[kixelated]

Problem

Release's certificate-hash setup rescans every unmatched PEM BEGIN marker, and outgoing path validation allocates all components before enforcing the existing 32-part limit. These are the JS fixes already landed in #6084.

Approach

Port the linear PEM delimiter search and early separator count. Add behavioral edge cases and just js bench parsing, wired into the nightly workflow. Unit tests do not assert wall time or process memory.

On the same Bun 1.4.2 host, repeated BEGIN inputs from 7,168 to 458,752 bytes took 0.51 ms to 3.81 s before, versus 0.014 ms to 0.45 ms after. Path rejection from 512 to 32,768 bytes took 19 to 295 microseconds before, versus roughly 2 to 3 microseconds after. These are best-of-five samples on a shared host, not performance gates.

Validation: just ci check, just ci test, 50 focused certificate/path tests, and the malformed-input benchmark passed in the active Nix development shell. The shell's Bun 1.4.2 matches release.

Impact

• No public API or wire-format changes; valid certificate hashes, first-certificate selection, path normalization, and the published part limit are preserved.
• Empty or whitespace-only PEM bodies now reject as malformed instead of hashing empty bytes, matching the main fix.
• Consumers: certificate-hash connection setup and outgoing path encoding in @moq/net.

Alternatives

A cherry-pick of the whole upstream commit would also carry unrelated publishing workflow changes. Those protections already run from main and need no backport.

Follow-ups

Quest tracking remains on main in #6343 until this release backport lands. No version bump or publication is included.

(written by GPT-6)

[kixelated]

The focused backport is complete: parser fixes, behavioral edge cases, and a malformed-input size sweep. Local CI check/test halves and the 50 focused tests passed. API and wire formats are unchanged; malformed empty PEM bodies reject as on main. No open design decisions or additional follow-ups were identified. Merge and publication remain with the maintainer.

(written by GPT-6)

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-22T16:42:25.877613Z	5a645ec	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[kixelated]

Merged into release after a clean Codex review of this head and green release checks; maintainer picked the merge in the quest-complete run.

(Written by Claude Opus 5.5)