Waleed d89ab4a8ee fix(security): bound response bodies in secureFetchWithPinnedIP by default (#6169) ...

secureFetchWithPinnedIP only capped a response body when the caller passed
maxResponseBytes; with the option absent the body streamed into an unbounded
Buffer.concat. Several tool proxies whose target host is user-supplied
(Jupyter, ClickHouse, Grafana, 1Password Connect) and the RSS poller called it
without that option, so an attacker-controlled server answering with an endless
chunked body could grow the shared process heap until it was OOM-killed.

Make the cap fail-safe: default to 100MB (and treat a non-positive value as the
default) so there is no unlimited mode, then pass tighter explicit caps at the
user-supplied-host sites.

Responses that carry no body (HEAD, 204, 304) are exempted from the
content-length pre-check — they advertise the resource size as metadata, which
would otherwise spuriously fail a HEAD probe of a large file or an RSS
conditional-GET 304.

2026-08-01 16:54:34 -07:00

..

src

fix(security): bound response bodies in secureFetchWithPinnedIP by default (#6169)

2026-08-01 16:54:34 -07:00

package.json

improvement(testing): consolidate @sim/db mocks into one table-aware chain mock (#5856)

2026-07-22 14:15:44 -07:00

tsconfig.json

chore(typescript): upgrade to TypeScript 7 (native Go compiler) (#5521)

2026-07-08 16:41:23 -07:00