@wfk (If you're not open to recommendations, let me know and I'll delete this.)

According to https://codeberg.org/ethical-foss/open-slopware#file-transferring, there is a slop-free alternative called gokrazy/rsync (or gokr-rsync). It's a minimal implementation of rsync in Go, and seems to exist specifically to avoid vulnerabilities: https://michael.stapelberg.ch/posts/2026-05-24-minimal-memory-safe-go-rsync-vulns/

Other than that, I know nothing about this project, so use at your own risk.

Here's the repo: https://github.com/gokrazy/rsync