Baptiste Arnaud b25c41b02b 🐛 Fix SSRF bypass via DNS rebinding in HTTP request and script fetch flows (#2461) ... - Add `createSafeDispatcher` with a `validatingLookup` that checks resolved IPs at TCP connection time, preventing DNS rebinding TOCTOU attacks (GHSA-hgqq-whf5-mrrf) - Pass the safe undici dispatcher in `safeFetchWithoutChunkedEncoding` (`ky.ts`) and in the isolated VM fetch wrapper (`executeFunction.ts`) - Export `parseIPAddress`, `validateIPAddress` and `ParsedIP` from `validateHttpReqUrl.ts` for reuse in the dispatcher - Add unit tests for `validatingLookup` and E2E test bot/spec for SSRF scenarios - Add `@types/bun` to `packages/lib` tsconfig --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>		2026-04-15 09:28:06 +00:00
..
builder	🐛 Fix credential access control and remove vulnerable S3 upload endpoint (#2459)	2026-04-15 10:39:54 +02:00
docs	✨ Add Ask Model action using OpenAI Responses API (#2455)	2026-04-13 14:02:35 +00:00
landing-page	📝 Update blog posts links (#2445)	2026-04-13 14:25:24 +02:00
viewer	🐛 Fix SSRF bypass via DNS rebinding in HTTP request and script fetch flows (#2461)	2026-04-15 09:28:06 +00:00
workflows	♻️ Remove shared-primitives package	2026-03-25 10:43:35 +01:00