Evidence record / heypi
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-10-13-heypi-gondolin-0-13-0-closes-hookless-internal-network-egress-outside-heypi-s-range
Gondolin 0.13.0 closes hookless internal-network egress outside heypi’s range. Gondolin 0.13.0 blocks guest HTTP/TLS to loopback, private, link-local and other internal ranges even without HTTP hooks. In 0.12.0, the IP check was skipped when httpHooks.isIpAllowed was absent, despite the older network documentation claiming default blocking. heypi’s ^0.12.0 range excludes 0.13.0, so ordinary fresh beta installs still select 0.12.0. The adapter installs no hooks itself. Hookless VMs could reach host-local services and cloud metadata endpoints, subject to host routing. No matching public Gondolin advisory was found in the crosscheck’s 2026-10-14 searches.
Channel: tagged-release upstream; heypi Gondolin adapter preview-or-beta at 0.3.0-beta.2. Half: defect. Date: 2026-10-04 (upstream release; fix 2026-10-01).
Operator consequence: For heypi Gondolin deployments near private services or cloud metadata, supply createHttpHooks() with blockInternalRanges enabled; the 0.12.0 helper defaults it to true and the adapter forwards the hook. An explicit 0.13.0 dependency override is another source-supported route, but compatibility has not been executed or established. Test the network boundary and the changes listed in section 14. A normal heypi update within the declared range does not obtain this fix.
Receipt
- https://github.com/earendil-works/gondolin/blob/v0.13.0/CHANGELOG.md#L12
- https://github.com/earendil-works/gondolin/commit/494cf18b7bd8cef7b63e1ae3665cb770c5ced0de
- https://github.com/earendil-works/gondolin/releases/tag/v0.13.0
- https://github.com/hunvreus/heypi/blob/436da22ceab0bc4e2db133e8626649b4bf76286d/packages/heypi-runtime-gondolin/package.json#L41
- https://github.com/hunvreus/heypi/blob/436da22ceab0bc4e2db133e8626649b4bf76286d/packages/heypi-runtime-gondolin/src/index.ts#L65-L82
- https://github.com/earendil-works/gondolin/blob/v0.12.0/host/src/http/hooks.ts#L143-L147
Finding metadata
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
Finding ID: 2026-10-13-heypi-gondolin-0-13-0-closes-hookless-internal-network-egress-outside-heypi-s-range
Source links
Primary links, including exact changelog lines when available.
- tagged commit file2026-10-13-heypi-gondolin-0-13-0-closes-hookless-internal-network-egress-outside-heypi-s-rangeearendil-works/gondolin / CHANGELOG.md#L12commit2026-10-13-heypi-gondolin-0-13-0-closes-hookless-internal-network-egress-outside-heypi-s-rangegithub.com/earendil-works/gondolin/commit/494cf18b7bd8cef7b63e1ae3665cb770c5ced0degithub release2026-10-13-heypi-gondolin-0-13-0-closes-hookless-internal-network-egress-outside-heypi-s-rangeearendil-works/gondolin / v0.13.0tagged commit file2026-10-13-heypi-gondolin-0-13-0-closes-hookless-internal-network-egress-outside-heypi-s-rangehunvreus/heypi / packages/heypi-runtime-gondolin/package.json#L41tagged commit file2026-10-13-heypi-gondolin-0-13-0-closes-hookless-internal-network-egress-outside-heypi-s-rangehunvreus/heypi / packages/heypi-runtime-gondolin/src/index.ts#L65-L82tagged commit file2026-10-13-heypi-gondolin-0-13-0-closes-hookless-internal-network-egress-outside-heypi-s-rangeearendil-works/gondolin / host/src/http/hooks.ts#L143-L147
Versioned source: run artifact