You'll notice
URL host parsing now rejects scheme-prefixed strings and strips whitespace before building fallback URLs
What
Before Claude Code builds a fallback https:// URL out of a bare host string, it now checks whether that string already looks like it starts with a URL scheme (something like foo: at the start) and bails out if so, instead of blindly prepending https://. It also now strips tab, newline, carriage-return, and surrounding whitespace characters from the string before parsing it.
Why
This closes off ways a crafted host string could be misinterpreted as pointing somewhere other than intended, such as smuggling in a different scheme or hiding characters in whitespace.