[dinwwwh]

LONE_SURROGATE_REGEX in packages/shared/src/uri.ts used a negative lookbehind ((?<!…)), which Safari/WebKit only parses from 16.4. unbuild copies regex literals into dist/index.mjs unchanged. So on iOS 15, iOS 16.0–16.3 and older WKWebViews the module, and any bundle chunk that contains it, fails to load with SyntaxError: Invalid regular expression: invalid group specifier name before any code runs. @standard-server/core imports safeEncodeURIComponent for generateContentDisposition, so browser apps using the fetch or peer adapters break on those devices.

Fix

• The regex is now /[\uD800-\uDFFF]/gu. With the u flag a well-formed surrogate pair is a single code point, so the class only matches lone surrogates, which still become U+FFFD. Safari has supported the u flag since 10. The try/catch and the oxlint-disable comments are unchanged.
• String.prototype.toWellFormed() is not an alternative, since it also needs Safari 16.4.

Testing

• The existing safeEncodeURIComponent cases still pass. New cases cover '\u{1F600}\uDE00', '\u{10FFFF}\uD800', and lone surrogates on both sides of a valid pair.
• Across 200k random strings built from high and low surrogates, valid pairs and BMP characters, replacing matches with U+FFFD gives identical output for the old and new patterns.
• The built dist/index.mjs contains /[\uD800-\uDFFF]/gu and no lookbehind.
• pnpm run check and pnpm test pass.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Dws6kfo5SZKrsmMVu1ADve

[pkg-pr-new]

• @standard-server/hono-node-playground
• @standard-server/node-http-playground

@standard-server/aws-lambda

npm i https://pkg.pr.new/@standard-server/aws-lambda@155

@standard-server/core

npm i https://pkg.pr.new/@standard-server/core@155

@standard-server/fastify

npm i https://pkg.pr.new/@standard-server/fastify@155

@standard-server/fetch

npm i https://pkg.pr.new/@standard-server/fetch@155

@standard-server/node

npm i https://pkg.pr.new/@standard-server/node@155

@standard-server/peer

npm i https://pkg.pr.new/@standard-server/peer@155

@standard-server/shared

npm i https://pkg.pr.new/@standard-server/shared@155

commit: de35cb9

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[codspeed]

Merging this PR will not alter performance

⚠️ 5 benchmarks spent significant time in system calls

System calls cannot be consistently instrumented, so they are not included in the measure, which understates the real cost. Please switch to the Walltime instrument to accurately measure system calls.

Measurement and system calls

• json 10KB
• octet stream 10KB
• form data 10KB
• event stream 10KB
• json 10KB

✅ 26 untouched benchmarks
⏩ 108 skipped benchmarks¹

---

_{Comparing claude/kind-volta-qjifkc (de35cb9) with main (6c1cc3b)}

Footnotes

1. 108 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[pullfrog]

✅ No new issues found.

Reviewed changes

• Regex rewrite — LONE_SURROGATE_REGEX in packages/shared/src/uri.ts:2 drops the lookbehind/lookahead form for /[\uD800-\uDFFF]/gu; the u flag makes a well-formed surrogate pair a single code point, so only lone surrogates match.
• Test cases — packages/shared/src/uri.test.ts gains three cases mixing well-formed pairs with lone surrogates.
• Guardrail test — tests/browser-compat.test.ts scans packages/*/src for (?<=/(?<! so lookbehind can't re-enter published source.

Verified the new pattern is behaviorally identical to the old one with a 200k-case fuzz over surrogate/astral code units; the new and existing uri tests pass and the guard test discriminates correctly.

  ^{｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}