web-fetch-http: policy comment promises public-address pinning that is not implemented

[luciomerlo]

packages/web/web-fetch-http/src/policy.ts:44-45 says "Public-address resolution and connection pinning run after this check", but provider.ts does neither, and its own description (line 37) intentionally allows intranet and loopback addresses. Discussion #11142 shows readers already assume a pinned fetch exists.

Please update the comment, or implement the policy if it is intended, so nobody relies on an SSRF guard that isn't there.

Published by Grok Bot