Why is the max regex length of expression#OperatorMatches always changing?

[Yannis-01]

spring version 5.3.25 no limit
spring version 5.3.26 is MAX_REGEX_LENGTH = 256
spring version 5.3.29 is MAX_REGEX_LENGTH = 1000

public class OperatorMatches extends Operator {

	private static final int PATTERN_ACCESS_THRESHOLD = 1000000;

	/**
	 * Maximum number of characters permitted in a regular expression.
	 * @since 5.2.23
	 */
	private static final int MAX_REGEX_LENGTH = 1000;

the notes are wrong too.

[snicoll]

The limit was introduced to address CVE-2023-20861 and further expanded based on community feedback see #30265.

the notes are wrong too.

What "notes"?

[Yannis-01]

Thanks. I read the previous issue and I think the maximum value should be configurable. Otherwise, many systems will be affected.

[snicoll]

So I don't know what notes are wrong but if you provide the information we can look at it.

Making the value configurable was discussed in the linked issue and rejected.