[paul-hammant]

Updates the vendored PCRE2 from 10.44 to 10.49, and closes #3109, whose fix has already landed (see below).

PCRE2 10.49

std/regex/pcre2/ is what std.regex runs on a box without a system libpcre2-8, and in every ae build --target cross build. Builds that use a system library are unchanged.

Security. std.regex only calls pcre2_compile, pcre2_match and pcre2_substitute, with no JIT. Of the fixes since 10.44, the one it can reach is GHSA-fmgr-6ggq-9859: integer overflows while compiling a pattern on 32-bit CPUs, leading to out-of-bounds writes. That hits the vendored engine on its 32-bit cross targets. The rest are in code std.regex never calls:

• GHSA-r9hj-j2rw-4q3m, the 10.49 fix: JIT stack;
• GHSA-2p8c-ff85-vh9x: JIT;
• GHSA-3r4p-g7gg-ppmf: DFA;
• GHSA-9qww-pwc4-77qq: MATCH_INVALID_UTF;
• GHSA-q8g2-wprr-34m9: pcre2_convert;
• GHSA-q7rw-r7qq-2hx6: serialize.

CVE-2025-58050 was introduced in 10.45 and fixed in 10.46, so this upgrade skips it.

Pattern behaviour changes (from upstream's NEWS):

• Unicode 17.
• Under caseless matching, \p{Ll} / \p{Lu} / [:lower:] match both cases, as Perl does.
• \x not followed by { or a hex digit is no longer a NUL escape; write \x00.

Layout changes.

• 10.45 split the compiler into three files and added pcre2_match_next.c.
• pcre2_jit_match.c, pcre2_jit_misc.c and pcre2_ucptables.c became *_inc.h files.
• The unity TU (aether_pcre2_vendored.c) and scripts/vendor-pcre2.sh now follow NON-AUTOTOOLS-BUILD's list of 31 sources. The script's comments now say how to check the signature and how to find the file list with gcc -MM.
• Upstream renamed LICENCE to LICENCE.md (SPDX BSD-3-Clause WITH PCRE2-exception); THIRD_PARTY_LICENSES.md carries the new text.

Provenance.

• The SHA-256 pinned in the script is GitHub's published asset digest.
• The tarball's GPG signature is good. It's from Nicholas Wilson's key (primary fingerprint A955 3620 4A3B B489 7152 3128 2A98 E77E B6F2 4CA8), the key upstream's SECURITY.md names for releases from 10.45 on.
• All 42 vendored files compare byte-identical to the tarball, apart from the three renames upstream designates for this kind of build.

Checked:

• make PCRE2=vendored from clean; libaether.a reports 10.49 2026-09-28.
• std/regex/test_regex.ae passes.
• regex_crossbuild passes: x86_64-linux, no sysroot.
• make test-ae PCRE2=vendored: 1863 passed. The 6 failures are the known local ones, the same on main.
• The unity TU compiles with no warnings under gcc -Wall -Wextra and under zig cc for x86_64-windows-gnu, aarch64-macos, x86_64-linux-musl and arm-linux-musleabihf.
• check-docs, check-tests, check-changelog and public_headers pass.

#3109

Closes #3109. The fix landed in 7a110b6, "tinyweb serves its WebSocket, SSE and chunked endpoints through std.http, on the server's port (#3109)", which merged with #3101. That commit referenced the issue without a closing keyword, so the issue stayed open. Against the issue's checklist, on current main:

• tinyweb's own listener ports and frame reader/writer are gone, and so is ws_client.ae.
• web_socket uses http.server_websocket, and sse_endpoint uses http.server_sse.
• Chunked bodies go through http.response_begin_chunked.
• with_timeout and with_keep_alive are applied. The options that were stored but never read have been removed.
• contrib/tinyweb/test_streams.ae covers each test the issue asks for: a message over 64 KiB both ways, a binary message with zero bytes, ping → pong, an idle connection past with_timeout, an SSE handler stopping once its client leaves, and a chunked body read back whole. All 12 specs pass here.
• Fragment reassembly has no tinyweb-level spec. It's std.http's codec, which is covered by its RFC 6455 conformance tests.

No code change was needed for it. It's included here so it closes without another CI run.

🤖 Generated with Claude Code