v12.3.6
datalab-to/suryav12.3.6Apr 20, 2026by thedotmack
AI Summary
Viewer fix to drop the rate limiter that was causing live viewer to receive Rate limit exceeded errors within seconds of startup.
Key Highlights
- Removed rate limiter entirely
- Worker is localhost-only so rate limiting is security theater
- Kept 5 MB JSON body limit
- Kept path traversal protection
- Kept localhost-only CORS
New Features
- Rate limiter removal
- Preserved security hardening from v12.3.3 (body limit, path traversal, CORS)
Full Release Notes
## Viewer fix: drop the rate limiter v12.3.5 kept the 300 req/min rate limiter from v12.3.3's "security hardening" bundle. That tripped the live viewer within seconds (it polls logs and stats) and served it "Rate limit exceeded" errors. **Fix**: remove the rate limiter entirely. The worker is localhost-only (enforced via CORS), so there's no abuse surface to protect. Rate-limiting a single-user local process is security theater. ### Still kept from v12.3.3 hardening - 5 MB JSON body limit - Path traversal protection - Localhost-only CORS - Everything else from v12.3.5 No upgrade action required.