MulmoClaude

Security

Delivers the SSRF deny-list fixes from #2459 to npm.

The bridge's urlGuard used to carry its own inline CIDR deny-list. In #2459 it was single-sourced onto @mulmoclaude/common/ssrf — but because this package builds with tsc and treats @mulmoclaude/common as an externalized runtime dependency (not bundled), the previously published 0.1.1 still shipped the pre-fix inline table. This release re-publishes against @mulmoclaude/[email protected], so installers now resolve the shared, corrected guard.

Two bypasses that existed in the old inline guard are fixed here:

• IPv4-mapped IPv6 in hex form. WHATWG URL serializes [::ffff:127.0.0.1] as ::ffff:7f00:1, so a deny-list that only matched the dotted-quad spelling let IPv4-mapped loopback (and any IPv4-mapped private address) through. Both spellings are now parsed.
• fe80::/10 under-blocking. The old string-prefix IPv6 check missed fe81::–febf::, which are inside the link-local fe80::/10 range. The shared check is mask-based and covers the whole range.

The shared table is also the union of the two previously-divergent copies, so the bridge additionally gains the reserved/benchmark/multicast ranges (192.0.0.0/24, 198.18.0.0/15, 224.0.0.0/4, 240.0.0.0/4) the core feeds client had been missing.

Requires

@mulmoclaude/common@^1.1.0 (published 2026-07-24).

📦 npm: @mulmobridge/[email protected]

What's Changed

• docs: record the @mulmoclaude/[email protected] release in the changelog by @isamu in https://github.com/receptron/mulmoclaude/pull/2514
• fix(canvas): per-instance id, honest Clear, off-canvas save, failure UI by @isamu in https://github.com/receptron/mulmoclaude/pull/2513
• fix(spreadsheet): RATE/IRR report #NUM! on non-convergence (#2360) by @isamu in https://github.com/receptron/mulmoclaude/pull/2516

Full Changelog: https://github.com/receptron/mulmoclaude/compare/@mulmobridge/[email protected]...@mulmobridge/[email protected]