mweinbach2/13/2026, 4:21:31 PM

Bun's fetch silently ignores the undici dispatcher option, so the DNS
pinning from the previous commit was dead code — leaving a TOCTOU
rebinding gap. Replace with a Bun-compatible approach: resolve DNS
once via resolveSafeWebUrl, then rewrite the URL to the resolved IP
and pass the original hostname via Host header.

Also fixes redirect loop off-by-one (<= to <) and adds CGNAT
(100.64.0.0/10) and benchmark (198.18.0.0/15) ranges to the
private IPv4 blocklist.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Parenta87686b