amqplib 2.3.0

v2.3.0

on Node.js NPM

Security release addressing GHSA-37f9-7m79-6866 (frame-handling denial of service reachable by a malicious or non-compliant broker).

• Reject a connection.tune whose frameMax is below the protocol minimum of 4096, and guard sendContent so an undersized frameMax can no longer send publishing into an unbounded loop.
• Add a maxFrameSize connection option (also a URL query parameter) bounding the size of incoming frames, checked from the frame header alone. Default 64 MiB (or the negotiated frameMax if larger); 0 disables it. Kept separate from the negotiated frameMax so brokers that send larger unsplit frames (see #784) still work.

Reported by Rizwan Bedekar (https://github.com/r-bedekar).