# A raw `Response::json`/`text`/`bytes` reads the whole body with no size limit,
# so a hostile or buggy server can stream an arbitrarily large body and OOM the
# client (worst case: the public, unauthenticated OTA updater check). Every body
# read must go through `client::helpers::read_body_capped` (or its `read_json_capped`
# / `read_text_capped` wrappers), which drains `bytes_stream()` under a hard cap.
# `blob_download` streams `bytes_stream()` directly under its own 4 GiB cap.
# This seal makes a new uncapped read a compile-time (clippy) error, not a latent
# OOM lever someone has to remember to avoid.
disallowed-methods = [
    { path = "reqwest::Response::json", reason = "unbounded body read; use client::helpers::read_json_capped" },
    { path = "reqwest::Response::text", reason = "unbounded body read; use client::helpers::read_text_capped" },
    { path = "reqwest::Response::bytes", reason = "unbounded body read; use client::helpers::read_body_capped (or bytes_stream() under an explicit cap)" },
]