Product Changelog

Follow updates, new validators, library releases, and fixes across the regex.to ecosystem.

v1.0.8 (September 14, 2026)

ReDoS Security Analyzer (regexSecurity.ts): Fixed false-positive detection in catastrophic backtracking analysis. Previously, non-capturing syntax (?:...), optional tokens (...)?, and numeric repetitions caused false "Nested Quantifiers" risk warnings on valid patterns (such as pl-vat).
Markdown Table Row (markdown-table-row): Fixed actual catastrophic backtracking vulnerability by constraining cell matching to (?:[^|\r\n]+\|)+ instead of open-ended wildcard (.+\|)+.
All 106 built-in patterns now pass 100% clean through automated ReDoS and security validation.

Added Polish VAT Number (VAT-UE) (pl-vat) validator supporting domestic and intra-community EU transactions, with optional or required PL country prefix and Polish hyphenation formats (PL5260250274, PL 123-456-32-18).
Added URL and package slug alias resolution for /nip, /regon, /vat, and /vat-pl to seamlessly map common queries to their canonical validator counterparts.

Enhanced Polish NIP (Tax ID) (pl-nip) pattern to officially support standard Polish hyphenated formats (123-456-32-18, 526-02-50-274) alongside raw 10-digit formats.
Enhanced Polish REGON (pl-regon) validator pattern with non-capturing group and extended metadata.

Added Slack Incoming Webhook URL (slack-webhook) validator for Slack webhook integration URLs (https://hooks.slack.com/services/T.../B.../...).
Added SemVer Range Specifier (semver-range) validator supporting version range syntax (^1.2.3, ~0.1.0, >=2.0.0, 1.x).
Added CSS Custom Property (Variable) (css-variable) validator for CSS custom property names (--primary-color, --bg-500).
Added SQL Identifier (sql-identifier) validator for table, column, and schema identifiers (unquoted, double-quoted, or backticked).
Added Redis Connection URI (redis-url) validator for Redis and Redis SSL URLs (redis://, rediss://) with user, password, port, and DB index.
Added Git Branch Name (git-branch) validator for Git branch name conventions (feature/login, bugfix/issue-123, main, release/v1.0).
Added NPM Package Name (npm-package-name) validator for scoped (@regexto/validators) and unscoped package names.
Added MIME Media Type (mime-type) validator for HTTP Content-Type and media type strings (application/json, image/png, text/html).
Added ULID (ulid) validator for 26-character Crockford Base32 Universally Unique Lexicographically Sortable Identifiers.
Added Discord Bot Token (discord-bot-token) validator for Discord bot API security tokens.

Added German Phone Number (phone-de) validator supporting international +49 and domestic 0 formats with optional separators.
Added AWS ARN (aws-arn) validator for Amazon Resource Names across all AWS services and partitions (aws, aws-cn, aws-us-gov).
Added Stripe API Key (stripe-key) validator detecting publishable (pk_), secret (sk_), and restricted (rk_) keys in both live and test modes.
Added Docker Image Name (docker-image) validator supporting optional registry host, namespace, tag, and SHA digest references.
Added US Passport Number (us-passport) validator for American passport numbers (1–2 letters followed by 7–8 digits).
Added UK NHS Number (uk-nhs) validator for UK National Health Service 10-digit numbers with optional space or hyphen separators.
Added Canadian SIN (ca-sin) validator for Social Insurance Numbers in NNN-NNN-NNN format.
Added EU VAT Number (vat-eu) validator covering all 27 EU member state VAT formats.
Added CSS oklch() Color (color-oklch) validator for CSS Color Level 4 oklch() function values including optional alpha channel.
Added GitHub Repository (github-repo) validator for owner/repo slug references following GitHub naming rules.

Added Security Policy (SECURITY.md) and Contributing Guidelines (CONTRIBUTING.md) to the repository and NPM package.
Added project metadata fields (bugs, funding) to NPM package.json to satisfy supply chain security checklists and improve project maintenance score on Socket.dev.

Fixed uncommitted lockfile issues during Rust crate release workflows by incorporating the --allow-dirty flag during cargo publish.

Added OpenAI API Key (openai-api-key) validator to check project keys starting with sk-proj-.
Added Cron Expression (cron-expression) validator with structural regex supporting step / values and comma , separated fields.
Added MongoDB Connection URI (mongodb-uri) validator supporting standard and SRV protocols.
Added ISBN-13 (isbn-13) book code validator with support for hyphens and spaces.
Added SSH Public Key (ssh-public-key) validator supporting standard keys (RSA, Ed25519, DSS, ECDSA).
Added Conventional Commit Message (conventional-commit) validator following the Conventional Commits specification.
Configured automated GitHub Actions workflows to auto-publish Python package on PyPI and Rust crate on Crates.io upon pushing release tags.

Added official Rust package support (regexto-validators crate) on Crates.io utilizing fancy-regex for lookarounds support.

Fixed inline global regex flags positioning bugs across Python and Go validators.
Corrected package build targets to ensure standard wheel exports for Python packages.

Initial public release of regex.to validators.
Single source of truth JSON pattern registry (79+ battle-tested patterns).
Released native, optimized packages for:
- JavaScript/TypeScript (NPM) with built-in Zod v4 ready helpers.
- Go module with PCRE lookaround compatibility.
- PHP class with safe delimiters validation.
- Python module with regex matching and type auto-detection.
Launched the regex.to sandbox website for real-time visualization, testing, and multi-language code generation.