RegExp.escape, and the helper everybody had written

Escaping a user-supplied string for use in a pattern, implemented from a Stack Overflow answer in every project since 2011.

// the helper, in four repositories, three of them
// subtly different
const escape = (s) => s.replace(/[.*+?^${}()|[]\]/g, '\$&')

// ES2025
RegExp.escape(userInput)

// and the one our version missed: a leading digit or
// hyphen, which the standard function escapes and the
// copied helper did not.

Four copies of a security-relevant one-liner, three of them incomplete, is the argument for this being in the language rather than in a package. The leading-character case is the one nobody thinks about and it matters when the escaped string is concatenated into a larger pattern — which is the only situation anybody escapes for.