I’m curious how this wasn’t caught in testing. When you set up a dual-stacked listener which is common when you omit the binding IP, you already get IPv4-mapped IPv6 address, and the request logs would have also shown the ::ffff:x.x.x.x addresses. Also curious as to why they are working with text representations of IP addresses instead of binary representations, although the incident GitHub described here could be very well a firewall deciding that IPv6 datagrams were invalid traffic.
However, to make this thread complete, I guess someone will again complain about the address format, without realizing that shoving in extra address bits on an IPv4 datagram is already a new protocol, the networking equivalent of Godwin’s law[1].