Advisories for Pypi/Zoo-Kcl package

Feeding a KCL program that wraps an expression in deep, unnecessary parentheses triggers the parser’s recursive expression -> unnecessarily_bracketed -> expression path. With enough nesting, the call stack grows until it exceeds the process stack limit, causing a stack overflow.

A race condition in kcl-lib can result in a use-after-free when accessing environments concurrently. During Vec reallocation, the previous buffer containing Box pointers is freed and replaced. A concurrent get_env operation that has already loaded a pointer to the old buffer may subsequently index into freed memory and retrieve a stale or corrupted Pin<Box>.