blog · release

bunqueue v2.6.60

Fixes 2 bugs. Webhook SSRF prevention in embedded mode: WebhookManager.add() now validates URLs against SSRF (localhost, private IPs, cloud metadata).

To install bunqueue v2.6.60

bun add bunqueue@2.6.60

npm install bunqueue@2.6.60

To upgrade bunqueue

bun add bunqueue@latest

Changes

• Extracted validateWebhookUrl to shared module: src/shared/webhookValidation.ts is now the single source of truth, re-exported from protocol.ts for backward compatibility.

Bugfixes

• Webhook SSRF prevention in embedded mode: WebhookManager.add() now validates URLs against SSRF (localhost, private IPs, cloud metadata). Previously only enforced at TCP server layer, leaving embedded SDK unprotected.
• Docs: pin Zod v3 for Starlight: Fixed Vercel build crash caused by Zod v4 incompatibility with Starlight 0.31.

---

← bunqueue v2.6.49 · Full changelog · All posts