[waleedlatif1]

Summary

• Bump re2js 2.8.6 → 2.8.7 in apps/sim and bun.lock, closing GHSA-gg6h-894w-4m9c (quadratic-time matching with the opt-in LOOKBEHINDS flag)
• Not reachable today: linear-regex.ts compiles with 0 or CASE_INSENSITIVE only, and lookaround split patterns are rewritten to non-capturing groups instead of using the flag. Bumping keeps the engine current rather than relying on that
• 2.8.7 also tightens UTF-8 decoding and lazily builds prefilter automatons; we only pass strings (UTF-16 path)
• Supersedes ci: bump re2js from 2.8.6 to 2.8.7 in /apps/sim in the npm_and_yarn group across 1 directory #9439, which updated package.json without the lockfile

Type of Change

• Dependency update

Testing

• linear-regex, regex-chunker, validate-regex, universal-grep, and vfs/operations tests: 257 passed on 2.8.7
• Lint, audits, type-check and the full suite run in CI

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Oct 29, 2026 5:56pm UTC

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable issues were found.

Summary

Updates re2js from 2.8.6 to 2.8.7.

• The app's shared regex workflows now use re2js 2.8.7.

_{Reviews (1) · Last reviewed commit: "chore(deps): bump re2js to 2.8.7" · Reviewed by Greptile}