Under the hoodTier: how much it should matter to you
1Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
SandboxArea: what it touches
Internal ChangesKind: in v2.1.277,
Internal ChangesSection of the release
What
Claude Code has an internal check for whether a network address counts as "local," used to control whether local tools can bind to it. This check now strips IPv6 zone identifiers (extra suffixes like %eth0 sometimes attached to IPv6 addresses) before evaluating an address. It also consolidates loopback and unspecified-address handling into a single computed result, and hands off unmatched cases to a new helper function instead of separately hardcoding checks for AWS and GCP metadata service IP addresses.
Why
This is a defensive check related to preventing server-side request forgery (SSRF), where a request is tricked into reaching an unintended internal address; normalizing IPv6 zone identifiers first helps make sure such addresses aren't misclassified and slip past the local-address check.
