• config.c — Redis config: add upper bound (10MB) on response length + malloc failure check
• db.c — Fix uint16_t → int for path length comparison; check statvfs() return value and handle f_blocks == 0 to avoid divide-by-zero
• parsers/quic.c — Prevent buffer overflow: clamp memcpy length to sizeof(buffer)
• reader-scheme.c — Prevent undefined behavior: clamp pcapng timestamp resolution bit shift to max 63
• thirdparty/patricia.c/.h — Remove unused prefix_toa/prefix_toa2/prefix_toa2x functions (dead code with thread-safety issues)
• arkimeCache.js — Fix require path ../common/arkimeUtil → ./arkimeUtil
• arkimeConfig.js — Fix JSON.stringify replacer false → null; add IPv6 [::1] to isInsecure()
• arkimeUtil.js — Fix expressErrorHandler: add headersSent guard, remove erroneous next() after res.send()
• auth.js — Add MD5/RFC 2617 documentation nosemgrep annotation on pass2ha1()
• notifier.js — Add missing .catch() on searchNotifiers promise chain
• user.js — Use rolesQ copy instead of this.roles in expandFromRoles loop
• api-buildquery.t — Add 3 test cases for :: (all-zeros IPv6) IP search expressions

License

I confirm that this contribution is made under an Apache 2.0 license and that I have the authority necessary to make this contribution on behalf of its copyright owner.