fix(isVAT): reject stray comma in DO and VE VAT numbers

[simonkundrik]

Problem

Two country matchers in src/lib/isVAT.js use character classes that unintentionally contain a literal comma, so they accept a stray ,:

DO: str => /^(DO)?(\d{11}|(\d{3}-\d{7}-\d{1})|[1,4,5]{1}\d{8}|([1,4,5]{1})-\d{2}-\d{5}-\d{1})$/.test(str),
VE: str => /^(VE)?[J,G,V,E]{1}-(\d{9}|(\d{8}-\d{1}))$/.test(str),

Inside a character class the commas are literals, so [1,4,5] matches 1 , 4 5 and [J,G,V,E] matches J , G V E. This produces false positives:

isVAT(',12345678', 'DO');     // => true (should be false)
isVAT(',-12-34567-8', 'DO');  // => true (should be false)
isVAT(',-123456789', 'VE');   // => true (should be false)
isVAT(',-12345678-9', 'VE');  // => true (should be false)

This is the same class of bug as the [J,Z] character class that was fixed in isISO6346 (#2772).

Fix

• DO: [1,4,5] → [145] (both occurrences)
• VE: [J,G,V,E] → [JGVE]

Every previously-valid input still validates (they begin with the intended digits/letters); only the stray comma is now rejected.

Tests

Added the comma inputs above to the DO and VE invalid lists in test/validators.test.js.

• Before the fix: the suite fails, e.g. validator.isVAT(",12345678", "DO") passed but should have failed.
• After the fix: full suite passes (318 passing), eslint src test is clean, and coverage is unchanged.

Found by auditing the validators for character classes that unintentionally contain a comma.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (a38f15b) to head (baf8fd5).
⚠️ Report is 8 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff            @@
##            master     #2814   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files          114       114           
  Lines         2587      2608   +21     
  Branches       656       663    +7     
=========================================
+ Hits          2587      2608   +21     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[simonkundrik]

Hi! Friendly nudge on this small one whenever someone gets a chance. All checks are passing. It fixes a couple of isVAT patterns (DO and VE) that accidentally accepted a stray comma because of literal commas in their character classes. More than glad to rebase or tweak anything if you'd like it done differently. Thanks for maintaining validator!

[tux-tn]

Nice catch! Thank you for your PR @simonkundrik

[Copilot]

Pull request overview

This PR fixes overly-permissive VAT validation for Dominican Republic (DO) and Venezuela (VE) by removing unintended literal commas from regex character classes in isVAT, and adds regression tests to ensure comma-prefixed inputs are rejected.

Changes:

• Update DO VAT matcher character classes from [1,4,5] to [145] (both occurrences) to prevent matching ,.
• Update VE VAT matcher character class from [J,G,V,E] to [JGVE] to prevent matching ,.
• Add invalid test fixtures for comma-prefixed DO/VE inputs in test/validators.test.js.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
src/lib/isVAT.js	Tightens DO/VE VAT regexes by removing unintended comma matches in character classes.
test/validators.test.js	Adds regression tests to confirm comma-prefixed DO/VE VAT values are rejected.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[tux-tn]

Sorry for closing the PR. I wanted to cancel the Copilot review, but it looks like doing so also closes the PR.