hermes-agent/plugins/platforms
Teknium 8986981df4
security(gateway): set explicit client_max_size on 3 uncapped aiohttp servers (#59180)
Sibling sweep from the #58902 raft review found aiohttp servers still
running on the implicit 1 MiB default with no explicit body cap:

- bluebubbles webhook (127.0.0.1): 1 MiB explicit cap — events are small
  JSON/form payloads; attachments arrive via the REST API
- teams Bot Framework listener (0.0.0.0 bind — most exposed): 1 MiB cap;
  activities are JSON well under that
- hermes proxy server: 10 MB cap mirroring api_server's MAX_REQUEST_BYTES
  (chat-completion payloads can be large, but must stay bounded)

client_max_size bounds every read path including chunked transfer-encoding
requests that carry no Content-Length (#58536/#58902 pattern).

Deliberately excluded: feishu, whatsapp_cloud, sms, line, wecom, msgraph —
open contributor PRs (#54938, #54944, #54620, #54931, #54934, #25296)
already cover those; reviewing them separately preserves their credit.

3 regression tests pin the wiring.
2026-07-05 14:48:28 -07:00
..
dingtalk fix(telegram): preserve Bot API update queue on watcher reconnect 2026-06-25 21:29:57 -07:00
discord fix(discord): dedup saturated mid-stream overflow previews to stop edit-rate-limit storms 2026-07-05 13:58:11 -07:00
email fix(email): harden adapter against malformed IMAP responses 2026-07-02 03:12:53 -07:00
feishu fix(feishu): send WebSocket CLOSE frame on disconnect (#10202) 2026-07-05 13:49:50 -07:00
google_chat fix: remove dead f-string prefixes via ruff F541 (216 sites) (#52336) 2026-07-05 13:42:46 -07:00
homeassistant fix(telegram): preserve Bot API update queue on watcher reconnect 2026-06-25 21:29:57 -07:00
irc fix(telegram): preserve Bot API update queue on watcher reconnect 2026-06-25 21:29:57 -07:00
line fix(telegram): preserve Bot API update queue on watcher reconnect 2026-06-25 21:29:57 -07:00
matrix fix(matrix): isolate per-event failures in _dispatch_sync gather 2026-07-03 03:27:47 -07:00
mattermost fix(mattermost): accept leading-space slash commands 2026-07-05 14:41:57 -07:00
ntfy fix(telegram): preserve Bot API update queue on watcher reconnect 2026-06-25 21:29:57 -07:00
photon revert(windows): roll back terminal-popup PRs #53791 #53810 #53829 (#53853) 2026-06-27 15:59:00 -07:00
raft security(raft): enforce body-size limit on chunked requests 2026-07-05 13:57:37 -07:00
simplex fix(telegram): preserve Bot API update queue on watcher reconnect 2026-06-25 21:29:57 -07:00
slack fix(slack): MPIMs (group DMs) obey shared-surface mention gating + reaction guard 2026-07-03 12:34:53 +05:30
sms fix(telegram): preserve Bot API update queue on watcher reconnect 2026-06-25 21:29:57 -07:00
teams security(gateway): set explicit client_max_size on 3 uncapped aiohttp servers (#59180) 2026-07-05 14:48:28 -07:00
telegram fix(telegram): redact bot token from connect/disconnect/send_document/send_video errors 2026-07-05 13:57:28 -07:00
wecom fix(gateway): fail-closed external-surface defaults + profile-aware multiplex authz 2026-07-01 03:56:28 -07:00
whatsapp feat(whatsapp): native Baileys polls, clarify-as-poll, locations, and rich inbound metadata 2026-07-05 06:27:20 -07:00