Version Packages

packages/sync-actions/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @commercetools/sync-actions
 
+## 8.4.0
+
+### Minor Changes
+
+- [#60](https://github.com/commercetools/typescript-dev-utilities/pull/60) [`a4edf89`](https://github.com/commercetools/typescript-dev-utilities/commit/a4edf89bcc79fb156a8c3ce635025d8338dad8b7) Thanks [@marcelogpinheiro](https://github.com/marcelogpinheiro)! - Upgrade the `jsondiffpatch` dependency from `0.5.0` to `^0.7.6`, moving off an unmaintained release onto the current maintained version.
+
+  A customer security report referenced `jsonpath-plus` (which is not, and never was, a dependency of this package). The reported version facts — pinned `0.5.0`, fixed in `0.7.6`, not backwards compatible — instead correspond to `jsondiffpatch`, a direct dependency used by the diff/patch utility behind update-action generation. This change adopts `jsondiffpatch@0.7.6`.
+
+  The public API and observable behavior of `@commercetools/sync-actions` are unchanged. Internally: `jsondiffpatch` 0.7 is ESM-only, so imports were updated to the package root and the dependency is bundled into the published CommonJS, ESM, and UMD artifacts (CommonJS consumers are unaffected). Fine-grained text diffing remains disabled, so a changed string is still reported as a whole-value replacement.
+
 ## 8.3.0
 
 ### Minor Changes

packages/sync-actions/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commercetools/sync-actions",
-  "version": "8.3.0",
+  "version": "8.4.0",
   "publishConfig": {
     "access": "public"
   },