Security
- Web Push delivery no longer reaches the server's own network through a malformed address
(completes the 2.81.1 fix). The push library reads a subscription address with an older parser
than the check before it, and for some unusual characters in the host the two disagreed, so a
crafted address could pass the check and still be sent to an internal address. A push address
now has to be a plain host name made of letters, digits, hyphens and dots, as every push service
hands out, and both parsers have to read the same host. A stored subscription with such an
address is removed on its next delivery, like the others.