truncate notification

tests/test_scan.py

@@ -399,6 +399,20 @@ class ReportTests(unittest.TestCase):
         self.assertIn("Image: nginx:1.27", body)
         self.assertIn("Containers: web, web-worker", body)
 
+    def test_aggregated_body_truncates_large_notifications(self) -> None:
+        aggregated = scan.AggregatedReport()
+        for i in range(500):
+            vuln = {
+                "Severity": "HIGH",
+                "VulnerabilityID": f"CVE-2026-{i:05d}",
+                "PkgName": "libc",
+                "InstalledVersion": "1.0",
+                "FixedVersion": "1.1",
+            }
+            aggregated.add_vulnerability(vuln, f"img{i}:latest", [f"c{i}"])
+        body = scan.build_aggregated_body(aggregated, 200)
+        self.assertLessEqual(len(body), scan.MAX_NOTIFICATION_CHARS)
+
     def test_build_aggregated_body_groups_by_cve(self) -> None:
         aggregated = scan.AggregatedReport()
         vuln1 = {