
Security News
The Next Open Source Security Race: Triage at Machine Speed
Claude Opus 4.6 has uncovered more than 500 open source vulnerabilities, raising new considerations for disclosure, triage, and patching at scale.
This crate provides a robust regular expression parser.
There are two primary types exported by this crate: Ast and Hir. The former
is a faithful abstract syntax of a regular expression, and can convert regular
expressions back to their concrete syntax while mostly preserving its original
form. The latter type is a high level intermediate representation of a regular
expression that is amenable to analysis and compilation into byte codes or
automata. An Hir achieves this by drastically simplifying the syntactic
structure of the regular expression. While an Hir can be converted back to
its equivalent concrete syntax, the result is unlikely to resemble the original
concrete syntax that produced the Hir.
This example shows how to parse a pattern string into its HIR:
use regex_syntax::{hir::Hir, parse};
let hir = parse("a|b").unwrap();
assert_eq!(hir, Hir::alternation(vec![
Hir::literal("a".as_bytes()),
Hir::literal("b".as_bytes()),
]));
This crate has no unsafe code and sets forbid(unsafe_code). While it's
possible this crate could use unsafe code in the future, the standard
for doing so is extremely high. In general, most code in this crate is not
performance critical, since it tends to be dwarfed by the time it takes to
compile a regular expression into an automaton. Therefore, there is little need
for extreme optimization, and therefore, use of unsafe.
The standard for using unsafe in this crate is extremely high because this
crate is intended to be reasonably safe to use with user supplied regular
expressions. Therefore, while there may be bugs in the regex parser itself,
they should never result in memory unsafety unless there is either a bug
in the compiler or the standard library. (Since regex-syntax has zero
dependencies.)
By default, this crate bundles a fairly large amount of Unicode data tables
(a source size of ~750KB). Because of their large size, one can disable some
or all of these data tables. If a regular expression attempts to use Unicode
data that is not available, then an error will occur when translating the Ast
to the Hir.
The full set of features one can disable are in the "Crate features" section of the documentation.
Simply running cargo test will give you very good coverage. However, because
of the large number of features exposed by this crate, a test script is
included in this directory which will test several feature combinations. This
is the same script that is run in CI.
The primary purpose of this crate is to provide the parser used by regex.
Specifically, this crate is treated as an implementation detail of the regex,
and is primarily developed for the needs of regex.
Since this crate is an implementation detail of regex, it may experience
breaking change releases at a different cadence from regex. This is only
possible because this crate is not a public dependency of regex.
Another consequence of this de-coupling is that there is no direct way to
compile a regex::Regex from a regex_syntax::hir::Hir. Instead, one must
first convert the Hir to a string (via its std::fmt::Display) and then
compile that via Regex::new. While this does repeat some work, compilation
typically takes much longer than parsing.
Stated differently, the coupling between regex and regex-syntax exists only
at the level of the concrete syntax.
FAQs
Unknown package
We found that regex-syntax demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Claude Opus 4.6 has uncovered more than 500 open source vulnerabilities, raising new considerations for disclosure, triage, and patching at scale.

Research
/Security News
Malicious dYdX client packages were published to npm and PyPI after a maintainer compromise, enabling wallet credential theft and remote code execution.

Security News
gem.coop is testing registry-level dependency cooldowns to limit exposure during the brief window when malicious gems are most likely to spread.