chore(deps): update dependency jsondiffpatch to ^0.7.0 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
jsondiffpatch	^0.4.1 → ^0.7.0

---

jsondiffpatch is vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin

CVE-2025-9910 / GHSA-33vc-wfww-vjfv

More information

Details

Vulnerability in jsondiffpatch

Versions of jsondiffpatch prior to 0.7.2 are vulnerable to Cross-site Scripting (XSS) in the HtmlFormatter (HtmlFormatter::nodeBegin). When diffs are rendered to HTML using the built-in formatter, untrusted payloads can inject scripts and execute in the context of a consuming web page.

Affected versions: >= 0, < 0.7.2
Patched version: 0.7.2

Remediation
Upgrade to jsondiffpatch 0.7.2 or later. The fix hardens the HTML formatter to avoid script injection.

Workarounds
Avoid using the HTML formatter on untrusted diffs, or sanitize/escape the rendered output.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-9910
• https://github.com/benjamine/jsondiffpatch/issues/383
• https://github.com/benjamine/jsondiffpatch/commit/0e374b5dd8d7879b329a9fc18affbd46ad50dd14
• https://benjamine.github.io/jsondiffpatch/index.html
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-12549277
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-12549276
• https://security.snyk.io/vuln/SNYK-JS-JSONDIFFPATCH-10369031
• https://github.com/advisories/GHSA-33vc-wfww-vjfv

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

jsondiffpatch patch APIs are vulnerable to prototype pollution

CVE-2026-8657 / GHSA-j4fx-xxwh-2485

More information

Details

Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Prototype Pollution via the jsondiffpatch.patch() and jsondiffpatch/formatters/jsonpatch.patch() APIs. An attacker can perform prototype pollution by supplying crafted delta or JSON Patch documents, as attacker-controlled property names and path segments are used to traverse and modify objects without restricting access to special properties like proto or constructor.prototype, allowing modification of Object.prototype.

Severity

• CVSS Score: 7.8 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:P

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-8657
• https://github.com/benjamine/jsondiffpatch/commit/381c0125efab49f6f0dbc08317d01d55717672af
• https://gist.github.com/yuki-matsuhashi/e570fb1579ae1f3190059b622b0473fb
• https://github.com/benjamine/jsondiffpatch/blob/96112c35a98f9201dd75d67fcee68a952c79e2fe/packages/jsondiffpatch/src/filters/nested.ts%23L107-L115
• https://github.com/benjamine/jsondiffpatch/blob/96112c35a98f9201dd75d67fcee68a952c79e2fe/packages/jsondiffpatch/src/filters/nested.ts%23L82-L87
• https://github.com/benjamine/jsondiffpatch/blob/96112c35a98f9201dd75d67fcee68a952c79e2fe/packages/jsondiffpatch/src/formatters/jsonpatch-apply.ts%23L146-L168
• https://github.com/benjamine/jsondiffpatch/blob/96112c35a98f9201dd75d67fcee68a952c79e2fe/packages/jsondiffpatch/src/formatters/jsonpatch-apply.ts%23L171-L199
• https://security.snyk.io/vuln/SNYK-JS-JSONDIFFPATCH-16322990
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-16732792
• https://github.com/advisories/GHSA-j4fx-xxwh-2485

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

benjamine/jsondiffpatch (jsondiffpatch)

v0.7.6

Compare Source

v0.7.5

Compare Source

v0.7.3

Compare Source

v0.7.2

Compare Source

v0.6.2

Compare Source

v0.6.1

Compare Source

v0.6.0

Compare Source

Breaking changes

• This package is now pure ESM. For more info, please read Sindre Sorhus's FAQ (#​350).
• Supported Node versions are ^18.0.0 || >=20.0.0 (#​350).
• Requires ES6 support (#​350).
• There is no longer a default export. Import this package by using import * as jsondiffpatch from 'jsondiffpatch' or by importing individual methods (#​350).
• Formatters are no longer exported from the main entry-point and must be imported from subpaths (#​350):
  • import * as annotatedFormatter from 'jsondiffpatch/formatters/annotated'
  • import * as baseFormatter from 'jsondiffpatch/formatters/base'
  • import * as consoleFormatter from 'jsondiffpatch/formatters/console'
  • import * as htmlFormatter from 'jsondiffpatch/formatters/html'
  • import * as jsonpatchFormatter from 'jsondiffpatch/formatters/jsonpatch'
• Updated CSS imports (#​350):
  • import 'jsondiffpatch/formatters/styles/html.css'
  • import 'jsondiffpatch/formatters/styles/annotated.css'
• The main entry-point no longer includes text diffing by default. Either pass in the diff-match-patch library via the textDiff.diffMatchPatch option, or use the jsondiffpatch/with-text-diffs entry point that is included for convenience (#​352).
• Context.switchTo() has been removed (#​345).
• BaseFormatter.typeFormattterErrorFormatter() now throws an error instead of returning a string (#​345).
• The UMD browser bundle has been removed. If you were using a script tag to include jsondiffpatch in your project, you can now import it inside of your main script tag as show below. For a more complete example, see the Visual Diff example before and after this change.

<!doctype html>
<html>
  <head>
    <link
      rel="stylesheet"
      href="https://esm.sh/jsondiffpatch@0.6.0/lib/formatters/styles/html.css"
      type="text/css"
    />
    <link
      rel="stylesheet"
      href="https://esm.sh/jsondiffpatch@0.6.0/lib/formatters/styles/annotated.css"
      type="text/css"
    />
  </head>
  <body>
    <script type="module">
      import * as jsondiffpatch from 'https://esm.sh/jsondiffpatch@0.6.0';
      import * as annotatedFormatter from 'https://esm.sh/jsondiffpatch@0.6.0/formatters/annotated';
      import * as htmlFormatter from 'https://esm.sh/jsondiffpatch@0.6.0/formatters/html';

      ...
    </script>
  </body>
</html>

Other changes

• Fix demo link in formatters doc by @​johnrees in #​311
• Fix the live demo link in the deltas docs by @​Xheldon in #​317
• Fix typos in project documentation by @​plan-do-break-fix in #​305
• Fix examples in documentation by @​dayures in #​308
• Update TS type file to include jsonpatch formatter by @​thilinatnt in #​310
• Fix incorrect matrix initialization by @​rexxars in #​291
• Documentation instances distinction by @​piomar123 in #​129
• Replace usages of substr with substring by @​Methuselah96 in #​343
• Remove dead branches by @​Methuselah96 in #​344
• Convert to TypeScript by @​Methuselah96 in #​345
• Convert tests to TypeScript by @​Methuselah96 in #​346
• Convert to monorepo and revamp build system by @​Methuselah96 in #​350
• Disable text diffs by default by @​Methuselah96 in #​352

New Contributors

• @​johnrees made their first contribution in #​311
• @​Xheldon made their first contribution in #​317
• @​plan-do-break-fix made their first contribution in #​305
• @​dayures made their first contribution in #​308
• @​thilinatnt made their first contribution in #​310
• @​rexxars made their first contribution in #​291
• @​piomar123 made their first contribution in #​129

Full Changelog: benjamine/jsondiffpatch@v0.5.0...v0.6.0

v0.5.0

Compare Source

What's Changed

• Update devDependencies by @​Methuselah96 in #​334
  • BREAKING Drops support for old browser versions like IE 8
• migrate to github.io by @​xamgore in #​307
• Add CI by @​Methuselah96 in #​333
• fix: chalk platform undefined error by upgrading the version by @​arjunvegda in #​332
• Add npm release workflow by @​Methuselah96 in #​336

New Contributors

• @​xamgore made their first contribution in #​307
• @​Methuselah96 made their first contribution in #​333
• @​arjunvegda made their first contribution in #​332

Full Changelog: benjamine/jsondiffpatch@v0.4.1...v0.5.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.