[media-types] Re: [IANA #1428369] application/vnd.pr oject-graph registration request

Hi Amanda,

On 23/09/2025 19:20, Amanda Baber via RT wrote:
> Hi Alexey,
>
> The applicant writes, "vnd.project-graph is the correct one. I will edit the document later."
>
> Is it OK to go ahead with the registration?

Yes.

Best Regards,

Alexey

> thanks,
> Amanda
>
> On Mon Sep 22 14:48:25 2025, [email protected] wrote:
>> Hi Amanda,
>>
>> Sorry for the delay.
>>
>> I think this is fine to register. One small clarifying question below:
>>
>> On 05/09/2025 02:00, Amanda Baber via RT wrote:
>>> Hi Alexey,
>>>
>>> Sending a reminder for this request from August 28th.
>>>
>>> thanks,
>>> Amanda
>>>
>>> On Thu Aug 28 17:47:54 2025, amanda.baber wrote:
>>>> Hi Alexey,
>>>>
>>>> Would you be able to review this new request by September 11th?
>>>>
>>>> thanks,
>>>> Amanda
>>>>
>>>> =====
>>>>
>>>> Name: Tianyu Zhang
>>>>
>>>> Email:[email protected]
>>>>
>>>> Media type name: application
>>>>
>>>> Media subtype name: vnd.project-graph
>> The references document currently mentions
>> "application/vnd.graphif.project-graph+zip" media type. Which media type
>> is the correct one?
>>>> Required parameters: N/A
>>>>
>>>> Optional parameters: N/A
>>>>
>>>> Encoding considerations: binary
>>>>
>>>> Security considerations: Compression Bombs: A PRG file may contain a
>>>> small ZIP that decompresses to an extremely large amount of data,
>>>> causing denial-of-service. Implementations MUST impose reasonable
>>>> limits on the number of extracted files and the total uncompressed
>>>> size.
>>>>
>>>> Path Traversal: Maliciously crafted ZIP entries could have names like
>>>> ../../../some_important_file. Implementations MUST NOT extract files
>>>> to filesystem, instead, read them directly from the ZIP stream to
>>>> memory or a controlled environment.
>>>>
>>>> Attachment Risks: The attachments directory can contain any file type.
>>>> The application processing the PRG file is responsible for handling
>>>> each attachment in a secure manner (e.g., run script files in sandbox,
>>>> detect malware in attachments).
>>>>
>>>> Interoperability considerations: This media type defines a format for
>>>> representing complex node graphs, such as project dependency graphs.
>>>>
>>>> The content is a ZIP-archived container that holds one `stage.msgpack`
>>>> file serialized using MessagePack, and may have other file in any
>>>> format. This combination provides efficient storage and fast parsing.
>>>>
>>>> The structure of the MessagePack-serialized data within the archive
>>>> MUST conform to the schema defined in [https://project-
>>>> graph.top/docs/spec/prg].
>>>>
>>>> Key considerations for implementers include:
>>>>
>>>> - Handling of required and optional properties gracefully (e.g.,
>>>> ignoring unknown optional properties rather than failing).
>>>> - Being aware that the graph may contain cycles and must be processed
>>>> accordingly to avoid infinite loops.
>>>> - The possibility of very large graphs, requiring streaming or chunked
>>>> processing strategies.
>>>>
>>>> Published specification:https://project-graph.top/docs/spec/prg
>>>>
>>>> Applications which use this media: Project Graph - [https://project-
>>>> graph.top]
>>>>
>>>> Fragment identifier considerations: UUIDs separated by `;`
>>>> See section 6.5 in the specification
>>>>
>>>> Restrictions on usage: N/A
>>>>
>>>> Provisional registration? (standards tree only): No
>>>>
>>>> Additional information:
>>>>
>>>> 1. Deprecated alias names for this type: N/A
>>>> 2. Magic number(s): PK\x03\x04
>>>> 3. File extension(s): .prg
>>>> 4. Macintosh file type code: N/A
>>>> 5. Object Identifiers: N/A
>>>>
>>>> Person to contact for further information:
>>>>
>>>> 1. Name: Tianyu Zhang
>>>> 2. Email:[email protected]
>>>>
>>>> Intended usage: COMMON
>>>>
>>>> Author/Change controller: Tianyu Zhang<[email protected]>
>> Best Regards,
>>
>> Alexey
>>

_______________________________________________
media-types mailing list -- [email protected]
To unsubscribe send an email to [email protected]