This is a hardening release. A single topic on ntfy.sh was polled continuously with poll=1 and no since cursor, which replays a topic's entire cache on every request. The changes below bound what one replay can cost, close two fields that had no size limit at all, and fix an ordering bug found while digging into it.
Bug fixes + maintenance:
- Fix messages being returned out of publish order when polling or replaying several topics at once (
/topic1,topic2/json?poll=1, #1297) - Limit the message title to 1 KB and all tags combined to 512 bytes, rejecting larger requests with HTTP 400 (error codes
40057and40058). Neither field had a size limit before, unlike the message body; on ntfy.sh the 99.9th percentile is 212 bytes for titles and 244 for tags - Cap a single cache replay at 10 MB of messages per topic. A poll without a
sincecursor returns a topic's entire cache, which was previously unbounded and could reach tens of megabytes on a busy topic, so one request could allocate that much on the server. The newest messages that fit are kept and a truncated response carries anX-Messages-Truncated: 1header visitor-attachment-daily-bandwidth-limitnow also covers messages replayed from the message cache by poll requests, not just attachment traffic. A poll without asincecursor returns a topic's entire cache, so a topic that is cheap to fill can be re-read for many times its own size; polls beyond the budget are rejected with HTTP 429 (error code 42905) before anything is written. Note that heavy pollers now consume the same budget as attachment downloads, so operators serving both may want to raise the limit