http: NO_PROXY does not match 'localhost.', '[::1]' or IPv4-mapped loopback #66853

Summary

ProxyConfig#shouldUseProxy() (lib/internal/http.js) compares the request host against NO_PROXY. Three forms of loopback are not recognised and are routed to the configured proxy anyway:

• http://localhost./ - trailing dot (new URL(u).hostname === 'localhost.')
• http://[::1]/ - IPv6 loopback as new URL(u).hostname returns it ('[::1]')
• http://[::ffff:7f00:1]/ - IPv4-mapped loopback

with NO_PROXY=localhost,127.0.0.1,::1.

Expected

The request goes direct, like http://localhost/.

Actual

It is sent through the proxy, including any Authorization header the operator explicitly excluded.

Repro

process.env.HTTP_PROXY = 'http://127.0.0.1:8080';
process.env.NO_PROXY   = 'localhost,127.0.0.1,::1';
require('http').get('http://localhost./', r => r.resume());  // observed at the proxy

Control: http://localhost/ is not sent to the proxy.

Suggested fix

Normalise before comparing: strip a single trailing dot, unwrap [/], lowercase, and canonicalise IPv4-mapped forms - compare the canonical host, not the raw URL.hostname. Add tests for all three.

Note: filed as a parity/correctness issue, not a security report - SECURITY.md places proxy/deployment network policy out of scope. undici fixed the identical mismatch as a non-security parity bug (undici#5637 / #5623).