repo import-issues checks --api-base once, then fetches pull heads (FetchPullHeads) and calls the API over a plain HTTP client, neither pinned to the checked address. Same class as #298: resolve, check and pin each connection (the internal/gitpin helper #298 adds, and a dialer that connects only to the checked address for the API client).
repo import-issues fetches from an unpinned address #301
Discussion
referenced in commit 0cd2b3a8ac by cmc: wiki: SSRF control partial while import-issues fetches unpinned
2026-09-29 02:39 UTCreferenced in commit 0728a77dae by cmc: control: import-issues API client keeps no idle connections
2026-09-29 02:59 UTCclosed by cmc in commit 367c79588a: wiki, changelog: import-issues connects only to checked addresses
2026-09-29 02:59 UTCreferenced in commit 11114e655e by cmc: control: import-issues refuses credentials, a query or a fragment in --api-base
2026-09-29 02:59 UTCreferenced in commit 1d81484849 by cmc: control: import-issues API client dials only the checked address
2026-09-29 02:59 UTCreferenced in commit fa31441639 by cmc: control: import-issues fetches pull heads pinned to the checked address
2026-09-29 02:59 UTC
referenced in commit c2e04ef116 by cmc: wiki: Known-Gaps keeps the open #301 row
2026-09-29 02:25 UTC