Headroom Daily: Proxy Hardening and a Timeout Cleanup Chain
The Headroom team shipped a security fix for a decompression-based denial of service and unwound a timeout misconfiguration across three connected pull requests, all landing in a same-day 0.37.1 release.
Duration: PT2M30S
Episode overview
This episode is a short developer briefing from Headroom Daily.
It explains recent repository work in plain language.
- Show: Headroom Daily
- Published: 2026-08-28T22:00:04Z
- Audio duration: PT2M30S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Good morning. It's August 28th, and this is Headroom Daily.
Today's clearest signal: a chain of proxy fixes, all from Tejas Chopra, that trace back to sloppy timeout and size assumptions in how the proxy handles request bodies.
Start with the security fix. PR 3325 closes a real denial-of-service hole: request handlers checked body size against the compressed wire size, but every decompression codec then expanded the full body in one shot before checking anything. Chopra measured a 16-kilobyte zstd payload expanding to 512 megabytes. The…
Then there's the timeout thread. Commit a5o7249, merged as PR 3327, found that the upstream write phase shared a 300-second budget with the read phase — meaning a dead connection could hang for minutes before the OS gave up, not httpx. The fix splits out a dedicated write timeout, defaulted to 150 seconds after real…
Elsewhere, routing gaps got attention too. PR 3324 fixes dashboard paths falling through to upstream passthrough instead of being served locally, and PR 3331 extends SIGHUP handling — previously only wired into the Claude wrapper — to the shared launch and proxy-watcher paths so terminal closures don't leave…
Outside Headroom, the…