PatternBleed - code scanning alert #431, rule js/identity-replacement (CWE-116), in tests/releaseNodeSources.test.cjs: a platform name was interpolated into a regex through p.replace('-', '-'), which replaces a hyphen with a hyphen. It reads as “escape this before putting it in a pattern” and does nothing at all, so the value went in raw.

Nothing failed, because a hyphen outside a character class needs no escaping - but the guard it looked like was not there, and a platform name carrying a . or a + would have matched the wrong row or thrown. CodeQL is right to flag the shape: its usual cause is a mistyped backslash escape, where a replacement meant to double a character silently is that character. The name is escaped for real now, with the same escapeRegExp the other guards in tests/ use.

tests/noIdentityReplacement.test.cjs catches the class rather than the instance - code scanning reports these days later in a web UI, the node suites report in fifteen seconds. Three things it took to make it honest: it compares the two sides as VALUES rather than as source text, since an escaped quote and a plain one are the same value and a text comparison would miss the very mistake it exists for; the two quote styles are separate alternatives rather than one character class excluding both, because CodeQL’s own example puts a double quote inside a single-quoted literal and the first shape of the pattern could not match it; and comments are stripped, with the guard skipping its own file, because this file and the one it was written for both quote the bad line to explain it. Verified in both directions - the repository is clean, and the same scan against the previous commit reports the offending line.