[kixelated]

Problem

The released @moq/flate decoder keeps inflating a hostile frame after its cap and returns small views that pin pako's scratch buffers.

Approach

Backport the bounded inflation and owned output fixes from moq-dev/moq#6900 onto release's per-frame decoder. Throw inside onData at the first chunk past the cap, refuse further input after that failure, clear retained chunks, and copy decoded frames into tight buffers.

Impact

• Public API: unchanged, including maxFrameSize and its 64 MiB default.
• Wire: unchanged.
• No version bump, merge, publication, or release dispatch.

Validation

• Reproduced both failures before the fix: a 1 MiB payload inflated completely with a 1 KiB cap, and retained output pinned a 64 KiB backing allocation.
• All 12 codec tests pass, including bounded inflation, retained ownership, exact limits, and independent per-frame budgets.
• just check origin/release passes, including JS checks, builds/API reports, tests, and documentation.
• git diff --check passes.

Alternatives

Keep release's per-frame policy rather than bringing main's breaking group budget back.

Follow-ups

Tracked by moq-dev/moq#6955: merge and patch publication remain pending the maintainer's authorization.

(Written by GPT-6)

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-28T00:11:28.044235Z	65fd28f	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[kixelated]

Automated review by review (OpenAI)
Reviewed commit: 65fd28f

No actionable bugs found in this release-relative change. Throwing from onData stops inflation at the first over-budget chunk; the latched failure prevents reuse of partially advanced decoder state, and finally releases accumulated chunks. Tight output copies also cover empty frames without changing the wire format or release's independent per-frame budget.

Direction: this is a focused backport; preserving maxFrameSize rather than importing main's group-budget policy avoids an unnecessary compatibility change. The new regressions target bounded work, retained-buffer ownership, exact limits, and consecutive-frame budgets.

Verification: inspected the changed source/tests and release base. I did not run tests, builds, interop, or the reported reproductions; no merge or publication performed.

[kixelated]

Merge summary: backport of the bounded @moq/flate inflation and owned-output fixes from #6900 onto release, keeping release's per-frame maxFrameSize policy (no public API or wire change).

• Head 65fd28fa50b43c7e82654ed07bd1425b7b9d5152: CI 19/19 passing, Codex review with no findings, OpenAI automated review with no actionable bugs.
• quest check against origin/release passes.
• No decisions outstanding. Landing with a merge commit per CONTRIBUTING for release; no version bump, publication, or release dispatch here (tracked by docs(quest): finish the flate release backport #6955).

(Written by Claude Opus 5.5)