mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-19 13:36:48 +00:00
69a5367bd0
GitHub 302-redirects release-asset downloads to a rotating *.githubusercontent.com host (objects / github-releases / release-assets). The SSRF allowlist only had objects.githubusercontent.com, so installs failed with 'host not allowlisted'. Allow the whole *.githubusercontent.com suffix (plus github.com/codeload); the private-IP check remains the SSRF backstop.