[ixuz]

What and why

The read limits held a Turtle text to its bytes, its triples and the characters of their terms. The parser makes the triple that links a nested collection, blank node, annotation or triple term to the level above only once that level closes, and keeps a context for every open level. A text that only opened levels made no triple to count, so only its size bounded the memory the parse held.

• The scan that already looks through every Turtle text before the parser reads it now also counts the levels it opens and closes, past strings, IRIs and comments, and refuses a text nested more than 64 levels deep with a ReadLimitError, with limits or with none.
• Every Turtle read goes through that scan, on either client: pod documents, releases, profiles, access controls and deck files.
• The app's own documents and the library's releases nest a few levels; the deepest file in the repository nests 2.
• One contract test that nested a triple term 100 deep now nests it 30 deep, so it still tests the parser's own refusal; the deeper text is refused by the new bound.
• The read-limit rules in docs/deck-library.md, docs/data-model.md, docs/boundaries.md and docs/testing.md, and the doc comments that list what a read refuses, name the bound.

Refs: GHSA-qv47-r346-839c