The check for whether an address is local was simplified and now strips IPv6 zone identifiers first
Claude Code has an internal check for whether a network address counts as "local," used to control whether local tools can bind to it. This check now strips IPv6 zone identifiers (extra suffixes like %eth0 sometimes attached to IPv6 addresses) before evaluating an address. It also consolidates loopback and unspecified-address handling into a single computed result, and hands off unmatched cases to a new helper function instead of separately hardcoding checks for AWS and GCP metadata service IP addresses.
This is a defensive check related to preventing server-side request forgery (SSRF), where a request is tricked into reaching an unintended internal address; normalizing IPv6 zone identifiers first helps make sure such addresses aren't misclassified and slip past the local-address check.