From c925bff3a22f7729d88f906ac953e5e38e8331b0 Mon Sep 17 00:00:00 2001
From: Shan Usmani <takhiro79@gmail.com>
Date: Thu, 23 Jul 2026 03:38:39 +0530
Subject: [PATCH 1/3] fix(a11y): respect prefers-reduced-motion in
 BackToTopButton

---
 src/components/BackToTopButton.tsx | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/src/components/BackToTopButton.tsx b/src/components/BackToTopButton.tsx
index fb48452e2..9cef27285 100644
--- a/src/components/BackToTopButton.tsx
+++ b/src/components/BackToTopButton.tsx
@@ -17,11 +17,21 @@ export default function BackToTopButton() {
     }
   };
 
+  const [prefersReducedMotion, setPrefersReducedMotion] = useState(false);
+
+  useEffect(() => {
+    const mq = window.matchMedia("(prefers-reduced-motion: reduce)");
+    setPrefersReducedMotion(mq.matches);
+    const handler = (e: MediaQueryListEvent) => setPrefersReducedMotion(e.matches);
+    mq.addEventListener("change", handler);
+    return () => mq.removeEventListener("change", handler);
+  }, []);
+
   const scrollToTop = () => {
     if (typeof window !== "undefined") {
       window.scrollTo({
         top: 0,
-        behavior: "smooth",
+        behavior: prefersReducedMotion ? "auto" : "smooth",
       });
     }
   };
@@ -70,7 +80,7 @@ export default function BackToTopButton() {
                 strokeDasharray={circumference}
                 strokeDashoffset={strokeDashoffset}
                 style={{ filter: "drop-shadow(0 0 6px color-mix(in srgb, var(--accent) 60%, transparent))" }}
-                className="transition-[stroke-dashoffset] duration-100"
+                className={`transition-[stroke-dashoffset] duration-100 ${prefersReducedMotion ? "!transition-none" : ""}`}
               />
             </svg>
             <button

From 4eb3a8f9917052ef5e8e6355787d2b4cae219ada Mon Sep 17 00:00:00 2001
From: Shan Usmani <takhiro79@gmail.com>
Date: Thu, 23 Jul 2026 04:09:38 +0530
Subject: [PATCH 2/3] test(ssrf): add regression tests for signed 32-bit
 integer overflow in IP parsing

Adds direct IP literal tests for private ranges 192.168.x.x, 172.16.x.x,
10.x.x.x, and 127.x.x.x. These regression tests verify the >>> 0 unsigned
right shift fix prevents the overflow that previously bypassed SSRF
protection for high-bit IPs like 192.168.x.x.

Closes #3118
---
 test/ssrf-protection.test.ts | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/test/ssrf-protection.test.ts b/test/ssrf-protection.test.ts
index 42afba1da..1899dde01 100644
--- a/test/ssrf-protection.test.ts
+++ b/test/ssrf-protection.test.ts
@@ -108,5 +108,26 @@ describe("ssrf-protection", () => {
       mockLookup.mockResolvedValue([{ address: "2001:4860:4860::8888", family: 6 }]);
       expect(await isSafeUrl("http://example.com")).toBe(true);
     });
+
+    it("should block 192.168.x.x as direct IP literal (regression: signed overflow #3118)", async () => {
+      expect(await isSafeUrl("http://192.168.1.1")).toBe(false);
+      expect(await isSafeUrl("http://192.168.0.1")).toBe(false);
+      expect(await isSafeUrl("http://192.168.255.255")).toBe(false);
+    });
+
+    it("should block 172.16.x.x as direct IP literal (regression: signed overflow #3118)", async () => {
+      expect(await isSafeUrl("http://172.16.0.1")).toBe(false);
+      expect(await isSafeUrl("http://172.31.255.255")).toBe(false);
+    });
+
+    it("should block 10.x.x.x as direct IP literal", async () => {
+      expect(await isSafeUrl("http://10.0.0.1")).toBe(false);
+      expect(await isSafeUrl("http://10.255.255.255")).toBe(false);
+    });
+
+    it("should block 127.x.x.x as direct IP literal", async () => {
+      expect(await isSafeUrl("http://127.0.0.1")).toBe(false);
+      expect(await isSafeUrl("http://127.255.255.255")).toBe(false);
+    });
   });
 });

From b59259a470a4022a2fc98e6c2ade5f16b53bd709 Mon Sep 17 00:00:00 2001
From: Shan Usmani <takhiro79@gmail.com>
Date: Sat, 25 Jul 2026 13:23:06 +0530
Subject: [PATCH 3/3] ci: re-trigger star check