build(deps): bump diff and mocha in /eng

[dependabot]

Bumps diff to 9.0.0 and updates ancestor dependency mocha. These dependencies need to be updated together.

Updates diff from 7.0.0 to 9.0.0

Changelog

Sourced from diff's changelog.

9.0.0

(All changes part of PR #672.)

• ES5 support is dropped. parsePatch now uses TextDecoder and Uint8Array, which are not available in ES5, and TypeScript is now compiled with the "es6" target. From now on, I intend to freely use any features that are deemed "Widely available" by Baseline. Users who need ES5 support should stick to version 8.

• C-style quoted strings in filename headers are now properly supported.

  When the name of either the old or new file in a patch contains "special characters", both GNU diff and Git quote the filename in the patch's headers and escape special characters using the same escape sequences that are used in string literals in C, including octal escapes for all non-ASCII characters. Previously, jsdiff had very little support for this; parsePatch would remove the quotes, and unescape any escaped backslashes, but would not unescape other escape sequences. formatPatch, meanwhile, did not quote or escape special characters at all.

  Now, parsePatch parses all the possible escape sequences that GNU diff (or Git) ever output, and formatPatch quotes and escapes filenames containing special characters in the same way GNU diff does.

• formatPatch now omits file headers when oldFileName or newFileName in the provided patch object are undefined, regardless of the headerOptions parameter. (Previously, it would treat the absence of oldFileName or newFileName as indicating the filename was the word "undefined" and emit headers --- undefined / +++ undefined.)

• formatPatch no longer outputs trailing tab characters at the end of ---/+++ headers.

  Previously, if formatPatch was passed a patch object to serialize that had empty strings for the oldHeader or newHeader property, it would include a trailing tab character after the filename in the --- and/or +++ file header. Now, this scenario is treated the same as when oldHeader/newHeader is undefined - i.e. the trailing tab is omitted.

• formatPatch no longer mutates its input when serializing a patch containing a hunk where either the old or new content contained zero lines. (Such a hunk occurs only when the hunk has no context lines and represents a pure insertion or pure deletion, which for instance will occur whenever one of the two files being diffed is completely empty.) Previously formatPatch would provide the correct output but also mutate the oldLines or newLines property on the hunk, changing the meaning of the underlying patch.

• Git-style patches are now supported by parsePatch, formatPatch, and reversePatch.

  Patches output by git diff can include some features that are unlike those output by GNU diff, and therefore not handled by an ordinary unified diff format parser. An ordinary diff simply describes the differences between the content of two files, but Git diffs can also indicate, via "extended headers", the creation or deletion of (potentially empty) files, indicate that a file was renamed, and contain information about file mode changes. Furthermore, when these changes appear in a diff in the absence of a content change (e.g. when an empty file is created, or a file is renamed without content changes), the patch will contain no associated ---/+++ file headers nor any hunks.

  jsdiff previously did not support parsing Git's extended headers, nor hunkless patches. Now parsePatch parses some of the extended headers, parses hunkless Git patches, and can determine filenames (e.g. from the extended headers) when parsing a patch that includes no --- or +++ file headers. The additional information conveyed by the extended headers we support is recorded on new fields on the result object returned by parsePatch. See isGit and subsequent properties in the docs in the README.md file.

  formatPatch now outputs extended headers based on these new Git-specific properties, and reversePatch respects them as far as possible (with one unavoidable caveat noted in the README.md file).

• Unpaired file headers now cause parsePatch to throw.

  It remains acceptable to have a patch with no file headers whatsoever (e.g. one that begins with a @@ hunk header on the very first line), but a patch with only a --- header or only a +++ header is now considered an error.

• parsePatch is now more tolerant of "trailing garbage"

  That is: after a patch, or between files/indexes in a patch, it is now acceptable to have arbitrary lines of "garbage" (so long as they unambiguously have no syntactic meaning - e.g. trailing garbage that leads with a +, -, or and thus is interpretable as part of a hunk still triggers a throw).

  This means we no longer reject patches output by tools that include extra data in "garbage" lines not understood by generic unified diff parsers. (For example, SVN patches can include "Property changes on:" lines that generic unified diff parsers should discard as garbage; jsdiff previously threw errors when encountering them.)

  This change brings jsdiff's behaviour more in line with GNU patch, which is highly permissive of "garbage".

• The oldFileName and newFileName fields of StructuredPatch are now typed as string | undefined instead of string. This type change reflects the (pre-existing) reality that parsePatch can produce patches without filenames (e.g. when parsing a patch that simply contains hunks with no file headers).

8.0.4

• #667 - fix another bug in diffWords when used with an Intl.Segmenter. If the text to be diffed included a combining mark after a whitespace character (i.e. roughly speaking, an accented space), diffWords would previously crash. Now this case is handled correctly.

8.0.3

• #631 - fix support for using an Intl.Segmenter with diffWords. This has been almost completely broken since the feature was added in v6.0.0, since it would outright crash on any text that featured two consecutive newlines between a pair of words (a very common case).
• #635 - small tweaks to tokenization behaviour of diffWords when used without an Intl.Segmenter. Specifically, the soft hyphen (U+00AD) is no longer considered to be a word break, and the multiplication and division signs (× and ÷) are now treated as punctuation instead of as letters / word characters.

... (truncated)

Commits

• ed13aca Update version in package.json and in release notes (#683)
• 7a49317 Bump dependencies again (#682)
• afe5aec Add Git support, and otherwise variously improve & fix parsePatch (and other ...
• 2e46779 Fix a typo (#679)
• dd2f994 8.0.4 release (#678)
• 3cc4384 Update docs on releasing to reflect migration to yarn berry (#677)
• 6fc2aa6 yarn up '*' && yarn up -R '**' (#676)
• af7393a yarn up '*' && yarn up -R '**' (#670)
• 4b5d180 Fix another bug in diffWords's "intlSegmenter" mode (#667)
• 10da50c yarn up '*' && yarn up -R '**' (#666)
• Additional commits viewable in compare view

Updates mocha from 11.7.6 to 12.0.3

Release notes

Sourced from mocha's releases.

v12.0.3

12.0.3 (2026-10-01)

🩹 Fixes

• keep watching when the last test file is removed (#6355) (921c161)
• show require() error on unsupported directory import (#6354) (a68344f)
• support --X one-char aliases (#6391) (1227939)

📚 Documentation

• refresh help output, fix stale links (#6357) (bb2e69a)

🧹 Chores

• add --import=tsx integration test (#6356) (3382fdd)
• touch a new file without stamping it afterwards (#6349) (d59467a)

v12.0.2

12.0.2 (2026-09-17)

🩹 Fixes

• fail nested tests on beforeEach failure (#6292) (a75b43b)
• give CLI reporter-option precedence over config file (#6331) (571110f)
• propagate spec file path on parallel worker death (#6268) (55a544a)
• use find-up-simple to workaround ERR_PACKAGE_PATH_NOT_EXPORTED (#6342) (a652ff5)
• watch existing dirs so first run starts armed (#6263) (f5c8aca)

📚 Documentation

• add remaining external services (#6316) (bfe0b5d)
• update copyright year, holder, and URLs (#6303) (288c075)

🧹 Chores

• add "stale branch" workflow (#6315) (ad17f9f)
• add dependency conflict detection workflow (#6246) (ef0ae32)
• add folder for reproducing issues (#6330) (6728030)
• add stale triage reminder for unreviewed issues (#6314) (ee35133)
• auto-remove "waiting for author" label on author activity (#6213) (dbd4322)
• convert file-unloader to ESM (#6294) (dc73f4c)
• deps: update dependency @​playwright/test to v1.63.0 (#6299) (931baa5)
• deps: update dependency eslint to v10.10.0 (#6296) (3cb22d1)

... (truncated)

Changelog

Sourced from mocha's changelog.

12.0.3 (2026-10-01)

🩹 Fixes

• keep watching when the last test file is removed (#6355) (921c161)
• show require() error on unsupported directory import (#6354) (a68344f)
• support --X one-char aliases (#6391) (1227939)

📚 Documentation

• refresh help output, fix stale links (#6357) (bb2e69a)

🧹 Chores

• add --import=tsx integration test (#6356) (3382fdd)
• touch a new file without stamping it afterwards (#6349) (d59467a)

12.0.2 (2026-09-17)

🩹 Fixes

• fail nested tests on beforeEach failure (#6292) (a75b43b)
• give CLI reporter-option precedence over config file (#6331) (571110f)
• propagate spec file path on parallel worker death (#6268) (55a544a)
• use find-up-simple to workaround ERR_PACKAGE_PATH_NOT_EXPORTED (#6342) (a652ff5)
• watch existing dirs so first run starts armed (#6263) (f5c8aca)

📚 Documentation

• add remaining external services (#6316) (bfe0b5d)
• update copyright year, holder, and URLs (#6303) (288c075)

🧹 Chores

• add "stale branch" workflow (#6315) (ad17f9f)
• add dependency conflict detection workflow (#6246) (ef0ae32)
• add folder for reproducing issues (#6330) (6728030)
• add stale triage reminder for unreviewed issues (#6314) (ee35133)
• auto-remove "waiting for author" label on author activity (#6213) (dbd4322)
• convert file-unloader to ESM (#6294) (dc73f4c)
• deps: update dependency @​playwright/test to v1.63.0 (#6299) (931baa5)
• deps: update dependency eslint to v10.10.0 (#6296) (3cb22d1)
• deps: update dependency knip to v6.35.0 (#6324) (a2416af)
• deps: update octoguide/bot action to v0.23.0 (#6304) (bbe5a27)

... (truncated)

Commits

• 51a0cc5 chore(main): release 12.0.3 (#6353)
• 1227939 fix: support --X one-char aliases (#6391)
• bb2e69a docs: refresh help output, fix stale links (#6357)
• 921c161 fix: keep watching when the last test file is removed (#6355)
• 3382fdd test: add --import=tsx integration test (#6356)
• a68344f fix: show require() error on unsupported directory import (#6354)
• d59467a test: touch a new file without stamping it afterwards (#6349)
• 70db1c7 chore(main): release 12.0.2 (#6300)
• 571110f fix: give CLI reporter-option precedence over config file (#6331)
• a652ff5 fix: use find-up-simple to workaround ERR_PACKAGE_PATH_NOT_EXPORTED (#6342)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[Copilot]

Copilot review overview

🟡 Changes recommended

The package’s Node engine range includes versions unsupported by Mocha 12.

Review effort: Balanced
Findings: 1

Open (1)

• Package engine range permits unsupported Node 22 versions for Mocha 12 · New

What changed in this PR

Updates the engineering package’s test dependencies.

Changes:

• Upgrades Mocha from 11.7.6 to 12.0.3.
• Updates transitive diff and related dependencies.

File	Description
eng/​package.json	Updates Mocha.
eng/​package-lock.json	Refreshes the resolved dependency tree.

Files not reviewed (1)

• eng/package-lock.json: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Brandon Waterloo [MSFT] (bwateratmsft)]

🤖 This update has not reached the required package age of 168 hours (7 full days).

Package	Version	Published (UTC)	Eligible (UTC)	Notes
mocha	12.0.3	2026-10-01T04:37:57Z	2026-10-08T04:37:57Z	direct dependency

The whole update becomes eligible at 2026-10-08T04:37:57Z.

Please wait until the eligibility time before approval.

[Brandon Waterloo [MSFT] (bwateratmsft)]

Unacceptable. Major bumps are way out of Dependabot's scope here.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.