-
v0.5.6 Stable
released this
2026-07-01 13:49:05 +00:00 | 55 commits to main since this releaseFixed
- HTTP client: bound the success-path (HTTP 200/201) JSON response decoders with
io.LimitReader(maxResponseBodySize), matching the guard already applied on the
error paths. A hostile or malfunctioning Kratos admin API could otherwise stream
an unbounded response body intojson.Decode, exhausting operator memory; the
success paths are now capped identically to the error paths.
Downloads
-
Source code (ZIP)
0 downloads
-
Source code (TAR.GZ)
0 downloads
- HTTP client: bound the success-path (HTTP 200/201) JSON response decoders with