[github-actions]

🚀 Automated Prepare Release v3.1.0

This PR contains the version bump for release v3.1.0.

✅ Release Steps Completed

• Tests & linting passed
• Project built successfully
• API documentation generated
• Demo page updated and tested
• Release notes generated in

✏️ Edit Release Notes

You can edit the release notes for this version in the file in this PR to curate the changelog before merging.

📋 Pending Steps (on PR merge)

• 🏷️ Git tag creation - will happen automatically via GitHub Actions
• 📋 GitHub release creation - will use edited notes from
• 📦 NPM publishing - will happen automatically via GitHub Actions

🔗 Release Links

• Demo: https://silverbucket.github.io/webfinger.js/
• GitHub Release: (will be created after merge)
• NPM: https://www.npmjs.com/package/webfinger.js (will update after merge)

---

🚀 Generated with automated release workflow

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: ddf25c7a-8615-487b-a2b3-7edf1ad00993

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

No medium, high, or critical vulnerabilities in the v3.1.0 release diff.

Reviewed the rebuilt client (address parsing, resource encoding, NAT64 well-known-prefix checks, and dns.lookup host validation) and traced attacker-controlled handles and URIs through to fetch. Private literals, IPv4-mapped forms, 64:ff9b::/96 embeddings, and hosts-file loopback names stay blocked, and the new query encoding does not let the resource value change the request host or path.

No earlier security-review threads were open on this PR.

  

_{Sent by Cursor Automation: Find vulnerabilities}

[cursor]

One high-severity SSRF gap remains in the NAT64 blocklist shipped in this release build. The well-known prefix 64:ff9b::/96 is blocked, but the local-use prefix 64:ff9b:1::/48 is still fetched, including redirects to link-local metadata. No other medium-or-higher issues in the diff.

  

_{Sent by Cursor Automation: PR review - Find vulnerabilities}

[cursor]

High — SSRF via the local-use NAT64 prefix 64:ff9b:1::/48

isWellKnownNat64 is true only for 64:ff9b::/96 (hextets 2–5 all zero) and then reads the last 32 bits as IPv4. Addresses in 64:ff9b:1::/48 fail that test, and 0x0064 is not unique-local, link-local, or multicast, so isPrivateAddress returns false. lookup and redirect handling still call fetch.

RFC 6052 §3.1 forbids the well-known prefix from representing non-global IPv4. RFC 8215 reserves 64:ff9b:1::/48 for local translation (IANA: not globally reachable) and lists checksum-neutral prefixes inside it, including 64:ff9b:1:fffe::/96, whose last 32 bits are the IPv4 target. A /48 embedding does not put the IPv4 address in those last 32 bits at all.

Confirmed on this build with allow_private_addresses: false:

• lookup('test@[64:ff9b:1:fffe::a9fe:a9fe]') requests https://[64:ff9b:1:fffe::a9fe:a9fe]/... (169.254.169.254)
• lookup('test@[64:ff9b:1:a00:0:100::]') requests that host (RFC 6052 /48 embedding of 10.0.0.1)
• a 302 to http://[64:ff9b:1:fffe::a9fe:a9fe]/latest/meta-data/ is followed

Impact: on a network that translates 64:ff9b:1::/48, a caller-supplied handle or a WebFinger redirect reaches private IPv4, including link-local cloud metadata. The same predicate is in webfinger.js, webfinger.cjs, and webfinger.min.js. Block the whole 64:ff9b:1::/48 prefix.