fix: remove numeric regex backtracking

[jbdevprimary]

Summary

• replace the numeric-string regular expression with a bounded parser
• preserve the existing optional-minus integer/decimal contract
• add a long malformed-number regression test
• refresh the workspace lock after the 8.5.2 release version update

Validation

• tox -e lint,typecheck,py311,py312,py313,py314,examples,docs,build,audit
• pnpm --dir docs validate
• actionlint .github/workflows/*.yml
• uv lock --check

[coderabbitai]

Warning

Review limit reached

Next included review available in 12 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: beb4f08d-6d05-48b9-9283-d83cfb2d2422

📥 Commits

Reviewing files that changed from the base of the PR and between 72061c7 and f7400a3.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (2)

• packages/extended-data/src/extended_data/primitives/types.py
• packages/extended-data/tests/core/test_type_utils.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[amazon-q-developer]

This PR successfully eliminates a regex backtracking vulnerability by replacing the NUMBER_PATTERN regex with a bounded linear-time parser. The new _is_decimal_number_string() function correctly prevents catastrophic backtracking attacks while maintaining the existing conversion contract. The implementation and test coverage look solid.

---

You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f7400a35cb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve the documented NUMBER_PATTERN export

NUMBER_PATTERN was a non-underscored constant explicitly listed in this module’s documentation, so consumers may import it directly from extended_data.primitives.types; replacing it outright with this private helper makes those imports fail after a patch upgrade. Retain and deprecate a compatible public matcher while using the bounded parser internally, or defer removal to a breaking release.

Useful? React with 👍 / 👎.