Patch Changes 6a2f01b: Add URL validation to download to prevent blind SSRF attacks. Private/internal IP addresses, localhost, and non-HTTP protocols are now rejected before fetching. 17d64e3: fix(provider-utils): prevent unicode escape bypass in secureJsonParse