  "version": "1.25.1",
   "description": "Bindings for RE2: fast, safe alternative to backtracking regular expression engines.",
   "homepage": "https://github.com/uhop/node-re2",
   "bugs": "https://github.com/uhop/node-re2/issues",
@@ -22,11 +22,11 @@
     "node-gyp": "^13.0.0"
   },
   "devDependencies": {
-    "@types/node": "^25.9.3",
+    "@types/node": "^26.0.1",
     "@unicode/unicode-17.0.0": "^1.6.17",
     "nano-benchmark": "^1.0.16",
     "prettier": "^3.8.4",
-    "tape-six": "^1.10.1",
+    "tape-six": "^1.14.0",
     "tape-six-proc": "^1.3.1",
     "typescript": "^6.0.3"
   },
@@ -65,8 +65,6 @@
   ],
   "author": "Eugene Lazutkin <eugene.lazutkin@gmail.com> (https://lazutkin.com/)",
   "funding": "https://github.com/sponsors/uhop",
-  "llms": "https://raw.githubusercontent.com/uhop/node-re2/master/llms.txt",
-  "llmsFull": "https://raw.githubusercontent.com/uhop/node-re2/master/llms-full.txt",
   "license": "BSD-3-Clause",
   "tape6": {
     "tests": [