harden: bound remaining catalog reads + lock in no-unbounded-read invariant#3145

Open

PascalThuet wants to merge 3 commits into

github:mainfrom

PascalThuet:split/catalog-bounded-reads

Commits on Jun 23, 2026

harden: bound HTTP reads and enforce strict redirects
PascalThuet
committed
harden: safe ZIP extraction, checksums, and bounded reads for extension/preset downloads
PascalThuet
committed

Commits on Jun 24, 2026

harden: bound remaining catalog reads and lock in the no-unbounded-read invariant
PascalThuet
committed