
Security News
PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.
@claudiu-ceia/sgrep
Advanced tools
sgrep performs structural search over TS/JS source files using metavariable templates.
Pattern input can be:
cwd)npm install --save-dev @claudiu-ceia/sgrep
sgrep \
[--json] \
[--no-color] \
[--no-isomorphisms] \
[--cwd <path>] \
[--concurrency <n>] \
[--verbose <level>] \
<pattern-input> [scope]
# through umbrella CLI
astkit search \
[--json] \
[--no-color] \
[--no-isomorphisms] \
[--cwd <path>] \
[--concurrency <n>] \
[--verbose <level>] \
<pattern-input> [scope]
Flags:
--json: output structured JSON--no-color: disable colored output in compact text mode--no-isomorphisms: disable isomorphism expansion--cwd <path>: working directory for resolving pattern file and scope--concurrency <n>: max files processed concurrently (default: 8)--verbose <level>: perf tracing to stderr (1=summary, 2=includes slow files)# inline pattern
sgrep 'const :[name] = :[value];' src
# pattern from file
sgrep rules/find-const.sgrep src --cwd /repo
# inspect expanded-match behavior and perf tracing
sgrep 'const obj = { a: :[x], b: :[y] };' src --verbose 2
Supported syntax is shared with spatch templates:
:[name]:[_] anonymous hole (not captured):[name~regex] regex-constrained hole... variadic wildcardRepeated named holes enforce equality:
:[x] + :[x]
Matches foo + foo, not foo + bar.
Regex-constrained holes intentionally use a safe subset:
256256 cumulative ambiguity expansions across alternatives,
sequences, and bounded repetitions; overlapping variable sibling repetitions; unbounded repetition
of nullable or ambiguous alternatives; and compounding nested quantifiers2048 cumulative work units; deterministic non-nullable ranges
do not consume ambiguity expansions2048 characters are rejectedExample with variadic wildcard:
foo(:[x], ..., :[y])
Matches calls where :[x] is the first argument and :[y] is the last argument.
Hole captures are required to be structurally balanced:
This prevents partial malformed captures.
sgrep expands patterns through a small isomorphism engine before matching.
The default rule only adds redundant parentheses around binary expressions. It does not remove parentheses or reorder expressions, because those transformations are not generally sound in JavaScript.
The programmatic UNSAFE_ISOMORPHISM_RULES export retains operand and object-property reordering for
specialized callers that can guarantee purity and compatible operand types.
Disable all isomorphisms with:
sgrep 'const total = :[x] + :[y];' src --no-isomorphisms
Patterns containing template wildcard ... intentionally skip AST-based isomorphism expansion to avoid ambiguity with JS spread syntax.
--json returns the full result object for machine consumers.cwd.import {
DEFAULT_ISOMORPHISM_RULES,
DEFAULT_SEARCH_EXCLUDED_DIRECTORIES,
DEFAULT_SEARCHABLE_EXTENSIONS,
expandPatternIsomorphisms,
formatSearchOutput,
runSearchCommand,
searchProject,
type ExpandIsomorphismsOptions,
type IsomorphismRule,
type SearchCommandFlags,
type SgrepOptions,
type SgrepResult,
} from "@claudiu-ceia/sgrep";
Core APIs:
searchProject(patternInput, options?)runSearchCommand(patternInput, scope, flags) for CLI embeddingformatSearchOutput(result, { color? }) for compact text formattingexpandPatternIsomorphisms(pattern, options?) for rule-driven expansionsearchProject and runSearchCommand return:
type SgrepResult = {
scope: string;
pattern: string;
filesScanned: number;
filesMatched: number;
totalMatches: number;
elapsedMs: number;
files: Array<{
file: string;
matchCount: number;
matches: Array<{
start: number;
end: number;
line: number;
character: number;
matched: string;
captures: Record<string, string>;
}>;
}>;
};
From monorepo root:
bun run sgrep -- --help
bun test packages/sgrep/__tests__
bun test --coverage packages/sgrep/__tests__
bun run typecheck
FAQs
Structural grep for TS/JS using metavariable templates.
We found that @claudiu-ceia/sgrep demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.

Security News
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.

Threat Research
/Security News
A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys.