jubnl e655a7a4e4 fix(ssrf): let .local/.internal hostnames pass to IP-level checks ...

The pre-DNS hostname block was redundant: any .local/.internal host
that resolves to a private IP is already gated by isPrivateNetwork +
ALLOW_INTERNAL_NETWORK, and any that resolves to loopback/link-local
is caught by isAlwaysBlocked unconditionally.

Dropping the hostname pre-check means Docker/LAN deployments can reach
services on .local hostnames (e.g. immich.local) with
ALLOW_INTERNAL_NETWORK=true, while loopback and link-local IPs
(including 169.254.169.254) remain hard-blocked with no override.

Reverts the isAlwaysBlocked guard loosening from 9a08368.

2026-05-03 16:43:39 +02:00

..

assets

refactor: move airports.json out of server/data into server/assets

2026-04-18 02:02:09 +02:00

public

chore(CRLF): normalize index.html line endings to LF

2026-04-05 04:35:17 +02:00

scripts

docs: add full wiki with 74 pages, assets, and CI workflow

2026-04-20 10:11:53 +02:00

src

fix(ssrf): let .local/.internal hostnames pass to IP-level checks

2026-05-03 16:43:39 +02:00

tests

Bug fixes - April 30th 2026 (#936)

2026-05-01 01:43:19 +02:00

.env.example

fix: hot fixes 23-04-2026 (#856)

2026-04-23 19:49:36 +02:00

package-lock.json

chore: bump version to 3.0.13 [skip ci]

2026-04-30 23:43:49 +00:00

package.json

chore: bump version to 3.0.13 [skip ci]

2026-04-30 23:43:49 +00:00

reset-admin.js

Stabilize core: better-sqlite3, versioned migrations, graceful shutdown

2026-03-22 17:52:24 +01:00

tsconfig.json

some fixes

2026-03-30 06:59:24 +02:00

vitest.config.ts

refactor(mcp): replace direct DB access with service layer calls

2026-04-04 18:12:53 +02:00