- CVE-2026-53789: stop a malicious sender expanding --delete scope by reclassifying implied parent directories as content dirs; the receiver now re-derives implied-parent status from its own implied_filter_list and rejects a non-directory encoding of the synthetic "." transfer root - Also guard the p[-1] read in the vendor-rewritten add_implied_include() when the normalized transfer argument is empty; the new implied-parent check depends on the root rule's exact spelling, and the unguarded read was an out-of-bounds read on an ordinary module-root transfer