* Make package/diff viewer colors theme-aware
The jfcherng/php-diff Inline renderer output is styled by each theme's
Diff.css, but every theme shipped an identical copy that hard-coded a
light palette (color: black, background: #fff, opaque #fbe1e1/#e1fbe1
add/remove tints). Inside the diff dialog this painted a light box with
dark text over dark themes (dark, sunrise, paper-plane) and over
midwinter's dark color-mode, so the modal did not match the theme.
Derive the base surface from the themed dialog instead of hard-coding it
(color: inherit, background: transparent, neutral translucent borders and
gutters) and express the add/remove/replace highlights as translucent
rgba overlays that read correctly on both light and dark surfaces. Light
themes render essentially as before; dark themes now inherit their dark
surface and light text. Applied to every theme so the shared stylesheet
stays identical.
* Band diff code columns on dark themes
On the dark themes the unchanged (context) code column and the
line-number gutter read too similarly, making the actual diff on the
right hard to pick out. Give the context old/new code cells a subtle
dark band (rgba(0,0,0,.25)) so the code reads as a panel distinct from
the lighter line-number gutter. Applied to dark, sunrise and paper-plane;
for midwinter the band is scoped to its dark color-mode only. Light
themes are unchanged.
* chore: replace unmaintained phpdiff vendor lib with jfcherng/php-diff
The manually-vendored include/vendor/phpdiff (chrisboulton/php-diff v1.1,
2009 - unmaintained since ~2013) backed the package-import file diff
viewer (package_import.php's package_diff_file()), its only call site.
Replace it with jfcherng/php-diff (^6.16, BSD-3-Clause), an actively
maintained continuation of the same library, declared as a real Composer
dependency in composer.json/composer.lock (installed at build/CI time,
same as this branch's other composer.json dependencies - not committed
to include/vendor, unlike the old hand-vendored phpdiff).
package_import.php now uses Jfcherng\Diff\Differ + RendererFactory in
place of the old Diff/Diff_Renderer_Html_Inline classes. Preserved the
existing nosemgrep justification comment, updated to reference the new
library's AbstractHtml::htmlSafe() escaping.
Adopted the vendor's own diff-table.css as the Diff.css in all 10 themes,
replacing the bespoke per-theme stylesheets that were tied to the old
library's class names.
* fix: address review feedback on jfcherng/php-diff migration
- package_import.php: narrow $oldfile/$newfile to array before
constructing Jfcherng\Diff\Differ so PHPStan can see the
false branch is excluded (fixes level 6/8 analysis failure).
- tests/tools/check_vendor_policy.php: drop the removed
include/vendor/phpdiff/ path from the legacy allowlist.
- tests/Unit/Security/Xss/PackageDiffRendererTest.php: rewrite
against the new Jfcherng\Diff\Differ/RendererFactory API instead
of the deleted vendored phpdiff classes.
TheWitness