Fix 2254 (#2271)

oberstet · web-flow · commit 29b797cf4da4 · 2026-07-17T14:18:33.000+02:00
* start new dev branch; add audit file * add new release key (Crossbar.io 26.7 public key) * Finalize 26.7.1: codename 'Shields Up' + accept max_message_size=0 (#2254) Release-prep content for 26.7.1: - Assign the 26.7 series codename 'Shields Up' (crossbar/_codename.py) — the release raises the router's shields against oversized / decompression-bomb payloads. Required by the release gate (test_codename.py). The startup banner picks it up automatically via get_codename_suffix(__version__). - Accept max_message_size=0 (= unlimited) on WebSocket transports, matching the documented '0 = allow any size'. check_transport_max_message_size() rejected < 1, so 0 (a valid autobahn 'unlimited') was refused despite the docs — the small doc-vs-validator gap noted while doing #2253; agreed to fold here. The RawSocket validator is unchanged (protocol minimum is 512; it has no 'unlimited'). - Changelog entries for the codename and the max_message_size=0 fix. Note: This work was completed with AI assistance (Claude Code). * chore: bump version to 26.7.1 * Fix stale ReadTheDocs URLs: crossbar -> crossbario (#2254) The RTD project slug changed from 'crossbar' to 'crossbario', so the docs badge in README.md rendered red ('failing') and its link 404'd. Update the RTD project badge and docs URL (readthedocs.org/projects/crossbar + crossbar.readthedocs.io -> the '...crossbario...' equivalents) in README.md, docs/index.rst (badge + target), docs/conf.py (ogp_site_url) and docs/releases.rst (per-version links). The PyPI badges (img.shields.io/.../crossbar.svg, pypi.org/pypi/crossbar) and the GitHub links (github.com/crossbario/crossbar) are correct and left unchanged — only the ReadTheDocs project/domain moved. Verified from asgard1 (after RTD egress was unblocked): crossbario.readthedocs.io -> 200 (old crossbar.readthedocs.io -> 404); projects/crossbario badge -> passing (old crossbar badge -> failing). Note: This work was completed with AI assistance (Claude Code).
diff --git a/.audit/oberstet_fix_2254.md b/.audit/oberstet_fix_2254.md
@@ -0,0 +1,8 @@
+- [ ] I did **not** use any AI-assistance tools to help create this pull request.
+- [x] I **did** use AI-assistance tools to *help* create this pull request.
+- [x] I have read, understood and followed the projects' [AI Policy](https://github.com/crossbario/autobahn-python/blob/main/AI_POLICY.md) when creating code, documentation etc. for this pull request.
+
+Submitted by: @oberstet
+Date: 2026-07-17
+Related issue(s): #2254
+Branch: oberstet:fix_2254
diff --git a/README.md b/README.md
@@ -3,7 +3,7 @@
 [![PyPI](https://img.shields.io/pypi/v/crossbar.svg)](https://pypi.python.org/pypi/crossbar)
 [![Python](https://img.shields.io/pypi/pyversions/crossbar.svg)](https://pypi.python.org/pypi/crossbar)
 [![CI](https://github.com/crossbario/crossbar/workflows/main/badge.svg)](https://github.com/crossbario/crossbar/actions?query=workflow%3Amain)
-[![Docs](https://readthedocs.org/projects/crossbar/badge/?version=latest)](https://crossbar.readthedocs.io/en/latest/)
+[![Docs](https://readthedocs.org/projects/crossbario/badge/?version=latest)](https://crossbario.readthedocs.io/en/latest/)
 [![License](https://img.shields.io/pypi/l/crossbar.svg)](https://github.com/crossbario/crossbar/blob/master/LICENSE)
 [![Downloads](https://img.shields.io/pypi/dm/crossbar.svg)](https://pypi.python.org/pypi/crossbar)
 
diff --git a/docs/changelog.rst b/docs/changelog.rst
@@ -8,9 +8,11 @@ Changelog
 26.7.1
 ------
 
+* new: release codename for the **26.7 series — "Shields Up"** — this release raises the router's shields against oversized and decompression-bomb payloads (`#2254 <https://github.com/crossbario/crossbar/issues/2254>`_)
 * new: coordinated WAMP **26.7.1 release train** — pin ``autobahn>=26.7.1`` for the WebSocket permessage-deflate decompression-bomb fix (advisory ``GHSA-hxp9-w8x3-p566``) and relock ``uv.lock`` to the coordinated set (autobahn 26.7.1, zlmdb 26.7.1); ``cfxdb`` and ``txaio`` remain at 26.6.1 (`#2250 <https://github.com/crossbario/crossbar/issues/2250>`_)
 * **⚠ behaviour change** — ``max_message_size`` now **defaults to 16 MB** (``2**24``) on **both** the WebSocket and RawSocket transports (secure by default). Previously the WebSocket default was ``0`` (unlimited) while RawSocket already defaulted to 16 MB, so a WebSocket transport that did not set the option accepted messages of any size — leaving the router unbounded by default and the ``GHSA-hxp9-w8x3-p566`` protection effectively opt-in. Messages larger than 16 MB on a WebSocket transport with no explicit ``max_message_size`` are now rejected (close code 1009, ``MESSAGE_TOO_BIG``). Set ``max_message_size`` explicitly if you need more — ``0`` allows any size, and WebSocket permits up to 64 MB (RawSocket cannot exceed 16 MB by protocol) (`#2251 <https://github.com/crossbario/crossbar/issues/2251>`_)
 * fix: range-validate WebSocket ``max_frame_size`` (``[0, 64 MB]``, ``0`` = unlimited). It was type-checked only, so a negative value passed ``crossbar check`` and — because autobahn enforces frames with ``0 < maxFramePayloadSize < length`` — silently *disabled* the frame limit instead of tightening it (`#2253 <https://github.com/crossbario/crossbar/issues/2253>`_)
+* fix: accept ``max_message_size: 0`` (= unlimited) on WebSocket transports, matching the documented "0 = allow any size"; the range validator previously rejected ``0`` (`#2254 <https://github.com/crossbario/crossbar/issues/2254>`_)
 * fix: validate RawSocket ``max_message_size`` over its actual protocol range ``[512, 16 MB]`` with a dedicated validator. It previously reused the WebSocket-shaped ``[1, 64 MB]`` check, so a RawSocket config with ``max_message_size`` below 512 or above 16 MB passed ``crossbar check`` but then raised ``AssertionError`` at transport start (autobahn's factory asserts the WAMP RawSocket handshake range ``2**(9+n)``, i.e. ``[512, 16 MB]``). Also corrects ``docs/RawSocket-Transport.rst``: the documented range (``1–64 MB``) and default (``128 kB``) were both wrong — the real default is 16 MB (`#2252 <https://github.com/crossbario/crossbar/issues/2252>`_)
 * fix: validate WebSocket ``compression`` transport configuration. ``check_websocket_compression()`` was an empty stub yet wired into ``check_websocket_options()``, so unknown codecs, unknown or mis-typed deflate attributes and out-of-range ``request_max_window_bits`` / ``max_window_bits`` / ``memory_level`` were all silently accepted and only surfaced (if at all) as a run-time error deep inside the compression backend (`#2250 <https://github.com/crossbario/crossbar/issues/2250>`_)
 * new: functional test asserting the router rejects a decompression ("zip") bomb — a payload tiny on the wire but inflating far past the transport's ``max_message_size`` — on its *uncompressed* reassembled size (close code 1009). Verified a genuine regression test: it fails against autobahn < 26.7.1 and passes against 26.7.1 (`#2250 <https://github.com/crossbario/crossbar/issues/2250>`_)
diff --git a/docs/conf.py b/docs/conf.py
@@ -188,7 +188,7 @@
 spelling_show_suggestions = True
 
 # -- OpenGraph (Social Media Meta Tags) -------------------------------------
-ogp_site_url = "https://crossbar.readthedocs.io/en/latest/"
+ogp_site_url = "https://crossbario.readthedocs.io/en/latest/"
 
 # -- Auto Section Anchors Configuration --------------------------------------
 # Force overwrite of auto-generated ids (id1, id2, etc.) with slug-based anchors
diff --git a/docs/index.rst b/docs/index.rst
@@ -9,8 +9,8 @@ WAMP Router for Distributed & Decentralized Microservices
    :target: https://pypi.python.org/pypi/crossbar
 .. |CI| image:: https://github.com/crossbario/crossbar/workflows/main/badge.svg
    :target: https://github.com/crossbario/crossbar/actions?query=workflow%3Amain
-.. |Docs| image:: https://readthedocs.org/projects/crossbar/badge/?version=latest
-   :target: https://crossbar.readthedocs.io/en/latest/
+.. |Docs| image:: https://readthedocs.org/projects/crossbario/badge/?version=latest
+   :target: https://crossbario.readthedocs.io/en/latest/
 .. |License| image:: https://img.shields.io/pypi/l/crossbar.svg
    :target: https://github.com/crossbario/crossbar/blob/master/LICENSE
 .. |Downloads| image:: https://img.shields.io/pypi/dm/crossbar.svg
diff --git a/docs/releases.rst b/docs/releases.rst
@@ -22,14 +22,14 @@ For detailed changelog entries, see :doc:`changelog`.
 
 * `GitHub Release <https://github.com/crossbario/crossbar/releases/tag/v23.1.2>`__
 * `PyPI Package <https://pypi.org/project/crossbar/23.1.2/>`__
-* `Documentation <https://crossbar.readthedocs.io/en/v23.1.2/>`__
+* `Documentation <https://crossbario.readthedocs.io/en/v23.1.2/>`__
 
 23.1.1
 ------
 
 * `GitHub Release <https://github.com/crossbario/crossbar/releases/tag/v23.1.1>`__
 * `PyPI Package <https://pypi.org/project/crossbar/23.1.1/>`__
-* `Documentation <https://crossbar.readthedocs.io/en/v23.1.1/>`__
+* `Documentation <https://crossbario.readthedocs.io/en/v23.1.1/>`__
 
 22.6.1
 ------
diff --git a/pyproject.toml b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "crossbar"
-version = "26.6.1"
+version = "26.7.1"
 description = "Crossbar.io multi-protocol (WAMP/WebSocket, REST/HTTP, MQTT) application router for microservices."
 readme = "README.md"
 requires-python = ">=3.11"
diff --git a/src/crossbar/_codename.py b/src/crossbar/_codename.py
@@ -27,6 +27,7 @@
 # crossbar/test/test_codename.py).
 _CODENAMES: Dict[Tuple[int, int], str] = {
     (26, 6): "Resistance Is Futile",
+    (26, 7): "Shields Up",
 }
 
 
diff --git a/src/crossbar/_version.py b/src/crossbar/_version.py
@@ -5,5 +5,5 @@
 #
 #####################################################################################
 
-__version__ = "26.6.1"
+__version__ = "26.7.1"
 __build__ = "19000101-0000000"
diff --git a/src/crossbar/common/checkconfig.py b/src/crossbar/common/checkconfig.py
@@ -1011,7 +1011,8 @@ def check_endpoint_timeout(timeout):
 
 def check_transport_max_message_size(max_message_size):
     """
-    Check the ``max_message_size`` parameter for a WebSocket transport ([1, 64MB]).
+    Check the ``max_message_size`` parameter for a WebSocket transport
+    ([0, 64MB], ``0`` = unlimited — the documented spelling).
 
     RawSocket has a narrower, protocol-imposed range and its own validator, see
     :func:`check_transport_rawsocket_max_message_size`.
@@ -1023,11 +1024,10 @@ def check_transport_max_message_size(max_message_size):
         raise InvalidConfigException(
             "'max_message_size' attribute in transport must be int ({} encountered)".format(type(max_message_size))
         )
-    if max_message_size < 1 or max_message_size > 64 * 1024 * 1024:
+    if max_message_size < 0 or max_message_size > 64 * 1024 * 1024:
         raise InvalidConfigException(
-            "invalid value {} for 'max_message_size' attribute in transport (must be from [1, 64MB])".format(
-                max_message_size
-            )
+            "invalid value {} for 'max_message_size' attribute in transport "
+            "(must be from [0, 64MB], 0 = unlimited)".format(max_message_size)
         )
 
 
diff --git a/src/crossbar/common/keys/crossbar-26-7.pub b/src/crossbar/common/keys/crossbar-26-7.pub
@@ -0,0 +1,2 @@
+untrusted comment: Crossbar.io 26.7 public key
+RWSly4ITEVV6EWkwbysJGXWTGQKQeh/ZvBqaNdKCxxPPs+4Fr2z/J7kB
diff --git a/src/crossbar/test/test_checkconfig.py b/src/crossbar/test/test_checkconfig.py
@@ -308,6 +308,15 @@ def test_max_frame_size_zero_allowed(self):
     def test_max_frame_size_positive_allowed(self):
         checkconfig.check_websocket_options({"max_frame_size": 65536})
 
+    def test_max_message_size_zero_allowed(self):
+        # 0 is the documented "unlimited" spelling for WebSocket max_message_size
+        # and a valid autobahn value; the validator must accept it (#2254).
+        checkconfig.check_websocket_options({"max_message_size": 0})
+
+    def test_max_message_size_negative_rejected(self):
+        with self.assertRaises(checkconfig.InvalidConfigException):
+            checkconfig.check_websocket_options({"max_message_size": -1})
+
 
 class CheckRealmTests(TestCase):
     """
diff --git a/src/crossbar/test/test_codename.py b/src/crossbar/test/test_codename.py
@@ -19,6 +19,9 @@ class TestCodename(unittest.TestCase):
     def test_known_series(self):
         self.assertEqual(get_codename("26.6.1"), "Resistance Is Futile")
 
+    def test_known_series_26_7(self):
+        self.assertEqual(get_codename("26.7.1"), "Shields Up")
+
     def test_dev_suffix(self):
         # a .devN suffix on a known year.month series still resolves
         self.assertEqual(get_codename("26.6.1.dev1"), "Resistance Is Futile")
diff --git a/uv.lock b/uv.lock

Original file line number	Diff line number	Diff line change
`@@ -27,6 +27,7 @@`
`27`	`27`	`# crossbar/test/test_codename.py).`
`28`	`28`	`_CODENAMES: Dict[Tuple[int, int], str] = {`
`29`	`29`	`(26, 6): "Resistance Is Futile",`
	`30`	`+ (26, 7): "Shields Up",`
`30`	`31`	`}`
`31`	`32`
`32`	`33`
Original file line number	Diff line number	Diff line change
`@@ -5,5 +5,5 @@`
`5`	`5`	`#`
`6`	`6`	`#####################################################################################`
`7`	`7`
`8`		`-__version__ = "26.6.1"`
	`8`	`+__version__ = "26.7.1"`
`9`	`9`	`__build__ = "19000101-0000000"`