LocalAI 4.12.1 hardens external URL handling
LocalAI shipped a security-only patch that validates every redirect hop, rejects carrier-grade NAT and 0.0.0.0/8 destinations as non-public, and connects to the address that passed validation instead of re-resolving an untrusted host.
Why it matters: Model and agent runtimes frequently fetch user-supplied URLs; redirect and DNS gaps can turn that convenience into server-side requests against private services or metadata endpoints.