On #curl's --max-filesize and --compressed. Should we do something about the "compression bomb" risk?

https://curl.se/mail/archive-2026-03/0000.html

curl: --max-filesize and --compressed

@bagder

--max-filesize should probably have been called --max-transfersize, if that is what it does

--max-transfersize for the on-wire bytes
--max-filesize for the locally stored bytes

But that would be a breaking change changing the semantics of --max-filesize.

Maybe deprecate it and add --max-transfer-size and --max-file-size (note the extra "-").