Skip to content

[pull] main from firecrawl:main - #91

Merged
pull[bot] merged 15 commits into
innFactory:mainfrom
firecrawl:main
Sep 28, 2026
Merged

pull[bot] merged 15 commits into
innFactory:mainfrom
firecrawl:main

Conversation

@pull

@pull pull Bot commented Sep 28, 2026 •

Copy link
Copy Markdown

See Commits and Changes for more details.


Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

Max17190 and others added 15 commits September 27, 2026 20:52
Co-authored-by: firecrawl-spring[bot] <254786068+firecrawl-spring[bot]@users.noreply.github.com>
Add MCP skill packages, supporting documentation, and package validation.
Every hosted MCP request introspected its token against www.firecrawl.dev
with no reuse. All pods on a GKE node share that node's public IP, and the
issuer's firewall rate-limits each IP to 1000 requests a minute. A busy node
crossed it, got 429 plus a one-minute 403 block, and returned "credential
validation is temporarily unavailable" to users.

- Reuse an active answer for up to 60s, capped by the token's exp, and an
  inactive answer for 10s. Keys are SHA-256 of token plus resource.
- Concurrent requests with one token share a single introspection call.
- Failed introspections are never cached.
- FIRECRAWL_OAUTH_INTROSPECT_CACHE_TTL_MS=0 turns the cache off.
- Log edge_mitigation (deny, challenge, rate_limit, other) from
  x-vercel-mitigated on a failed introspection.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Do not cache an active answer whose exp is present but malformed.
- Refresh recency on a hit, so eviction drops the least recently used entry.
- Test the cache with the real introspectionTtlMs (exp cap and inactive
  window), clear(), and LRU eviction.
- Add the stderr TypeError guard to the new smoke tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
fix(auth): cache OAuth introspection answers per pod
This reverts merge commit ed62c03.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Revert "fix(auth): cache OAuth introspection answers per pod" (#458)
Relands the change from #458, which was reverted only to keep deployment
details out of the public PR description. The code is unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…reland

fix(auth): cache OAuth introspection answers per pod (reland)
@pull pull Bot locked and limited conversation to collaborators Sep 28, 2026
@pull pull Bot added the ⤵️ pull label Sep 28, 2026
@pull
pull Bot merged commit b96f2e0 into innFactory:main Sep 28, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants