From 31da5fb8a15cb80e4c6a64a180ca7af05d129e71 Mon Sep 17 00:00:00 2001
From: Alex Leventer <alexleventer@gmail.com>
Date: Wed, 21 Oct 2026 16:35:12 -0700
Subject: [PATCH 1/2] Bump diff to 8.0.4 for CVE-2026-24001

Fixes #145
---
 package-lock.json | 12 ++++++------
 package.json      |  2 +-
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 4c270a4..8241793 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,16 +1,16 @@
 {
   "name": "@flydotio/dockerfile",
-  "version": "0.7.8",
+  "version": "0.7.11",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@flydotio/dockerfile",
-      "version": "0.7.8",
+      "version": "0.7.11",
       "license": "MIT",
       "dependencies": {
         "chalk": "^5.4.1",
-        "diff": "^7.0.0",
+        "diff": "^8.0.4",
         "ejs": "^3.1.10",
         "inquirer": "^12.4.1",
         "shell-quote": "^1.8.2",
@@ -1341,9 +1341,9 @@
       }
     },
     "node_modules/diff": {
-      "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/diff/-/diff-7.0.0.tgz",
-      "integrity": "sha512-PJWHUb1RFevKCwaFA9RlG5tCd+FO5iRh9A8HEtkmBH2Li03iJriB6m6JIN4rGz3K3JLawI7/veA1xzRKP6ISBw==",
+      "version": "8.0.4",
+      "resolved": "https://registry.npmjs.org/diff/-/diff-8.0.4.tgz",
+      "integrity": "sha512-DPi0FmjiSU5EvQV0++GFDOJ9ASQUVFh5kD+OzOnYdi7n3Wpm9hWWGfB/O2blfHcMVTL5WkQXSnRiK9makhrcnw==",
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">=0.3.1"
diff --git a/package.json b/package.json
index 687aad6..f8d549f 100644
--- a/package.json
+++ b/package.json
@@ -20,7 +20,7 @@
   },
   "dependencies": {
     "chalk": "^5.4.1",
-    "diff": "^7.0.0",
+    "diff": "^8.0.4",
     "ejs": "^3.1.10",
     "inquirer": "^12.4.1",
     "shell-quote": "^1.8.2",

From 25a17b8cddfc5453f27aa380e971b2ddee6a6715 Mon Sep 17 00:00:00 2001
From: Alex Leventer <alexleventer@gmail.com>
Date: Wed, 21 Oct 2026 16:40:04 -0700
Subject: [PATCH 2/2] Bump mocha's nested diff to 5.2.2 for CVE-2026-24001

---
 package-lock.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 8241793..f2f8f84 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -3346,9 +3346,9 @@
       }
     },
     "node_modules/mocha/node_modules/diff": {
-      "version": "5.2.0",
-      "resolved": "https://registry.npmjs.org/diff/-/diff-5.2.0.tgz",
-      "integrity": "sha512-uIFDxqpRZGZ6ThOk84hEfqWoHx2devRFvpTZcTHur85vImfaxUbTW9Ryh4CpCuDnToOP1CEtXKIgytHBPVff5A==",
+      "version": "5.2.2",
+      "resolved": "https://registry.npmjs.org/diff/-/diff-5.2.2.tgz",
+      "integrity": "sha512-vtcDfH3TOjP8UekytvnHH1o1P4FcUdt4eQ1Y+Abap1tk/OB2MWQvcwS2ClCd1zuIhc3JKOx6p3kod8Vfys3E+A==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {