Fixes: #64313

Summary

The bundled ansi-regex OSC pattern used by stripVTControlCharacters() relied on a restrictive URI character class that failed when OSC 8 hyperlink URIs contained RFC 3986-valid characters such as (, ), !, +, [ and ].

This updates OSC handling to match sequences generically as:

ESC ] ... ST

aligned with ansi-regex v6.2.0.

Problem

stripVTControlCharacters() failed to correctly strip OSC 8 hyperlinks whose URI contained characters omitted from the previous regex character class:

[-a-zA-Z\d/#&.:=?%@~_]

Example:

import { stripVTControlCharacters } from 'node:util';

const link =
  '\u001B]8;;https://example.com/(foo\u0007label\u001B]8;;\u0007';

console.log(stripVTControlCharacters(link));

Actual

ttps://example.com/(foo\u0007label

Expected

label

The OSC match terminated early at (, leaving most of the escape sequence in the output.

Changes

• Replace the restrictive OSC URI matcher with generic OSC matching up to the first string terminator (BEL, ESC \, or 0x9C)
• Sync the bundled regex behavior with ansi-regex v6.2.0
• Preserve existing CSI handling logic

Tests

Added regression coverage in:

test/parallel/test-util-stripvtcontrolcharacters.js

for OSC 8 hyperlinks containing:

• (
• )
• !
• +
• [ ]

across all supported OSC string terminators.

Notes

• Existing CSI handling is unchanged
• Fast-path behavior is unchanged
• Embedded OSC terminators inside URIs retain previous behavior