test(conformance): cover challenge header parity

[brendanjryan]

Motivation

Challenge-header behavior has drifted across SDKs because Unicode escape and extension-method cases were absent from the shared vectors.

Summary

• add BMP, astral, realm, literal escape, truncated escape, and raw Latin-1 scenarios
• add the canonical extended method identifier scenario
• exercise parse, format, and round-trip behavior where applicable

Key design considerations

• mppx wire behavior remains the golden reference
• SDK updates: mpp-rs #428, mpp-go #168, and pympp #256
• original reports: mpp-rs #414, mpp-rs #418, mpp-go #154, and pympp #247
• keep this draft until the pinned SDK revisions contain the corresponding fixes

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​github.com/​tempoxyz/​mpp-go@​v0.2.0 ⏵ v0.2.1-0.20260921155548-d3948998a76e	-7
	pypi/​pympp@​0.10.1 ⏵ 0.11.0	+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Recently published: golang github.com/tempoxyz/mpp-go published 36 minutes ago Location: Package overview From: conformance/adapters/go/go.mod → golang/github.com/tempoxyz/mpp-go@v0.2.1-0.20260921155548-d3948998a76e ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/github.com/tempoxyz/mpp-go@v0.2.1-0.20260921155548-d3948998a76e. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-21T16:24:21.715985Z	b0dea7b	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b0dea7b5e5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".