Merge pull request #4316 from umami-software/codex/umami-GHSA-w7hf-qxh9-2cm3

Limit batch API payloads to 500 items

src/app/api/batch/route.ts

@@ -4,7 +4,7 @@ import { parseRequest } from '@/lib/request';
 import { json, serverError } from '@/lib/response';
 import { anyObjectParam } from '@/lib/schema';
 
-const schema = z.array(anyObjectParam);
+const schema = z.array(anyObjectParam).max(500);
 
 export async function POST(request: Request) {
   try {