fix: bound MCP request bodies at 1 MiB (CVE-2026-108859)

[teemow]

Problem

The nancy scan fails on CVE-2026-108859: mcp-go through v1.2.1 (the latest release, no fix yet) reads a Streamable HTTP POST body whole with io.ReadAll before validating it.

Proposed solution

• The MCP route is wrapped in http.MaxBytesHandler at 1 MiB, the bound the REST API already applies, so the vulnerable read never takes more than that.
• .nancy-ignore ignores the CVE until 2026-11-12, referencing CVE-2026-108859: bound MCP request bodies until mcp-go ships a fix #324, which stays open for the mcp-go bump.

Acceptance criteria

• A POST to /mcp over 1 MiB is refused and the endpoint keeps answering (test).
• Normal MCP requests unaffected (existing tests).
• go-build green.

Refs #324

Written by an agent.

[circleci-architect]

Published Helm chart model-manager

1.17.2-r02c38c47t20261012140451h5d3da52

Chart	model-manager
Version	1.17.2-r02c38c47t20261012140451h5d3da52
OCI reference	oci://gsoci.azurecr.io/charts/giantswarm/model-manager:1.17.2-r02c38c47t20261012140451h5d3da52
Digest	sha256:493b506626570874b73941398b2d067f9cc04ff4b587b408b0b676054d80235d
Registry	public — gsoci.azurecr.io
Git catalog	giantswarm-test-catalog (index)

Pull this chart

helm pull oci://gsoci.azurecr.io/charts/giantswarm/model-manager --version 1.17.2-r02c38c47t20261012140451h5d3da52

_{Posted by architect-orb · build 4317 · commit 5d3da52 · updated in place on every push}