Skip to content

Verify NOVA against the Unraid 7.4.0 request limits #320

Closed

Description

@nofuturekid

What and why

Check NOVA against the request limits of Unraid 7.4.0 and record the result. Unraid 7.4.0 (2026-11-10) adds request-size and query-complexity limits; its release notes say "Clients that rely on schema introspection in that mode or exceed the limits may need to be adjusted" (https://docs.unraid.net/unraid-os/release-notes/7.4.0/).

Known already: the project's test server runs Unraid 7.4.0 and NOVA works against it in versions 0.1.44 to 0.1.46 (device runs on 2026-11-13). What remains is the explicit check of the two limits below, so that growing queries do not hit them unnoticed.

Other apps: none relevant.

What NOVA has today

The largest operation is GetArray (queries.graphql:68): 59 fields, nesting depth 4. NOVA sends Ping { __typename }, which is not blocked. WebSocket subscriptions are in subscriptions.graphql.

API side

Limits in unraid/api main (api/src/unraid-api/graph/request-protection.ts, introspection-plugin.ts, read 2026-11-13): max cost 1,000, depth 20, 100 aliases, WebSocket maxTokens 5,000; only __schema and __type are blocked. These come from code on main and may differ from the 7.4.0 release.

Constraints from NOVA's principles

Official API only. No introspection needed.

Open questions

  • What cost does the server report for the largest query, and how much headroom is there?
  • How many tokens does the subscription connect message use?

Acceptance criteria

  • Largest query (GetArray) cost measured on 7.4.0 against the limit of 1,000.
  • WebSocket token usage checked against the limit of 5,000.
  • Result recorded in HANDOFF.md or an ADR note, including the server version.

Size

S

Activity

  1. self-assigned this
    on Nov 13, 2026
  2. nofuturekid commented on Nov 13, 2026

    @nofuturekid
    CollaboratorAuthor

    Result of the check (PR #337), run 2026-11-13 against a real Unraid 7.4.0 (API 4.37.11+8e587fe2, built from unraid/api commit 8e587fe, where request-protection.ts sets the limits):

    • Limits (from the source): cost 1,000, depth 20, 100 aliases, 5,000 GraphQL tokens (HTTP and WebSocket subscribe), 1 MiB body (Fastify default, no bodyLimit set). Only __schema and __type are blocked.
    • All 15 shipped queries were sent read-only: every one validates and answers HTTP 200 with data (FetchContainerLogs sent with a fake id: passes validation, resolver error as expected).
    • Largest query GetArray: cost 59 of 1,000 (6 %), depth 4 of 20. Most tokens: GetNotificationList with 78 of 5,000. At most 2 aliases. Largest request document 477 bytes.
    • The server's own refusals match the formula exactly: 17 aliased copies of GetArray are refused with "found 1003" (17 x 59), 31 copies of GetNotificationList with "found 1023" (31 x 33, fragments included); cost 1,000 / 100 aliases accepted, 1,001 / 101 refused, 5,001 tokens refused.
    • WebSocket: the connection_init message is not tokenised; only the subscribe query is. The five subscriptions use 8 to 20 tokens (measured by the unit test, not sent live).
    • GraphqlRequestLimitsTest (CI) now fails when any operation passes 70 % of a limit and names the operation and the measure. Limits and margin are in HANDOFF.md ("Unraid 7.4 request limits").

    Not measured live: depth 21 and the body limit (from the source only).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

enhancementNew feature or requestmarket-2026-11From the market overview of 2026-11-13

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions