fix(serializers): bound untrusted msgpack decode depth and header allocation (LAB-2503) - #276

Merged

27Bslash6 merged 11 commits into

mainfrom

lab-2503-decode-bounds

Sep 13, 2026

Commits on Sep 2, 2026

fix(serializers): bound untrusted msgpack decode depth and header allocation (LAB-2503)
27Bslash6
committed
4941f34
fix(serializers): apply LAB-2503 panel findings to the decode bound
27Bslash6
committed
d9eee87
perf(serializers): zero-copy Rust header walk for the msgpack decode bound (LAB-2503)
27Bslash6
committed
385798a
fix(serializers): apply LAB-2503 panel round 2 to the Rust decode walk
27Bslash6
committed
0ba205b

Commits on Sep 7, 2026

fix(serializers): apply LAB-2503 round-3 review to the decode bound
Mark S
committed
72e8ef5
fix(serializers): gate forged columnar documents by shape before pandas sees them (LAB-2503)
Mark S
committed
d4a226b
Merge remote-tracking branch 'origin/main' into agent/winston/f9b79b31a365
Mark S
committed
f2fb321
fix(serializers): snapshot mutable exporters before the decode walk; pin the vector link (LAB-2503)
Mark S
committed
b120fd9
fix(serializers): drop the unreachable NumPy fallback on the plain decode path (LAB-2503)
Mark S
committed
338c6dc
fix(serializers): refuse unknown column type markers on the columnar decode routes (LAB-2503)
Mark S
committed
d0b5980

Commits on Sep 10, 2026

fix(serializers): normalise memoryview inputs before the decode walk; refuse truncated NUMPY_RAW metadata (LAB-2503)
Mark S
committed
e5ff7e1