chore: add `eslint-plugin-regexp` (#1123)

.oxlintrc.json

···
 {
   "$schema": "https://unpkg.com/oxlint/configuration_schema.json",
   "plugins": ["unicorn", "typescript", "oxc", "vue", "vitest"],
-  "jsPlugins": ["@e18e/eslint-plugin"],
+  "jsPlugins": ["@e18e/eslint-plugin", "eslint-plugin-regexp"],
   "categories": {
     "correctness": "error",
     "suspicious": "warn",
···
     "e18e/prefer-timer-args": "error",
     "e18e/prefer-date-now": "error",
     "e18e/prefer-regex-test": "error",
-    "e18e/prefer-array-some": "error"
+    "e18e/prefer-array-some": "error",
+    // RegExp - Possible Errors (most critical)
+    "regexp/no-contradiction-with-assertion": "error",
+    "regexp/no-dupe-disjunctions": "error",
+    "regexp/no-empty-alternative": "error",
+    "regexp/no-empty-capturing-group": "error",
+    "regexp/no-empty-character-class": "error",
+    "regexp/no-empty-group": "error",
+    "regexp/no-empty-lookarounds-assertion": "error",
+    "regexp/no-escape-backspace": "error",
+    "regexp/no-invalid-regexp": "error",
+    "regexp/no-lazy-ends": "error",
+    "regexp/no-misleading-capturing-group": "error",
+    "regexp/no-misleading-unicode-character": "error",
+    "regexp/no-missing-g-flag": "error",
+    "regexp/no-optional-assertion": "error",
+    "regexp/no-potentially-useless-backreference": "error",
+    "regexp/no-super-linear-backtracking": "error",
+    "regexp/no-useless-assertions": "error",
+    "regexp/no-useless-backreference": "error",
+    "regexp/no-useless-dollar-replacements": "error",
+    "regexp/strict": "error",
+    // RegExp - Best Practices
+    "regexp/confusing-quantifier": "warn",
+    "regexp/control-character-escape": "error",
+    "regexp/negation": "error",
+    "regexp/no-dupe-characters-character-class": "error",
+    "regexp/no-empty-string-literal": "error",
+    "regexp/no-extra-lookaround-assertions": "error",
+    "regexp/no-invisible-character": "error",
+    "regexp/no-legacy-features": "error",
+    "regexp/no-non-standard-flag": "error",
+    "regexp/no-obscure-range": "error",
+    "regexp/no-octal": "error",
+    "regexp/no-standalone-backslash": "error",
+    "regexp/no-trivially-nested-assertion": "error",
+    "regexp/no-trivially-nested-quantifier": "error",
+    "regexp/no-unused-capturing-group": "warn",
+    "regexp/no-useless-character-class": "error",
+    "regexp/no-useless-flag": "error",
+    "regexp/no-useless-lazy": "error",
+    "regexp/no-useless-quantifier": "error",
+    "regexp/no-useless-range": "error",
+    "regexp/no-useless-set-operand": "error",
+    "regexp/no-useless-string-literal": "error",
+    "regexp/no-useless-two-nums-quantifier": "error",
+    "regexp/no-zero-quantifier": "error",
+    "regexp/optimal-lookaround-quantifier": "warn",
+    "regexp/optimal-quantifier-concatenation": "error",
+    "regexp/prefer-predefined-assertion": "error",
+    "regexp/prefer-range": "error",
+    "regexp/prefer-set-operation": "error",
+    "regexp/simplify-set-operations": "error",
+    "regexp/use-ignore-case": "error",
+    // RegExp - Stylistic Issues (less critical, focused on consistency)
+    "regexp/match-any": "warn",
+    "regexp/no-useless-escape": "warn",
+    "regexp/no-useless-non-capturing-group": "warn",
+    "regexp/prefer-character-class": "warn",
+    "regexp/prefer-d": "warn",
+    "regexp/prefer-plus-quantifier": "warn",
+    "regexp/prefer-question-quantifier": "warn",
+    "regexp/prefer-star-quantifier": "warn",
+    "regexp/prefer-unicode-codepoint-escapes": "warn",
+    "regexp/prefer-w": "warn",
+    "regexp/sort-flags": "warn"
   },
   "overrides": [
     {

app/composables/useStructuredFilters.ts

···
 
   // Regex to match operators: name:value, desc:value, description:value, kw:value, keyword:value
   // Value continues until whitespace or next operator
-  const operatorRegex = /\b(name|desc|description|kw|keyword):([^\s]+)/gi
+  const operatorRegex = /\b(name|desc|description|kw|keyword):(\S+)/gi
 
   let remaining = input
   let match

app/pages/search.vue

···
   // Must start with alphanumeric
   if (!/^[a-z0-9]/i.test(name)) return false
   // Can contain alphanumeric, hyphen, underscore
-  return /^[a-z0-9_-]+$/i.test(name)
+  return /^[\w-]+$/.test(name)
 }
 
 /** Validated user/org suggestion */

app/utils/formatters.ts

···
 
   const fmt = (n: number) => {
     if (decimals <= 0) return Math.round(n).toString()
-    return n
-      .toFixed(decimals)
-      .replace(/\.0+$/, '')
-      .replace(/(\.\d*?)0+$/, '$1')
+    const fixed = n.toFixed(decimals)
+    // Remove trailing zeros after decimal point
+    return fixed.includes('.') ? fixed.replace(/0+$/, '').replace(/\.$/, '') : fixed
   }
 
   const join = (suffix: string, n: number) => `${sign}${fmt(n)}${space ? ' ' : ''}${suffix}`

app/utils/npm/outdated-dependencies.ts

···
  */
 export function constraintIncludesPrerelease(constraint: string): boolean {
   return (
-    /-(alpha|beta|rc|next|canary|dev|preview|pre|experimental)/i.test(constraint) ||
+    /-(?:alpha|beta|rc|next|canary|dev|preview|pre|experimental)/i.test(constraint) ||
     /-\d/.test(constraint)
   )
 }

cli/src/schemas.ts

···
 
 // Validation pattern for npm usernames/org names
 // These follow similar rules: lowercase alphanumeric with hyphens, can't start/end with hyphen
-const NPM_USERNAME_RE = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/i
+const NPM_USERNAME_RE = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/i
 
 // ============================================================================
 // Base Schemas

knip.ts

···
 
         /** Oxlint plugins don't get picked up yet */
         '@e18e/eslint-plugin',
+        'eslint-plugin-regexp',
       ],
       ignoreUnresolved: ['#components', '#oauth/config'],
     },

package.json

···
     "@vitest/coverage-v8": "4.0.18",
     "@vue/test-utils": "2.4.6",
     "axe-core": "4.11.1",
+    "eslint-plugin-regexp": "3.0.0",
     "fast-check": "4.5.3",
     "h3": "1.15.5",
     "knip": "5.83.0",

pnpm-lock.yaml

···
       axe-core:
         specifier: 4.11.1
         version: 4.11.1
+      eslint-plugin-regexp:
+        specifier: 3.0.0
+        version: 3.0.0(eslint@9.39.2(jiti@2.6.1))
       fast-check:
         specifier: 4.5.3
         version: 4.5.3
···
     resolution: {integrity: sha512-U7VdrJFnJgo4xjrHpTzu0yrHPGImdsmD95ZlgYSEajAn2JKzDhDTPG9kBTefmObL2w/ngeZnilk+OV9CG3d7UA==}
     engines: {node: '>= 6'}
 
+  comment-parser@1.4.5:
+    resolution: {integrity: sha512-aRDkn3uyIlCFfk5NUA+VdwMmMsh8JGhc4hapfV4yxymHGQ3BVskMQfoXGpCo5IoBuQ9tS5iiVKhCpTcB4pW4qw==}
+    engines: {node: '>= 12.0.0'}
+
   common-tags@1.8.2:
     resolution: {integrity: sha512-gk/Z852D2Wtb//0I+kRFNKKE9dIIVirjoqPoA1wJU+XePVXZfGeBpk45+A1rKO4Q43prqWBNY/MiIeRLbPWUaA==}
     engines: {node: '>=4.0.0'}
···
 
   eslint-plugin-depend@1.4.0:
     resolution: {integrity: sha512-MQs+m4nHSfgAO9bJDsBzqw0ofK/AOA0vfeY/6ahofqcUMLeM6/D1sTYs21fOhc17kNU/gn58YCtj20XaAssh2A==}
+
+  eslint-plugin-regexp@3.0.0:
+    resolution: {integrity: sha512-iW7hgAV8NOG6E2dz+VeKpq67YLQ9jaajOKYpoOSic2/q8y9BMdXBKkSR9gcMtbqEhNQzdW41E3wWzvhp8ExYwQ==}
+    engines: {node: ^20.19.0 || ^22.13.0 || >=24}
+    peerDependencies:
+      eslint: '>=9.38.0'
 
   eslint-scope@5.1.1:
     resolution: {integrity: sha512-2NxwbF/hZ0KpepYN0cNbo+FN6XoK7GaHlQhgx/hIZl6Va0bF45RQOOwhLIy8lQDbuCiadSLCBnH2CFYquit5bw==}
···
     resolution: {integrity: sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==}
     hasBin: true
 
+  jsdoc-type-pratt-parser@7.1.1:
+    resolution: {integrity: sha512-/2uqY7x6bsrpi3i9LVU6J89352C0rpMk0as8trXxCtvd4kPk1ke/Eyif6wqfSLvoNJqcDG9Vk4UsXgygzCt2xA==}
+    engines: {node: '>=20.0.0'}
+
   jsesc@3.1.0:
     resolution: {integrity: sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA==}
     engines: {node: '>=6'}
···
     resolution: {integrity: sha512-DJnGAeenTdpMEH6uAJRK/uiyEIH9WVsUmoLwzudwGJUwZPp80PDBWPHXSAGNPwNvIXAbe7MSUB1zQFugFml66A==}
     engines: {node: '>=4'}
 
+  refa@0.12.1:
+    resolution: {integrity: sha512-J8rn6v4DBb2nnFqkqwy6/NnTYMcgLA+sLr0iIO41qpv0n+ngb7ksag2tMRl0inb1bbO/esUwzW1vbJi7K0sI0g==}
+    engines: {node: ^12.0.0 || ^14.0.0 || >=16.0.0}
+
   reflect.getprototypeof@1.0.10:
     resolution: {integrity: sha512-00o4I+DVrefhv+nX0ulyi3biSHCPDe+yLv5o/p6d/UVlirijB8E16FtfwSAi4g3tcqrQ4lRAqQSoFEZJehYEcw==}
     engines: {node: '>= 0.4'}
···
 
   regex@6.1.0:
     resolution: {integrity: sha512-6VwtthbV4o/7+OaAF9I5L5V3llLEsoPyq9P1JVXkedTP33c7MfCG0/5NOPcSJn0TzXcG9YUrR0gQSWioew3LDg==}
+
+  regexp-ast-analysis@0.7.1:
+    resolution: {integrity: sha512-sZuz1dYW/ZsfG17WSAG7eS85r5a0dDsvg+7BiiYR5o6lKCAtUrEwdmRmaGF6rwVj3LcmAeYkOWKEPlbPzN3Y3A==}
+    engines: {node: ^12.0.0 || ^14.0.0 || >=16.0.0}
 
   regexp-tree@0.1.27:
     resolution: {integrity: sha512-iETxpjK6YoRWJG5o6hXLwvjYAoW+FEZn9os0PD/b6AP6xQwsa/Y7lCVgIixBbUPMfhu+i2LtdeAqVTgGlQarfA==}
···
   schema-utils@4.3.3:
     resolution: {integrity: sha512-eflK8wEtyOE6+hsaRVPxvUKYCpRgzLqDTb8krvAsRIwOGlHoSgYLgBXoubGgLd2fT41/OUYdb48v4k4WWHQurA==}
     engines: {node: '>= 10.13.0'}
+
+  scslre@0.3.0:
+    resolution: {integrity: sha512-3A6sD0WYP7+QrjbfNA2FN3FsOaGGFoekCVgTyypy53gPxhbkCIjtO6YWgdrfM+n/8sI8JeXZOIxsHjMTNxQ4nQ==}
+    engines: {node: ^14.0.0 || >=16.0.0}
 
   scule@1.3.0:
     resolution: {integrity: sha512-6FtHJEvt+pVMIB9IBY+IcCJ6Z5f1iQnytgyfKMhDKgmzYG+TeH/wx1y3l27rshSbLiSanrR9ffZDrEsmjlQF2g==}
···
 
   commander@6.2.1: {}
 
+  comment-parser@1.4.5: {}
+
   common-tags@1.8.2: {}
 
   commondir@1.0.1: {}
···
       empathic: 2.0.0
       module-replacements: 2.11.0
       semver: 7.7.3
+
+  eslint-plugin-regexp@3.0.0(eslint@9.39.2(jiti@2.6.1)):
+    dependencies:
+      '@eslint-community/eslint-utils': 4.9.1(eslint@9.39.2(jiti@2.6.1))
+      '@eslint-community/regexpp': 4.12.2
+      comment-parser: 1.4.5
+      eslint: 9.39.2(jiti@2.6.1)
+      jsdoc-type-pratt-parser: 7.1.1
+      refa: 0.12.1
+      regexp-ast-analysis: 0.7.1
+      scslre: 0.3.0
 
   eslint-scope@5.1.1:
     dependencies:
···
   js-yaml@4.1.1:
     dependencies:
       argparse: 2.0.1
+
+  jsdoc-type-pratt-parser@7.1.1: {}
 
   jsesc@3.1.0: {}
 
···
     dependencies:
       redis-errors: 1.2.0
 
+  refa@0.12.1:
+    dependencies:
+      '@eslint-community/regexpp': 4.12.2
+
   reflect.getprototypeof@1.0.10:
     dependencies:
       call-bind: 1.0.8
···
   regex@6.1.0:
     dependencies:
       regex-utilities: 2.3.0
+
+  regexp-ast-analysis@0.7.1:
+    dependencies:
+      '@eslint-community/regexpp': 4.12.2
+      refa: 0.12.1
 
   regexp-tree@0.1.27: {}
 
···
       ajv: 8.17.1
       ajv-formats: 2.1.1(ajv@8.17.1)
       ajv-keywords: 5.1.0(ajv@8.17.1)
+
+  scslre@0.3.0:
+    dependencies:
+      '@eslint-community/regexpp': 4.12.2
+      refa: 0.12.1
+      regexp-ast-analysis: 0.7.1
 
   scule@1.3.0: {}
 

server/api/registry/org/[org]/packages.get.ts

···
 const NPM_REGISTRY = 'https://registry.npmjs.org'
 
 // Validation pattern for npm org names (alphanumeric with hyphens)
-const NPM_ORG_NAME_RE = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/i
+const NPM_ORG_NAME_RE = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/i
 
 function validateOrgName(name: string): void {
   if (!name || name.length > 50 || !NPM_ORG_NAME_RE.test(name)) {

server/api/registry/readme/[...pkg].get.ts

···
 ]
 
 /** Matches standard README filenames (case-insensitive, for checking registry metadata) */
-const standardReadmePattern = /^readme(\.md|\.markdown)?$/i
+const standardReadmePattern = /^readme(?:\.md|\.markdown)?$/i
 
 /**
  * Fetch README from jsdelivr CDN for a specific package version.

server/utils/docs/text.ts

···
+/* oxlint-disable regexp/no-super-linear-backtracking */
 /**
  * Text Processing Utilities
  *
···
  * Create a URL-safe HTML anchor ID for a symbol.
  */
 export function createSymbolId(kind: string, name: string): string {
-  return `${kind}-${name}`.replace(/[^a-zA-Z0-9-]/g, '_')
+  return `${kind}-${name}`.replace(/[^a-z0-9-]/gi, '_')
 }
 
 /**
···
   result = result
     .replace(/`([^`]+)`/g, '<code class="docs-inline-code">$1</code>')
     .replace(/\*\*([^*]+)\*\*/g, '<strong>$1</strong>')
-    .replace(/\n\n+/g, '<br><br>')
+    .replace(/\n{2,}/g, '<br><br>')
     .replace(/\n/g, '<br>')
 
   // Highlight and restore code blocks

server/utils/npm.ts

···
 function constraintIncludesPrerelease(constraint: string): boolean {
   // Look for prerelease identifiers in the constraint
   return (
-    /-(alpha|beta|rc|next|canary|dev|preview|pre|experimental)/i.test(constraint) ||
+    /-(?:alpha|beta|rc|next|canary|dev|preview|pre|experimental)/i.test(constraint) ||
     /-\d/.test(constraint)
   ) // e.g., -0, -1
 }

server/utils/shiki.ts

···
         defaultColor: 'dark',
       })
       // Remove inline style from <pre> tag so CSS can control appearance
-      html = html.replace(/<pre([^>]*)\s+style="[^"]*"/, '<pre$1')
+      html = html.replace(/<pre([^>]*) style="[^"]*"/, '<pre$1')
       // Shiki doesn't encode > in text content (e.g., arrow functions =>)
       // We need to encode them for HTML validation
       return escapeRawGt(html)

shared/schemas/package.ts

···
 export const VersionSchema = v.pipe(
   v.string(),
   v.nonEmpty('Version is required'),
-  v.regex(/^[a-z0-9._+-]+$/i, 'Invalid version format'),
+  v.regex(/^[\w.+-]+$/, 'Invalid version format'),
 )
 
 /**

shared/utils/git-providers.ts

···
   const normalized = raw.replace(/^git\+/, '')
 
   // Handle ssh:// and git:// URLs by converting to https://
-  if (/^(ssh|git):\/\//i.test(normalized)) {
+  if (/^(?:ssh|git):\/\//i.test(normalized)) {
     try {
       const url = new URL(normalized)
       const path = url.pathname.replace(/^\/*/, '')

shared/utils/npm.ts

···
 import { createError } from 'h3'
 import validatePackageName from 'validate-npm-package-name'
 
-const NPM_USERNAME_RE = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/i
+const NPM_USERNAME_RE = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/i
 const NPM_USERNAME_MAX_LENGTH = 50
 
 /**

shared/utils/parse-basic-frontmatter.ts

···
 export function parseBasicFrontmatter(fileContent: string): Record<string, unknown> {
-  const match = fileContent.match(/^---\s*\n([\s\S]*?)\n---\s*(?:\n|$)/)
+  const match = fileContent.match(/^---[ \t]*\n([\s\S]*?)\n---[ \t]*(?:\n|$)/)
   if (!match?.[1]) return {}
 
   return match[1].split('\n').reduce<Record<string, unknown>>((acc, line) => {