From ae766ee7a56e9532510cc6a559edefee9cbe9424 Mon Sep 17 00:00:00 2001
From: shrawak <darksoulshrawak@gmail.com>
Date: Tue, 31 Mar 2026 19:46:06 +0545
Subject: [PATCH 1/4] fix(isSlug): restrict allowed characters to valid slug
 charset

The isSlug regex was inconsistent - it used [^\s]* in the middle which
allowed any non-whitespace character (dots, asterisks, ampersands, etc.)
while only restricting the 2nd character to [a-z0-9-\\]. This caused:

- i.am.not.a.slug -> false (dot at position 2 caught)
- slug.is.cool -> true (dot at position 4+ not caught)

The new regex only allows lowercase alphanumeric characters, hyphens,
and underscores - consistent with what slug generators produce.

Also moved test cases containing * and & from valid to invalid, since
these are not valid slug characters.

Fixes #2383
---
 src/lib/isSlug.js       |  2 +-
 test/validators.test.js | 11 +++++++++--
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/src/lib/isSlug.js b/src/lib/isSlug.js
index 28b872a92..e3e7e32ed 100644
--- a/src/lib/isSlug.js
+++ b/src/lib/isSlug.js
@@ -1,6 +1,6 @@
 import assertString from './util/assertString';
 
-let charsetRegex = /^[^\s-_](?!.*?[-_]{2,})[a-z0-9-\\][^\s]*[^-_\s]$/;
+let charsetRegex = /^[a-z0-9](?!.*[-_]{2,})(?:[a-z0-9-_]*[a-z0-9])?$/;
 
 export default function isSlug(str) {
   assertString(str);
diff --git a/test/validators.test.js b/test/validators.test.js
index 1fa629092..f99ed5d50 100644
--- a/test/validators.test.js
+++ b/test/validators.test.js
@@ -14187,13 +14187,15 @@ describe('Validators', () => {
     test({
       validator: 'isSlug',
       valid: [
+        'f',
+        'fo',
         'foo',
         'foo-bar',
         'foo_bar',
         'foo-bar-foo',
         'foo-bar_foo',
-        'foo-bar_foo*75-b4r-**_foo',
-        'foo-bar_foo*75-b4r-**_foo-&&',
+        'foo-75-b4r-foo',
+        'a1-b2_c3',
       ],
       invalid: [
         'not-----------slug',
@@ -14203,6 +14205,11 @@ describe('Validators', () => {
         '_not-slug',
         'not-slug_',
         'not slug',
+        'i.am.not.a.slug',
+        'slug.is.cool',
+        'foo-bar_foo*75-b4r-**_foo',
+        'foo-bar_foo*75-b4r-**_foo-&&',
+        'Foo-Bar',
       ],
     });
   });

From 541883c56c7191e2e97b059b919035e740b7227a Mon Sep 17 00:00:00 2001
From: shrawak <darksoulshrawak@gmail.com>
Date: Tue, 31 Mar 2026 23:07:34 +0545
Subject: [PATCH 2/4] fix(isSlug): update charset regex to allow valid slug
 characters

---
 src/lib/isSlug.js       | 2 +-
 test/validators.test.js | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/lib/isSlug.js b/src/lib/isSlug.js
index e3e7e32ed..62bc26da0 100644
--- a/src/lib/isSlug.js
+++ b/src/lib/isSlug.js
@@ -1,6 +1,6 @@
 import assertString from './util/assertString';
 
-let charsetRegex = /^[a-z0-9](?!.*[-_]{2,})(?:[a-z0-9-_]*[a-z0-9])?$/;
+let charsetRegex = /^[a-z0-9](?!.*[-_]{2,})(?:[a-z0-9_-]*[a-z0-9])?$/;
 
 export default function isSlug(str) {
   assertString(str);
diff --git a/test/validators.test.js b/test/validators.test.js
index f99ed5d50..00725c671 100644
--- a/test/validators.test.js
+++ b/test/validators.test.js
@@ -14210,6 +14210,7 @@ describe('Validators', () => {
         'foo-bar_foo*75-b4r-**_foo',
         'foo-bar_foo*75-b4r-**_foo-&&',
         'Foo-Bar',
+        'a:b'
       ],
     });
   });

From ab79ac05943bf7d4e10fdb9f0489fbfc59ad9a14 Mon Sep 17 00:00:00 2001
From: shrawak <darksoulshrawak@gmail.com>
Date: Tue, 31 Mar 2026 23:09:40 +0545
Subject: [PATCH 3/4] fix(validators): add missing trailing comma

---
 test/validators.test.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/validators.test.js b/test/validators.test.js
index 00725c671..76d515ac5 100644
--- a/test/validators.test.js
+++ b/test/validators.test.js
@@ -14210,7 +14210,7 @@ describe('Validators', () => {
         'foo-bar_foo*75-b4r-**_foo',
         'foo-bar_foo*75-b4r-**_foo-&&',
         'Foo-Bar',
-        'a:b'
+        'a:b',
       ],
     });
   });

From 4f94cd11755bcb4943a54d14b71b63677938ac5e Mon Sep 17 00:00:00 2001
From: shrawak <darksoulshrawak@gmail.com>
Date: Tue, 31 Mar 2026 23:20:48 +0545
Subject: [PATCH 4/4] fix(isSlug): change charsetRegex variable to const for
 better immutability

---
 src/lib/isSlug.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/lib/isSlug.js b/src/lib/isSlug.js
index 62bc26da0..51e595ba3 100644
--- a/src/lib/isSlug.js
+++ b/src/lib/isSlug.js
@@ -1,6 +1,6 @@
 import assertString from './util/assertString';
 
-let charsetRegex = /^[a-z0-9](?!.*[-_]{2,})(?:[a-z0-9_-]*[a-z0-9])?$/;
+const charsetRegex = /^[a-z0-9](?!.*[-_]{2,})(?:[a-z0-9_-]*[a-z0-9])?$/;
 
 export default function isSlug(str) {
   assertString(str);