fix: close host-scoping deny-list bypasses via alternate address encodings (#635) - #649

Merged

MCKRUZ merged 4 commits into

mainfrom

fix/635-host-scoping-bypasses

Sep 11, 2026

Commits on Sep 11, 2026

fix: close host-scoping deny-list evasion via alternate encodings (#635)

MCKRUZ
and
claude
committed
ddbaa21
fix: exclude userinfo/fragment/query/backslash from host synthetic-parse, correct overstated doc claim (#635)

MCKRUZ
and
claude
committed
504a6d9
fix: collapse deprecated IPv4-compatible IPv6 form, correct IdnHost-throw claim (#635)

MCKRUZ
and
claude
committed
e92b809
fix: re-normalize host to a fixed point to catch post-IDNA-fold IPv4 literals (#635)

MCKRUZ
and
claude
committed
698d550