A greedy regex that ate the leading major version digit

Following the devcontainer boot fixes in self-referential-version-sync, automated developer CLI updates still triggered unexpected re-installation cycles on container startup. Even though pnpm version 11.19.0 was already present in the workspace, the auto-updater reported that the environment was running an outdated version. Tracing the version extraction pipeline revealed that the utility function parsing command output was mangling multi-digit major version numbers.

Tracing the regex backtracking bug#

The extract_version helper in .devcontainer/auto-update-developer-clis.sh used a regular expression to strip non-numeric prefix characters (such as v or CLI name headers) from raw output strings like pnpm 11.19.0.

# Before: greedy wildcard matching
version=$(echo "$output" | sed -E 's/^.*([0-9]+\.[0-9]+\.[0-9]+).*/\1/')

# After: non-digit prefix matching
version=$(echo "$output" | sed -E 's/^[^0-9]*([0-9]+\.[0-9]+\.[0-9]+).*/\1/')

Because .* is greedy, the initial wildcard consumed characters as far to the right as possible before backtracking to satisfy the three-part semantic version pattern. When presented with pnpm 11.19.0, the greedy wildcard consumed pnpm 1, leaving 1.19.0 to match the version capture group.

Matching non-digits explicitly#

To prevent backtracking into numeric digits, the leading prefix pattern was changed from .* to [^0-9]*.

Using non-digit character classes stops pattern matching immediately at the first numeric digit, preserving multi-digit major version numbers.

Specifying [^0-9]* guarantees that regex scanning halts immediately when encountering the first digit character, preserving 11.19.0 intact regardless of major version magnitude.

Verifying multi-digit version test cases#

To lock the regex fix in place, the auto-update test script test-auto-update-developer-clis.sh was expanded with explicit multi-digit version test cases.

# test-auto-update-developer-clis.sh
assert_extracted "pnpm 11.19.0" "11.19.0"
assert_extracted "node v20.10.0" "20.10.0"

Running the test suite confirmed that multi-digit tool versions for Node.js and pnpm extract cleanly, restoring silent, non-redundant devcontainer startup updates.