[Docs Site] Bump cidr-tools from 12.1.2 to 13.0.1

[dependabot]

Bumps cidr-tools from 12.1.2 to 13.0.1.

Release notes

Sourced from cidr-tools's releases.

13.0.1

Re-published because off issue on last publish.

13.0.0

Breaking

Addded network input validation, enabled by default. Will throw an error if any of the inputs does not pass cidr-regex validation.

Has around 30-100% performance impact. Pass {validate: false} as the trailing argument to any function to restore the previous lenient parsing.

mergeCidr(networks, {validate: false});
containsCidr(a, b, {validate: false});
normalizeCidr(network, {validate: false});

Commits

• Validate networks instead of returning a wrong one (silverwind)
• speed up IPv4 parsing and IPv6 normalization (silverwind)
• rework benchmark to survive dead code elimination (silverwind)
• update ip-bigint to 9.0.8 (silverwind)
• remove obsolete registry-url from workflows (silverwind)
• Disable pnpm's dependency check before script runs (silverwind)

12.1.3

• simplify v4 masking and range handling (silverwind)
• update ip-bigint to 9.0.7 (silverwind)
• update deps (silverwind)
• Set confirmModulesPurge to false (silverwind)

Commits

• 2f6d39a 13.0.1
• 051cd69 Cover the reported rejection cases in tests
• ec6f838 13.0.0
• 86aeac8 Validate networks instead of returning a wrong one
• 23297c9 speed up IPv4 parsing and IPv6 normalization
• f2e7f6c rework benchmark to survive dead code elimination
• 7b6aa56 update ip-bigint to 9.0.8
• 21ce2c0 remove obsolete registry-url from workflows
• 23eda0f Disable pnpm's dependency check before script runs
• a3b61d0 12.1.3
• Additional commits viewable in compare view

[cloudflare-docs-bot]

Dependabot review

Package	Impact	Recommendation
cidr-tools 12.1.2 → 13.0.1	🟠 Medium	⚠️ Verify

Overall: ✅ Merge + spot-check

cidr-tools 13.0.1 introduces a breaking change: network input validation (via cidr-regex) is now enabled by default, and invalid inputs throw instead of being parsed leniently. The repo's only usage is SubtractIPCalculator.tsx, a visitor-facing client-side React island that calls parseCidr (already wrapped in try/catch) and excludeCidr (only invoked after all inputs pass validation), so the new throw behavior degrades gracefully to a disabled button/empty results rather than crashing. All hardcoded MDX defaults are valid network CIDRs; the only residual risk is stricter acceptance affecting calculator output on pages with dynamic props (cloud-private-ip.mdx partial). Recommend merging after a quick spot-check of the calculator pages.

Package details

cidr-tools: 12.1.2 → 13.0.1

Type: breaking change
Dependency type: direct (devDependencies)

What changed

• Network input validation enabled by default in 13.0.0: any input failing cidr-regex validation now throws instead of being parsed leniently; {validate: false} restores prior behavior.
• ~30-100% performance impact on parsing functions (negligible for an interactive calculator).
• Internal deps changed: ip-bigint 9.0.6 -> 10.0.1 and new dependency cidr-regex@7.1.0.
• 13.0.1 re-publish adds test coverage for reported over-rejection edge cases.
• 12.1.3 simplified IPv4 masking and range handling (behavior fix).

Usage in this repo
Imported in src/components/react/SubtractIPCalculator.tsx (excludeCidr, parseCidr), rendered as a client:load React island on reserved-ips.mdx, split-tunnel partials, and cloud-private-ip.mdx (which passes dynamic props.splitTunnelCidr / props.calcExclude). parseCidr is called inside try/catch via isValidCidr, and excludeCidr is only called when every input passes isValidCidr.

Impact: 🟠 Medium — The changed API (throw on invalid input) is fully guarded by the component's existing try/catch, so the worst case is a disabled button or empty results — no crash. Hardcoded defaults are valid CIDRs, but the stricter validation can change calculator output for previously leniently-accepted inputs (especially the dynamic props on cloud-private-ip.mdx), so a manual spot-check of the calculator pages is warranted.

---

[github-actions]

This pull request requires reviews from CODEOWNERS as it changes files that match the following patterns:

Pattern	Owners
package.json	@cloudflare/content-engineering
*	@cloudflare/product-owners

[cloudflare-workers-and-pages]

🚀 Deploying Preview to Cloudflare 🚀

Preview URL: https://dependabot-npm-and-yarn-cidr-tools-13-0-1.previews.developers.cloudflare.com (commit 64c6f12)

This URL reflects your latest Preview deployment

Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://def8926f.previews.developers.cloudflare.com	64c6f12	2026-09-08T13:05:13.853Z	Visit the dashboard ↗
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://3922d31c.previews.developers.cloudflare.com	17a4102	2026-09-07T15:13:07.491Z	Visit the dashboard ↗
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://cc076f17.previews.developers.cloudflare.com	72dd9fb	2026-08-25T20:31:11.911Z	Visit the dashboard ↗

[github-actions]

Preview URL: https://64c6f127.preview.developers.cloudflare.com
Preview Branch URL: https://dependabot-npm-and-yarn-cidr-tools-13-0-1.preview.developers.cloudflare.com