
Fixing SSRF and TOCTOU in fetch pinning
validateAndResolveUrl resolved a hostname twice — once to validate, once to pin — leaving a TOCTOU window where DNS could answer differently between the two calls. The fix collapses both resolutions into one and pins the fetch to the entire validated address set instead of a single OS-picked IP.








