v1.0.2

Security

Http.request()'s maxResponseBytes guard now enforces the limit incrementally while
streaming the response body, instead of buffering the full body via res.text() first —
closes a memory-exhaustion path for a chunked response with no honest Content-Length.

net-guard.js's SSRF host check now also blocks IPv6 unique-local (fc00::/7), IPv6
link-local (fe80::/10), and IPv4-mapped IPv6 addresses (::ffff:a.b.c.d and the
URL-normalized hex-hextet form) — closes bypasses that skipped the IPv4-only
private-range check.

safeUrl now rejects URLs carrying embedded userinfo credentials
(https://user:pass@host/...) — closes a phishing/link-spoofing vector distinct from the
existing scheme allowlist.