kepr / e75345778d8b

fix: Cap zlib decompression by manifest size (v1.55.49) - Require declared uncompressed size for object decompression and verification - Cap decompression at declared size plus slack, bounded by MAX_FILE_SIZE - Thread manifest file sizes through ingest, archive, graph, review, diff, build, and raw-file paths - Add regression coverage for compressed payloads that inflate beyond the declared-size slack

dev · 13 weeks ago · 2026-06-12 · 14.1 MB

parent: 9099967f5fc0