From 2a6fd77c08f8a78d0acd3287454a9f68af6f3a8e Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Sun, 19 Jul 2026 05:51:11 -0700 Subject: [PATCH] fix(net-policy): restore ipaddr typing compatibility Repair main CI by preserving newer ipaddr range labels across merged declarations and narrowing CIDR match operands by address family. --- packages/net-policy/src/ip.ts | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/packages/net-policy/src/ip.ts b/packages/net-policy/src/ip.ts index 616d36691666..591429ecd67f 100644 --- a/packages/net-policy/src/ip.ts +++ b/packages/net-policy/src/ip.ts @@ -17,7 +17,9 @@ function normalizeLowercaseStringOrEmpty(value: unknown): string { export type ParsedIpAddress = ipaddr.IPv4 | ipaddr.IPv6; type Ipv4Range = ReturnType; type Ipv6Range = ReturnType; -type BlockedIpv6Range = Ipv6Range | "discard"; +// Older co-installed ipaddr.js declarations can merge with 2.4's ambient module and +// omit newer runtime ranges from ReturnType, so preserve the policy's known labels. +type BlockedIpv6Range = Ipv6Range | "benchmarking" | "discard" | "orchid2"; type Ipv6Hextets = readonly [number, number, number, number, number, number, number, number]; // ipaddr.js guarantees 8 hextets; throw loudly on an impossible shape instead of @@ -362,10 +364,13 @@ export function isIpInCidr(ip: string, cidr: string): boolean { try { const [baseAddress, prefixLength] = ipaddr.parseCIDR(candidate); const comparableBase = normalizeIpv4MappedAddress(baseAddress); - return ( - comparableIp.kind() === comparableBase.kind() && - comparableIp.match([comparableBase, prefixLength]) - ); + if (isIpv4Address(comparableIp) && isIpv4Address(comparableBase)) { + return comparableIp.match([comparableBase, prefixLength]); + } + if (isIpv6Address(comparableIp) && isIpv6Address(comparableBase)) { + return comparableIp.match([comparableBase, prefixLength]); + } + return false; } catch { return false; }