Update diff dependency to fix GHSA-73rr-hh4g-fpgx DoS vulnerability by Copilot · Pull Request #1900 · textlint/textlint

Copilot · 2026-01-19T09:21:19Z

The diff package versions prior to 8.0.3 contain a DoS vulnerability (GHSA-73rr-hh4g-fpgx) where parsePatch and applyPatch can enter infinite loops or exhibit O(n³) performance when parsing patches with malformed filename headers containing line break characters.

Changes

Updated diff from ^5.2.0 to ^8.0.3 in @textlint/fixer-formatter
Removed @types/diff dependency (diff 8.x includes native TypeScript types)

The package uses only diffLines from the diff API, which remains compatible across versions.

Original prompt

This section details on the original issue you should resolve

<issue_title>Vulnerable diff dependency in @textlint/fixer-formatter</issue_title>
<issue_description>Hi,
thanks for supporting textlint :)

By running npm audit after installing the latest textlint version (15.5.0), it appears that it installs a vulnerable version of diff:
# npm audit report

diff  <8.0.3
jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch - https://github.com/advisories/GHSA-73rr-hh4g-fpgx
fix available via `npm audit fix --force`
Will install renovate@31.13.3, which is a breaking change
node_modules/diff
  @textlint/fixer-formatter  *
  Depends on vulnerable versions of diff
  node_modules/@textlint/fixer-formatter
    textlint  >=10.1.3
    Depends on vulnerable versions of @textlint/fixer-formatter
    node_modules/textlin
Updating using npm audit fix is not possible because of the dependency constraints:

textlint/packages/@textlint/fixer-formatter/package.json

Lines 41 to 51 in baa7d35

"dependencies": {

"@textlint/module-interop": "workspace:*",

"@textlint/resolver": "workspace:*",

"@textlint/types": "workspace:*",

"chalk": "^4.1.2",

"debug": "^4.4.3",

"diff": "^5.2.0",

"string-width": "^4.2.3",

"strip-ansi": "^6.0.1",

"text-table": "^0.2.0"

},

Would it be possible to release a new version that uses diff >= 8.0.3, that according to GHSA-73rr-hh4g-fpgx, mitigates the vulnerability?

thanks!</issue_description>

<agent_instructions>Update diff and fix this issue and pass test</agent_instructions>

Comments on the Issue (you are @copilot in this section)

Fixes Vulnerable diff dependency in @textlint/fixer-formatter #1899

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

…ility Co-authored-by: azu <19714+azu@users.noreply.github.com>

Co-authored-by: azu <19714+azu@users.noreply.github.com>

azu · 2026-01-19T09:38:05Z

@copilot tell me summary of diff changelogs

azu · 2026-01-19T09:39:26Z

https://github.com/kpdecker/jsdiff/blob/master/release-notes.md

Copilot · 2026-01-19T09:39:43Z

@copilot tell me summary of diff changelogs

Here's a summary of diff changelogs from v5.2.0 to v8.0.3:

Major Changes by Version

v6.0.0 (Breaking changes):

diffWords: Radically changed to no longer treat whitespace as tokens by default, providing more intuitive diffing
diffChars: Now diffs Unicode code points instead of UTF-16 code units
parsePatch: Always runs in strict mode (previously optional)
Change objects now guarantee added/removed properties are booleans
TypeScript type definitions officially added
Deprecated diffTrimmedLines (use diffLines with ignoreWhitespace: true)

v7.0.0 (Breaking):

Fixed diffWords regression: numbers and underscores treated as word characters again

v8.0.0 (Breaking):

Rewritten in TypeScript - now includes built-in type definitions (no need for @types/diff)
Diff is now a class (can extend via class CustomDiff extends Diff)
Removed undocumented merge function
Multiple ReDOS fixes in diffSentences and diffWords
ESM support added alongside CommonJS

v8.0.3 (Security fix):

Fixed DoS vulnerabilities in parsePatch (GHSA-73rr-hh4g-fpgx) - infinite loop and cubic-time ReDOS attacks now prevented

Impact on textlint

The package only uses diffLines which remains backward compatible. The main benefit is the security fix and built-in TypeScript types (removing the need for @types/diff).

Copilot

Pull request overview

This pull request updates the diff dependency from version ^5.2.0 to ^8.0.3 in the @textlint/fixer-formatter package to address a Denial of Service (DoS) vulnerability (GHSA-73rr-hh4g-fpgx). The vulnerability affects versions prior to 8.0.3, where parsePatch and applyPatch functions can enter infinite loops or exhibit O(n³) performance with malformed filename headers.

Changes:

Updated diff dependency from ^5.2.0 to ^8.0.3 in @textlint/fixer-formatter
Removed @types/diff dependency as diff 8.x includes native TypeScript types

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
packages/@textlint/fixer-formatter/package.json	Updated diff to ^8.0.3 and removed @types/diff from devDependencies
pnpm-lock.yaml	Updated lockfile to reflect new diff version (8.0.3) and removed @types/diff references

Files not reviewed (1)

pnpm-lock.yaml: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

azu

lgtm

@azu

## What's Changed ### Documentation * docs: add GitHub formatter documentation by @azu in #1857 * Update CLI documentation for lint error handling by @thompson-tomo in #1861 ### CI * chore(deps): update github/codeql-action action to v3.31.6 by @renovate[bot] in #1860 * chore(deps): update peter-evans/create-pull-request action to v7.0.11 by @renovate[bot] in #1865 * chore(deps): update github/codeql-action action to v3.31.7 by @renovate[bot] in #1870 * chore(deps): update github/codeql-action action to v3.31.8 by @renovate[bot] in #1876 * chore(deps): update github/codeql-action action to v3.31.9 by @renovate[bot] in #1879 * chore(deps): update rossjrw/pr-preview-action action to v1.7.0 by @renovate[bot] in #1882 * chore(deps): update rossjrw/pr-preview-action action to v1.7.1 by @renovate[bot] in #1885 * chore(deps): update rossjrw/pr-preview-action action to v1.7.2 by @renovate[bot] in #1886 * chore(deps): update minor updates by @renovate[bot] in #1887 ### Dependency Updates * Update diff dependency to fix GHSA-73rr-hh4g-fpgx DoS vulnerability by @Copilot in #1900 * fix(deps): update dependency @modelcontextprotocol/sdk to ^1.24.3 by @renovate[bot] in #1859 * chore(deps): update eslint to ^8.49.0 (minor) by @renovate[bot] in #1862 * chore(deps): update pnpm to v10.25.0 by @renovate[bot] in #1863 * chore(deps): update dependency @types/node to ^24.10.2 by @renovate[bot] in #1864 * chore(deps): update dependency @types/node to ^24.10.3 by @renovate[bot] in #1866 * fix(deps): update react monorepo to ^19.2.3 (patch) by @renovate[bot] in #1867 * chore(deps): update dependency @types/shelljs to ^0.10.0 by @renovate[bot] in #1868 * chore(deps): update dependency @eslint/js to ^9.39.2 by @renovate[bot] in #1869 * chore(deps): update dependency @types/node to ^24.10.4 by @renovate[bot] in #1871 * chore(deps): update pnpm to v10.26.0 by @renovate[bot] in #1872 * chore(deps): update eslint to ^8.50.0 (minor) by @renovate[bot] in #1874 * fix(deps): update dependency @modelcontextprotocol/sdk to ^1.25.0 by @renovate[bot] in #1875 * fix(deps): update dependency @modelcontextprotocol/sdk to ^1.25.1 by @renovate[bot] in #1877 * chore(deps): update pnpm to v10.26.1 by @renovate[bot] in #1878 * chore(deps): update eslint to ^8.50.1 (patch) by @renovate[bot] in #1880 * chore(deps): update pnpm to v10.26.2 by @renovate[bot] in #1881 * chore(deps): update eslint to ^8.51.0 (minor) by @renovate[bot] in #1883 * chore(deps): update pnpm to v10.27.0 by @renovate[bot] in #1884 * chore(deps): update eslint to ^8.52.0 (minor) by @renovate[bot] in #1888 * fix(deps): update dependency @modelcontextprotocol/sdk to ^1.25.2 by @renovate[bot] in #1889 * chore(deps): update pnpm to v10.28.0 by @renovate[bot] in #1890 * chore(deps): update patch updates (patch) by @renovate[bot] in #1891 * chore(deps): update dependency @types/node to ^24.10.7 by @renovate[bot] in #1892 * fix(deps): update babel monorepo to ^7.28.6 (patch) by @renovate[bot] in #1893 * chore(deps): update eslint to ^8.53.0 (minor) by @renovate[bot] in #1894 * chore(deps): update dependency @types/node to ^24.10.8 by @renovate[bot] in #1895 * chore(deps): update dependency @types/node to ^24.10.9 by @renovate[bot] in #1897 **Full Changelog**: v15.5.0...v15.5.1 Co-authored-by: azu <azu@users.noreply.github.com>

Initial plan

86b4606

Copilot AI assigned Copilot and azu Jan 19, 2026

Copilot started work on behalf of azu January 19, 2026 09:21 View session

Copilot AI and others added 2 commits January 19, 2026 09:26

Update diff dependency from ^5.2.0 to ^8.0.3 to fix security vulnerab…

396a086

…ility Co-authored-by: azu <19714+azu@users.noreply.github.com>

Remove @types/diff as diff 8.x includes built-in TypeScript types

4ddd706

Co-authored-by: azu <19714+azu@users.noreply.github.com>

azu self-requested a review January 19, 2026 09:28

Copilot AI changed the title ~~[WIP] Fix vulnerable diff dependency in @textlint/fixer-formatter~~ Update diff dependency to fix GHSA-73rr-hh4g-fpgx DoS vulnerability Jan 19, 2026

Copilot finished work on behalf of azu January 19, 2026 09:31

azu marked this pull request as ready for review January 19, 2026 09:37

Copilot AI review requested due to automatic review settings January 19, 2026 09:37

Copilot started reviewing on behalf of azu January 19, 2026 09:37 View session

Copilot started work on behalf of azu January 19, 2026 09:38 View session

Copilot AI reviewed Jan 19, 2026

View reviewed changes

azu approved these changes Jan 19, 2026

View reviewed changes

Copilot AI requested a review from azu January 19, 2026 09:40

Copilot finished work on behalf of azu January 19, 2026 09:40

azu merged commit f06d997 into master Jan 19, 2026
30 checks passed

azu deleted the copilot/fix-vulnerable-diff-dependency branch January 19, 2026 09:40

github-actions Bot mentioned this pull request Jan 19, 2026

v15.5.1 #1901

Merged

azu added Type: Dependencies Dependency issues or Changes to dependency files Type: Security Vulnerability disclosure or Fixing security issue labels Jan 19, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Update diff dependency to fix GHSA-73rr-hh4g-fpgx DoS vulnerability#1900

Update diff dependency to fix GHSA-73rr-hh4g-fpgx DoS vulnerability#1900
azu merged 3 commits intomasterfrom
copilot/fix-vulnerable-diff-dependency

Copilot AI commented Jan 19, 2026 •

edited

Loading

Uh oh!

azu commented Jan 19, 2026

Uh oh!

azu commented Jan 19, 2026

Uh oh!

Copilot AI commented Jan 19, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

azu left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	"dependencies": {
	"@textlint/module-interop": "workspace:*",
	"@textlint/resolver": "workspace:*",
	"@textlint/types": "workspace:*",
	"chalk": "^4.1.2",
	"debug": "^4.4.3",
	"diff": "^5.2.0",
	"string-width": "^4.2.3",
	"strip-ansi": "^6.0.1",
	"text-table": "^0.2.0"
	},

Uh oh!

Conversation

Copilot AI commented Jan 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Comments on the Issue (you are @copilot in this section)

Uh oh!

azu commented Jan 19, 2026

Uh oh!

azu commented Jan 19, 2026

Uh oh!

Copilot AI commented Jan 19, 2026

Major Changes by Version

Impact on textlint

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

azu left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Jan 19, 2026 •

edited

Loading