v0.40.2

• Security (SSRF): the /bookmark and /import endpoints fetched a
  caller-supplied URL with no restriction on the target, letting an
  unauthenticated caller make the server request internal-only hosts
  (loopback, private ranges, and the link-local cloud-metadata endpoint) and,
  via bookmark, read the response back. Outbound fetches are now blocked from
  reaching non-public addresses, validated at DNS-resolution time so redirects
  and DNS-rebinding are covered too. Set ATOMIC_ALLOW_PRIVATE_FETCH=1 to opt
  out (e.g. for intentional LAN fetches). Reported by Ray Sabee / Whitehat
  Security (whitehatsecurity.nl).