Bryan Helmkamp 1214bebd14 fix(client): reject obfuscated IPv4 literals at target parse time ... url::Url normalizes decimal (http://2130706433) and hex (http://0x7f000001) IPv4 host forms into 127.0.0.1, so after canonical_http_url rewrites the target the loopback classifier cannot tell them apart from a legitimate http://127.0.0.1 and lets a refresh token ride plaintext HTTP. Detect these forms on the raw input string and bail out before the url crate can hide them, and split the loopback test to cover the parse-time rejection path. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>		2026-04-20 21:49:09 -04:00
..
crates	fix(client): reject obfuscated IPv4 literals at target parse time	2026-04-20 21:49:09 -04:00
packages/fabro-api-client	Merge remote-tracking branch 'origin/main'	2026-04-20 09:47:47 -04:00