)]}'
{
  "commit": "4ba2ffa47cfb93d995234d4ac087c24aaa670773",
  "tree": "fb0ab0449fbfc135bfabf233206dcf615f134d68",
  "parents": [
    "529d8e869a14da46efe75b7e904a6183dd26ae29"
  ],
  "author": {
    "name": "Alan Donovan",
    "email": "adonovan@google.com",
    "time": "Mon Jul 06 13:50:28 2026 -0400"
  },
  "committer": {
    "name": "Alan Donovan",
    "email": "adonovan@google.com",
    "time": "Tue Jul 07 22:51:07 2026 -0400"
  },
  "message": "syntax: reject excessively nested bracketed expressions\n\nBoth the scanner and the parser contain recursions driven\nby user input, so an excessively nested input string can cause\nthem to exceed the stack and crash the program.\n\nThis change rejects such inputs in both the scanner and\nparser, using the existing depth counter in the scanner\nand a new counter in the parser.\n\nThe interpreter already imposes a limit.\n\nThe tests include a static check that the call graph\nwithin the parser has no cycles except those including\nat least one use of p.enter/p.leave.\n\nThis commit addresses GHSA-wcqm-92f8-mh2v, which concerns\na denial-of-service vulnerability since attacker-controlled\ninputss may cause a Starlark-based application to crash.\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "7d453c385bfa054f58f8534873d0ff84098b3175",
      "old_mode": 33188,
      "old_path": "syntax/parse.go",
      "new_id": "e115393b1bcdf62787e0b0e28580596953893437",
      "new_mode": 33188,
      "new_path": "syntax/parse.go"
    },
    {
      "type": "modify",
      "old_id": "9bb48af9607c2209ea9e42b49ee76462d6316816",
      "old_mode": 33188,
      "old_path": "syntax/parse_test.go",
      "new_id": "75645a4ece88293baf998aac581e0030a825f984",
      "new_mode": 33188,
      "new_path": "syntax/parse_test.go"
    },
    {
      "type": "modify",
      "old_id": "894cf7f76811aa9974c71b557192a9c8d322b99f",
      "old_mode": 33188,
      "old_path": "syntax/scan.go",
      "new_id": "c45be866b4fbb59f4e28392503b7b1ce9cc18767",
      "new_mode": 33188,
      "new_path": "syntax/scan.go"
    }
  ]
}