node-diff - Debian Package Tracker

general

source: node-diff (main)
version: 5.2.2~dfsg+~5.2.3-2
maintainer: Debian Javascript Maintainers (archive) (DMD)
uploaders: Yadd [DMD]
arch: all
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 4.0.2~dfsg-2
oldstable: 5.0.0~dfsg+~5.0.1-4
stable: 5.0.0~dfsg+~5.0.1-4
testing: 5.2.2~dfsg+~5.2.3-2
unstable: 5.2.2~dfsg+~5.2.3-2
exp: 8.0.3~dfsg-2

versioned links

4.0.2~dfsg-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
5.0.0~dfsg+~5.0.1-4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
5.2.2~dfsg+~5.2.3-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
8.0.3~dfsg-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

node-diff

action needed

A new upstream version is available: 9.0.0+~8.0.0 high

A new upstream version 9.0.0+~8.0.0 is available, you should consider packaging it.

Created: 2026-02-19 Last update: 2026-05-03 11:03

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 8.0.3~dfsg-3, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 649dbad4a2c5fe02e4a4634313a238facb494e55
Author: Xavier Guimard <yadd@debian.org>
Date:   Thu Apr 30 07:02:31 2026 +0200

    Add patch to skip the "enormous hunk" regression test

Created: 2026-04-30 Last update: 2026-04-30 06:30

lintian reports 1 warning normal

Lintian reports 1 warning about this package. You should make the package lintian clean getting rid of them.

Created: 2026-04-06 Last update: 2026-04-06 20:31

1 low-priority security issue in trixie low

There is 1 open security issue in trixie.

1 issue left for the package maintainer to handle:

CVE-2026-24001: (needs triaging) jsdiff is a JavaScript text differencing implementation. Prior to versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1, attempting to parse a patch whose filename headers contain the line break characters `\r`, `\u2028`, or `\u2029` can cause the `parsePatch` method to enter an infinite loop. It then consumes memory without limit until the process crashes due to running out of memory. Applications are therefore likely to be vulnerable to a denial-of-service attack if they call `parsePatch` with a user-provided patch as input. A large payload is not needed to trigger the vulnerability, so size limits on user input do not provide any protection. Furthermore, some applications may be vulnerable even when calling `parsePatch` on a patch generated by the application itself if the user is nonetheless able to control the filename headers (e.g. by directly providing the filenames of the files to be diffed). The `applyPatch` method is similarly affected if (and only if) called with a string representation of a patch as an argument, since under the hood it parses that string using `parsePatch`. Other methods of the library are unaffected. Finally, a second and lesser interdependent bug - a ReDOS - also exhibits when those same line break characters are present in a patch's *patch* header (also known as its "leading garbage"). A maliciously-crafted patch header of length *n* can take `parsePatch` O(*n*³) time to parse. Versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1 contain a fix. As a workaround, do not attempt to parse patches that contain any of these characters: `\r`, `\u2028`, or `\u2029`.

You can find information about how to handle this issue in the security team's documentation.

Created: 2026-01-23 Last update: 2026-04-28 19:02

1 low-priority security issue in bookworm low

There is 1 open security issue in bookworm.

1 issue left for the package maintainer to handle:

CVE-2026-24001: (needs triaging) jsdiff is a JavaScript text differencing implementation. Prior to versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1, attempting to parse a patch whose filename headers contain the line break characters `\r`, `\u2028`, or `\u2029` can cause the `parsePatch` method to enter an infinite loop. It then consumes memory without limit until the process crashes due to running out of memory. Applications are therefore likely to be vulnerable to a denial-of-service attack if they call `parsePatch` with a user-provided patch as input. A large payload is not needed to trigger the vulnerability, so size limits on user input do not provide any protection. Furthermore, some applications may be vulnerable even when calling `parsePatch` on a patch generated by the application itself if the user is nonetheless able to control the filename headers (e.g. by directly providing the filenames of the files to be diffed). The `applyPatch` method is similarly affected if (and only if) called with a string representation of a patch as an argument, since under the hood it parses that string using `parsePatch`. Other methods of the library are unaffected. Finally, a second and lesser interdependent bug - a ReDOS - also exhibits when those same line break characters are present in a patch's *patch* header (also known as its "leading garbage"). A maliciously-crafted patch header of length *n* can take `parsePatch` O(*n*³) time to parse. Versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1 contain a fix. As a workaround, do not attempt to parse patches that contain any of these characters: `\r`, `\u2028`, or `\u2029`.

You can find information about how to handle this issue in the security team's documentation.

Created: 2026-01-23 Last update: 2026-04-28 19:02

news

[rss feed]

[2026-04-30] Accepted node-diff 8.0.3~dfsg-2 (source all) into experimental (Xavier Guimard)
[2026-04-26] Accepted node-diff 8.0.3~dfsg-1 (source) into experimental (Xavier Guimard)
[2026-04-08] node-diff 5.2.2~dfsg+~5.2.3-2 MIGRATED to testing (Debian testing watch)
[2026-04-06] Accepted node-diff 5.2.2~dfsg+~5.2.3-2 (source) into unstable (Xavier Guimard)
[2026-04-06] Accepted node-diff 5.2.2~dfsg+~5.2.3-1 (source) into unstable (Xavier Guimard)
[2026-02-21] node-diff 5.0.0~dfsg+~5.0.1-6 MIGRATED to testing (Debian testing watch)
[2026-02-18] Accepted node-diff 5.0.0~dfsg+~5.0.1-6 (source) into unstable (Alexandre Detiste)
[2026-01-08] node-diff 5.0.0~dfsg+~5.0.1-5 MIGRATED to testing (Debian testing watch)
[2026-01-05] Accepted node-diff 5.0.0~dfsg+~5.0.1-5 (source) into unstable (Santiago Vila)
[2022-10-30] node-diff 5.0.0~dfsg+~5.0.1-4 MIGRATED to testing (Debian testing watch)
[2022-10-28] Accepted node-diff 5.0.0~dfsg+~5.0.1-4 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2022-02-10] node-diff 5.0.0~dfsg+~5.0.1-3 MIGRATED to testing (Debian testing watch)
[2022-02-07] Accepted node-diff 5.0.0~dfsg+~5.0.1-3 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2021-11-24] node-diff 5.0.0~dfsg+~5.0.1-2 MIGRATED to testing (Debian testing watch)
[2021-11-22] Accepted node-diff 5.0.0~dfsg+~5.0.1-2 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2021-11-09] node-diff 5.0.0~dfsg+~5.0.1-1 MIGRATED to testing (Debian testing watch)
[2021-11-06] Accepted node-diff 5.0.0~dfsg+~5.0.1-1 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2021-07-09] Accepted node-diff 5.0.0~dfsg-1 (source) into experimental (Manas Kashyap) (signed by: Xavier Guimard)
[2020-11-15] node-diff 4.0.2~dfsg-2 MIGRATED to testing (Debian testing watch)
[2020-11-12] Accepted node-diff 4.0.2~dfsg-2 (source) into unstable (Xavier Guimard)
[2020-11-12] Accepted node-diff 4.0.2~dfsg-1 (source) into unstable (Xavier Guimard)
[2020-07-13] node-diff 1.4.0~dfsg-4 MIGRATED to testing (Debian testing watch)
[2020-07-11] Accepted node-diff 1.4.0~dfsg-4 (source) into unstable (Olivier Tilloy) (signed by: Gianfranco Costamagna)
[2020-02-15] node-diff 1.4.0~dfsg-3 MIGRATED to testing (Debian testing watch)
[2020-02-13] Accepted node-diff 1.4.0~dfsg-3 (source) into unstable (Xavier Guimard)
[2019-09-01] node-diff 1.4.0~dfsg-2 MIGRATED to testing (Debian testing watch)
[2019-08-29] Accepted node-diff 4.0.1~dfsg-1 (source) into experimental (Jonas Smedegaard)
[2019-08-29] Accepted node-diff 1.4.0~dfsg-2 (source) into unstable (Jonas Smedegaard)
[2015-05-31] Accepted node-diff 1.4.0~dfsg-1 (source all) into unstable (Jonas Smedegaard)
[2013-08-24] node-diff 1.0.4-1 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 0

links

homepage
lintian (0, 1)
buildd: logs, exp, reproducibility
popcon
browse source code
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 5.0.0~dfsg+~5.0.1-6