fix: override diff package to patched versions

[frankmueller-msft]

Summary

• Overrides the diff (jsdiff) package to patched versions across all 13 workspaces to resolve a known ReDoS vulnerability
• Version mapping: diff@3.x → 4.0.4, diff@4.x → 4.0.4, diff@5.x → 5.2.2, diff@7.x → 8.0.3 (no 7.x fix exists), diff@8.x → 8.0.3
• Bumps all 8 direct diff devDependencies from ^3.5.0 to ^4.0.4 (all test-only usage)
• Consumers affected: mocha, sinon, ts-node, @microsoft/api-extractor
• Adds version-scoped override keys to syncpack ignore list in build-tools
• No code changes — config, lockfile, and devDependency version updates only

Test plan

• CI passes across all workspace pipelines (client packages, build-tools, common-utils, protocol-definitions, server-gitrest, server-historian, server-routerlicious, docs, eslint-config-fluid, eslint-plugin-fluid, benchmark-tool, test-tools, api-markdown-documenter, repo-policy-check)
• Link check passes (257,792 links, 0 errors)
• No functional changes — overrides and devDependency bumps only affect transitive dependency resolution and test builds

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Updates pnpm overrides across the repo to force diff (jsdiff) onto patched versions in response to a ReDoS vulnerability, including special handling to bump 7.x consumers to 8.0.3 where no 7.x fix exists.

Changes:

• Add version-scoped pnpm overrides for diff across root + workspace package.json files and corresponding workspace lockfiles.
• Regenerate lockfiles to reflect updated diff resolutions (e.g., 5.2.0 → 5.2.2, 8.0.2 → 8.0.3, 7.0.0 → 8.0.3).
• Update build-tools syncpack config to ignore newly introduced version-scoped override keys.

Reviewed changes

Copilot reviewed 14 out of 27 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tools/test-tools/pnpm-lock.yaml	Adds diff@>=5 <6 override and updates locked diff version to 5.2.2.
tools/test-tools/package.json	Adds pnpm override + comment for patched diff 5.x.
tools/benchmark/pnpm-lock.yaml	Adds diff@>=5 <6 override and updates locked diff to 5.2.2.
tools/benchmark/package.json	Adds pnpm override + comment for patched diff 5.x.
tools/api-markdown-documenter/pnpm-lock.yaml	Adds diff overrides for 5.x and 7.x→8.0.3; updates lockfile accordingly.
tools/api-markdown-documenter/package.json	Adds pnpm overrides + rationale for bumping 7.x to 8.0.3.
server/routerlicious/pnpm-lock.yaml	Adds diff overrides (4.x/5.x/8.x) and updates locked versions.
server/routerlicious/package.json	Adds pnpm overrides + comment for patched diff versions.
server/historian/pnpm-lock.yaml	Adds diff overrides (5.x, 7.x→8.0.3, 8.x) and updates lockfile.
server/historian/package.json	Adds pnpm overrides + rationale for 7.x bump.
server/gitrest/pnpm-lock.yaml	Adds diff overrides (5.x, 7.x→8.0.3, 8.x) and updates lockfile.
server/gitrest/package.json	Adds pnpm overrides + rationale for 7.x bump.
pnpm-lock.yaml	Adds root diff overrides and updates locked/resolved diff entries.
package.json	Adds root pnpm overrides + comment for patched diff versions (including 7.x→8.0.3).
docs/pnpm-lock.yaml	Adds diff@>=5 <6 override and updates locked diff to 5.2.2.
docs/package.json	Adds pnpm override + comment for patched diff 5.x.
common/lib/protocol-definitions/pnpm-lock.yaml	Adds diff@>=8 <9 override and updates lockfile to 8.0.3.
common/lib/protocol-definitions/package.json	Adds pnpm override + comment for patched diff 8.x.
common/lib/common-utils/pnpm-lock.yaml	Adds diff overrides (4.x/5.x/8.x) and updates lockfile.
common/lib/common-utils/package.json	Adds pnpm overrides + comment for patched diff versions.
common/build/eslint-plugin-fluid/pnpm-lock.yaml	Adds diff@>=5 <6 override and updates lockfile to 5.2.2.
common/build/eslint-plugin-fluid/package.json	Adds pnpm override + comment for patched diff 5.x.
common/build/eslint-config-fluid/pnpm-lock.yaml	Adds diff@>=5 <6 override and updates lockfile to 5.2.2.
common/build/eslint-config-fluid/package.json	Adds pnpm override + comment for patched diff 5.x.
build-tools/syncpack.config.cjs	Adds version-scoped diff override keys to syncpack ignore list.
build-tools/pnpm-lock.yaml	Adds diff overrides (4.x, 7.x→8.0.3, 8.x) and updates lockfile.
build-tools/package.json	Adds pnpm overrides + rationale for 7.x bump within build-tools release group.

Files not reviewed (13)

• build-tools/pnpm-lock.yaml: Language not supported
• common/build/eslint-config-fluid/pnpm-lock.yaml: Language not supported
• common/build/eslint-plugin-fluid/pnpm-lock.yaml: Language not supported
• common/lib/common-utils/pnpm-lock.yaml: Language not supported
• common/lib/protocol-definitions/pnpm-lock.yaml: Language not supported
• docs/pnpm-lock.yaml: Language not supported
• pnpm-lock.yaml: Language not supported
• server/gitrest/pnpm-lock.yaml: Language not supported
• server/historian/pnpm-lock.yaml: Language not supported
• server/routerlicious/pnpm-lock.yaml: Language not supported
• tools/api-markdown-documenter/pnpm-lock.yaml: Language not supported
• tools/benchmark/pnpm-lock.yaml: Language not supported
• tools/test-tools/pnpm-lock.yaml: Language not supported

---

You can also share your feedback on Copilot code review. Take the survey.

[frankmueller-msft]

This is expected pnpm behavior with overrides. The package.json declares "diff": "^3.5.0" but the root workspace has "diff@>=3 <4": "^4.0.4" in pnpm overrides, which forces the lockfile specifier to ^4.0.4. The lockfile was generated by pnpm install with these overrides active — pnpm install --frozen-lockfile will pass because the override is part of the resolution context.

[Abe27342]

Seems valid to consider bumping diff legitimately in packages where we depend on it though. Relying on overrides for everything is not good practice

[frankmueller-msft]

Good point — bumped all 8 packages with direct diff devDependencies from ^3.5.0 to ^4.0.4. They're all test-only deps (only one actual import in merge-tree/src/test/beastTest.spec.ts). The diff@>=3 <4 override stays as a safety net for any transitive 3.x consumers.

[frankmueller-msft]

Same as above — this is how pnpm overrides work. The manifest says ^3.5.0 but the override "diff@>=3 <4": "^4.0.4" changes the resolved specifier in the lockfile. This is correct and --frozen-lockfile passes.

[github-actions]

🔗 No broken links found! ✅

Your attention to detail is admirable.

linkcheck output

> fluid-framework-docs-site@0.0.0 ci:check-links /home/runner/work/FluidFramework/FluidFramework/docs
> start-server-and-test "npm run serve -- --no-open" 3000 check-links

1: starting server using command "npm run serve -- --no-open"
and when url "[ 'http://127.0.0.1:3000' ]" is responding with HTTP status code 200
running tests using command "npm run check-links"


> fluid-framework-docs-site@0.0.0 serve
> docusaurus serve --no-open

[SUCCESS] Serving "build" directory at: http://localhost:3000/

> fluid-framework-docs-site@0.0.0 check-links
> linkcheck http://localhost:3000 --skip-file skipped-urls.txt

Crawling...

Stats:
  257792 links
    1822 destination URLs
    2063 URLs ignored
       0 warnings
       0 errors