Route all server-initiated outbound HTTP through one SSRF-protected layer:
- Resolve each host once, validate every resolved address (private,
loopback, link-local, CGNAT 100.64/10, multicast, reserved, unspecified,
IPv4-mapped IPv6), and reject if any is unsafe.
- Pin the connection to the validated address via curl's RESOLVE option so
curl cannot re-resolve to a rebound IP (closes the validate-then-connect
TOCTOU). Uses getaddrinfo so IPv6 records are checked too.
- Add a sync SafeTransport and safehttp.post, and move the webhook and
recipe-action paths off raw requests.post so they are guarded like the
scraper.
- Add HTTP_ALLOW_LIST / HTTP_DISALLOW_LIST settings (deny > allow > default)
so operators can reach an internal server or block extra hosts.
Apprise notifications egress through the third-party library and are not
covered here.
* use locale to set language header
* rewrite i18n provider and drop dependency
* rename file
* rename CrudMixin to HttpRepo
* refactor: code-cleanup
* add crowdin source
* remove unused translations
* grab translations from dev branch
* add translation support for foods, units, and labels
* remove rich import
