mirror of
https://github.com/Cacti/cacti.git
synced 2026-10-28 07:37:11 +09:00
TheWitness
1a37594ad6
* chore: replace unmaintained phpdiff vendor lib with jfcherng/php-diff The manually-vendored include/vendor/phpdiff (chrisboulton/php-diff v1.1, 2009 - unmaintained since ~2013) backed the package-import file diff viewer (package_import.php's package_diff_file()), its only call site. Replace it with jfcherng/php-diff (^6.16, BSD-3-Clause), an actively maintained continuation of the same library, declared as a real Composer dependency in composer.json/composer.lock (installed at build/CI time, same as this branch's other composer.json dependencies - not committed to include/vendor, unlike the old hand-vendored phpdiff). package_import.php now uses Jfcherng\Diff\Differ + RendererFactory in place of the old Diff/Diff_Renderer_Html_Inline classes. Preserved the existing nosemgrep justification comment, updated to reference the new library's AbstractHtml::htmlSafe() escaping. Adopted the vendor's own diff-table.css as the Diff.css in all 10 themes, replacing the bespoke per-theme stylesheets that were tied to the old library's class names. * fix: address review feedback on jfcherng/php-diff migration - package_import.php: narrow $oldfile/$newfile to array before constructing Jfcherng\Diff\Differ so PHPStan can see the false branch is excluded (fixes level 6/8 analysis failure). - tests/tools/check_vendor_policy.php: drop the removed include/vendor/phpdiff/ path from the legacy allowlist. - tests/Unit/Security/Xss/PackageDiffRendererTest.php: rewrite against the new Jfcherng\Diff\Differ/RendererFactory API instead of the deleted vendored phpdiff classes.