Marc-André Bombeck 65677c2112 fix(api): bound every JSON body read ...

Raising the middleware body cap to 512 MB for archive imports removed
the implicit ceiling that protected JSON routes, so any bulk endpoint
would buffer an arbitrarily large body before validation ran. Every
JSON body read under /api now carries an explicit byte cap sized to its
legitimate payload (64 KB for single-record routes up to 16 MB for the
measurement import), webhooks cap before signature work, and oversized
bodies return 413.

2026-06-10 11:36:51 +02:00

..

route.ts

fix(api): bound every JSON body read

2026-06-10 11:36:51 +02:00