fix(isISO8601): reject non-space whitespace as the date-time separator

[yfwmaniish]

Fixes #2861.

What

The default (non-strictSeparator) iso8601 regex used [T\s] for the date-time separator. \s matches tab, newline, form feed, vertical tab, and non-breaking space in addition to a plain space, so all of them were accepted between the date and time parts:

validator.isISO8601('2009-01-01\t00:00:00'); // true (tab)
validator.isISO8601('2009-01-01\n00:00:00'); // true (newline)

ISO 8601 itself permits only T. RFC 3339 §5.6 additionally allows a plain space by convention, which is presumably why the character class was there in the first place — but neither spec permits the rest of \s. A newline in particular is worth rejecting on its own: it lets a two-line input pass what's meant to be a single-value check.

strictSeparator: true already rejects all of these (it only ever allowed [T], no whitespace alternation at all), so this only affects the default mode.

Fix

[T\s] → [T ] in the main iso8601 regex, so only T or a literal space separates the date and time part. One-character change; iso8601StrictSeparator is untouched since it never had this issue.

Testing

Added \t, \n, \f, \v, and a non-breaking space (U+00A0) separator case to the shared invalidISO8601 array in test/validators.test.js, which is exercised by both the default-options test and the strict = true regression test (not strictSeparator, which already had its own, unaffected assertions).

• Negative control: reverted just the regex character and reran — fails with the exact reported symptom (validator.isISO8601("2009-01-01\t00:00:00") passed but should have failed, in both the default and strict-mode test blocks); restored.
• Full suite: npx mocha --require @babel/register --reporter dot --recursive — 323/323 passing.
• eslint on both changed files — clean.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (a79ff98) to head (711119f).

Additional details and impacted files

@@            Coverage Diff            @@
##            master     #2874   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files          114       114           
  Lines         2599      2599           
  Branches       658       658           
=========================================
  Hits          2599      2599           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

This pull request fixes isISO8601 default validation in src/lib/isISO8601.js to reject non-space whitespace characters (e.g., tab/newline) as the date-time separator, aligning behavior with ISO 8601 / RFC 3339 expectations and addressing #2861.

Changes:

• Tighten the default ISO 8601 regex separator from [T\\s] to [T ] (allow only T or a literal space).
• Add regression test cases ensuring tab/newline/form-feed/vertical-tab/non-breaking-space separators are rejected.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/lib/isISO8601.js	Updates the default ISO 8601 regex to disallow non-space whitespace as the date-time separator.
test/validators.test.js	Extends invalidISO8601 test inputs to cover non-space whitespace separators (including NBSP).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[lbesecker195]

I ran the old and new regex locally: 2009-01-01\t00:00:00 and 2009-01-01\n00:00:00 matched before and are rejected now, while the space and T separators still match. ISO 8601 permits only a space in place of T, so [T ] is the correct class. LGTM.