Fixes #154: Unicode characters cause wholeWord to break

.nvmrc

@@ -1 +1 @@
-20.17.0
+22.19.0

README.md

@@ -135,6 +135,21 @@ profanity.censor('I like big butts and I cannot lie', CensorType.AllVowels);
 // I like big b$tts and I cannot lie
 ```
 
+### unicodeWordBoundaries
+
+Controls whether word boundaries are Unicode-aware. By default this is set to `false` due to the performance impact.
+
+- When `false` (default), whole-word matching uses ASCII-style boundaries (similar to `\b`) plus underscore `_` as a separator. This is fastest and ideal for ASCII inputs.
+- When `true`, whole-word matching uses Unicode-aware boundaries so words with diacritics (e.g., `vehículo`, `horário`) and compound separators are handled correctly.
+
+```JavaScript
+// Enable Unicode-aware boundaries when processing non-ASCII input
+const profanity = new Profanity({ unicodeWordBoundaries: true });
+
+profanity.exists('vehículo horario');
+// false (does not match on "culo" inside "vehículo")
+```
+
 ## Customize the word list
 
 Add words:

contribute.md

@@ -65,10 +65,6 @@ The Profanity project includes an .nvmrc file, so you can run `nvm use` to switc
 
 The Profanity project includes Husky for running Git Hooks. Running `git commit` will trigger `lint-staged` which will lint all files currently staged in Git. If linting fails, the commit will be cancelled
 
-### Dependencies
-
-- `chai`: we must use v4.x because v5.x is pure ESM, and we require CommonJS modules
-
 ### Translations
 
 We utilize a self-hosted instance of the Open Source [LibreTranslate](https://github.com/LibreTranslate/LibreTranslate) lib to translate the core English list of profane words.

eslint.config.mjs

@@ -11,6 +11,15 @@ export default [
   js.configs.recommended,
   ...ts.configs.recommended,
   security.configs.recommended,
+  {
+    // Disable noisy security warnings that are intentional in this codebase
+    rules: {
+      // Dynamic regex construction is required for the profanity alternation
+      "security/detect-non-literal-regexp": "off",
+      // Indexed access in benchmarks/translate is safe in our context
+      "security/detect-object-injection": "off",
+    },
+  },
   {
     // These file-matching rules will be processed after the above configs
     files: ["**/*.{js,ts}"],