[do-io]

The rss and dynamic_feed blocks fetched feed_url from the server with no check on where it pointed. They now go through OutboundUrlGuard:

• the host must resolve only to public addresses (private, loopback, link-local including cloud metadata, carrier-grade NAT and reserved ranges are refused, IPv4 and IPv6, including integer, hex and IPv4-mapped forms);
• the request is pinned to the checked address, follows no redirects, and has 3 s connect and 5 s total timeouts;
• a response over mail-builder.feeds.max_bytes (default 1 MB) is ignored;
• a refused or failed feed falls back to the block's own items, as before;
• mail-builder.feeds.allowed_hosts lets a host through, for feeds served from your own network.

Tests: a table of refused URLs (nothing is sent), a public feed still works, redirects are not followed, size limit, allowed host, and the address classification. The test case binds a guard that never touches DNS. I also ran the real resolver against real names and the odd IP forms by hand.

README gets a short "Feed blocks" section. Needs a patch release (2.5.1) so that applications using the editor or the compiler get it.

🤖 Generated with Claude Code