v3.0.4

What's changed

• fix(NetworkList): includes() missed an address a supernet covered

Correctness fix: membership tests could return a false negative

Networks.includes() and NetworkList.includes() could answer false for an address that a stored network genuinely covers.

new Networks(['192.168.0.0/16', '10.0.0.0/8', '10.1.0.0/16'])
    .includes('10.9.9.9');   // false before this release — 10.0.0.0/8 covers it

Lookups binary-search the packed [start, end] records, which is only sound when the stored ranges are disjoint. Ranges were sorted and exact duplicates dropped, but overlapping ones were deliberately kept. A probe landing on a subnet nested inside an earlier supernet, with the target above that subnet's end, would move right and never revisit the supernet sitting at a lower index.

Three or more records are needed to surface it: with two, the first probe is index 0 and hits the supernet, so a two-entry list answered correctly. Both address families were affected.

Who was affected

Any list where one entry is a subnet of another — a natural thing to write in a hand-maintained allow-list. The failure was silent: no throw and no bad index, just a false where true was correct.

Users of @imqueue/http-protect should also read the v3.0.2 notes. Ban lists were never affected; safeNetworks exemptions were.

Behaviour changes

Overlapping ranges are now coalesced at construction, which is observable on overlapping input:

• NetworkList.length drops, because records merge. It stays correct as the binary-search bound — it is simply no longer the count of CIDR strings you passed in.
• toArray() / toJSON() return the minimal cover of the merged range, so a supernet plus its subnet round-trips as just the supernet. The addresses covered are identical; the record count is not.

Only overlap is merged, never mere adjacency: 11.0.0.0/8 and 12.0.0.0/8 stay two records, because the union of two adjacent prefixes need not be a prefix itself.

Full Changelog: v3.0.3...v3.0.4

About

@imqueue/net — Fast and reliable binary network address checker for node with IPv4 & IPv6 support. Part of the @imqueue framework for Node.js & TypeScript microservices.

• Docs: https://imqueue.org/
• Guide for AI assistants / LLMs: https://imqueue.org/llms.txt
• Commercial license & support: https://imqueue.com/
• npm i @imqueue/net