diff@7.0.0 has DoS advisory in parsePatch/applyPatch (GHSA-73rr-hh4g-fpgx) #1588

Summary

npm audit on the current package.json reports a low-severity DoS in diff@7.0.0:

• GHSA-73rr-hh4g-fpgx — jsdiff DoS in parsePatch and applyPatch on crafted patch input.

Affected range: 6.0.0 - 8.0.2. Fixed in diff@9.0.0 (breaking change).

Reproduction

cd ~/.claude/skills/gstack
npm i --package-lock-only --ignore-scripts
npm audit

diff  6.0.0 - 8.0.2
jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch
1 low severity vulnerability

Impact

Low practical risk — gstack uses diff against local content the user controls, not untrusted input. But it surfaces on every npm audit against gstack and blocks clean supply-chain audits for users who vendor gstack into their projects.

Suggested fix

Bump to diff@^9.0.0. The breaking change is mostly around ESM/CJS exports and a few renamed APIs — worth checking call sites in browse/ for any parsePatch/applyPatch/createPatch usage.

Reported via Claude Code during a supply-chain audit of installed skills — signatures all verified clean, no compromise, just this one CVE.