Chris Sherwood 78017a333d fix(maps): cap marker notes at 500 characters server-side ... The UI enforces 500 characters but the validator did not, so the API accepted up to the MySQL TEXT ceiling. The API needs no authentication by design, so an uncapped free-text column reachable from any page a user visits is a cheap way to bloat the database. Matches the limit the form already shows. Found in a security review of the release PRs. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8Mgg1vd2eKSs8StZiuyMV		2026-09-29 15:54:41 -07:00
..
controllers	fix(maps): cap marker notes at 500 characters server-side	2026-09-29 15:54:41 -07:00
data	refactor(drug-reference): make collections JSON the single source for curated data (#1130)	2026-08-04 03:38:35 +00:00
exceptions	fix(Docs): documentation renderer fixes	2025-12-23 16:00:33 -08:00
jobs	fix(queue): clear terminal jobs before re-dispatch so downloads aren't silently dropped	2026-09-29 15:54:41 -07:00
middleware	fix(API): skip compression for Server-Sent Events (#798)	2026-05-20 10:16:00 -07:00
models	feat(maps): map marker management	2026-09-29 15:54:41 -07:00
services	feat(ai): support local vision attachments	2026-09-29 15:54:41 -07:00
utils	feat(ai): support local vision attachments	2026-09-29 15:54:41 -07:00
validators	feat(AI): let retrieval decline instead of making the prompt paper over it	2026-09-29 15:54:41 -07:00