Skip to content

build(deps): bump diff, @npmcli/template-oss, tap and tcompare - #58

Open
dependabot[bot] wants to merge 1 commit into
latestfrom
dependabot/npm_and_yarn/multi-03767618a8
Open

build(deps): bump diff, @npmcli/template-oss, tap and tcompare#58
dependabot[bot] wants to merge 1 commit into
latestfrom
dependabot/npm_and_yarn/multi-03767618a8

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 24, 2026

Copy link
Copy Markdown

Bumps diff, @npmcli/template-oss, tap and tcompare. These dependencies needed to be updated together.
Updates diff from 5.2.0 to 9.0.0

Changelog

Sourced from diff's changelog.

9.0.0

(All changes part of PR #672.)

  • ES5 support is dropped. parsePatch now uses TextDecoder and Uint8Array, which are not available in ES5, and TypeScript is now compiled with the "es6" target. From now on, I intend to freely use any features that are deemed "Widely available" by Baseline. Users who need ES5 support should stick to version 8.

  • C-style quoted strings in filename headers are now properly supported.

    When the name of either the old or new file in a patch contains "special characters", both GNU diff and Git quote the filename in the patch's headers and escape special characters using the same escape sequences that are used in string literals in C, including octal escapes for all non-ASCII characters. Previously, jsdiff had very little support for this; parsePatch would remove the quotes, and unescape any escaped backslashes, but would not unescape other escape sequences. formatPatch, meanwhile, did not quote or escape special characters at all.

    Now, parsePatch parses all the possible escape sequences that GNU diff (or Git) ever output, and formatPatch quotes and escapes filenames containing special characters in the same way GNU diff does.

  • formatPatch now omits file headers when oldFileName or newFileName in the provided patch object are undefined, regardless of the headerOptions parameter. (Previously, it would treat the absence of oldFileName or newFileName as indicating the filename was the word "undefined" and emit headers --- undefined / +++ undefined.)

  • formatPatch no longer outputs trailing tab characters at the end of ---/+++ headers.

    Previously, if formatPatch was passed a patch object to serialize that had empty strings for the oldHeader or newHeader property, it would include a trailing tab character after the filename in the --- and/or +++ file header. Now, this scenario is treated the same as when oldHeader/newHeader is undefined - i.e. the trailing tab is omitted.

  • formatPatch no longer mutates its input when serializing a patch containing a hunk where either the old or new content contained zero lines. (Such a hunk occurs only when the hunk has no context lines and represents a pure insertion or pure deletion, which for instance will occur whenever one of the two files being diffed is completely empty.) Previously formatPatch would provide the correct output but also mutate the oldLines or newLines property on the hunk, changing the meaning of the underlying patch.

  • Git-style patches are now supported by parsePatch, formatPatch, and reversePatch.

    Patches output by git diff can include some features that are unlike those output by GNU diff, and therefore not handled by an ordinary unified diff format parser. An ordinary diff simply describes the differences between the content of two files, but Git diffs can also indicate, via "extended headers", the creation or deletion of (potentially empty) files, indicate that a file was renamed, and contain information about file mode changes. Furthermore, when these changes appear in a diff in the absence of a content change (e.g. when an empty file is created, or a file is renamed without content changes), the patch will contain no associated ---/+++ file headers nor any hunks.

    jsdiff previously did not support parsing Git's extended headers, nor hunkless patches. Now parsePatch parses some of the extended headers, parses hunkless Git patches, and can determine filenames (e.g. from the extended headers) when parsing a patch that includes no --- or +++ file headers. The additional information conveyed by the extended headers we support is recorded on new fields on the result object returned by parsePatch. See isGit and subsequent properties in the docs in the README.md file.

    formatPatch now outputs extended headers based on these new Git-specific properties, and reversePatch respects them as far as possible (with one unavoidable caveat noted in the README.md file).

  • Unpaired file headers now cause parsePatch to throw.

    It remains acceptable to have a patch with no file headers whatsoever (e.g. one that begins with a @@ hunk header on the very first line), but a patch with only a --- header or only a +++ header is now considered an error.

  • parsePatch is now more tolerant of "trailing garbage"

    That is: after a patch, or between files/indexes in a patch, it is now acceptable to have arbitrary lines of "garbage" (so long as they unambiguously have no syntactic meaning - e.g. trailing garbage that leads with a +, -, or and thus is interpretable as part of a hunk still triggers a throw).

    This means we no longer reject patches output by tools that include extra data in "garbage" lines not understood by generic unified diff parsers. (For example, SVN patches can include "Property changes on:" lines that generic unified diff parsers should discard as garbage; jsdiff previously threw errors when encountering them.)

    This change brings jsdiff's behaviour more in line with GNU patch, which is highly permissive of "garbage".

  • The oldFileName and newFileName fields of StructuredPatch are now typed as string | undefined instead of string. This type change reflects the (pre-existing) reality that parsePatch can produce patches without filenames (e.g. when parsing a patch that simply contains hunks with no file headers).

8.0.4

  • #667 - fix another bug in diffWords when used with an Intl.Segmenter. If the text to be diffed included a combining mark after a whitespace character (i.e. roughly speaking, an accented space), diffWords would previously crash. Now this case is handled correctly.

8.0.3

  • #631 - fix support for using an Intl.Segmenter with diffWords. This has been almost completely broken since the feature was added in v6.0.0, since it would outright crash on any text that featured two consecutive newlines between a pair of words (a very common case).
  • #635 - small tweaks to tokenization behaviour of diffWords when used without an Intl.Segmenter. Specifically, the soft hyphen (U+00AD) is no longer considered to be a word break, and the multiplication and division signs (× and ÷) are now treated as punctuation instead of as letters / word characters.

... (truncated)

Commits

Updates @npmcli/template-oss from 4.22.0 to 4.30.0

Release notes

Sourced from @​npmcli/template-oss's releases.

v4.30.0

4.30.0 (2026-03-19)

Features

v4.29.0

4.29.0 (2026-01-15)

Features

Dependencies

v4.28.1

4.28.1 (2025-11-21)

Dependencies

Chores

v4.28.0

4.28.0 (2025-10-29)

Features

v4.27.1

4.27.1 (2025-10-20)

Bug Fixes

v4.27.0

4.27.0 (2025-10-20)

Features

v4.26.1

4.26.1 (2025-10-20)

Bug Fixes

v4.26.0

4.26.0 (2025-10-16)

Features

... (truncated)

Changelog

Sourced from @​npmcli/template-oss's changelog.

4.30.0 (2026-03-19)

Features

4.29.0 (2026-01-15)

Features

Dependencies

4.28.1 (2025-11-21)

Dependencies

Chores

4.28.0 (2025-10-29)

Features

4.27.1 (2025-10-20)

Bug Fixes

4.27.0 (2025-10-20)

Features

4.26.1 (2025-10-20)

Bug Fixes

4.26.0 (2025-10-16)

Features

4.25.1 (2025-09-18)

Bug Fixes

Dependencies

... (truncated)

Commits
  • afcb3c1 chore: release 4.30.0 (#554)
  • 6bc2bc0 feat: filters items out of the release process that aren't for backports (#553)
  • 08b30f8 chore: release 4.29.0 (#550)
  • 040af67 feat: move node14 tests to macos-15-intel (#551)
  • ed24fbf deps: bump @​actions/core from 1.11.1 to 2.0.0 (#549)
  • fc3fc00 chore: release 4.28.1 (#547)
  • 06ab9b5 deps: bump ini from 5.0.0 to 6.0.0 (#546)
  • d0dc345 deps: bump @​commitlint/cli from 19.8.1 to 20.1.0 (#541)
  • 0c603c7 deps: bump proc-log from 5.0.0 to 6.0.0 (#544)
  • 1137f1b deps: bump @​commitlint/config-conventional from 19.8.1 to 20.0.0 (#540)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​npmcli/template-oss since your current version.


Updates tap from 16.3.10 to 21.7.4

Release notes

Sourced from tap's releases.

tap@21.7.4

No release notes provided.

tap@21.7.2

No release notes provided.

tap@21.6.3

No release notes provided.

tap@21.6.2

No release notes provided.

tap@21.6.1

No release notes provided.

tap@21.6.0

No release notes provided.

tap@21.5.1

No release notes provided.

tap@21.5.0

No release notes provided.

tap@21.3.0

No release notes provided.

tap@21.2.0

No release notes provided.

tap@21.1.6

No release notes provided.

tap@21.1.5

No release notes provided.

tap@21.1.3

No release notes provided.

tap@21.1.2

No release notes provided.

tap@21.1.0

No release notes provided.

tap@21.0.2

No release notes provided.

tap@21.0.1

No release notes provided.

... (truncated)

Commits
  • 9b0010e update versions
  • 5dd46c9 @​tapjs/processinfo@​3.1.12
  • 9bf9c46 try second time to remove local tags when pub fails
  • 0ab7f3c update versions
  • 79acbfa changelog for 21.7 patch
  • 49c7eec fix node 26 ts warnings by ignoring them
  • ce51daf update processinfo to use module.registerHooks
  • e793776 update versions
  • 8c5675c update processinfo to fix uuid advisory
  • c96e8e1 fix homepage links in package.json
  • Additional commits viewable in compare view
Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates tcompare from 5.0.7 to 9.3.2

Commits
  • e793776 update versions
  • 8c5675c update processinfo to fix uuid advisory
  • c96e8e1 fix homepage links in package.json
  • 0bbfca3 update versions
  • f272a15 Avoid shell execution for child processes in npm and reporter logic
  • 7ed5c83 run: make shuffle test slightly less nondeterministic
  • 60ad480 stack: ignore the 'async' marker on stack trace lines
  • 7e8f59b Fix formatting for JSON output paths in documentation.
  • 5a7a801 update versions
  • 0109318 changelog 21.7
  • Additional commits viewable in compare view
Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
build(deps): bump diff, @npmcli/template-oss, tap and tcompare
7a54834 
Bumps [diff](https://github.com/kpdecker/jsdiff), [@npmcli/template-oss](https://github.com/npm/template-oss), [tap](https://github.com/tapjs/tapjs) and [tcompare](https://github.com/tapjs/tapjs). These dependencies needed to be updated together.

Updates `diff` from 5.2.0 to 9.0.0
- [Changelog](https://github.com/kpdecker/jsdiff/blob/master/release-notes.md)
- [Commits](kpdecker/jsdiff@v5.2.0...v9.0.0)

Updates `@npmcli/template-oss` from 4.22.0 to 4.30.0
- [Release notes](https://github.com/npm/template-oss/releases)
- [Changelog](https://github.com/npm/template-oss/blob/main/CHANGELOG.md)
- [Commits](npm/template-oss@v4.22.0...v4.30.0)

Updates `tap` from 16.3.10 to 21.7.4
- [Release notes](https://github.com/tapjs/tapjs/releases)
- [Commits](https://github.com/tapjs/tapjs/compare/v16.3.10...tap@21.7.4)

Updates `tcompare` from 5.0.7 to 9.3.2
- [Release notes](https://github.com/tapjs/tapjs/releases)
- [Commits](https://github.com/tapjs/tapjs/compare/v5.0.7...tcompare@9.3.2)

---
updated-dependencies:
- dependency-name: diff
  dependency-version: 9.0.0
  dependency-type: direct:production
- dependency-name: "@npmcli/template-oss"
  dependency-version: 4.30.0
  dependency-type: direct:development
- dependency-name: tap
  dependency-version: 21.7.4
  dependency-type: direct:development
- dependency-name: tcompare
  dependency-version: 9.3.2
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 24, 2026
@snyk-io

snyk-io Bot commented Jul 24, 2026

Copy link
Copy Markdown

✅ Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
✅ Open Source Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants