Fix UB in IOChunk::as_str(): only cache utf8_verified on successful UTF-8 validation

The multiline matching resulted in a large performance regression due to
the indiscriminate use of the dotall (?s) flag.  Change the regex
selection process to use only the flag when probably needed.

.github/workflows/GnuComment.yml

@@ -18,7 +18,7 @@ jobs:
       github.event.workflow_run.event == 'pull_request'
     steps:
       - name: 'Download artifact'
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           script: |
             // List all artifacts from GnuTests
@@ -32,12 +32,12 @@ jobs:
             var matchArtifact = artifacts.data.artifacts.filter((artifact) => {
               return artifact.name == "comment"
             })[0];
-            
+
             if (!matchArtifact) {
               console.log('No comment artifact found');
               return;
             }
-            
+
             var download = await github.rest.actions.downloadArtifact({
               owner: context.repo.owner,
               repo: context.repo.repo,
@@ -49,12 +49,12 @@ jobs:
       - run: unzip comment.zip || echo "Failed to unzip comment artifact"
 
       - name: 'Comment on PR'
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
             var fs = require('fs');
-            
+
             // Check if files exist
             if (!fs.existsSync('./NR')) {
               console.log('No NR file found, skipping comment');
@@ -64,10 +64,10 @@ jobs:
               console.log('No result.txt file found, skipping comment');
               return;
             }
-            
+
             var issue_number = Number(fs.readFileSync('./NR'));
             var content = fs.readFileSync('./result.txt');
-            
+
             if (content.toString().trim().length > 7) { // 7 because we have backquote + \n
               await github.rest.issues.createComment({
                 owner: context.repo.owner,
@@ -77,4 +77,4 @@ jobs:
               });
             } else {
               console.log('Comment content too short, skipping');
-            }
+            }

.github/workflows/GnuTests.yml

@@ -28,7 +28,7 @@ jobs:
     steps:
     #### Get the code, setup cache
     - name: Checkout code (sed)
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
       with:
         path: 'sed'
         persist-credentials: false
@@ -40,7 +40,7 @@ jobs:
       with:
         workspaces: "./sed -> target"
     - name: Checkout code (GNU sed testsuite)
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
       with:
         repository: 'mirror/sed'
         path: 'gnu.sed'
@@ -56,16 +56,18 @@ jobs:
         ## Build Rust sed binary
         cd 'sed'
         cargo build --config=profile.release.strip=true --profile=release #-fast
-        zstd -19 target/release/sed -o ../sed-x86_64-unknown-linux-gnu.zst
+        tar -C target/release -cf - sed | zstd -19 -o ../sed-x86_64-unknown-linux-gnu.tar.zst
     - name: Publish latest commit
-      uses: softprops/action-gh-release@v2
+      uses: softprops/action-gh-release@v3
       if: github.event_name == 'push' && github.ref == 'refs/heads/main'
       with:
         tag_name: latest-commit
+        body: |
+          commit: ${{ github.sha }}
         draft: false
         prerelease: true
         files: |
-          sed-x86_64-unknown-linux-gnu.zst
+          sed-x86_64-unknown-linux-gnu.tar.zst
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -75,8 +77,8 @@ jobs:
       run: |
         ## Run GNU sed testsuite using our script
         cd 'sed'
-        # Set GNU testsuite directory
-        export GNU_TESTSUITE_DIR="../gnu.sed/testsuite"
+        # Set GNU sed source directory (testsuite is at gnu.sed/testsuite/)
+        export GNU_SED_DIR="../gnu.sed"
         # Run tests with JSON output
         ./util/run-gnu-testsuite.sh --json-output "${{ env.TEST_FULL_SUMMARY_FILE }}" || true
 
@@ -91,7 +93,7 @@ jobs:
         find . -name "*json*" -type f || echo "No JSON files found"
 
     - name: Upload full json results
-      uses: actions/upload-artifact@v6
+      uses: actions/upload-artifact@v7
       with:
         name: sed-gnu-full-result
         path: sed/${{ env.TEST_FULL_SUMMARY_FILE }}
@@ -99,7 +101,7 @@ jobs:
 
     - name: Upload test logs
       if: always()
-      uses: actions/upload-artifact@v6
+      uses: actions/upload-artifact@v7
       with:
         name: test-logs
         path: |
@@ -126,13 +128,13 @@ jobs:
         outputs TEST_SUMMARY_FILE
 
     - name: Checkout code (sed)
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
       with:
         path: 'sed'
         persist-credentials: false
 
     - name: Retrieve reference artifacts
-      uses: dawidd6/action-download-artifact@v12
+      uses: dawidd6/action-download-artifact@v21
       continue-on-error: true
       with:
         workflow: GnuTests.yml
@@ -142,7 +144,7 @@ jobs:
         if_no_artifact_found: warn
 
     - name: Download full json results
-      uses: actions/download-artifact@v7
+      uses: actions/download-artifact@v8
       with:
         name: sed-gnu-full-result
         path: results
@@ -203,13 +205,13 @@ jobs:
         outputs HASH TOTAL PASS FAIL SKIP
 
     - name: Upload SHA1/ID of 'test-summary'
-      uses: actions/upload-artifact@v6
+      uses: actions/upload-artifact@v7
       with:
         name: "${{ steps.summary.outputs.HASH }}"
         path: "${{ steps.vars.outputs.TEST_SUMMARY_FILE }}"
 
     - name: Upload test results summary
-      uses: actions/upload-artifact@v6
+      uses: actions/upload-artifact@v7
       with:
         name: test-summary
         path: "${{ steps.vars.outputs.TEST_SUMMARY_FILE }}"
@@ -259,10 +261,10 @@ jobs:
           echo "ONLY_INTERMITTENT=true" >> $GITHUB_ENV
           echo "::notice ::No new test failures detected"
         fi
-    
+
     - name: Upload comparison log (for GnuComment workflow)
       if: success() || failure()
-      uses: actions/upload-artifact@v6
+      uses: actions/upload-artifact@v7
       with:
         name: comment
         path: reference/comment/

.github/workflows/audit.yml

@@ -0,0 +1,17 @@
+name: Security audit
+
+# spell-checker:ignore (misc) rustsec
+
+on:
+  schedule:
+    - cron: "0 0 * * *"
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: rustsec/audit-check@v2
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/benchmarks.yml

@@ -25,25 +25,20 @@ jobs:
         benchmark-target:
           - { package: sed }
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
 
-      - name: Install system dependencies
-        shell: bash
-        run: |
-          sudo apt-get -y update
-
       - uses: dtolnay/rust-toolchain@stable
-
       - uses: Swatinem/rust-cache@v2
 
       - name: Run sccache-cache
-        uses: mozilla-actions/sccache-action@v0.0.9
+        uses: mozilla-actions/sccache-action@v0.0.10
 
-      - name: Install cargo-codspeed
-        shell: bash
-        run: cargo install cargo-codspeed --locked
+      - name: Install tools
+        uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-codspeed
 
       - name: Build benchmarks for ${{ matrix.benchmark-target.package }}
         shell: bash

.github/workflows/ci.yml

@@ -13,10 +13,31 @@ jobs:
       matrix:
         os: [ubuntu-latest, macOS-latest, windows-latest]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - run: cargo check
 
+  check_android:
+    name: cargo check (Android ${{ matrix.target }})
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        target: [aarch64-linux-android, armv7-linux-androideabi]
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+      - uses: android-actions/setup-android@v4
+      - name: Install Android NDK
+        run: sdkmanager "ndk;29.0.14206865"
+      - name: Install cargo-ndk
+        run: cargo install cargo-ndk
+      - name: Check Android target
+        run: cargo ndk --platform 21 --target ${{ matrix.target }} check
+        env:
+          ANDROID_NDK_HOME: ${{ env.ANDROID_SDK_ROOT }}/ndk/29.0.14206865
+
   test:
     name: cargo test
     runs-on: ${{ matrix.os }}
@@ -28,7 +49,7 @@ jobs:
         run: |
           git config --global core.autocrlf false
           git config --global core.eol lf
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - run: cargo test --all
 
@@ -47,7 +68,7 @@ jobs:
       run: |
         git config --global core.autocrlf false
         git config --global core.eol lf
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
     - name: Initialize workflow variables
       id: vars
       shell: bash
@@ -109,7 +130,7 @@ jobs:
         ls -al
         echo "report=${COVERAGE_REPORT_FILE}" >> $GITHUB_OUTPUT
     - name: Upload coverage results (to Codecov.io)
-      uses: codecov/codecov-action@v5
+      uses: codecov/codecov-action@v7
       with:
         token: ${{ secrets.CODECOV_TOKEN }}
         files: ${{ steps.coverage.outputs.report }}

.github/workflows/code-quality.yml

@@ -25,7 +25,7 @@ jobs:
     name: cargo fmt --all -- --check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - run: rustup component add rustfmt
       - run: cargo fmt --all -- --check
@@ -44,14 +44,14 @@ jobs:
           - { os: macos-latest }
           - { os: windows-latest }
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@master
         with:
           toolchain: stable
           components: clippy
       - uses: Swatinem/rust-cache@v2
       - name: Run sccache-cache
-        uses: mozilla-actions/sccache-action@v0.0.9
+        uses: mozilla-actions/sccache-action@v0.0.10
       - name: Initialize workflow variables
         id: vars
         shell: bash

.github/workflows/fuzzing.yml

@@ -21,18 +21,20 @@ jobs:
     name: Build the fuzzers
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
       with:
         persist-credentials: false
-    - uses: dtolnay/rust-toolchain@nightly
     - name: Install `cargo-fuzz`
-      run: cargo install cargo-fuzz
+      uses: taiki-e/install-action@v2
+      with:
+        tool: cargo-fuzz
     - uses: Swatinem/rust-cache@v2
       with:
         shared-key: "cargo-fuzz-cache-key"
         cache-directories: "fuzz/target"
     - name: Run `cargo-fuzz build`
-      run: cargo +nightly fuzz build
+      # https://github.com/rust-fuzz/cargo-fuzz/issues/398
+      run: env RUSTC_BOOTSTRAP=1 cargo fuzz build --target $(rustc --print host-tuple)
 
   fuzz-run:
     needs: fuzz-build
@@ -47,18 +49,19 @@ jobs:
           - { name: fuzz_sed, should_pass: false }
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
       with:
         persist-credentials: false
-    - uses: dtolnay/rust-toolchain@nightly
     - name: Install `cargo-fuzz`
-      run: cargo install cargo-fuzz
+      uses: taiki-e/install-action@v2
+      with:
+        tool: cargo-fuzz
     - uses: Swatinem/rust-cache@v2
       with:
         shared-key: "cargo-fuzz-cache-key"
         cache-directories: "fuzz/target"
     - name: Restore Cached Corpus
-      uses: actions/cache/restore@v5
+      uses: actions/cache/restore@v6
       with:
         key: corpus-cache-${{ matrix.test-target.name }}
         path: |
@@ -70,7 +73,8 @@ jobs:
       run: |
         mkdir -p fuzz/stats
         STATS_FILE="fuzz/stats/${{ matrix.test-target.name }}.txt"
-        cargo +nightly fuzz run ${{ matrix.test-target.name }} -- -max_total_time=${{ env.RUN_FOR }} -timeout=${{ env.RUN_FOR }} -detect_leaks=0 -print_final_stats=1 2>&1 | tee "$STATS_FILE"
+        # https://github.com/rust-fuzz/cargo-fuzz/issues/398
+        env RUSTC_BOOTSTRAP=1 cargo fuzz run --target $(rustc --print host-tuple) ${{ matrix.test-target.name }} -- -max_total_time=${{ env.RUN_FOR }} -timeout=${{ env.RUN_FOR }} -detect_leaks=0 -print_final_stats=1 2>&1 | tee "$STATS_FILE"
 
         # Extract key stats from the output
         if grep -q "stat::number_of_executed_units" "$STATS_FILE"; then
@@ -140,13 +144,13 @@ jobs:
 
         echo "" >> $GITHUB_STEP_SUMMARY
     - name: Save Corpus Cache
-      uses: actions/cache/save@v5
+      uses: actions/cache/save@v6
       with:
         key: corpus-cache-${{ matrix.test-target.name }}
         path: |
           fuzz/corpus/${{ matrix.test-target.name }}
     - name: Upload Stats
-      uses: actions/upload-artifact@v6
+      uses: actions/upload-artifact@v7
       with:
         name: fuzz-stats-${{ matrix.test-target.name }}
         path: |
@@ -159,11 +163,11 @@ jobs:
     runs-on: ubuntu-latest
     if: always()
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
       - name: Download all stats
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           path: fuzz/stats-artifacts
           pattern: fuzz-stats-*
@@ -257,7 +261,7 @@ jobs:
         run: |
           cat fuzzing_summary.md
       - name: Upload Summary
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: fuzzing-summary
           path: fuzzing_summary.md

.github/workflows/ignore-intermittent.txt

@@ -4,4 +4,4 @@
 # Add test names that are known to be flaky or environment-dependent
 # Example:
 # basic_substitution
-# line_address_test
+# line_address_test

.github/workflows/release.yml

@@ -56,7 +56,7 @@ jobs:
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
           submodules: recursive
@@ -66,7 +66,7 @@ jobs:
         shell: bash
         run: "curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.30.3/cargo-dist-installer.sh | sh"
       - name: Cache dist
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: cargo-dist-cache
           path: ~/.cargo/bin/dist
@@ -82,7 +82,7 @@ jobs:
           cat plan-dist-manifest.json
           echo "manifest=$(jq -c "." plan-dist-manifest.json)" >> "$GITHUB_OUTPUT"
       - name: "Upload dist-manifest.json"
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: artifacts-plan-dist-manifest
           path: plan-dist-manifest.json
@@ -116,7 +116,7 @@ jobs:
       - name: enable windows longpaths
         run: |
           git config --global core.longpaths true
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
           submodules: recursive
@@ -131,7 +131,7 @@ jobs:
         run: ${{ matrix.install_dist.run }}
       # Get the dist-manifest
       - name: Fetch local artifacts
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           pattern: artifacts-*
           path: target/distrib/
@@ -158,7 +158,7 @@ jobs:
 
           cp dist-manifest.json "$BUILD_MANIFEST_NAME"
       - name: "Upload artifacts"
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: artifacts-build-local-${{ join(matrix.targets, '_') }}
           path: |
@@ -175,19 +175,19 @@ jobs:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       BUILD_MANIFEST_NAME: target/distrib/global-dist-manifest.json
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
           submodules: recursive
       - name: Install cached dist
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: cargo-dist-cache
           path: ~/.cargo/bin/
       - run: chmod +x ~/.cargo/bin/dist
       # Get all the local artifacts for the global tasks to use (for e.g. checksums)
       - name: Fetch local artifacts
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           pattern: artifacts-*
           path: target/distrib/
@@ -205,7 +205,7 @@ jobs:
 
           cp dist-manifest.json "$BUILD_MANIFEST_NAME"
       - name: "Upload artifacts"
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: artifacts-build-global
           path: |
@@ -225,19 +225,19 @@ jobs:
     outputs:
       val: ${{ steps.host.outputs.manifest }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
           submodules: recursive
       - name: Install cached dist
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: cargo-dist-cache
           path: ~/.cargo/bin/
       - run: chmod +x ~/.cargo/bin/dist
       # Fetch artifacts from scratch-storage
       - name: Fetch artifacts
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           pattern: artifacts-*
           path: target/distrib/
@@ -250,14 +250,14 @@ jobs:
           cat dist-manifest.json
           echo "manifest=$(jq -c "." dist-manifest.json)" >> "$GITHUB_OUTPUT"
       - name: "Upload dist-manifest.json"
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           # Overwrite the previous copy
           name: artifacts-dist-manifest
           path: dist-manifest.json
       # Create a GitHub Release while uploading all files to it
       - name: "Download GitHub Artifacts"
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           pattern: artifacts-*
           path: artifacts
@@ -290,7 +290,7 @@ jobs:
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
           submodules: recursive

.github/workflows/wasi.yml

@@ -0,0 +1,28 @@
+# spell-checker:ignore wasip
+name: WASI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+# End the current execution if there is a new changeset in the PR.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+jobs:
+  test_wasi:
+    name: Tests
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v7
+    - uses: dtolnay/rust-toolchain@stable
+      with:
+        targets: wasm32-wasip1
+    - name: check
+      run: cargo check --target wasm32-wasip1

.pre-commit-config.yaml

@@ -0,0 +1,55 @@
+# See https://pre-commit.com for more information
+# See https://pre-commit.com/hooks.html for more hooks
+exclude: ^tests/fixtures/
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
+    hooks:
+      - id: check-added-large-files
+      - id: check-executables-have-shebangs
+      - id: check-json
+        exclude: '\.vscode/(cSpell|extensions)\.json' # cSpell.json and extensions.json use comments
+      - id: check-shebang-scripts-are-executable
+        exclude: '.+\.rs' # would be triggered by #![some_attribute]
+      - id: check-symlinks
+      - id: check-toml
+      - id: check-yaml
+        args: [ --allow-multiple-documents ]
+      - id: destroyed-symlinks
+      - id: end-of-file-fixer
+      - id: mixed-line-ending
+        args: [ --fix=lf ]
+      - id: trailing-whitespace
+
+  - repo: local
+    hooks:
+      - id: rust-linting
+        name: Rust linting
+        description: Run cargo fmt on files included in the commit.
+        entry: cargo +stable fmt --
+        pass_filenames: true
+        types: [file, rust]
+        language: system
+      - id: rust-clippy
+        name: Rust clippy
+        description: Run cargo clippy on files included in the commit.
+        entry: cargo +stable clippy --workspace --all-targets --all-features -- -D warnings
+        pass_filenames: false
+        types: [file, rust]
+        language: system
+      - id: cargo-lock-check
+        name: Cargo.lock sync check
+        description: Ensure Cargo.lock and fuzz/Cargo.lock are up-to-date.
+        entry: bash -c 'for dir in . fuzz; do ( cd "$dir" && cargo fetch --quiet ); done'
+        pass_filenames: false
+        files: 'Cargo\.(toml|lock)$'
+        language: system
+      - id: cspell
+        name: Code spell checker (cspell)
+        description: Run cspell to check for spelling errors (if available).
+        entry: bash -c 'if command -v cspell >/dev/null 2>&1; then cspell --no-must-find-files -- "$@"; else echo "cspell not found, skipping spell check"; exit 0; fi' --
+        pass_filenames: true
+        language: system
+
+ci:
+  skip: [rust-linting, rust-clippy, cargo-lock-check, cspell]

CONTRIBUTING.md

@@ -0,0 +1,32 @@
+# Contributing to sed
+
+Hi! Welcome to uutils/sed, and thanks for wanting to contribute!
+
+This project follows the shared conventions of the [uutils](https://github.com/uutils)
+organization. Before opening a pull request, please read:
+
+- Our **[Review Guidelines](https://uutils.github.io/reviews/)** — what we expect
+  from a pull request and how reviews are carried out.
+- Our community's [CODE_OF_CONDUCT.md](./CODE_OF_CONDUCT.md), if present.
+
+Finally, feel free to join our [Discord](https://discord.gg/wQVJbvJ)!
+
+> [!WARNING]
+> uutils is original code and cannot contain any code from GNU or other
+> strongly-licensed (GPL/LGPL) implementations. We **cannot** accept changes
+> based on the GNU source code, and you **must not link** to it either. You may
+> look at permissively-licensed implementations (MIT/BSD) and read the GNU
+> *manuals* — never the GNU *source*.
+
+## In short
+
+- Discuss non-trivial changes in an issue **before** writing the code.
+- Keep pull requests **small, self-contained, and descriptively titled**
+  (e.g. `sed: fix ...`).
+- Make sure CI passes: tests are green, `rustfmt` is satisfied, and there are
+  no `clippy` warnings.
+- Add tests for new behavior; don't let coverage regress.
+- Write small, atomic commits annotated with the component you touched.
+
+See the [Review Guidelines](https://uutils.github.io/reviews/) for the full
+details.

Cargo.toml

@@ -35,33 +35,31 @@ chrono = { version = "0.4.37", default-features = false, features = [
 ] }
 clap = { version = "4.4", features = ["wrap_help", "cargo"] }
 clap_complete = "4.5"
-clap_mangen = "0.2"
-divan = { package = "codspeed-divan-compat", version = "4.0.5" }
-fancy-regex = "0.17.0"
+clap_mangen = "0.3"
+divan = { package = "codspeed-divan-compat", version = "5.0.0" }
+fancy-regex = "0.18.0"
 hex = "0.4"
 libc = "0.2.153"
 memchr = "2.7.4"
 memmap2 = "0.9"
-phf = "0.13.0"
-phf_codegen = "0.13.0"
+phf = "0.14.0"
+phf_codegen = "0.14.0"
 predicates = "3.1.3"
-rand = { version = "0.9", features = ["small_rng"] }
+rand = { version = "0.10.0" }
 regex = "1.10.4"
-sha2 = "0.10"
+sha2 = "0.11"
 sysinfo = "0.38"
 tempfile = "3.10.1"
-textwrap = { version = "0.16.1", features = ["terminal_size"] }
 terminal_size = "0.4.2"
-uucore = { version = "0.5.0", features = ["libc"] }
+textwrap = { version = "0.16.1", features = ["terminal_size"] }
+uucore = { version = "0.9.0", features = ["libc"] }
 xattr = "1.3.1"
 
 
 [dependencies]
-assert_fs = { workspace = true }
 clap = { workspace = true }
 clap_complete = { workspace = true }
 clap_mangen = { workspace = true }
-ctor = "0.6.0"
 fancy-regex =  { workspace = true }
 memchr = { workspace = true }
 memmap2.workspace = true
@@ -75,7 +73,9 @@ textwrap = { workspace = true }
 uucore = { workspace = true }
 
 [dev-dependencies]
+assert_fs = { workspace = true }
 chrono = { workspace = true }
+ctor = "1.0.0"
 divan = { workspace = true }
 hex = { workspace = true }
 libc = { workspace = true }
@@ -85,13 +85,13 @@ regex = { workspace = true }
 sha2 = { workspace = true }
 tempfile = { workspace = true }
 uucore = { workspace = true, features = ["entries", "process", "signals", "benchmark"] }
-uutests = "0.5.0"
+uutests = "0.9.0"
 
 [target.'cfg(unix)'.dev-dependencies]
 xattr = { workspace = true }
 
 [target.'cfg(any(target_os = "linux", target_os = "android"))'.dev-dependencies]
-rlimit = "0.10.1"
+rlimit = "0.11.0"
 
 [build-dependencies]
 phf_codegen = { workspace = true }
@@ -107,31 +107,53 @@ path = "src/bin/sed.rs"
 name = "sed_bench"
 harness = false
 
-# The default release profile. It contains all optimizations, without
-# sacrificing debug info. With this profile (like in the standard
-# release profile), the debug info and the stack traces will still be available.
 [profile.release]
 lto = true
-
-# A release-like profile that is tuned to be fast, even when being fast
-# compromises on binary size. This includes aborting on panic.
-[profile.release-fast]
-inherits = "release"
 panic = "abort"
-codegen-units = 1 # should be moved to release without regression
+# should be dropped to 1 for binary size without performance drop
+codegen-units = 7
 
 # A release-like profile that is as small as possible.
 [profile.release-small]
-inherits = "release-fast"
+inherits = "release"
 opt-level = "z"
 strip = true
 
 [lints.clippy]
-default_trait_access = "warn"
-manual_string_new = "warn"
+all = { level = "warn", priority = -1 }
+
+cargo = { level = "warn", priority = -1 }
+
+pedantic = { level = "warn", priority = -1 }
+# The counts were generated with this command:
+#   cargo +nightly clippy --all-targets --workspace --message-format=json --quiet \
+#     | jq -r '.message.code.code | select(. != null and startswith("clippy::"))' \
+#     | sort | uniq -c | sort -h -r
+missing_errors_doc = "allow"                 # 69
+doc_markdown = "allow"                       # 63
+must_use_candidate = "allow"                 # 56
+needless_raw_string_hashes = "allow"         # 20
+needless_pass_by_value = "allow"             # 15
+missing_panics_doc = "allow"                 # 12
+cast_possible_truncation = "allow"           # 7
+unnecessary_wraps = "allow"                  # 6
+match_wildcard_for_single_variants = "allow" # 4
+cast_sign_loss = "allow"                     # 4
+cast_possible_wrap = "allow"                 # 4
+uninlined_format_args = "allow"              # 3
+similar_names = "allow"                      # 3
+used_underscore_binding = "allow"            # 2
+too_many_lines = "allow"                     # 2
+struct_excessive_bools = "allow"             # 2
+match_same_arms = "allow"                    # 2
+ignore_without_reason = "allow"              # 2
+format_push_string = "allow"                 # 2
+should_panic_without_expect = "allow"        # 1
+many_single_char_names = "allow"             # 1
+comparison_chain = "allow"
+multiple_crate_versions = "allow"
+unnested_or_patterns = "allow"
+
+restriction = { level = "allow", priority = -1 }
 cognitive_complexity = "warn"
-implicit_clone = "warn"
-range-plus-one = "warn"
-redundant-clone = "warn"
-match_bool = "warn"
-semicolon_if_nothing_returned = "warn"
+redundant_clone = "warn"

README.md

@@ -3,7 +3,7 @@
 [![License](http://img.shields.io/badge/license-MIT-blue.svg)](https://github.com/uutils/sed/blob/main/LICENSE)
 [![dependency status](https://deps.rs/repo/github/uutils/sed/status.svg)](https://deps.rs/repo/github/uutils/sed)
 
-[![CodeCov](https://codecov.io/gh/uutils/sed/branch/master/graph/badge.svg)](https://codecov.io/gh/uutils/sed)
+[![CodeCov](https://codecov.io/gh/uutils/sed/branch/main/graph/badge.svg)](https://codecov.io/gh/uutils/sed)
 
 # sed
 
@@ -14,7 +14,7 @@ and other extensions.
 
 ## Status
 
-At this state _sed_ implements all POSIX commands
+At this state _sed_ implements all [POSIX features](https://pubs.opengroup.org/onlinepubs/9799919799/)
 and can run correctly the two complex scripts of its integration tests:
 [hanoi.sed](https://github.com/uutils/sed/blob/main/tests/fixtures/sed/script/hanoi.sed) (solves the Towers of Hanoi puzzle) and
 [math.sed](https://github.com/uutils/sed/blob/main/tests/fixtures/sed/script/math.sed)  (implements an arbitrary precision integer math calculator).
@@ -26,9 +26,12 @@ Further work aims to:
 * Implement more GNU extensions,
 * Improve performance where possible.
 
-## Installation
+## Installation and Use
 
-Ensure you have Rust installed on your system. You can install Rust through [rustup](https://rustup.rs/).
+We provide a Linux x86_64 binary archive from the main branch at
+https://github.com/uutils/sed/releases/tag/latest-commit .
+
+For other platforms, ensure you have Rust installed on your system. You can install Rust through [rustup](https://rustup.rs/).
 
 Clone the repository and build the project using Cargo:
 
@@ -41,11 +44,16 @@ cargo run --release
 
 The binary is named `sed` in `target/release/sed`.
 
+You can also try *sed* on the web
+through the [uutils Playground](https://uutils.org//playground/)
+by clicking on the `Load sed` button.
+
 ## Testing
 
 ### GNU sed Compatibility Testing
 
-Test compatibility against GNU sed using the comprehensive testsuite (47+ tests, ~10% pass rate):
+Test compatibility against GNU sed by running the upstream testsuite shell scripts
+with a lightweight gnulib test-framework shim:
 
 ```bash
 # Clone GNU sed testsuite (one time setup)
@@ -54,11 +62,16 @@ git clone https://github.com/mirror/sed.git ../gnu.sed
 # Run compatibility tests
 ./util/run-gnu-testsuite.sh
 
+# Verbose mode shows failure details
+./util/run-gnu-testsuite.sh -v
+
 # Generate JSON results for CI
 ./util/run-gnu-testsuite.sh --json-output results.json
 ```
 
-The testsuite extracts test cases from the GNU sed repository and tests them against expected outputs.
+The harness executes each `.sh` test from the GNU sed testsuite directly, injecting
+our Rust sed binary via `PATH` and providing shim implementations of the gnulib test
+framework functions (`compare_`, `returns_`, `skip_`, etc.).
 
 ### Unit Tests
 
@@ -72,21 +85,25 @@ cargo test
 * Spaces can precede a regular expression modifier.
 * `I` can be used in as a synonym for the `i` (case insensitive) substitution
   flag.
+* `M` and `m` substitution flags allow multi-line matching.
 * In addition to `\n`, other escape sequences (octal, hex, C) are supported
   in the strings of the `y` command.
   Under POSIX these yield undefined behavior.
 * The `a`, `c`, and `i` commands do not require an initial backslash,
   allow text to appear on the same line, and support escape sequences
   in the specified text.
+* The `a`, `i`, `=`, `l`, `q` and `r` commands support address range as an extension to POSIX.
 * The substitution command replacement group `\0` is a synonym for &.
 * A `Q` command (optionally followed by an exit code) quits immediately.
 * The `q` command can be optionally followed by an exit code.
 * The `l` command can be optionally followed by the output width.
-* The `--follow-symlinks` flag for in-place editing.
+* The `--follow-symlinks` option for in-place editing.
+* The `--sandbox` option that limits potentially destructive commands.
 * Address 0 can be used to specify an address range that is already
   active on line 1 and can finish with the specified regular expression.
 * Address steps can be specified in the form of start~step and start,~step
   ranges.
+* Address 0 can be used in the `r` command to prepend a file.
 
 ### Supported BSD and GNU extensions
 * The second address in a range can be specified as a relative address with +N.

SECURITY.md

@@ -0,0 +1,44 @@
+# Security Policy
+
+## Supported Versions
+
+We provide security updates only for the latest released version of `uutils/sed`.
+Older versions may not receive patches.
+If you are using a version packaged by your Linux distribution, please check with your distribution maintainers for their update policy.
+
+---
+
+## Reporting a Vulnerability
+
+**Do not open public GitHub issues for security vulnerabilities.**
+This prevents accidental disclosure before a fix is available.
+
+Instead, please use the following method:
+
+- **Email:** [sylvestre@debian.org](mailto:Sylvestre@debian.org)
+- **Encryption (optional):** You may encrypt your report using our PGP key:
+Fingerprint: B60D B599 4D39 BEC4 D1A9 5CCF 7E65 28DA 752F 1BE1
+---
+
+### What to Include in Your Report
+
+To help us investigate and resolve the issue quickly, please include as much detail as possible:
+
+- **Type of issue:** e.g. privilege escalation, information disclosure.
+- **Location in the source:** file path, commit hash, branch, or tag.
+- **Steps to reproduce:** exact commands, test cases, or scripts.
+- **Special configuration:** any flags, environment variables, or system setup required.
+- **Affected systems:** OS/distribution and version(s) where the issue occurs.
+- **Impact:** your assessment of the potential severity (DoS, RCE, data leak, etc.).
+
+---
+
+## Disclosure Policy
+
+We follow a **Coordinated Vulnerability Disclosure (CVD)** process:
+
+1. We will acknowledge receipt of your report within **10 days**.
+2. We will investigate, reproduce, and assess the issue.
+3. We will provide a timeline for developing and releasing a fix.
+4. Once a fix is available, we will publish a GitHub Security Advisory.
+5. You will be credited in the advisory unless you request anonymity.

fuzz/Cargo.toml

@@ -12,10 +12,10 @@ console = "0.16.0"
 libfuzzer-sys = "0.4.7"
 libc = "0.2.153"
 tempfile = "3.15.0"
-rand = { version = "0.9.0", features = ["small_rng"] }
-similar = "2.5.0"
-uucore = { version = "0.5.0", features = ["libc"] }
-uufuzz = "0.5.0"
+rand = { version = "0.10.0" }
+similar = "3.0.0"
+uucore = { version = "0.9.0", features = ["libc"] }
+uufuzz = "0.9.0"
 
 sed = { path = ".." }
 

src/sed/command.rs

@@ -105,6 +105,16 @@ pub enum ReplacementPart {
     Group(u32),      // \1 to \9
 }
 
+// The maximum value allowed in regex quantifier
+pub const RE_DUP_MAX: usize = 32767;
+
+/// Regex modes (BRE or ERE)
+#[derive(Copy, Clone, Debug)]
+pub enum RegexMode {
+    Basic,
+    Extended,
+}
+
 #[derive(Debug)]
 /// All specified replacements for an RE
 pub struct ReplacementTemplate {
@@ -162,12 +172,12 @@ impl ReplacementTemplate {
                 ReplacementPart::Literal(s) => result.push_str(s),
 
                 ReplacementPart::WholeMatch => {
-                    result.push_str(caps.get(0)?.map(|m| m.as_str()).unwrap_or(""));
+                    result.push_str(caps.get(0)?.map(|m| m.as_str()).unwrap_or_default());
                 }
 
                 ReplacementPart::Group(n) => {
                     let i: usize = (*n).try_into().unwrap();
-                    result.push_str(caps.get(i)?.map(|m| m.as_str()).unwrap_or(""));
+                    result.push_str(caps.get(i)?.map(|m| m.as_str()).unwrap_or_default());
                 }
             }
         }
@@ -202,6 +212,8 @@ pub struct Substitution {
     pub occurrence: usize,                            // Which occurrence to substitute
     pub print_flag: bool,                             // True if 'p' flag
     pub ignore_case: bool,                            // True if 'I' flag
+    pub execute: bool,                                // True if 'e' flag (GNU extension)
+    pub multiline: bool,                              // True if 'm' or 'M' flag (GNU extension)
     pub write_file: Option<Rc<RefCell<NamedWriter>>>, // Writer to file if 'w' flag is used
 }