- MJPEG broadcaster: cap concurrent clients at 32 with a clean 503
response when exceeded. Without a cap an attacker can open thousands
of connections to /stream/raw and exhaust goroutines, file
descriptors, and the clients map. The subscribe/unsubscribe helpers
make the slot reservation atomic and the rejection happens before
hijacking so the client gets a proper HTTP error rather than headers
with no body.
- overlay.truncate: convert to []rune before slicing. The previous
byte-based slice could split a multi-byte UTF-8 character mid-byte
if OctoPrint returns a non-ASCII filename, producing invalid UTF-8
in the overlay.
- octoprint.Client: replace unsafe.Pointer with atomic.Pointer[Snapshot]
for type safety; same atomic semantics with no unsafe code.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
ryan.mcgeeandClaude Opus 4.7
8b02d230aa