UPinar/contrastapi

PATCH hotfix on top of v1.33.7 (seq-fix; tag-only, no release). Completes the S251 httpx connection-pool leak remediation: v1.33.5 (initial hotfix) → v1.33.7 (parallel→sequential fetch_live_page) → v1.33.8 (pattern-B).

What changed

• Pattern-B streaming-cancel hardening (4 sites). async with _ssrf_http.stream(...) → build_request + send(stream=True) + try/finally: await asyncio.shield(resp.aclose()) in fetch_live_page, fetch_robots_txt, fetch_homepage_html, walk_redirect_chain. The pooled connection is now returned even when the awaiting task is cancelled mid-stream — closing the bounded httpcore pool leak that could exhaust the pool and cause site-wide 504s.
• Pool-acquire timeout 5.0 → 12.0s on the shared SSRF-guarded client (defense-in-depth; effective now that streaming sites no longer pin a per-request timeout).
• Route hard timeout. GET /v1/tech/{domain} and GET /v1/domain/{domain}/vulns now wrap the live-page fetch in asyncio.wait_for(…, 13.0s) with a clean 504 on timeout (mirrors the canonical domain_report pattern; fixes a 500-on-timeout edge). Operator note: these two endpoints now hard-cap at ~13s for unreachable/slow targets.

Compatibility

• No response shape/content change for the same input. No schema / route / MCP-contract change.
• MCP: 53 tools / 7 Resources / 3 Prompts — unchanged. MCP Registry not republished (no contract change).

Tests

• pytest 2440 → 2446 (+6: new test_streaming_pool_leak.py — pool-timeout, aclose-on-cancel ×3, route wait_for ×2). Full suite green; ruff + pip-audit clean.