fix(security): add npm override for diff@8.0.3 (GHSA-73rr-hh4g-fpgx) (#209)

* fix(security): add npm override for diff@8.0.3 (GHSA-73rr-hh4g-fpgx)
Add npm overrides to force diff@^8.0.3 to fix DoS vulnerability
CVE-2026-24001 in parsePatch/applyPatch methods.
mocha@11.7.5 depends on vulnerable diff@7.0.0.

🖥️ IDE: [Cursor](https://cursor.sh)
🔌 Extension: [Claude Code](https://claude.ai/download)

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Model-Raw: claude-opus-4-5-20251101

* chore: bump version to 0.14.1 and update CHANGELOG
Add security fix entry for GHSA-73rr-hh4g-fpgx.

🖥️ IDE: [Cursor](https://cursor.sh)
🔌 Extension: [Claude Code](https://claude.ai/download)

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Model-Raw: claude-opus-4-5-20251101

* fix: add diff@8.0.3 as explicit devDependency
npm overrides alone caused 'Cannot find module diff' in E2E tests.
Adding diff as explicit dependency ensures it's installed.

🖥️ IDE: [Cursor](https://cursor.sh)
🔌 Extension: [Claude Code](https://claude.ai/download)

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Model-Raw: claude-opus-4-5-20251101

---------

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

Author: nullvariant

extensions/git-id-switcher/CHANGELOG.md

@@ -7,6 +7,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.14.1] - 2026-01-23
+
+### Security
+
+- **Dependency Vulnerability Fix**: Added npm override to force `diff@^8.0.3`
+  - Fixes GHSA-73rr-hh4g-fpgx (CVE-2026-24001): DoS vulnerability in `parsePatch` and `applyPatch` methods
+  - `mocha@11.7.5` depends on vulnerable `diff@7.0.0`
+
 ## [0.14.0] - 2026-01-22
 
 ### Changed

extensions/git-id-switcher/package.json

@@ -2,7 +2,7 @@
   "name": "git-id-switcher",
   "displayName": "%extension.displayName%",
   "description": "%extension.description%",
-  "version": "0.14.0",
+  "version": "0.14.1",
   "publisher": "nullvariant",
   "icon": "images/icon.png",
   "engines": {
@@ -280,6 +280,7 @@
   },
   "devDependencies": {
     "@types/mocha": "^10.0.10",
+    "diff": "^8.0.3",
     "@types/node": "^25.0.9",
     "@types/vscode": "^1.85.0",
     "@typescript-eslint/eslint-plugin": "^8.0.0",

extensions/git-id-switcher/src/documentation.internal.ts

@@ -25,7 +25,7 @@ export const DOCUMENT_HASHES: Record<string, string> = {
   'AGENTS.md': '54f16b767e57686b3eb46a2b4aa02b378554cc492c32c49ed96588f6d184b6b8',
   'CODE_OF_CONDUCT.md': 'a5eb286c902437bbe0f6d409894f20e51c172fa869fe2f151bfa388f9d911b54',
   'CONTRIBUTING.md': '4150f8810aec7b2e8eff9f3c69ee1bae1374843f50a812efa6778cba27a833cd',
-  'extensions/git-id-switcher/CHANGELOG.md': '1d2910df3d7ff8947ca614e80af194ce778d0d55e537f046489010f2479dbbf5',
+  'extensions/git-id-switcher/CHANGELOG.md': '4e1a449caa6b873fdc5af7134d9738a5b6d9815e5e5f47e5454761acb983702f',
   'extensions/git-id-switcher/docs/CONTRIBUTING.md': '7d6ad2bc4d8c838790754cb9df848cb65f9fdce7e1a13e5c965b83a3d5b6378c',
   'extensions/git-id-switcher/docs/DESIGN_PHILOSOPHY.md': 'f9718b61ac161cb466dbc76845688e7acacf4e5fdc4b8b9553269dba4a094f6b',
   'extensions/git-id-switcher/docs/i18n/ain/README.md': '4d309165e22a943b2a1791914db02bc2762d5fb643f5350a2426558ac7b3ae19',