npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67dandTyler Longwell b8f9764943 fix(desktop): bound avatar fetch memory with capped streaming ...

Review finding (Wren): fetch_avatar buffered the full response before
checking MAX_AVATAR_FETCH_BYTES, so a missing or dishonest Content-Length
could consume unbounded network/memory. Now preflights content_length()
and streams with a running cap check that rejects before appending any
chunk that would cross 10 MiB — same contract as media_download.rs.
Accumulator boundary extracted for unit testing.

Co-authored-by: Tyler Longwell <tlongwell@block.xyz>
Signed-off-by: Tyler Longwell <tlongwell@block.xyz>

2026-07-27 22:32:09 -04:00

..

assets

feat(desktop): mint_agent_card + save_agent_card commands for Agent Trading Cards

2026-07-27 22:15:49 -04:00

capabilities

fix(desktop): allow staged updater commands (#1870)

2026-07-14 21:28:45 +00:00

examples

fix(huddle): Pocket TTS quality — grouped chunking + FP32 model bundle (#2224)

2026-07-22 15:59:06 -07:00

icons

Update DMG background and label size (#1629)

2026-07-08 15:28:32 +01:00

src

fix(desktop): bound avatar fetch memory with capped streaming

2026-07-27 22:32:09 -04:00

tests

feat(huddle): fix concurrent-speaker mixing + jitter buffer + protocol v2 (up to 10 peers) (#609)

2026-05-18 16:34:52 -04:00

.gitignore

feat(acp): bring your own harness (BYOH) — generic ACP runtime seam + settings gallery (#2773)

2026-07-26 20:06:20 -04:00

build.rs

Gate default relay auto-connect behind release flag (#2589)

2026-07-23 13:59:10 -07:00

Cargo.lock

fix(desktop): probe legacy Goose install dir on Windows (#3248)

2026-07-27 21:30:21 -04:00

Cargo.toml

feat(acp): bring your own harness (BYOH) — generic ACP runtime seam + settings gallery (#2773)

2026-07-26 20:06:20 -04:00

Entitlements.plist

fix(desktop): load downloaded mesh runtime on signed macOS builds (#1932)

2026-07-15 21:28:17 -04:00

Info.plist

fix(desktop): explain macOS local network access (#2263)

2026-07-25 01:54:31 +00:00

tauri.conf.json

chore(release): release Buzz Desktop version 0.4.26 (#2808)

2026-07-25 06:57:58 -07:00

tauri.dev.conf.json

Rename desktop app to Buzz (#960)

2026-06-11 15:06:24 +00:00