Skip to content

fix(deps): update dependency diff to v8.0.3 (spectrum-two)#4460

Open
renovate[bot] wants to merge 1 commit intospectrum-twofrom
renovate/spectrum-two-diff-8.x
Open

fix(deps): update dependency diff to v8.0.3 (spectrum-two)#4460
renovate[bot] wants to merge 1 commit intospectrum-twofrom
renovate/spectrum-two-diff-8.x

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Feb 11, 2026

This PR contains the following updates:

Package Change Age Confidence
diff 8.0.28.0.3 age confidence

Release Notes

kpdecker/jsdiff (diff)

v8.0.3

Compare Source

  • #​631 - fix support for using an Intl.Segmenter with diffWords. This has been almost completely broken since the feature was added in v6.0.0, since it would outright crash on any text that featured two consecutive newlines between a pair of words (a very common case).
  • #​635 - small tweaks to tokenization behaviour of diffWords when used without an Intl.Segmenter. Specifically, the soft hyphen (U+00AD) is no longer considered to be a word break, and the multiplication and division signs (× and ÷) are now treated as punctuation instead of as letters / word characters.
  • #​641 - the format of file headers in createPatch etc. patches can now be customised somewhat. It now takes a headerOptions option that can be used to disable the file headers entirely, or omit the Index: line and/or the underline. In particular, this was motivated by a request to make jsdiff patches compatible with react-diff-view, which they now are if produced with headerOptions: FILE_HEADERS_ONLY.
  • #​647 and #​649 - fix denial-of-service vulnerabilities in parsePatch whereby adversarial input could cause a memory-leaking infinite loop, typically crashing the calling process. Also fixed ReDOS vulnerabilities whereby adversarially-crafted patch headers could take cubic time to parse. Now, parsePatch should reliably take linear time. (Handling of headers that include the line break characters \r, \u2028, or \u2029 in non-trailing positions is also now more reasonable as side effect of the fix.)

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added dependencies Pull requests that update a dependency file ready-for-review skip_vrt Add to a PR to skip running VRT (but still pass the action) labels Feb 11, 2026
@renovate renovate bot requested a review from a team February 11, 2026 15:07
@github-actions
Copy link
Contributor

github-actions bot commented Feb 11, 2026

📚 Branch preview

PR #4460 has been deployed to Azure Blob Storage: https://spectrumcss.z13.web.core.windows.net/pr-4460/index.html.

@github-actions
Copy link
Contributor

File metrics

Summary

Total size: 1.41 MB*

🎉 No changes detected in any packages

* Size is the sum of all main files for packages in the library.
* An ASCII character in UTF-8 is 8 bits or 1 byte.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file ready-for-review skip_vrt Add to a PR to skip running VRT (but still pass the action)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants