Abdul WahabandCursor 520a55547e Admit one brace level inside shadow interpolations ...

Review finding on #553: an object-literal argument like
${getOffset({ size: 2 })} ended the interpolation match at the inner
closing brace, losing the shadow context. Interpolations now admit one
level of braces (with paired quotes inside); the shared subpattern is
hoisted into compiled constants. Deeper nesting stays fail-safe by
design: a line-scoped regex cannot balance arbitrary braces, and the
miss produces a waivable finding, never a leak.

AI-assisted (Cursor agent), reviewed by maintainer.

Co-authored-by: Cursor <cursoragent@cursor.com>

2026-08-10 13:28:11 +05:00

..

bin

Fix #476: stop using JSON.stringify/double quotes as shell quoting in four exec sites (#533)

2026-08-08 18:43:17 -07:00

engine

Admit one brace level inside shadow interpolations

2026-08-10 13:28:11 +05:00

lib

Simplify CSS color channel parsing (#520)

2026-08-05 15:28:17 -07:00