[MFA-G]

slugifyWithCounter() can return the same slug twice. Its whole purpose is to guarantee unique slugs, so this defeats the feature.

import {slugifyWithCounter} from '@sindresorhus/slugify';

const slugify = slugifyWithCounter();

slugify('foo');    //=> 'foo'
slugify('foo');    //=> 'foo-2'
slugify('foo 2');  //=> 'foo-2'   ← duplicate

The counter is keyed on the incoming slug only (occurrences), so it has no idea that foo-2 was already handed out as the counter form of a different input. It happens in either order — foo, foo 2, foo also yields foo-2 twice — and is easy to hit in practice, since heading-to-anchor generation is the main use case and documents that repeat a heading and separately have a Foo 2 heading are ordinary.

Fix

Track the slugs actually returned in a Set and keep bumping the counter while the candidate is already taken. The comparison is lowercased to match how occurrences is keyed, so a {lowercase: false} call cannot collide with a lowercase one either. reset() clears it alongside occurrences.

The common path is unchanged: the loop body only runs on an actual collision, so there is no extra work for the normal case beyond one Set lookup and insert.

Results after the fix:

slugify('foo');    //=> 'foo'
slugify('foo');    //=> 'foo-2'
slugify('foo 2');  //=> 'foo-2-2'

Validation

• npm test (xo + ava): 25/25 pass, no lint errors.
• The new test fails on main with 'foo-2' where 'foo-2-2' is expected.
• Randomized check over 2000 sessions × 12 calls from a pool of colliding inputs: main produces duplicates, the patched version never does.