Skip to content

Limit action request body size#15564

Merged
matthewp merged 2 commits into5-legacyfrom
security/actions-body-limit-5x
Feb 18, 2026
Merged

Limit action request body size#15564
matthewp merged 2 commits into5-legacyfrom
security/actions-body-limit-5x

Conversation

@matthewp
Copy link
Copy Markdown
Contributor

@matthewp matthewp commented Feb 18, 2026

  • Add a default 1 MB action request body cap to avoid oversized payloads exhausting memory
  • Enforce the limit for chunked bodies by buffering with a hard cap and returning 413

Testing

  • New test added to the Actions test with a large buffer in the body.

Docs

N/A, bug fix

Limits the size to prevent exhausting the server and potentionally crashing it.
@changeset-bot
Copy link
Copy Markdown

changeset-bot bot commented Feb 18, 2026

🦋 Changeset detected

Latest commit: 0011521

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@github-actions github-actions bot added the pkg: astro Related to the core `astro` package (scope) label Feb 18, 2026
@matthewp matthewp marked this pull request as draft February 18, 2026 13:33
@withastro withastro deleted a comment from github-actions bot Feb 18, 2026
@withastro withastro deleted a comment from github-actions bot Feb 18, 2026
@matthewp matthewp marked this pull request as ready for review February 18, 2026 19:31
@matthewp matthewp merged commit 522f880 into 5-legacy Feb 18, 2026
24 checks passed
@matthewp matthewp deleted the security/actions-body-limit-5x branch February 18, 2026 19:40
@astrobot-houston astrobot-houston mentioned this pull request Feb 18, 2026
matthewp added a commit that referenced this pull request Feb 19, 2026
* Limit the size of an action payload

Limits the size to prevent exhausting the server and potentionally crashing it.

* fix build
dadezzz pushed a commit to dadezzz/ice-notes that referenced this pull request Feb 22, 2026
This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [astro](https://astro.build) ([source](https://github.com/withastro/astro/tree/HEAD/packages/astro)) | [`5.17.2` → `5.17.3`](https://renovatebot.com/diffs/npm/astro/5.17.2/5.17.3) | ![age](https://developer.mend.io/api/mc/badges/age/npm/astro/5.17.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/astro/5.17.2/5.17.3?slim=true) |

---

### Release Notes

<details>
<summary>withastro/astro (astro)</summary>

### [`v5.17.3`](https://github.com/withastro/astro/releases/tag/astro%405.17.3)

[Compare Source](https://github.com/withastro/astro/compare/astro@5.17.2...astro@5.17.3)

##### Patch Changes

- [#&#8203;15564](withastro/astro#15564) [`522f880`](withastro/astro@522f880) Thanks [@&#8203;matthewp](https://github.com/matthewp)! - Add a default body size limit for server actions to prevent oversized requests from exhausting memory.

- [#&#8203;15569](withastro/astro#15569) [`e01e98b`](withastro/astro@e01e98b) Thanks [@&#8203;matthewp](https://github.com/matthewp)! - Respect image allowlists when inferring remote image sizes and reject remote redirects.

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNS44IiwidXBkYXRlZEluVmVyIjoiNDMuMjUuOCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->

Co-authored-by: Renovate Bot <renovate@zarantonello.dev>
Co-committed-by: Renovate Bot <renovate@zarantonello.dev>
matthewp added a commit that referenced this pull request Feb 23, 2026
* Limit the size of an action payload

Limits the size to prevent exhausting the server and potentionally crashing it.

* fix build
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

pkg: astro Related to the core `astro` package (scope)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant