Refuse allow-listed hostnames that resolve to loopback, link-local or configured private ranges - #522

Merged

shawnm-anthropic merged 22 commits into

mainfrom

dcochran/resolved-ip-guard

Sep 10, 2026

Commits on Sep 7, 2026

feat(network): refuse allow-listed hostnames that resolve to denied addresses
dannycochran
committed
a3ac53e

Commits on Sep 8, 2026

fix(network): deny the host's own addresses, zoned link-local results, and non-loopback answers for localhost names
dannycochran
committed
3283f78
fix(proxy): give the plain-HTTP direct leg no shared connection pool
dannycochran
committed
1508831
refactor(network): canonicalise injected interface addresses in one place
dannycochran
committed
73bcb55
refactor(network): derive the resolved-address rules from the allow/deny lists; drop allowedResolvedAddresses
dannycochran
committed
01cad37

Commits on Sep 9, 2026

Commits on Sep 10, 2026