5 people ad791f8ea5 fix: block localhost and loopback addresses in SSRF protection (#28622) ...

* fix: block localhost and loopback addresses in SSRF protection

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: block loopback IPs by hostname in SSRF protection

Add 127.0.0.1, ::1, [::1], and 0.0.0.0 to blocked hostnames list for
defense-in-depth protection against SSRF attacks targeting localhost.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Romit <romitgabani1.work@gmail.com>
Co-authored-by: Romit <85230081+romitg2@users.noreply.github.com>

2026-03-28 13:21:58 +00:00

..

app-store

fix: add missing vi.mock() calls to prevent vitest worker shutdown flakiness (#28459)

2026-03-17 09:55:37 +05:30

app-store-cli

fix(app-store-cli): incorrect type annotation (#28319)

2026-03-11 18:32:44 +05:30

config

refactor: extract dedicated @calcom/i18n package (#28141)

2026-02-23 13:30:12 +00:00

coss-ui

refactor: migrate webhooks page to coss/ui components (#27714)

2026-03-04 12:56:15 +00:00

dayjs

fix: load dayjs utc plugin before timezone plugin (#28314)

2026-03-06 21:00:24 +05:30

debugging

…

ee

…

emails

fix: hide cal branding for orgs/teams (#27643)

2026-02-25 20:53:01 +09:00

embeds

fix: guard against document being undefined in embed-iframe informAboutScroll (#28596)

2026-03-27 11:50:35 +00:00

features

fix: upgrade handlebars to 4.7.9 to resolve critical vulnerability (#28625)

2026-03-28 17:01:18 +09:00

i18n

fix: improve German translation for reschedule button #28607 (#28624)

2026-03-28 08:48:11 +00:00

kysely

refactor: apply biome formatting to several packages (#27439)

2026-02-05 07:24:34 -03:00

lib

fix: block localhost and loopback addresses in SSRF protection (#28622)

2026-03-28 13:21:58 +00:00

platform

feat: api v2 DELETE booking attendees endpoint (#27781)

2026-03-18 13:25:53 +02:00

prisma

feat: add integration options for API v2 update booking location endpoint (#26363)

2026-03-17 15:15:17 +05:30

sms

refactor: apply biome formatting to packages/sms, prisma, emails, lib (#27880)

2026-02-13 07:39:01 -03:00

testing

refactor: extract dedicated @calcom/i18n package (#28141)

2026-02-23 13:30:12 +00:00

trpc

fix: prevent IDOR in PBAC updateRole and deleteRole tRPC endpoints (#28569)

2026-03-25 03:38:35 +05:30

tsconfig

…

types

fix: correct admin password banner message and auto-sign-out after 2FA enable (#28129)

2026-03-10 12:46:31 -03:00

ui

fix: update routing form identifier hint text with learn more link (#27837)

2026-02-20 13:09:09 +01:00