GHSA-5x5g-h9x8-2fh9

### Impact The streaming decoder recursively invokes itself for every complete value remaining in a chunk. A single chunk containing many small valid MessagePack values can exhaust the JavaScript call stack and interrupt the process or stream. ### Patches The streaming decoder now drains concatenated values iteratively with constant call-stack depth. ### Workarounds Limit the number of MessagePack values accepted in one chunk, or split large batches before passing them to the decoder stream.