The Cloudflare ips-v4/v6.txt and paloalto/.gitkeep were git-tracked. The Cloudflare files are overwritten at runtime by every whitelist refresh, so on a deployed server they become locally-modified tracked files that make 'git pull' conflict. Keep the read-only paloalto/scanner-ips.txt seed tracked; ignore the rest (they are re-downloaded if absent; built-in ranges are the fallback).