Skip to content

security(deps): update the Mocha jsdiff chain when upstream permits #13

Description

@semantic-craft

Problem

A full npm audit reports low-severity GHSA-73rr-hh4g-fpgx in diff 7.0.0 through Mocha 11.7.6. The patched diff line starts at 8.0.3, while the current latest Mocha 11.7.6 still declares diff ^7.0.0; latest @vscode/test-cli 0.0.15 also remains on Mocha 11.7.6.

npm audit fix proposes downgrading the direct test stack, and forcing the next diff major would bypass Mocha’s declared range, so neither is an appropriate automatic fix.

Acceptance criteria

  • Update Mocha / @vscode/test-cli after an upstream release accepts diff >= 8.0.3, or after upstream explicitly confirms major compatibility.
  • Do not use a blind transitive override.
  • Run npm ci, build, typecheck, unit tests, and integration-test compilation.
  • Full npm audit no longer reports GHSA-73rr-hh4g-fpgx.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions