This is quite a weird one. The old regex was causing issues for some users and even Stack overflow errors while
trying to parse the Regex??
Explanation from Claude:
The character classes here (\u{e0061}-\u{e0066}, \u{e0041}-\u{e0046}, \u{e0030}-\u{e0039}) are all in the Unicode Tags block (U+E0000–U+E007F), which is outside the Basic Multilingual Plane — every one of these code points is represented internally as a surrogate pair. When you build a /u-flag regex with several ranges of astral (non-BMP) code points inside a character class, and then apply a repetition quantifier to that class ({1,6}, or +? as in the actual error), V8's Irregexp compiler has to expand/canonicalize the class and unroll the quantifier. For BMP regexes this is cheap, but the astral-range handling triggers a much deeper recursive expansion in the compiler itself.
This is a known class of V8/Chromium bugs (regex-compiler stack overflow on Unicode-mode patterns with supplementary-plane character-class ranges + quantifiers) — it's not something wrong with your logic, it's the compiling of the pattern that blows the native stack on affected Chromium versions/builds, not the matching. That's why it only hits "some users": it depends on their exact V8 build/stack size, not the input string.
This had a bad interaction with SupportHelper, where it could be used to add a "Run Snippet" button
to any linked message, which when clicked would run code contained in that message
Reported by Kaede
We added these in the past to work around issues where Vesktop would go blank while backgrounded.
The issue is likely fixed now, at least I cannot reproduce.
The best way to test it out is to just remove them and see if anyone complains :P
Also adds back the bandai fix for the obscure app-region bug which was removed in an earlier commit.
Turns out this is still a bug.'
'
Fixes:
- Webpack Patcher: incorrect patch error handling could lead to some functional patches not being applied
- CommandsAPI: subcommands were impossible to unregister
- useAwaiter: on error, the value was set to null even if a fallbackValue was specified, violating the type contract
- Patcher: build check boolean logic was grouped incorrectly due to missing parantheses
- CustomCommands: commands weren't unregistered on stop, leading to error when enabling, disabling & re-renabling the plugin
- Notification Log: delete was by timestamp instead of ID and non-atomic
- FixSpotifyEmbeds: settings listener was registered inside browser-window-created event handler, leading to duplicate listeners
- CustomRPC: changing activity type or timestamp didn't update the RPC
- CopyStickerLinks: message patch had non-sense code, just removed it
- XSOverlay: UDP socket wasn't closed on stop
- VoiceMessages: Web recorder never closed the mic media stream, which continues showing the OS mic indicator
- PictureInPicture: Video clone wasn't properly cleaned up, which leaked memory
- Themes (Extension version): theme object urls were never cleaned up, which leaked memory on theme change
- Themes (Extension version): Upload Theme button hitbox was only the text, not the whole button. Also added Drag & Drop from file manager support
- Dearrow: toggling for one embed flipped the global dearrow by default setting
- Extension Installer: the zip extract function was vulnerable to path traversal, although we only ever used this for React DevTools obtained via https so it has low impact
- FileWatchers: ensure always properly cleaned up
- components/Link: mutated props which is a very bad practice
All fixes are human written, only the audit was done by Claude Fable (thanks for ur tokens, Zere).
It is possible to replace a message in place by creating a new message with the same nonce as an existing one.
This is not considered an edit since it's a new message. Thus it bypasses our edit logging and can be used to "delete" a message by replacing it with an empty one.
This fixes that bypass
Vendicated
