From c384728f9834aa209745dad05510f4c9fa3b147e Mon Sep 17 00:00:00 2001 From: genisis0x Date: Tue, 19 May 2026 13:34:31 +0530 Subject: [PATCH 1/2] fix(deps): bump diff to ^9.0.0 to clear GHSA-73rr-hh4g-fpgx (#1588) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `npm audit` flags diff@7.0.0 with a low-severity DoS in parsePatch/applyPatch (GHSA-73rr-hh4g-fpgx, affected 6.0.0–8.0.2, fixed in 9.0.0). gstack uses diff against local content the user controls so practical risk is low, but the advisory surfaces on every audit pass and blocks clean supply-chain runs for users vendoring gstack. The 9.0.0 breaking changes only touch parsePatch / applyPatch / createPatch and the ESM/CJS exports. Both call sites in this repo (browse/src/snapshot.ts:568, browse/src/meta-commands.ts:712) use `Diff.diffLines`, whose signature and return shape are unchanged in v9, so this is a no-op at runtime. --- bun.lock | 4 ++-- package.json | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/bun.lock b/bun.lock index 7a1833e94..9ce828214 100644 --- a/bun.lock +++ b/bun.lock @@ -7,7 +7,7 @@ "dependencies": { "@huggingface/transformers": "^4.1.0", "@ngrok/ngrok": "^1.7.0", - "diff": "^7.0.0", + "diff": "^9.0.0", "html-to-docx": "1.8.0", "marked": "^18.0.2", "playwright": "^1.58.2", @@ -259,7 +259,7 @@ "devtools-protocol": ["devtools-protocol@0.0.1581282", "", {}, "sha512-nv7iKtNZQshSW2hKzYNr46nM/Cfh5SEvE2oV0/SEGgc9XupIY5ggf84Cz8eJIkBce7S3bmTAauFD6aysMpnqsQ=="], - "diff": ["diff@7.0.0", "", {}, "sha512-PJWHUb1RFevKCwaFA9RlG5tCd+FO5iRh9A8HEtkmBH2Li03iJriB6m6JIN4rGz3K3JLawI7/veA1xzRKP6ISBw=="], + "diff": ["diff@9.0.0", "", {}, "sha512-svtcdpS8CgJyqAjEQIXdb3OjhFVVYjzGAPO8WGCmRbrml64SPw/jJD4GoE98aR7r25A0XcgrK3F02yw9R/vhQw=="], "dom-serializer": ["dom-serializer@0.2.2", "", { "dependencies": { "domelementtype": "^2.0.1", "entities": "^2.0.0" } }, "sha512-2/xPb3ORsQ42nHYiSunXkDjPLBaEj/xTwUO4B7XCZQTRk7EBtTOPaygh10YAAh2OI1Qrp6NWfpAhzswj0ydt9g=="], diff --git a/package.json b/package.json index c5168d648..c9889c0de 100644 --- a/package.json +++ b/package.json @@ -51,7 +51,7 @@ "dependencies": { "@huggingface/transformers": "^4.1.0", "@ngrok/ngrok": "^1.7.0", - "diff": "^7.0.0", + "diff": "^9.0.0", "html-to-docx": "1.8.0", "marked": "^18.0.2", "playwright": "^1.58.2", From 662f515c2dc3cb801900846dd1cbc47a6fab57c3 Mon Sep 17 00:00:00 2001 From: genisis0x Date: Thu, 18 Jun 2026 12:31:29 +0530 Subject: [PATCH 2/2] chore(version): claim free queue slot 1.60.2.0 to clear stale version-gate --- VERSION | 2 +- package.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/VERSION b/VERSION index c4190e004..762f17554 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -1.60.1.0 +1.60.2.0 diff --git a/package.json b/package.json index c9889c0de..e6aa2f2a4 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "gstack", - "version": "1.60.1.0", + "version": "1.60.2.0", "description": "Garry's Stack — Claude Code skills + fast headless browser. One repo, one install, entire AI engineering workflow.", "license": "MIT", "type": "module",