Bound nested metadata counts and coder properties by their backing data, validate file and stream consistency, and buffer decoded headers incrementally instead of reserving attacker-declared output sizes.
Add synchronous and asynchronous allocation regressions for GHSA-vwpg-q8vc-g6fg, including external metadata and valid bit-packed empty entries.
Use a ValueTask read core and memory-based compressed-input refills on modern targets, replace per-block Huffman output arrays with scalar parameters, and decode directly into array-backed caller memory with a pooled fallback.
Preserve generated sync array-read semantics and clear codec output references after reads. Add slice, fallback, cancellation, failure, tree-validation, and read-ahead coverage; document staged ZIP profiles.
Validation: 2,989 .NET 10 tests passed; all library targets, net48 tests, and performance project compile; formatting checks pass.
Replace historical profiling rounds with a self-contained report for the origin/master merge comparison, including allocation results, timing variability, validation, and reproduction artifacts.
Reuse LZMA2 trial decoders and pooled compressed output, pool and consolidate decoder probability banks, lazily rent encoder optimization scratch, and avoid copying direct async memory writes.
Use bounded stack scratch and stream 7z metadata without temporary property buffers. Add ownership, failure, context-shrink, Unicode, and block-boundary regressions.
Document allocation profiles, the small-file LZMA2 throughput tradeoff, and rejection of exact-size match-finder arrays. Validation: 3,016 .NET 10 tests passed; all library targets, net48 tests, and performance project compile; formatting checks pass.
Dispose cached folder decoders during async archive cleanup and scope temporary encoded-header decoders in both read paths. Release LZMA range-decoder input buffers on partial reads and failures while preserving borrowed source ownership.
Correct the synchronous extraction-reader benchmark and expand lifetime and checksum coverage. Document profiling showing async Archive allocations falling from 8.95 MiB to 0.70 MiB per extraction, with metadata-only allocations reduced by 70%.
Validation: 2,989 .NET 10 Release tests passed; all library targets, the performance project, and net48 test compilation succeeded. Formatting and whitespace checks passed.
Reuse unpacker-owned pooled scratch arrays for async RAR5 and RAR2 Huffman tables, preserving alphabet bounds and zeroed history tails. Match async Archive CRC32/BLAKE2sp verification to the synchronous path and dispose entry streams when initialization fails.
Add regression tests and profiling documentation showing approximately 3.13 MiB fewer managed allocations per 200 MiB extraction. Keep this change based directly on master without unrelated branch commits.
Validation: 2,983 .NET 10 Release tests passed, all six library targets built, net48 tests compiled, and formatting checks passed.
