fix(security): prefer IPv4 when pinning DB and 1Password connections

[waleedlatif1]

Summary

• Same class of bug fixed for MCP in fix(mcp): pin outbound connections to IPv4 to avoid unreachable-IPv6 hangs #5798, applied to the other two pinned-resolution sites (flagged by both review passes on that PR).
• SSRF pinning forces each outbound connection to a single resolved IP, which strips Happy Eyeballs' IPv4 fallback. dns.lookup(verbatim) returns the IPv6 address first for dual-stack hosts, so a dual-stack database host or 1Password Connect server gets pinned to IPv6 — unreachable on IPv4-only egress (AWS NAT gateways) and hangs until timeout.
• validateDatabaseHost and validateConnectServerUrl now resolve all addresses ({ all: true, verbatim: true }) and prefer IPv4; IPv6-only hosts still pin their sole address.

Safety

• SSRF unchanged: the selected (IPv4-preferred) address is the exact one that gets validated (isPrivateOrReservedIP / assertConnectIpAllowed) and pinned — never a "validate A, connect B" split. Equal-or-stricter than before (a private IPv4 is now caught where it was previously masked by an IPv6 pick).
• No signature/threading changes.

Type of Change

• Bug fix

Testing

• lib/core/security + all DB tool utils (postgresql/clickhouse/mysql) + onepassword suites green (617); tsc + biome clean.
• Added tests: dual-stack host prefers IPv4; IPv6-only host pins its sole address (onepassword). validateDatabaseHost uses the identical expression, covered by the domain-check test in fix(mcp): pin outbound connections to IPv4 to avoid unreachable-IPv6 hangs #5798.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 21, 2026 5:26am

[cursor]

PR Summary

Medium Risk
Touches SSRF-sensitive DNS resolution and pinning for database and 1Password outbound paths; behavior change is narrow (address selection) but affects production connectivity.

Overview
Fixes connection hangs on dual-stack hosts when outbound traffic uses IPv4-only egress (e.g. AWS NAT). SSRF defenses pin each connection to one resolved IP, which removes Happy Eyeballs’ IPv4 fallback; a single dns.lookup with verbatim: true often returned IPv6 first, so database and 1Password Connect URLs could be pinned to an unreachable address.

validateDatabaseHost and validateConnectServerUrl now resolve all addresses ({ all: true, verbatim: true }) and prefer IPv4, falling back to the sole address on IPv6-only hosts. The chosen IP is still the one validated and pinned—SSRF policy is unchanged or stricter.

OnePassword tests were updated for the array-shaped lookup mock and add coverage for dual-stack (IPv4 chosen) and IPv6-only pinning.

^{Reviewed by Cursor Bugbot for commit c0c41c0. Configure here.}

[greptile-apps]

Greptile Summary

This PR prefers IPv4 when pinning database and 1Password Connect connections. The main changes are:

• Resolve all addresses before selecting a pinned IP.
• Prefer IPv4 while retaining IPv6-only support.
• Test dual-stack selection and IPv6-only fallback.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.
• The validated address is the same address used for connection pinning.
• IPv6-only hosts retain the existing fallback behavior.

Important Files Changed

Filename	Overview
apps/sim/app/api/tools/onepassword/utils.ts	Resolves all Connect server addresses, prefers IPv4, and validates the selected pinned address.
apps/sim/lib/core/security/input-validation.server.ts	Applies IPv4-preferred address selection to database host validation without changing its pinning contract.
apps/sim/app/api/tools/onepassword/utils.test.ts	Updates DNS mocks for array results and covers dual-stack and IPv6-only selection.

_{Reviews (1): Last reviewed commit: "fix(security): prefer IPv4 when pinning ..." | Re-trigger Greptile}