Visitar URL original
Comparing v10.2.1...v10.2.2 路 beaugunderson/ip-address 路 GitHub
Skip to content
Permalink

Comparing changes

Choose two branches to see what鈥檚 changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: beaugunderson/ip-address
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: v10.2.1
Choose a base ref
...
head repository: beaugunderson/ip-address
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: v10.2.2
Choose a head ref
  • 2 commits
  • 8 files changed
  • 1 contributor

Commits on Jul 25, 2026

  1. Merge commit from fork 

    Every special-use classifier was built on isInSubnet, which short-circuits to
false when the receiver's prefix is shorter than the reference range's. That
prefix comes from the CIDR suffix on the parsed input, so a suffix such as /0
suppressed classification entirely: isLoopback, isPrivate, isLinkLocal,
isCGNAT, isMulticast, isUnspecified, isBroadcast, isULA, isMapped4, isTeredo,
is6to4, isDocumentation and getType all reported internal addresses as
unremarkable while correctForm() still returned the real target. Guards built
on these checks to block SSRF could be bypassed with '127.0.0.1/0'.

The suffix also defeated the IPv4-mapped/NAT64 normalization added in 10.2.1
for GHSA-22jq-vg5j-6vgg, since that path is reached through isInSubnet:
'::ffff:127.0.0.1/0' reverted to reading as non-internal.

Split the two questions apart. isHostInSubnet compares the address's host bits
against the reference range only and backs every classifier; isInSubnet keeps
its subnet-containment semantics, including the guard that a wider network is
not contained in a narrower one, so '10.0.0.0/8' is still not in '10.0.0.0/16'.

Tests assert suffix-independent classification across every prefix length for
both families, that public addresses are not newly misclassified, and that
containment still rejects wider networks.
    @beaugunderson
    beaugunderson authored Jul 25, 2026
    Configuration menu
    Copy the full SHA
    488fe9b View commit details
    Browse the repository at this point in the history

  2. 10.2.2

    @beaugunderson
    beaugunderson committed Jul 25, 2026
    Configuration menu
    Copy the full SHA
    f7314db View commit details
    Browse the repository at this point in the history
Loading