paul-hammant · Oct 24, 2026 · Oct 24, 2026
diff --git a/THIRD_PARTY_LICENSES.md b/THIRD_PARTY_LICENSES.md
@@ -98,7 +98,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
-## PCRE2 — BSD-3-Clause (with binary-redistribution exemption)
+## PCRE2 — BSD-3-Clause WITH PCRE2-exception (binary-redistribution exemption)
 
 Used by `std.regex` (issue
 [#1389](https://github.com/aether-lang-dev/aether/issues/1389)). The directory
@@ -108,11 +108,14 @@ Used by `std.regex` (issue
 `scripts/vendor-pcre2.sh`. It carries no local patches; three files keep the
 alternate names upstream itself designates for non-autotools embedding
 (`pcre2.h`, `config.h`, `pcre2_chartables.c`). The upstream licence text,
-also present as `std/regex/pcre2/LICENCE`:
+also present as `std/regex/pcre2/LICENCE.md`:
 
 ```
-PCRE2 LICENCE
--------------
+PCRE2 Licence
+=============
+
+| SPDX-License-Identifier: | BSD-3-Clause WITH PCRE2-exception |
+|---------|-------|
 
 PCRE2 is a library of functions to support regular expressions whose syntax
 and semantics are as close as possible to those of the Perl 5 language.
@@ -126,43 +129,52 @@ testdata directory is not copyrighted and is in the public domain.
 The basic library functions are written in C and are freestanding. Also
 included in the distribution is a just-in-time compiler that can be used to
 optimize pattern matching. This is an optional feature that can be omitted when
-the library is built.
+the library is built. The just-in-time compiler is separately licensed under the
+"2-clause BSD" licence.
+
 
+COPYRIGHT
+---------
 
-THE BASIC LIBRARY FUNCTIONS
----------------------------
+### The basic library functions
 
-Written by:       Philip Hazel
-Email local part: Philip.Hazel
-Email domain:     gmail.com
+    Written by:       Philip Hazel
+    Email local part: Philip.Hazel
+    Email domain:     gmail.com
 
-Retired from University of Cambridge Computing Service,
-Cambridge, England.
+    Retired from University of Cambridge Computing Service,
+    Cambridge, England.
 
-Copyright (c) 1997-2024 University of Cambridge
-All rights reserved.
+    Copyright (c) 1997-2007 University of Cambridge
+    Copyright (c) 2007-2024 Philip Hazel
+    All rights reserved.
 
+### PCRE2 Just-In-Time compilation support
 
-PCRE2 JUST-IN-TIME COMPILATION SUPPORT
---------------------------------------
+    Written by:       Zoltan Herczeg
+    Email local part: hzmester
+    Email domain:     freemail.hu
 
-Written by:       Zoltan Herczeg
-Email local part: hzmester
-Email domain:     freemail.hu
+    Copyright (c) 2010-2024 Zoltan Herczeg
+    All rights reserved.
 
-Copyright(c) 2010-2024 Zoltan Herczeg
-All rights reserved.
+### Stack-less Just-In-Time compiler
 
+    Written by:       Zoltan Herczeg
+    Email local part: hzmester
+    Email domain:     freemail.hu
 
-STACK-LESS JUST-IN-TIME COMPILER
---------------------------------
+    Copyright (c) 2009-2024 Zoltan Herczeg
+    All rights reserved.
 
-Written by:       Zoltan Herczeg
-Email local part: hzmester
-Email domain:     freemail.hu
+The code in the `deps/sljit` directory has its own LICENSE file.
 
-Copyright(c) 2009-2024 Zoltan Herczeg
-All rights reserved.
+### All other contributions
+
+Many other contributors have participated in the authorship of PCRE2. As PCRE2
+has never required a Contributor Licensing Agreement, or other copyright
+assignment agreement, all contributions have copyright retained by each
+original contributor or their employer.
 
 
 THE "BSD" LICENCE
@@ -171,16 +183,16 @@ THE "BSD" LICENCE
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are met:
 
-    * Redistributions of source code must retain the above copyright notices,
-      this list of conditions and the following disclaimer.
+* Redistributions of source code must retain the above copyright notices,
+  this list of conditions and the following disclaimer.
 
-    * Redistributions in binary form must reproduce the above copyright
-      notices, this list of conditions and the following disclaimer in the
-      documentation and/or other materials provided with the distribution.
+* Redistributions in binary form must reproduce the above copyright
+  notices, this list of conditions and the following disclaimer in the
+  documentation and/or other materials provided with the distribution.
 
-    * Neither the name of the University of Cambridge nor the names of any
-      contributors may be used to endorse or promote products derived from this
-      software without specific prior written permission.
+* Neither the name of the University of Cambridge nor the names of any
+  contributors may be used to endorse or promote products derived from this
+  software without specific prior written permission.
 
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
@@ -203,8 +215,6 @@ not apply all the way down a chain of software. If binary package A includes
 PCRE2, it must respect the condition, but if package B is software that
 includes package A, the condition is not imposed on package B unless it uses
 PCRE2 independently.
-
-End
 ```
 
 ## Project Wycheproof — Apache License 2.0

diff --git a/new_changelogs/20261024T190000Z-security-pcre2-10.49.md b/new_changelogs/20261024T190000Z-security-pcre2-10.49.md
@@ -0,0 +1,13 @@
+- **The vendored PCRE2 is 10.49, up from 10.44.** It is what `std.regex` runs
+  on a box without a system libpcre2-8, and in every `ae build --target` cross
+  build. Of the fixes since 10.44, the one std.regex can reach is
+  GHSA-fmgr-6ggq-9859: integer overflows while compiling a pattern on 32-bit
+  CPUs, leading to out-of-bounds writes. The rest (GHSA-r9hj-j2rw-4q3m,
+  -2p8c-ff85-vh9x, -3r4p-g7gg-ppmf, -9qww-pwc4-77qq, -q8g2-wprr-34m9,
+  -q7rw-r7qq-2hx6) are in JIT, DFA, invalid-UTF, convert and serialize paths
+  std.regex does not call. Patterns see PCRE2's own changes since 10.44:
+  Unicode 17, `\p{Ll}` / `\p{Lu}` / `[:lower:]` under caseless matching now
+  match both cases as Perl does, and `\x` not followed by `{` or a hex digit is
+  no longer a NUL escape (write `\x00`). The release tarball's GPG signature
+  checks against the key upstream's SECURITY.md names. Builds that use a
+  system libpcre2-8 are unchanged.
diff --git a/scripts/vendor-pcre2.sh b/scripts/vendor-pcre2.sh
@@ -6,6 +6,14 @@
 # Run from the repo root. To bump the version: update VERSION and SHA256
 # below (sha from the pcre2 GitHub release page), run the script, review
 # the diff, and update THIRD_PARTY_LICENSES.md if the licence text changed.
+# The release is also GPG-signed (pcre2-<v>.tar.gz.sig); upstream's
+# SECURITY.md names the signing key. Check it by hand when bumping:
+#   gpg --recv-keys A95536204A3BB489715231282A98E77EB6F24CA8
+#   gpg --verify pcre2-<v>.tar.gz.sig pcre2-<v>.tar.gz
+# When the source list in NON-AUTOTOOLS-BUILD changes, update the lists
+# below and the #includes in aether_pcre2_vendored.c together;
+# `gcc -MM std/regex/aether_pcre2_vendored.c -DAETHER_VENDOR_PCRE2` lists
+# every file the unity build reads.
 #
 # The vendored tree is VERBATIM upstream — no local patches, ever. The three
 # files whose committed name differs from their upstream name are the ones
@@ -19,8 +27,8 @@
 # by editing config.h, so the whole tree stays checkable against upstream.
 set -eu
 
-VERSION=10.44
-SHA256=86b9cb0aa3bcb7994faa88018292bc704cdbb708e785f7c74352ff6ea7d3175b
+VERSION=10.49
+SHA256=929f0b20e62879252a15886b06c89f1edef61a363cbd5826fb041080a5e557ae
 URL="https://github.com/PCRE2Project/pcre2/releases/download/pcre2-${VERSION}/pcre2-${VERSION}.tar.gz"
 DEST=std/regex/pcre2
 
@@ -39,23 +47,25 @@ SRC="$TMP/pcre2-${VERSION}/src"
 rm -rf "$DEST"
 mkdir -p "$DEST"
 
-# The 28 sources aether_pcre2_vendored.c #includes, plus the 3 that those
-# sources themselves #include (jit_match/jit_misc/ucptables are textual
-# inclusions upstream, never compiled standalone).
+# The 31 sources NON-AUTOTOOLS-BUILD lists, which aether_pcre2_vendored.c
+# #includes.
 for f in \
-    pcre2_auto_possess pcre2_chkdint pcre2_compile pcre2_config \
-    pcre2_context pcre2_convert pcre2_dfa_match pcre2_error pcre2_extuni \
-    pcre2_find_bracket pcre2_jit_compile pcre2_maketables pcre2_match \
-    pcre2_match_data pcre2_newline pcre2_ord2utf pcre2_pattern_info \
+    pcre2_auto_possess pcre2_chkdint pcre2_compile pcre2_compile_cgroup \
+    pcre2_compile_class pcre2_config pcre2_context pcre2_convert \
+    pcre2_dfa_match pcre2_error pcre2_extuni pcre2_find_bracket \
+    pcre2_jit_compile pcre2_maketables pcre2_match pcre2_match_data \
+    pcre2_match_next pcre2_newline pcre2_ord2utf pcre2_pattern_info \
     pcre2_script_run pcre2_serialize pcre2_string_utils pcre2_study \
     pcre2_substitute pcre2_substring pcre2_tables pcre2_ucd \
-    pcre2_valid_utf pcre2_xclass \
-    pcre2_jit_match pcre2_jit_misc pcre2_ucptables; do
+    pcre2_valid_utf pcre2_xclass; do
     cp "$SRC/$f.c" "$DEST/"
 done
 
-# Internal headers the sources include.
-for h in pcre2_internal.h pcre2_intmodedep.h pcre2_ucp.h; do
+# Internal headers the sources include, and the *_inc.h files they include
+# textually (never compiled standalone).
+for h in pcre2_internal.h pcre2_intmodedep.h pcre2_ucp.h pcre2_compile.h \
+    pcre2_util.h pcre2_jit_match_inc.h pcre2_jit_misc_inc.h \
+    pcre2_ucptables_inc.h; do
     cp "$SRC/$h" "$DEST/"
 done
 
@@ -66,14 +76,14 @@ cp "$SRC/pcre2_chartables.c.dist" "$DEST/pcre2_chartables.c"
 
 # Upstream licence, kept beside the code it covers (also reproduced in
 # THIRD_PARTY_LICENSES.md).
-cp "$TMP/pcre2-${VERSION}/LICENCE" "$DEST/LICENCE"
+cp "$TMP/pcre2-${VERSION}/LICENCE.md" "$DEST/LICENCE.md"
 
 cat > "$DEST/VENDOR.md" <<EOF
 # Vendored PCRE2 ${VERSION}
 
 Byte-identical subset of upstream PCRE2 ${VERSION}
 (<https://github.com/PCRE2Project/pcre2>), BSD-3-Clause — full licence in
-\`LICENCE\` here and in \`THIRD_PARTY_LICENSES.md\`. Vendored for #1389 so
+\`LICENCE.md\` here and in \`THIRD_PARTY_LICENSES.md\`. Vendored for #1389 so
 \`std.regex\` works without a system libpcre2-8: native builds on boxes
 without the library, and \`ae build --target ...\` cross builds with no
 CROSSBUILD_SYSROOT.

diff --git a/std/regex/aether_pcre2_vendored.c b/std/regex/aether_pcre2_vendored.c
diff --git a/std/regex/pcre2/LICENCE → std/regex/pcre2/LICENCE.md b/std/regex/pcre2/LICENCE → std/regex/pcre2/LICENCE.md
@@ -1,5 +1,8 @@
-PCRE2 LICENCE
--------------
+PCRE2 Licence
+=============
+
+| SPDX-License-Identifier: | BSD-3-Clause WITH PCRE2-exception |
+|---------|-------|
 
 PCRE2 is a library of functions to support regular expressions whose syntax
 and semantics are as close as possible to those of the Perl 5 language.
@@ -13,43 +16,52 @@ testdata directory is not copyrighted and is in the public domain.
 The basic library functions are written in C and are freestanding. Also
 included in the distribution is a just-in-time compiler that can be used to
 optimize pattern matching. This is an optional feature that can be omitted when
-the library is built.
+the library is built. The just-in-time compiler is separately licensed under the
+"2-clause BSD" licence.
+
 
+COPYRIGHT
+---------
 
-THE BASIC LIBRARY FUNCTIONS
----------------------------
+### The basic library functions
 
-Written by:       Philip Hazel
-Email local part: Philip.Hazel
-Email domain:     gmail.com
+    Written by:       Philip Hazel
+    Email local part: Philip.Hazel
+    Email domain:     gmail.com
 
-Retired from University of Cambridge Computing Service,
-Cambridge, England.
+    Retired from University of Cambridge Computing Service,
+    Cambridge, England.
 
-Copyright (c) 1997-2024 University of Cambridge
-All rights reserved.
+    Copyright (c) 1997-2007 University of Cambridge
+    Copyright (c) 2007-2024 Philip Hazel
+    All rights reserved.
 
+### PCRE2 Just-In-Time compilation support
 
-PCRE2 JUST-IN-TIME COMPILATION SUPPORT
---------------------------------------
+    Written by:       Zoltan Herczeg
+    Email local part: hzmester
+    Email domain:     freemail.hu
 
-Written by:       Zoltan Herczeg
-Email local part: hzmester
-Email domain:     freemail.hu
+    Copyright (c) 2010-2024 Zoltan Herczeg
+    All rights reserved.
 
-Copyright(c) 2010-2024 Zoltan Herczeg
-All rights reserved.
+### Stack-less Just-In-Time compiler
 
+    Written by:       Zoltan Herczeg
+    Email local part: hzmester
+    Email domain:     freemail.hu
 
-STACK-LESS JUST-IN-TIME COMPILER
---------------------------------
+    Copyright (c) 2009-2024 Zoltan Herczeg
+    All rights reserved.
 
-Written by:       Zoltan Herczeg
-Email local part: hzmester
-Email domain:     freemail.hu
+The code in the `deps/sljit` directory has its own LICENSE file.
 
-Copyright(c) 2009-2024 Zoltan Herczeg
-All rights reserved.
+### All other contributions
+
+Many other contributors have participated in the authorship of PCRE2. As PCRE2
+has never required a Contributor Licensing Agreement, or other copyright
+assignment agreement, all contributions have copyright retained by each
+original contributor or their employer.
 
 
 THE "BSD" LICENCE
@@ -58,16 +70,16 @@ THE "BSD" LICENCE
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are met:
 
-    * Redistributions of source code must retain the above copyright notices,
-      this list of conditions and the following disclaimer.
+* Redistributions of source code must retain the above copyright notices,
+  this list of conditions and the following disclaimer.
 
-    * Redistributions in binary form must reproduce the above copyright
-      notices, this list of conditions and the following disclaimer in the
-      documentation and/or other materials provided with the distribution.
+* Redistributions in binary form must reproduce the above copyright
+  notices, this list of conditions and the following disclaimer in the
+  documentation and/or other materials provided with the distribution.
 
-    * Neither the name of the University of Cambridge nor the names of any
-      contributors may be used to endorse or promote products derived from this
-      software without specific prior written permission.
+* Neither the name of the University of Cambridge nor the names of any
+  contributors may be used to endorse or promote products derived from this
+  software without specific prior written permission.
 
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
@@ -90,5 +102,3 @@ not apply all the way down a chain of software. If binary package A includes
 PCRE2, it must respect the condition, but if package B is software that
 includes package A, the condition is not imposed on package B unless it uses
 PCRE2 independently.
-
-End
diff --git a/std/regex/pcre2/VENDOR.md b/std/regex/pcre2/VENDOR.md
@@ -1,14 +1,14 @@
-# Vendored PCRE2 10.44
+# Vendored PCRE2 10.49
 
-Byte-identical subset of upstream PCRE2 10.44
+Byte-identical subset of upstream PCRE2 10.49
 (<https://github.com/PCRE2Project/pcre2>), BSD-3-Clause — full licence in
-`LICENCE` here and in `THIRD_PARTY_LICENSES.md`. Vendored for #1389 so
+`LICENCE.md` here and in `THIRD_PARTY_LICENSES.md`. Vendored for #1389 so
 `std.regex` works without a system libpcre2-8: native builds on boxes
 without the library, and `ae build --target ...` cross builds with no
 CROSSBUILD_SYSROOT.
 
-- Upstream tarball: pcre2-10.44.tar.gz
-- SHA-256: `86b9cb0aa3bcb7994faa88018292bc704cdbb708e785f7c74352ff6ea7d3175b`
+- Upstream tarball: pcre2-10.49.tar.gz
+- SHA-256: `929f0b20e62879252a15886b06c89f1edef61a363cbd5826fb041080a5e557ae`
 - Regenerate with: `scripts/vendor-pcre2.sh` (edit VERSION/SHA256 there to bump)
 
 Three files are upstream files under the name upstream designates for