Harden URL reads against rebinding and compression bombs - #372

Merged

vinitkumar merged 7 commits into

fix/coordinated-review-findings

Aug 4, 2026

Commits on Aug 4, 2026

fix: require boolean private network opt-in
vinitkumar
committed
758a16a
fix: wrap invalid Unicode hostnames
vinitkumar
committed
a2cd2f7
fix: pin URL requests to validated DNS addresses
vinitkumar
committed
997844a
fix: bound incremental response decompression
vinitkumar
committed
a7e1316
docs: add security migration guidance
vinitkumar
committed
828cf9a
test: complete URL boundary coverage
vinitkumar
committed
20a090f
fix: tests
vinitkumar
committed
f5784ad