fix(content-type): replace git-diff with jsdiff to clear Snyk issue

[naman-contentstack]

Why

git-diff@2.0.7 is unmaintained (last published 2018) and pulls in chalk@2, diff@3, loglevel, shelljs and shelljs.exec. Snyk flagged the only vulnerable path in the entire monorepo through that tree:

✗ Missing Release of Resource after Effective Lifetime [Medium]
  SNYK-JS-INFLIGHT-6095116
  git-diff@2.0.7 > shelljs@0.8.5 > glob@7.2.3 > inflight@1.0.6

Snyk lists it under "Issues with no direct upgrade or patch" — because git-diff is abandoned, there is nothing to bump to. The dependency has to go.

What

Replaced it with diff@^9 (jsdiff): zero runtime dependencies, bundled TypeScript types, dual CJS/ESM. As a side effect it also drops the dependency on a git binary and the temp-file + subprocess round trip git-diff used to shell out through shelljs.

import {createTwoFilesPatch} from 'diff'

function buildDiffString(previous: any, current: any) {
  return createTwoFilesPatch(
    previous.uid, current.uid,
    JSON.stringify(previous, null, 2), JSON.stringify(current, null, 2),
    current.updated_at, current.updated_at,
  )
}

createTwoFilesPatch emits the --- / +++ file headers itself, so the hand-rolled header concatenation is gone. @types/git-diff dropped too, since diff ships its own types.

Output equivalence

Not assumed — checked. Both the old and new patch strings were run through Diff2html.parse and compared on file names, added/deleted line counts, hunk headers, and every line's type and content. Identical. The rendered compare view is unchanged.

One behaviour actually improves: git-diff returned undefined when both sides matched, which interpolated the literal string "undefined" into the patch. createTwoFilesPatch returns a well-formed patch with no hunks.

Tests

The existing spec mocked diff2html, so the generated patch was never asserted — the diff-building logic had no real coverage. Added two cases against the string handed to Diff2html.parse:

• headers, @@ hunk, and the actual changed -/+ lines
• identical-input case: no hunks, and no literal "undefined"

Both were mutation-checked — corrupting buildDiffString makes them fail, so they catch regressions rather than just passing.

tsc -b --force   exit 0
Test Suites:     16 passed, 16 total
Tests:           78 passed, 78 total   (was 76)
snyk test --all-projects   no vulnerable paths, monorepo-wide

Reviewer notes

• .talismanrc: the pinned pnpm-lock.yaml checksum is bumped. Talisman flags the lockfile's sha512-... npm integrity hashes as "base64 encoded text" — a false positive, not a secret. The file is already ignored by checksum; the lockfile change invalidated the pin. Same thing 38bebe6 and db3fcc5 did. The pre-commit hook was not bypassed — Talisman and Snyk both ran and passed.
• Version bump: this branch also carries a pre-existing, uncommitted 1.5.3 → 1.5.4 bump that was already in the working tree, in the same package.json as the dep change and not cleanly separable. Happy to pull it out if you'd rather it landed on its own.
• Pre-existing bug, deliberately not fixed here — src/core/content-type/compare.ts:18:

  tmp.file({...}, async function (err: any, ...) {
    if (err) throw err

  The callback is async and nothing awaits it, so a real tmp failure becomes an unhandled rejection and kills the CLI instead of surfacing a readable error. This is the one uncovered branch in the coverage report. Out of scope for a dependency swap — worth a follow-up ticket.

🤖 Generated with Claude Code

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	0	25	✅ Passed
🟡 Medium Severity	0	0	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed

[Copilot]

Pull request overview

This PR updates the contentstack-cli-content-type plugin to eliminate the unmaintained git-diff dependency (and its vulnerable transitive tree) by switching unified-patch generation to diff (jsdiff), while keeping the existing compare HTML output flow via diff2html.

Changes:

• Replaced git-diff with diff’s createTwoFilesPatch in the content-type compare output generator.
• Strengthened Jest coverage by asserting the unified patch string passed into Diff2html.parse (including the identical-input case).
• Updated dependency/lockfile state, docs references to the new diff implementation, and the .talismanrc lockfile checksum; bumped the package version.

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
pnpm-lock.yaml	Removes git-diff and related transitive deps, adds diff, and updates lockfile resolutions.
packages/contentstack-content-type/src/core/content-type/compare.ts	Switches diff generation from git-diff to diff.createTwoFilesPatch.
packages/contentstack-content-type/tests/core/content-type/compare.test.ts	Adds assertions on the generated patch string provided to diff2html.
packages/contentstack-content-type/skills/contentstack-cli-content-type/SKILL.md	Updates documentation to reflect diff usage instead of git-diff.
packages/contentstack-content-type/skills/code-review/SKILL.md	Updates dependency review checklist to replace git-diff with diff.
packages/contentstack-content-type/package.json	Drops git-diff / @types/git-diff, adds diff, and bumps version to 1.5.4.
.talismanrc	Updates the pinned checksum for pnpm-lock.yaml.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	0	25	✅ Passed
🟡 Medium Severity	0	0	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	0	25	✅ Passed
🟡 Medium Severity	0	0	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed

[Copilot]

Pull request overview

Copilot reviewed 6 out of 7 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Suppressed comments (1)

packages/contentstack-content-type/skills/contentstack-cli-content-type/SKILL.md:103

• The docs refer to the diff builder as diff, which is ambiguous (could be read as the unix diff tool). Clarifying that this is the npm diff (jsdiff) package will make the dependency swap easier to understand for future maintainers.

- **Compare**: `core/content-type/compare.ts` builds a unified diff from two JSON snapshots (`diff`), parses with **diff2html**, writes a **temporary HTML** file, opens it in the browser (`cli-ux` / `cli.open`). Not a terminal table.

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	0	25	✅ Passed
🟡 Medium Severity	0	0	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	0	25	✅ Passed
🟡 Medium Severity	0	0	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed