Problem
A full npm audit reports low-severity GHSA-73rr-hh4g-fpgx in diff 7.0.0 through Mocha 11.7.6. The patched diff line starts at 8.0.3, while the current latest Mocha 11.7.6 still declares diff ^7.0.0; latest @vscode/test-cli 0.0.15 also remains on Mocha 11.7.6.
npm audit fix proposes downgrading the direct test stack, and forcing the next diff major would bypass Mocha’s declared range, so neither is an appropriate automatic fix.
Acceptance criteria
- Update Mocha /
@vscode/test-cli after an upstream release accepts diff >= 8.0.3, or after upstream explicitly confirms major compatibility.
- Do not use a blind transitive override.
- Run
npm ci, build, typecheck, unit tests, and integration-test compilation.
- Full
npm audit no longer reports GHSA-73rr-hh4g-fpgx.
Problem
A full
npm auditreports low-severity GHSA-73rr-hh4g-fpgx indiff7.0.0 through Mocha 11.7.6. The patcheddiffline starts at 8.0.3, while the current latest Mocha 11.7.6 still declaresdiff ^7.0.0; latest@vscode/test-cli0.0.15 also remains on Mocha 11.7.6.npm audit fixproposes downgrading the direct test stack, and forcing the nextdiffmajor would bypass Mocha’s declared range, so neither is an appropriate automatic fix.Acceptance criteria
@vscode/test-cliafter an upstream release acceptsdiff >= 8.0.3, or after upstream explicitly confirms major compatibility.npm ci, build, typecheck, unit tests, and integration-test compilation.npm auditno longer reports GHSA-73rr-hh4g-fpgx.