[glenn-jocher]

Fixes the two js/polynomial-redos CodeQL alerts in lib/openapi.ts:

• expandServerUrl: /{([^}]+)}/g rescans to the end of the string from every unmatched {, so O(n²) on URLs with many {. Excluding { from the variable name (/{([^{}]+)}/g) keeps each scan bounded. Server variable names never contain braces.
• stringFormatMatches email: [^@\s]+\.[^@\s]+ lets both quantifiers compete for dots in the domain. [^@\s.]+(?:\.[^@\s.]+)+ is unambiguous. Real addresses match as before; addresses with empty domain labels (a@b..c) are now rejected, which is also correct.

Timing on 100 KB crafted inputs: server URL 5040 ms → 0.1 ms, email 1727 ms → 0.4 ms. bun run lint, typecheck, and test pass.

🛠️ PR Summary

_{Made with ❤️ by Ultralytics Actions}

🌟 Summary

Updated server URL and email-format regexes in lib/openapi.ts to avoid excessive backtracking on crafted inputs.

📊 Key Changes

• Server variable matching now excludes braces from variable names, preventing scans from repeatedly crossing unmatched opening braces.
• Email validation now matches domain labels separated by dots, avoiding competing quantifiers and rejecting empty labels such as b..c.

🎯 Purpose & Impact

• Crafted server URLs and email strings no longer trigger the same excessive regex backtracking; email addresses with empty domain labels are rejected.

[UltralyticsAssistant]

👋 Hello @glenn-jocher, thank you for submitting a ultralytics/openapi 🚀 PR! This automated message confirms your contribution was received, and an Ultralytics engineer will assist with the review. To ensure a seamless integration of your work, please review the following checklist:

• ✅ Define a Purpose: Clearly explain the purpose of your fix or feature in your PR description, and link to any relevant issues. Ensure your commit messages are clear, concise, and adhere to the project's conventions.
• ✅ Synchronize with Source: Confirm your PR is synchronized with the ultralytics/openapi main branch. If it's behind, update it by clicking the 'Update branch' button or by running git pull and git merge main locally.
• ✅ Ensure CI Checks Pass: Verify all Ultralytics Continuous Integration (CI) checks are passing. If any checks fail, please address the issues.
• ✅ Update Documentation: Update the relevant documentation for any new or modified features.
• ✅ Add Tests: If applicable, include or update tests to cover your changes, and confirm that all tests are passing.
• ✅ Sign the CLA: Please ensure you have signed our Contributor License Agreement if this is your first Ultralytics PR by writing "I have read the CLA Document and I sign the CLA" in a new message.
• ✅ Minimize Changes: Limit your changes to the minimum necessary for your bug fix or feature addition. "It is not daily increase but daily decrease, hack away the unessential. The closer to the source, the less wastage there is." — Bruce Lee

For more guidance, please refer to our Contributing Guide. Don't hesitate to leave a comment if you have any questions. Thank you for contributing to Ultralytics! 🚀

[UltralyticsAssistant]

🔍 PR Review

_{Made with ❤️ by Ultralytics Actions}

Reviewed both regex changes in lib/openapi.ts and their callers. The replacements preserve expected behavior while avoiding the described backtracking paths. LGTM.

[UltralyticsAssistant]

🎉 Excited to see this PR merged—thanks, @glenn-jocher! The regex updates prevent excessive backtracking on crafted server URLs and email strings, and reject empty email domain labels.

“Well done is better than well said.” — Benjamin Franklin

A fitting reminder of the impact of this focused improvement.