@lunora/browser 1.0.0-alpha.35 → 1.0.0-alpha.37

package/README.md

@@ -107,7 +107,9 @@ If you deliberately drive the browser at an internal service reachable through a
 const browser = createBrowser({ binding: env.BROWSER, launch, allowPrivateTargets: true });
 ```
 
-Only set `allowPrivateTargets` when every URL is trusted — it re-opens the SSRF surface. The guard does not resolve DNS, so a public hostname that resolves to a private address (DNS rebinding) is out of scope; keep caller-supplied URLs trusted regardless.
+Only set `allowPrivateTargets` when every URL is trusted — it re-opens the SSRF surface.
+
+DNS rebinding is covered too: whenever `allowedHosts` is unset, the host is resolved over DoH and refused if it maps to a private address, before the browser launches and again on every redirect hop. Setting `allowedHosts` turns that re-check off, because an exact-host allowlist already closes rebinding and may deliberately name an internal host reachable over a Tunnel; pass `resolveDns: true` to force both.
 
 > This README covers the basics. For the full API, options, and guides, see the **[documentation](https://lunora.sh/docs/packages/browser)**.
 

package/dist/index.d.mts

@@ -194,8 +194,13 @@ interface LunoraBrowserOptions {
    * trailing-dot-normalized, IPv6 brackets stripped). This is the only guard
    * that fully closes DNS rebinding: a public hostname that resolves to a
    * private/metadata IP can still be pinned out if it isn't on the list. Set it
-   * whenever you pass client-controlled URLs to the browser. Leave it unset (the
-   * default) to keep the previous behavior (only the string-based SSRF guard).
+   * whenever you pass client-controlled URLs to the browser.
+   *
+   * Leaving it unset (the default) is NOT unguarded: it turns
+   * {@link LunoraBrowserOptions.resolveDns} on, so every host is resolved over
+   * DoH and refused if it maps to a private address. Setting an allowlist turns
+   * that re-check off (the allowlist is the stronger guard, and may deliberately
+   * name an internal host); `resolveDns: true` forces both.
    */
   allowedHosts?: string[];
   /**

package/dist/index.d.ts

@@ -194,8 +194,13 @@ interface LunoraBrowserOptions {
    * trailing-dot-normalized, IPv6 brackets stripped). This is the only guard
    * that fully closes DNS rebinding: a public hostname that resolves to a
    * private/metadata IP can still be pinned out if it isn't on the list. Set it
-   * whenever you pass client-controlled URLs to the browser. Leave it unset (the
-   * default) to keep the previous behavior (only the string-based SSRF guard).
+   * whenever you pass client-controlled URLs to the browser.
+   *
+   * Leaving it unset (the default) is NOT unguarded: it turns
+   * {@link LunoraBrowserOptions.resolveDns} on, so every host is resolved over
+   * DoH and refused if it maps to a private address. Setting an allowlist turns
+   * that re-check off (the allowlist is the stronger guard, and may deliberately
+   * name an internal host); `resolveDns: true` forces both.
    */
   allowedHosts?: string[];
   /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/browser",
-  "version": "1.0.0-alpha.35",
+  "version": "1.0.0-alpha.37",
   "description": "Cloudflare Browser Rendering for Lunora: ctx.browser screenshots, PDF, and scraping in actions",
   "keywords": [
     "browser-rendering",
@@ -46,7 +46,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/errors": "1.0.0-alpha.28"
+    "@lunora/errors": "1.0.0-alpha.30"
   },
   "peerDependencies": {
     "@cloudflare/playwright": ">=1.0.0"