v1.1.2

Upgrade note (HTTP mode only): the HTTP server now binds 127.0.0.1 by default and only accepts loopback Host headers. If you expose it on a network, set BIND_HOST (e.g. 0.0.0.0) and ALLOWED_HOSTS (your hostname). Requests carrying an Origin header are rejected, and fetch_l402 no longer fetches private/loopback addresses or follows redirects. stdio mode is unaffected.

What's Changed

• fix(http): validate incoming Host/Origin and outbound fetch targets by @reneaaron in #33
• fix(http): don't let NWC client cleanup errors escape the close handler by @reneaaron in #34

New Contributors

• @reneaaron made their first contribution in #33

Full Changelog: v1.1.1...v1.1.2