Changes
- Read at most 20000 bytes of an endpoint's response body instead of buffering it whole and truncating afterwards, so memory use of the worker no longer depends on the size of the response (thanks @lav45)
- Improve validation of EndpointHeaders to reject invalid values and more forbidden keys.
- (Security) Clamp the
Retry-Afterheader to 7 days; a malicious endpoint could previously cause a panic with a very long Retry-After. This can cause denial-of-service by exhausting available workers.
Full Changelog: server-v1.104.0...server-v1.105.0