[alexleventer]

Fixes #145.

Problem

@flydotio/dockerfile depends on diff@^7.0.0, which is affected by CVE-2026-24001, a DoS in parsePatch/applyPatch (patched in 8.0.3). This package only calls Diff.createPatch (gdf.js, to show conflicts), so it isn't exploitable here, but npm audit and other scanners flag every install.

Change

• Bump diff to ^8.0.4.
• Update mocha's nested copy of diff from 5.2.0 to 5.2.2 (the patched 5.x) in package-lock.json. It's a dev dependency, but scanners flag it too.

The lockfile also picks up its stale root version catching up to package.json (0.7.8 → 0.7.11).

diff 8 is still dual ESM/CJS with no Node engine bump (>=0.3.1), so the existing import * as Diff from 'diff' works unchanged.

Testing

• npm audit no longer reports diff.
• createPatch gives the same unified diff output on 8.0.4.
• eslint clean. npm test: 126 passing, 3 failing (bun base/cache-bun, svelte-bun), the same 3 that fail on main without bun installed.

🤖 Generated with Claude Code