5 people ad791f8ea5 fix: block localhost and loopback addresses in SSRF protection (#28622) ...

* fix: block localhost and loopback addresses in SSRF protection

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: block loopback IPs by hostname in SSRF protection

Add 127.0.0.1, ::1, [::1], and 0.0.0.0 to blocked hostnames list for
defense-in-depth protection against SSRF attacks targeting localhost.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Romit <romitgabani1.work@gmail.com>
Co-authored-by: Romit <85230081+romitg2@users.noreply.github.com>

2026-03-28 13:21:58 +00:00

..

__mocks__

fix: replace @ts-ignore with @ts-expect-error to fix biome lint errors (#26849)

2026-01-14 19:05:57 -03:00

__tests__

refactor: extract dedicated @calcom/i18n package (#28141)

2026-02-23 13:30:12 +00:00

apps

refactor: apply biome formatting to packages/sms, prisma, emails, lib (#27880)

2026-02-13 07:39:01 -03:00

auth

refactor: remove @calcom/features dependency from @calcom/prisma (#23820)

2025-09-18 16:40:39 +00:00

bookings

refactor: calEventParser CalendarEvent ISP (#25890)

2026-01-17 10:40:01 +05:30

browser

fix: Scrolling to timeslot issue on Safari with inline-embeds (#22547)

2025-07-23 04:26:08 -03:00

builders/CalendarEvent

refactor: extract dedicated @calcom/i18n package (#28141)

2026-02-23 13:30:12 +00:00

components

fix: resolve noNonNullAssertion and noImplicitAnyLet lint issues (#27021)

2026-01-19 20:07:18 -03:00

crmManager

refactor: Remove circular deps between @calcom/lib and @calcom/features [1] (#24399)

2025-10-13 12:01:02 -03:00

crypto

feat: add encryptedKey column to Credential table for calendar integrations (#27154)

2026-01-30 09:15:13 -03:00

cva

fix: typos in several package/ directories (#19495)

2025-02-24 14:44:08 +00:00

dayjs

fix: display phone numbers and localized timezone in BookingDetailsSheet (#27909)

2026-02-13 10:27:01 +00:00

domainManager

fix: remove unreachable code in deleteDomain function (#28312)

2026-03-06 14:05:47 +00:00

dto

feat(flags): add @Memoize and @Unmemoize decorators for declarative caching (#27063)

2026-01-22 16:26:27 +01:00

holidays

refactor: apply biome formatting to packages/sms, prisma, emails, lib (#27880)

2026-02-13 07:39:01 -03:00

hooks

feat: add upgrade banners for teams and organizations (#27650)

2026-03-05 18:19:01 +09:00

idempotencyKey

fix: Generate new idempotency key when round robin reassigning (#22065)

2025-06-26 17:43:31 +00:00

intervalLimits

feat: make source required on EventBusyDetails for Troubleshooter display (#27088)

2026-03-06 14:53:14 -03:00

payment

refactor: circular deps between app store and lib [3] (#23742)

2025-09-14 11:24:16 -03:00

raqb

refactor: apply biome formatting to packages/sms, prisma, emails, lib (#27880)

2026-02-13 07:39:01 -03:00

schedules/transformers

refactor: apply biome formatting to packages/sms, prisma, emails, lib (#27880)

2026-02-13 07:39:01 -03:00

server

feat: enable microsoft sign ups (#28080)

2026-03-05 16:47:40 +05:30

service

refactor: Move attribute and routing-forms code from app-store/lib to features (#26025)

2025-12-29 21:51:06 -03:00

sync

chore: Cleanup Close.com (#16929)

2024-11-13 15:14:31 -05:00

tasker

refactor: apply biome formatting to packages/sms, prisma, emails, lib (#27880)

2026-02-13 07:39:01 -03:00

test

feat: Configure cancellation reason (#26872)

2026-02-24 13:35:51 -03:00

tracing

refactor: apply biome formatting to packages/sms, prisma, emails, lib (#27880)

2026-02-13 07:39:01 -03:00

tracking

refactor: apply biome formatting to packages/sms, prisma, emails, lib (#27880)

2026-02-13 07:39:01 -03:00

unstable_cache

perf: server-fetch data for all pages in /settings/my-account (#20712)

2025-07-24 22:36:40 +01:00

zod

refactor: apply biome formatting to packages/sms, prisma, emails, lib (#27880)

2026-02-13 07:39:01 -03:00

array.test.ts

feat: Support event level conflict checking (#18052)

2024-12-19 19:34:24 +00:00

array.ts

feat: Support event level conflict checking (#18052)

2024-12-19 19:34:24 +00:00

availability.ts

refactor: apply biome formatting to packages/sms, prisma, emails, lib (#27880)

2026-02-13 07:39:01 -03:00

buildCalEventFromBooking.ts

refactor: extract dedicated @calcom/i18n package (#28141)

2026-02-23 13:30:12 +00:00

CalendarAppError.ts

chore: rename DWD to DelegationCredential (#19744)

2025-03-05 10:42:20 -03:00

CalendarService.test.ts

fix(caldav): consistent UIDs and VTIMEZONE in iCalendar output (#28115)

2026-02-21 14:38:56 +00:00

CalendarService.ts

fix(caldav): consistent UIDs and VTIMEZONE in iCalendar output (#28115)

2026-02-21 14:38:56 +00:00

CalEventParser.test.ts

feat: Upgrade to Next 15 (#18834)

2025-03-20 21:30:51 -03:00

CalEventParser.ts

feat: add platform URL support for reschedule and cancel links in workflow emails (#27132)

2026-03-13 15:48:51 +04:00

checkIfItFallbackImage.ts

fix avatar remove button (#12249)

2023-11-15 15:23:33 +05:30

checkRateLimitAndThrowError.test.ts

chore: Upgrade prisma to 6.7.0 (#21264)

2025-09-11 15:27:50 +01:00

checkRateLimitAndThrowError.ts

chore: system wide ratelimit per path (#25080)

2025-11-12 22:01:59 +00:00

CloseCom.ts

fix: resolve noNonNullAssertion and noImplicitAnyLet lint issues (#27021)

2026-01-19 20:07:18 -03:00

CloseComeUtils.ts

refactor: Introduce crmManager (#14272)

2024-05-31 13:54:52 +00:00

connectedCalendar.ts

feat: Support event level conflict checking (#18052)

2024-12-19 19:34:24 +00:00

constants.ts

feat: Sink url shortner for sms workflow reminders (#26608)

2026-03-16 20:51:28 +00:00

contructEmailFromPhoneNumber.ts

feat: booking with phone number (#14461)

2024-09-11 17:56:04 -07:00

convertToNewDurationType.test.ts

fix: Correct hours-to-days conversion in convertToNewDurationType (#27964)

2026-02-15 21:01:00 +05:30

convertToNewDurationType.ts

fix: Correct hours-to-days conversion in convertToNewDurationType (#27964)

2026-02-15 21:01:00 +05:30

cookie.ts

feat: google ads conversion tracking (#25198)

2025-11-25 12:58:10 +00:00

crypto.test.ts

fix: handle non-deterministic AES-256-CBC decryption in crypto test (#26383)

2026-01-01 23:18:35 -03:00

crypto.ts

Prefix node protocol (#26391)

2026-01-02 12:47:00 +00:00

csvUtils.ts

refactor: apply biome formatting to packages/sms, prisma, emails, lib (#27880)

2026-02-13 07:39:01 -03:00

currencyConversions.ts

refactor: circular deps between app store and lib [5] (#23936)

2025-09-19 10:16:56 -03:00

dateTimeFormatter.test.ts

fix: add Icelandic, Lithuanian, and Norwegian locale support for Booker (#25519)

2026-01-13 08:47:39 -03:00

dateTimeFormatter.ts

fix: add Icelandic, Lithuanian, and Norwegian locale support for Booker (#25519)

2026-01-13 08:47:39 -03:00

dbReadResponseSchema.ts

refactor: Remove circular deps between @calcom/lib and @calcom/features [2] (#24438)

2025-10-17 06:48:08 -03:00

default-cookies.ts

refactor: cookie domain logic in defaultCookies (#22168)

2025-06-30 20:21:16 +00:00

defaultAvatarImage.ts

fix: #14769 (#14777)

2024-04-27 18:14:37 +02:00

delegationCredential.ts

refactor: circular deps between app store and lib [6] (#23971)

2025-10-09 14:02:12 +00:00

deriveAppDictKeyFromType.ts

chore: removed last web3 references (#12540)

2023-11-29 11:57:50 +00:00

emailSchema.ts

fix: Hotfix in change from @spammer.com to spammer.com (#24479)

2025-10-15 15:38:14 +01:00

entityPermissionUtils.shared.ts

refactor: prevents mixed server/clients imports (#21499)

2025-05-25 09:07:49 +00:00

env.ts

Feature: Verify login on signup with magic link. (#2122)

2022-04-21 14:32:25 -06:00

errorCodes.ts

fix: Improve the error handling in Stripe collectCard method (#27249)

2026-01-27 06:47:11 +00:00

errors.ts

refactor: apply biome formatting to packages/sms, prisma, emails, lib (#27880)

2026-02-13 07:39:01 -03:00

extract-base-email.ts

chore: Add guest email blacklist (#15255)

2024-05-30 17:13:34 +00:00

fetch-wrapper.ts

feat: Allow reschedule when max booker bookings have been reached (#21778)

2025-06-13 23:54:33 +00:00

fetchUsername.ts

fix: Correctly prefill username in case of non-org email invite in an org (#12854)

2023-12-19 02:44:48 +00:00

fetchWithTimeout.ts

fix: refactor i18n loadTranslations and set timeout to 3s (#22878)

2025-08-04 10:30:18 +01:00

findDurationType.ts

Enforces explicit type imports (#7158)

2023-02-16 15:39:57 -07:00

formatCalendarEvent.ts

fix: different calendar hosts (#24000)

2025-10-01 12:15:34 +03:00

formatPhoneNumber.ts

refactor: small improvements for cal ai (#23444)

2025-08-29 17:42:15 +05:30

formbricks.ts

feat: custom feedback dialog for feature opt-in (#27578)

2026-02-05 11:01:14 +00:00

fromEntriesWithDuplicateKeys.ts

fix: replace @ts-ignore with @ts-expect-error to fix biome lint errors (#26849)

2026-01-14 19:05:57 -03:00

generateHashedLink.ts

feat: Multiple Private links per Event Type (#15896)

2024-10-03 00:58:54 +05:30

getAdditionalEmailHeaders.ts

fix: add sendgrid-specific header only for SendGrid smtp server (#11932)

2023-11-16 13:51:30 -03:00

getAvatarUrl.ts

fix: avatar URL breaking for team/orgs in BookerEmbed atom (#27424)

2026-02-03 17:19:48 +00:00

getBooking.tsx

refactor: apply biome formatting to packages/sms, prisma, emails, lib (#27880)

2026-02-13 07:39:01 -03:00

getBrandColours.test.ts

refactor: Moving from jest to vitest (#9035)

2023-05-24 23:35:44 +00:00

getBrandColours.tsx

fix: Use constants.ts for brand colours > db DEFAULT (#13167)

2024-01-11 20:22:35 +00:00

getCalcomUrl.ts

fix: Add cal.eu to IS_CALCOM (#23111)

2025-08-18 16:04:48 +05:30

getClientErrorFromUnknown.ts

refactor: remove tRPC references from packages/lib (#24553)

2025-10-27 18:13:25 +00:00

getIP.test.ts

fix: improve getIP header resolution for CF → Vercel setup (#28152)

2026-02-24 14:47:14 +00:00

getIP.ts

fix: improve getIP header resolution for CF → Vercel setup (#28152)

2026-02-24 14:47:14 +00:00

getMetadataHelpers.ts

feat: admin org list now shows all, dns check added (#10875)

2023-08-23 21:01:12 +00:00

getOrgIdFromMemberOrTeamId.ts

fix: cal ai webhook (#24368)

2025-11-05 13:31:55 +04:00

getReplyToEmail.test.ts

feat: custom reply To Email (#20771)

2025-04-23 06:44:44 -07:00

getReplyToEmail.ts

fix: replyTo includes the correct email (#21843)

2025-06-17 10:45:44 +00:00

getReplyToHeader.test.ts

fix: join Reply-To addresses as string for SMTP compatibility (#28611)

2026-03-28 13:08:52 +00:00

getReplyToHeader.ts

fix: join Reply-To addresses as string for SMTP compatibility (#28611)

2026-03-28 13:08:52 +00:00

getSafe.ts

feat: Upgrade to Next 15 (#18834)

2025-03-20 21:30:51 -03:00

getSafeRedirectUrl.test.ts

Prevent xss in preview aand load resources from known URL (#18978)

2025-02-05 12:17:56 +05:30

getSafeRedirectUrl.ts

refactor: apply biome formatting to packages/sms, prisma, emails, lib (#27880)

2026-02-13 07:39:01 -03:00

getTeamIdFromEventType.ts

feat: optimize Prisma queries by replacing findFirst with findUnique where applicable (#21826)

2025-06-17 09:52:02 +03:00

getTldPlus1.ts

fix: correct bookingUrl for EU instance in API responses (#27046)

2026-01-20 12:48:30 +00:00

getValidRhfFieldName.test.ts

feat: normalize routing form identifier field with URL-safe format (#25128)

2025-11-18 11:24:33 +05:30

getValidRhfFieldName.ts

feat: normalize routing form identifier field with URL-safe format (#25128)

2025-11-18 11:24:33 +05:30

gtm.ts

feat: gtm push signup event (#14031)

2024-03-08 15:13:29 +00:00

hasEditPermissionForUser.ts

refactor: remove tRPC references from packages/lib (#24553)

2025-10-27 18:13:25 +00:00

hashedLinksUtils.ts

refactor: apply biome formatting to packages/sms, prisma, emails, lib (#27880)

2026-02-13 07:39:01 -03:00

hasKeyInMetadata.ts

feature/settings-username-update (#2306)

2022-07-06 13:31:07 -06:00

http-error.ts

fix: replace @ts-ignore with @ts-expect-error to fix biome lint errors (#26849)

2026-01-14 19:05:57 -03:00

i18n.ts

refactor: extract dedicated @calcom/i18n package (#28141)

2026-02-23 13:30:12 +00:00

intervalTree.ts

perf: optimize filterRedundantDateRanges from O(n²) to O(n log n) (#22093)

2025-07-03 10:59:33 +01:00

invertLogoOnDark.ts

fix: logo lack of contrast (#12401)

2023-11-17 14:10:58 +00:00

isEqual.ts

feat: Attribute filter/Segment for Round Robin hosts (#17361)

2024-11-20 10:22:53 +05:30

isEventTypeColor.ts

feat: Assign colors to events (#15298)

2024-08-14 15:10:40 +02:00

isKeyInObject.ts

Adds basic global feature flags (#7459)

2023-03-24 17:59:04 -07:00

isMac.ts

Adds a fully extensible command(ctrl)+k interface for Cal (#3346)

2022-07-14 06:45:07 +00:00

isOutOfBounds.timezone.test.ts

fix: Stores the DateRange in UTC instead of user machine that caused the bug (#26900)

2026-01-19 10:41:53 +02:00

isOutOfBounds.tsx

fix: resolve noNonNullAssertion and noImplicitAnyLet lint issues (#27021)

2026-01-19 20:07:18 -03:00

isPrismaObj.ts

chore: Upgrade prisma to 6.7.0 (#21264)

2025-09-11 15:27:50 +01:00

isProblematicTimezone.ts

Fix: Filter Timezones by cities (#7540)

2023-03-06 17:52:20 +00:00

isRecurringEvent.ts

feat(lib): add more tests to lib package (#7210)

2023-03-10 22:10:56 +00:00

isSmsCalEmail.ts

feat: booking with phone number (#14461)

2024-09-11 17:56:04 -07:00

jest.config.json

refactor: v2 event-types (#15457)

2024-06-21 10:49:12 +00:00

jsonUtils.ts

App Store (#1869)

2022-03-23 15:00:30 -07:00

LinkBuilder.ts

feat: add platform URL support for reschedule and cancel links in workflow emails (#27132)

2026-03-13 15:48:51 +04:00

logger.server.ts

refactor: apply biome formatting to packages/sms, prisma, emails, lib (#27880)

2026-02-13 07:39:01 -03:00

logger.ts

Add DI for BookingAudit (#25123)

2025-11-28 09:14:48 +00:00

markdownIt.ts

Fixes formatted description in email + sanitize html everywhere (#7928)

2023-03-28 09:40:13 +00:00

markdownToSafeHTML.ts

fix: unordered list issue (#23454)

2025-08-30 15:37:10 +00:00

markdownToSafeHTMLClient.ts

fix: unordered list issue (#23454)

2025-08-30 15:37:10 +00:00

navigateInTopWindow.ts

fix: Broken navigation after booking creation in some cases (#15664)

2024-07-08 13:56:58 +00:00

next-seo.config.ts

chore: Adds deprecated-imports-next-router (#14486)

2024-04-16 11:46:45 +01:00

notEmpty.ts

App Store (#1869)

2022-03-23 15:00:30 -07:00

objectKeys.ts

Enables strict mode in nextjs apps (#2354)

2022-04-04 20:26:14 +00:00

OgImages.test.ts

refactor: apply biome formatting to packages/sms, prisma, emails, lib (#27880)

2026-02-13 07:39:01 -03:00

OgImages.tsx

refactor: apply biome formatting to packages/sms, prisma, emails, lib (#27880)

2026-02-13 07:39:01 -03:00

package.json

refactor: extract dedicated @calcom/i18n package (#28141)

2026-02-23 13:30:12 +00:00

parse-dates.ts

fix: recurring events with calendar connections (#12250)

2023-11-07 12:09:56 -03:00

parse-zone.ts

New Booker Component (preparations for booker atom) (#6792)

2023-04-24 16:32:30 +02:00

perf.ts

fix: replace console logging with logger across services and features (#26127)

2025-12-23 08:24:23 +00:00

piiFreeData.ts

chore: Upgrade prisma to 6.7.0 (#21264)

2025-09-11 15:27:50 +01:00

pkce.test.ts

feat: OAuth PKCE (#25313)

2025-11-26 17:02:42 +01:00

pkce.ts

Prefix node protocol (#26391)

2026-01-02 12:47:00 +00:00

random.test.ts

refactor: Moving from jest to vitest (#9035)

2023-05-24 23:35:44 +00:00

random.ts

feat(lib): add more tests to lib package (#7210)

2023-03-10 22:10:56 +00:00

rateLimit.ts

refactor: apply biome formatting to packages/sms, prisma, emails, lib (#27880)

2026-02-13 07:39:01 -03:00

recentImpersonations.ts

feat: implement recent impersonations list with localStorage storage (#23610)

2025-09-06 19:56:08 +05:30

recurringStrings.ts

fix: Recurring events set to "yearly" don't recur (#24361)

2025-11-03 16:20:15 +00:00

redactError.ts

Avoid using prisma types on client (#23566)

2025-09-04 00:58:13 +00:00

redactSensitiveData.test.ts

feat: add missing sensitive fields to redactSensitiveData (#24121)

2025-10-01 20:26:58 -03:00

redactSensitiveData.ts

feat: add missing sensitive fields to redactSensitiveData (#24121)

2025-10-01 20:26:58 -03:00

redirect.ts

refactor: Billing service (#15366)

2024-10-04 13:44:50 -07:00

retellAIFetcher.ts

feat: retell AI webhook url (#14430)

2024-04-05 22:44:57 +05:30

safeStringify.ts

fix: Show error log (#14960)

2024-05-10 08:47:57 +01:00

sanitizeCalendarObject.ts

Caldav/refactor: Mutiple Fixes and General code improvement (#8031)

2023-04-12 14:30:39 -03:00

sdk-event.ts

feat: Add framework to send all events fired for embed to Analytics Apps (#15173)

2024-05-31 16:07:09 +00:00

Sendgrid.ts

chore: update tslog from 3.2.1 to 4.9.2 (#11717)

2023-10-17 19:00:48 +00:00

sentryWrapper.ts

refactor: apply biome formatting to packages/sms, prisma, emails, lib (#27880)

2026-02-13 07:39:01 -03:00

serverConfig.ts

feat: add resend email transport (#12645)

2023-12-04 15:31:55 -08:00

slugify-lenient.ts

slugify lenient (#25923)

2025-12-16 14:01:54 +00:00

slugify.test.ts

fix: typos in several package/ directories (#19495)

2025-02-24 14:44:08 +00:00

slugify.ts

fix: replace @ts-ignore with @ts-expect-error to fix biome lint errors (#26849)

2026-01-14 19:05:57 -03:00

smsLockState.ts

fix: resolve noNonNullAssertion and noImplicitAnyLet lint issues (#27021)

2026-01-19 20:07:18 -03:00

ssrfProtection.test.ts

fix: block localhost and loopback addresses in SSRF protection (#28622)

2026-03-28 13:21:58 +00:00

ssrfProtection.ts

fix: block localhost and loopback addresses in SSRF protection (#28622)

2026-03-28 13:21:58 +00:00

stripe-error.ts

refactor: Error code - remove circular dep between app store <-> lib (#23669)

2025-09-08 07:31:28 -03:00

stripMarkdown.ts

fix: strip markdown from meta description tag in users page (#8769)

2023-05-15 07:44:23 +00:00

telemetry.ts

chore: Remove next-collect package (#25146)

2025-11-19 13:54:26 +00:00

testEmails.ts

test: testing workflow triggers (#12823)

2023-12-21 18:57:06 +05:30

testSMS.ts

test: add unit tests for sms sending (#14737)

2024-05-02 10:42:38 -04:00

text.test.ts

fix: use maxLength parameter in truncateOnWord instead of hardcoded value (#27961)

2026-02-15 09:51:53 +00:00

text.ts

fix: use maxLength parameter in truncateOnWord instead of hardcoded value (#27961)

2026-02-15 09:51:53 +00:00

timeFormat.ts

refactor: event type builder (#19459)

2025-03-20 07:49:14 -07:00

timeShift.ts

feat: add time shift badge for recurring events with shifted local times (#25568)

2025-12-11 20:18:00 +00:00

timezone.ts

fix: timezone-dropdown (#23469)

2025-08-31 08:20:19 +00:00

timezoneConstants.ts

perf: Remove dayjs import from main constants.ts file (#19644)

2025-03-11 10:37:51 +00:00

timeZones.ts

chore: remove companion app (moved to calcom/companion) (#27957)

2026-02-16 10:08:24 -03:00

totp.ts

fix: add 2fa and email verification grace period (#10771)

2023-08-17 16:13:04 +02:00

translationConstants.ts

feat: workflow auto translation (#27087)

2026-02-25 01:03:55 +05:30

triggerDevLogger.ts

feat: Booking EmailAndSms Notifications Tasker (#24944)

2025-11-28 14:00:04 +00:00

tsconfig.json

perf: Remove tRPC types from @calcom/lib (#24551)

2025-10-19 13:14:25 +00:00

tsconfig.test.json

feat(lib): add more tests to lib package (#7210)

2023-03-10 22:10:56 +00:00

turndownService.ts

chore: plain text plugin for Editor (#17134)

2024-11-11 20:23:12 +05:30

validateBookerLayouts.ts

feat: event settings booker layout toggle (#9082)

2023-06-06 15:31:43 +00:00

videoTokens.ts

refactor: apply biome formatting to packages/sms, prisma, emails, lib (#27880)

2026-02-13 07:39:01 -03:00

WebAppURL.ts

chore: Introduce a new class WebAppURL that extends URL (#14982)

2024-07-18 07:27:34 +00:00

webstorage.ts

refactor: Use sessionStorage instead of localStorage for decoy booking data (#24450)

2025-12-12 07:42:44 -03:00

weekday.test.ts

fix: add Icelandic, Lithuanian, and Norwegian locale support for Booker (#25519)

2026-01-13 08:47:39 -03:00

weekday.ts

fix: add Icelandic, Lithuanian, and Norwegian locale support for Booker (#25519)

2026-01-13 08:47:39 -03:00

weekstart.test.ts

fix: #15749 Display availability page as per weekstart setting (#15753)

2024-07-16 11:31:02 +02:00

weekstart.ts

fix: #15749 Display availability page as per weekstart setting (#15753)

2024-07-16 11:31:02 +02:00