Fix pySigma RE2 compatibility in fresh installations

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "netscaler-triage"
-version = "1.0.0"
+version = "1.0.1"
 description = "Offline NetScaler evidence analysis with inspectable decoding and provenance"
 readme = "README.md"
 license = "MIT"
@@ -17,7 +17,8 @@ dependencies = [
     "rich>=14.1",
     "rich-argparse>=1.7",
     "pyzipper>=0.3.6",
-    "pysigma>=1.5.1",
+    # pySigma 2 defaults to RE2, which rejects the supported lookahead rules.
+    "pysigma>=1.5.1,<2",
 ]
 
 [project.scripts]