From c384728f9834aa209745dad05510f4c9fa3b147e Mon Sep 17 00:00:00 2001 From: genisis0x Date: Tue, 19 May 2026 13:34:31 +0530 Subject: [PATCH] fix(deps): bump diff to ^9.0.0 to clear GHSA-73rr-hh4g-fpgx (#1588) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `npm audit` flags diff@7.0.0 with a low-severity DoS in parsePatch/applyPatch (GHSA-73rr-hh4g-fpgx, affected 6.0.0–8.0.2, fixed in 9.0.0). gstack uses diff against local content the user controls so practical risk is low, but the advisory surfaces on every audit pass and blocks clean supply-chain runs for users vendoring gstack. The 9.0.0 breaking changes only touch parsePatch / applyPatch / createPatch and the ESM/CJS exports. Both call sites in this repo (browse/src/snapshot.ts:568, browse/src/meta-commands.ts:712) use `Diff.diffLines`, whose signature and return shape are unchanged in v9, so this is a no-op at runtime. --- bun.lock | 4 ++-- package.json | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/bun.lock b/bun.lock index 7a1833e94..9ce828214 100644 --- a/bun.lock +++ b/bun.lock @@ -7,7 +7,7 @@ "dependencies": { "@huggingface/transformers": "^4.1.0", "@ngrok/ngrok": "^1.7.0", - "diff": "^7.0.0", + "diff": "^9.0.0", "html-to-docx": "1.8.0", "marked": "^18.0.2", "playwright": "^1.58.2", @@ -259,7 +259,7 @@ "devtools-protocol": ["devtools-protocol@0.0.1581282", "", {}, "sha512-nv7iKtNZQshSW2hKzYNr46nM/Cfh5SEvE2oV0/SEGgc9XupIY5ggf84Cz8eJIkBce7S3bmTAauFD6aysMpnqsQ=="], - "diff": ["diff@7.0.0", "", {}, "sha512-PJWHUb1RFevKCwaFA9RlG5tCd+FO5iRh9A8HEtkmBH2Li03iJriB6m6JIN4rGz3K3JLawI7/veA1xzRKP6ISBw=="], + "diff": ["diff@9.0.0", "", {}, "sha512-svtcdpS8CgJyqAjEQIXdb3OjhFVVYjzGAPO8WGCmRbrml64SPw/jJD4GoE98aR7r25A0XcgrK3F02yw9R/vhQw=="], "dom-serializer": ["dom-serializer@0.2.2", "", { "dependencies": { "domelementtype": "^2.0.1", "entities": "^2.0.0" } }, "sha512-2/xPb3ORsQ42nHYiSunXkDjPLBaEj/xTwUO4B7XCZQTRk7EBtTOPaygh10YAAh2OI1Qrp6NWfpAhzswj0ydt9g=="], diff --git a/package.json b/package.json index c5168d648..c9889c0de 100644 --- a/package.json +++ b/package.json @@ -51,7 +51,7 @@ "dependencies": { "@huggingface/transformers": "^4.1.0", "@ngrok/ngrok": "^1.7.0", - "diff": "^7.0.0", + "diff": "^9.0.0", "html-to-docx": "1.8.0", "marked": "^18.0.2", "playwright": "^1.58.2",