Skip to content

fix: corrected negative time options and cancle decompression on limit - #916

Merged
panva merged 4 commits into
panva:mainfrom
grMLEqomlkkU5Eeinz4brIrOVCUCkJuN:main
Nov 1, 2026
Merged

panva merged 4 commits into
panva:mainfrom
grMLEqomlkkU5Eeinz4brIrOVCUCkJuN:main

Conversation

@grMLEqomlkkU5Eeinz4brIrOVCUCkJuN

@grMLEqomlkkU5Eeinz4brIrOVCUCkJuN grMLEqomlkkU5Eeinz4brIrOVCUCkJuN commented Nov 1, 2026 •

Copy link
Copy Markdown

I am the author of lacewing and antlion, and I noticed a few minor stuff that needed fixing relating to input and cancellation, and was worth moving upstream (was working on a v3 for my libraries that corrects some implicit behaviours). Thanks for building this library :>

The first change is to clockTolerance to fix it from accepting negative values

The second change was to properly close the stream in transform by adding the missing cancellation

The third change is to correct the issue where negative values in the Remote JWKS were accepted (which actually makes the resolve refetch I think, I doubt people can use this in a DoS attack or anything but this is something worth noting)

Have a nice day.

@grMLEqomlkkU5Eeinz4brIrOVCUCkJuN

Copy link
Copy Markdown
Author

woah that was fast

@grMLEqomlkkU5Eeinz4brIrOVCUCkJuN

Copy link
Copy Markdown
Author

mb should have added a regression check, thanks mate

@panva
panva merged commit c2dd2ff into panva:main Nov 1, 2026
21 checks passed
@grMLEqomlkkU5Eeinz4brIrOVCUCkJuN

Copy link
Copy Markdown
Author

thanks

@panva

panva commented Nov 1, 2026

Copy link
Copy Markdown
Owner

thank you

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants