feat(parser): add feed.published field and xml:base URL resolution

[bug-ops]

Summary

This PR addresses critical API compatibility gaps identified in the feedparser-rs gap analysis:

• feed.published / feed.published_parsed field - RSS <pubDate> and Atom <published> at feed level now accessible via Python and Node.js bindings
• xml:base URL resolution - Relative URLs are now automatically resolved to absolute URLs using xml:base attributes (Atom) or channel link (RSS)
• SSRF protection - All resolved URLs are validated against dangerous targets (localhost, private IPs, cloud metadata endpoints)

Changes

Core Library

• Add published: Option<DateTime<Utc>> to FeedMeta struct
• Add extract_xml_base() helper for xml:base attribute extraction
• Add resolve_safe() method to BaseUrlContext with SSRF validation
• Integrate URL resolution in Atom parser (feed + entry level xml:base)
• Integrate URL resolution in RSS parser (channel link as base)

Python Bindings

• Add published getter returning RFC3339 string
• Add published_parsed getter returning time.struct_time

Node.js Bindings

• Add published field returning milliseconds since epoch
• Easy conversion to JavaScript Date: new Date(feed.feed.published)
• TypeScript definitions updated

Security

• Block localhost (127.0.0.1, ::1, localhost domain)
• Block private IPs (10.x.x.x, 192.168.x.x, 172.16-31.x.x)
• Block cloud metadata (169.254.169.254, metadata.google.internal)
• Block dangerous schemes (file://, data://, javascript://)
• Block absolute malicious URLs in href attributes
• Case-insensitive scheme validation (prevents bypass via FILE://, JAVASCRIPT:)

Test Plan

• 10 URL resolution integration tests
• 23 SSRF security tests (including case-insensitive scheme bypass)
• 13 Python integration tests
• 48 Node.js tests pass
• All 474 Rust tests pass
• cargo clippy --all-targets clean
• cargo fmt applied

API Compatibility

Before: 85% Python feedparser parity
After: ~95% parity for modern feeds (RSS 2.0, Atom 1.0, JSON Feed)

No breaking changes to existing API.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

@@            Coverage Diff             @@
##             main      #26      +/-   ##
==========================================
+ Coverage   90.75%   90.85%   +0.10%     
==========================================
  Files          32       32              
  Lines        6175     6245      +70     
==========================================
+ Hits         5604     5674      +70     
  Misses        571      571              

Flag	Coverage Δ
rust-core	90.85% <100.00%> (+0.10%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
crates/feedparser-rs-core/src/parser/atom.rs	89.16% <100.00%> (+0.34%)	⬆️
crates/feedparser-rs-core/src/parser/common.rs	75.36% <100.00%> (+1.92%)	⬆️
crates/feedparser-rs-core/src/parser/rss.rs	94.43% <100.00%> (+0.05%)	⬆️
crates/feedparser-rs-core/src/types/feed.rs	96.36% <ø> (ø)
crates/feedparser-rs-core/src/util/base_url.rs	99.61% <100.00%> (+0.03%)	⬆️

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

This PR adds critical Python API compatibility features to feedparser-rs: support for feed.published_parsed field and xml:base URL resolution with SSRF protection. The changes enable RSS channel <pubDate> and Atom <published> dates to be exposed at the feed level (previously only available for entries), and implement automatic resolution of relative URLs against xml:base attributes or channel links while blocking SSRF attack vectors.

Key Changes

• Feed-level publication dates: RSS <pubDate> and Atom <published> now populate FeedMeta.published field, exposed in Python bindings as both RFC3339 string and time.struct_time
• URL resolution: Relative URLs in feeds are automatically resolved to absolute URLs using xml:base (Atom) or channel link (RSS) as the base
• SSRF protection: All resolved URLs are validated against localhost, private IPs, cloud metadata endpoints, and dangerous schemes (file://, data://, etc.)

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
crates/feedparser-rs-core/src/types/feed.rs	Added published: Option<DateTime<Utc>> field to FeedMeta struct
crates/feedparser-rs-core/src/util/base_url.rs	Added resolve_safe() method to BaseUrlContext with SSRF validation logic
crates/feedparser-rs-core/src/parser/common.rs	Added extract_xml_base() helper to extract xml:base attributes from XML elements
crates/feedparser-rs-core/src/parser/atom.rs	Integrated xml:base extraction and URL resolution for feed and entry elements
crates/feedparser-rs-core/src/parser/rss.rs	Changed RSS <pubDate> to populate feed.published instead of feed.updated; integrated channel link as base URL for item link and enclosure resolution
crates/feedparser-rs-py/src/types/feed_meta.rs	Added Python getters for published (string) and published_parsed (time.struct_time)
crates/feedparser-rs-py/tests/test_phase1_integration.py	13 comprehensive Python integration tests covering date parsing and URL resolution
crates/feedparser-rs-core/tests/test_url_resolution.rs	10 integration tests for xml:base URL resolution behavior
crates/feedparser-rs-core/tests/test_url_security.rs	19 SSRF protection tests validating blocking of malicious URLs

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 3 comments.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 13 changed files in this pull request and generated no new comments.