JLine 4.4.7

JLine 4.4.7 is a security and bug fix release addressing two security vulnerabilities and one rendering correctness bug.

The history /PATTERN search in HistoryCommands was compiling user-supplied regex patterns with a raw Pattern.compile + Matcher.find() call, with no execution-time guard — the only unprotected regex path in the project. A pathological pattern like (a+)+z would hang the session thread indefinitely via catastrophic backtracking (GHSA-vrw4-fppg-3rhf). The fix routes through SafeRegex, consistent with all other regex call sites. The telnet NEW-ENVIRON handler (TelnetIO.readNEVariables) enforced its 100-variable limit only within a single subnegotiation frame via a local counter that reset on each call. An unauthenticated client could send multiple frames to accumulate an unbounded number of environment entries and exhaust server heap (GHSA-7qh2-r6cc-r47w, bypassing the incomplete fix for CVE-2026-56740); the fix also checks the persistent connection-level map size. Finally, AttributedStringBuilder.setLength did not recompute lastLineLength after truncation, causing subsequent tab stops to be calculated against the wrong position; three regression tests covering cleared builder, newline removal, and last-line shortening were added by the contributor.

🐛 Bug Fixes

• fix: guard history /pattern regex search against ReDoS via SafeRegex (#2286) @gnodet
• fix: enforce NEW-ENVIRON variable limit across frames to prevent memory exhaustion (#2287) @gnodet
• fix: recompute tab position after truncation (#2305) @PHJ2000

📦 Dependency Updates

• chore: bump sshd.version from 2.19.0 to 2.20.0
• chore: bump com.diffplug.spotless:spotless-maven-plugin from 3.10.2 to 3.10.3
• chore: bump com.palantir.javaformat:palantir-java-format from 2.98.0 to 2.100.0
• chore: bump slf4j.version from 2.0.19 to 2.0.20 (#2289)
• chore: bump org.graalvm.sdk:graal-sdk from 25.3.4.1 to 25.4.4.1.1 (#2292)

Full Changelog: 4.4.6...4.4.7