hermes-agent/gateway/platforms
Teknium 8986981df4
security(gateway): set explicit client_max_size on 3 uncapped aiohttp servers (#59180)
Sibling sweep from the #58902 raft review found aiohttp servers still
running on the implicit 1 MiB default with no explicit body cap:

- bluebubbles webhook (127.0.0.1): 1 MiB explicit cap — events are small
  JSON/form payloads; attachments arrive via the REST API
- teams Bot Framework listener (0.0.0.0 bind — most exposed): 1 MiB cap;
  activities are JSON well under that
- hermes proxy server: 10 MB cap mirroring api_server's MAX_REQUEST_BYTES
  (chat-completion payloads can be large, but must stay bounded)

client_max_size bounds every read path including chunked transfer-encoding
requests that carry no Content-Length (#58536/#58902 pattern).

Deliberately excluded: feishu, whatsapp_cloud, sms, line, wecom, msgraph —
open contributor PRs (#54938, #54944, #54620, #54931, #54934, #25296)
already cover those; reviewing them separately preserves their credit.

3 regression tests pin the wiring.
2026-07-05 14:48:28 -07:00
..
qqbot fix: remove dead f-string prefixes via ruff F541 (216 sites) (#52336) 2026-07-05 13:42:46 -07:00
__init__.py perf(gateway): defer QQAdapter and YuanbaoAdapter imports via PEP 562 (#22790) 2026-05-09 13:17:48 -07:00
_http_client_limits.py fix(gateway): tighten httpx keepalive and close whatsapp typing-response leak (#18451) 2026-05-02 02:23:37 -07:00
ADDING_A_PLATFORM.md feat(whatsapp): add WhatsApp Business Cloud API adapter 2026-05-23 01:07:01 -04:00
api_server.py fix(api_server): return 413 for oversized chunked bodies 2026-07-04 15:35:05 -07:00
base.py feat(cron/slack): flat in-channel continuable cron delivery surface 2026-07-01 03:16:13 -07:00
bluebubbles.py security(gateway): set explicit client_max_size on 3 uncapped aiohttp servers (#59180) 2026-07-05 14:48:28 -07:00
helpers.py refactor: extract shared GFM table→bullet helpers into helpers.py 2026-06-27 03:57:24 +05:30
msgraph_webhook.py fix(telegram): preserve Bot API update queue on watcher reconnect 2026-06-25 21:29:57 -07:00
signal.py fix(telegram): preserve Bot API update queue on watcher reconnect 2026-06-25 21:29:57 -07:00
signal_format.py fix(signal): share markdown formatting across send paths 2026-06-20 13:47:14 +05:30
signal_rate_limit.py feat(gateway/signal): add support for multiple images sending 2026-04-30 04:28:08 -07:00
webhook.py fix(webhook): reject generic V2 signature missing timestamp instead of falling back to V1 2026-07-05 02:25:38 -07:00
weixin.py fix(gateway): fail-closed external-surface defaults + profile-aware multiplex authz 2026-07-01 03:56:28 -07:00
whatsapp_cloud.py fix(whatsapp_cloud): honor documented WHATSAPP_CLOUD_ALLOWED_USERS / ALLOW_ALL_USERS 2026-07-05 00:41:34 -07:00
whatsapp_common.py feat(whatsapp): native Baileys polls, clarify-as-poll, locations, and rich inbound metadata 2026-07-05 06:27:20 -07:00
yuanbao.py fix(yuanbao): skip resource resolve on cache hits 2026-07-05 13:53:30 -07:00
yuanbao_media.py fix(security): SSRF guard yuanbao media download_url (#54470) 2026-06-28 15:29:59 -07:00
yuanbao_proto.py feat(Yuanbao): support wechat forward msg (#43508) 2026-06-12 02:06:47 -07:00
yuanbao_sticker.py yuanbao platform (#16298) 2026-04-26 18:50:49 -07:00