Fixing a silent truncation bug in Waaseyaa's StreamHttpClient
php
dev.to
Ahnii! Waaseyaa's packages/http-client package wraps PHP streams behind a small HttpClientInterface, with StreamHttpClient as the production implementation. It caps how many bytes of a response body it will read, so a runaway or hostile endpoint can't exhaust worker memory. That cap had a bug: hitting it didn't fail the request. It silently handed back a truncated body as a successful HttpResponse. What follows walks through the bug, the fix, and the broader lesson about bounding a read without