0.2.0

What's Changed

• Add Dependabot configuration by @adamtheturtle in #28
• Add Dependabot auto-merge workflow by @adamtheturtle in #30
• Bump actions/checkout from 5 to 7 by @dependabot[bot] in #29
• Add repository-local SwiftFormat configuration by @adamtheturtle in #27
• Add post-DNS resolved address validation APIs by @adamtheturtle in #94
• Treat bare @ as empty userinfo, not credentials by @adamtheturtle in #90
• Unwrap public IPv4-mapped addresses instead of always blocking by @adamtheturtle in #87
• Reject port 0 under every PortRule by @adamtheturtle in #83
• Make OriginRule.origin(matching:) throw on bad config by @adamtheturtle in #91
• Reject underscores in hostname labels by @adamtheturtle in #84
• Block DNS rebinding wildcard services as special-use names by @adamtheturtle in #93
• Semantic same-origin redirect checks and broader sensitive headers by @adamtheturtle in #88
• Ignore single-label hostSuffix rules by @adamtheturtle in #85
• Harden redirect Location scanning and rejection reporting by @adamtheturtle in #89
• Reject relative URLs and normalize ValidatedURL scheme casing by @adamtheturtle in #97
• Tighten fragment and query policy edge cases by @adamtheturtle in #99
• Verify validatedInitialURL on redirect hops by @adamtheturtle in #100
• Rebuild header map after stripping sensitive redirect headers by @adamtheturtle in #102
• Fix README examples to avoid special-use example.com by @adamtheturtle in #103
• Trap empty URLPolicy.https(origins:) at configuration time by @adamtheturtle in #104
• Allow-list entries override special-use host name blocks by @adamtheturtle in #86
• Let hostSuffix match IP literals by canonical form by @adamtheturtle in #92
• Expose URLPolicy.rejection(for:) for diagnostics by @adamtheturtle in #95
• Label parserDisagreement errors with the differing field by @adamtheturtle in #96
• Add cancelTask redirect mode and validate protocol-relative Locations by @adamtheturtle in #101
• Serialize ValidatedURL.origin in RFC 6454 form by @adamtheturtle in #98
• Fix compile break and stale tests after stacked PR merges by @adamtheturtle in #105
• Restore default sensitive redirect header fields by @adamtheturtle in #114
• Rebuild header map after stripping redirect credentials by @adamtheturtle in #115
• Compare redirect origins with URLHost equivalence by @adamtheturtle in #116
• Preserve Foundation URL spelling during validation by @adamtheturtle in #117
• Exercise single-label hostSuffix guard with a public .com host by @adamtheturtle in #118
• Apply post-DNS validation without IP-literal string rule by @adamtheturtle in #119
• Fix IDN same-origin redirect header preservation by @adamtheturtle in #121
• Reject bidi and format characters as confusable host code points by @adamtheturtle in #127
• Reject maximumLength 0 at configuration time by @adamtheturtle in #122
• Count normalized path segments toward the path limit by @adamtheturtle in #124
• Treat alphabetic numeric-suffix hosts as domains by @adamtheturtle in #128
• Report invalid UTF-8 host percent-encoding separately by @adamtheturtle in #126
• Test allow-listed IANA example domains by @adamtheturtle in #129
• Fix duplicate confusableCharacter and file_length lint by @adamtheturtle in #140
• Decode Teredo client XOR into embedded IPv4 checks by @adamtheturtle in #143
• Document defaultPort is independent of allowedSchemes by @adamtheturtle in #136
• Accept portless custom schemes under PortRule.any by @adamtheturtle in #131
• Document that punycode ACE labels skip IDNA validation by @adamtheturtle in #133
• Document validate(URL) checks Foundation absoluteString by @adamtheturtle in #134
• Document fail-closed parser disagreement across Foundation by @adamtheturtle in #137
• Harden docs that redirect delegate must stay final and immutable by @adamtheturtle in #138
• Expose SpecialUseDomains.registryLastChecked date by @adamtheturtle in #139
• Document conservative .internal suffix false positives by @adamtheturtle in #141
• Reject maximumPathSegments 0 at configuration time by @adamtheturtle in #123
• Allow subset of special-purpose addresses by registry name by @adamtheturtle in #144
• Fix test merge corruption and lint thresholds by @adamtheturtle in #145
• Classify percent-encoded host controls as forbidden code points by @adamtheturtle in #125
• Test explicit origins override special-use host blocks by @adamtheturtle in #130
• Add validate(resolvedAddresses:) for post-DNS SSRF checks by @adamtheturtle in #132
• Document .alt special-use TLD block and opt-in by @adamtheturtle in #142
• Trap incompatible origin ports and portRule at init by @adamtheturtle in #135
• Fix ReservedAddressTests merge corruption by @adamtheturtle in #146
• Align Vale with shared prose checks by @adamtheturtle in #148

New Contributors

• @dependabot[bot] made their first contribution in #29

Full Changelog: 0.1.2...0.2.0