jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch

## Security Vulnerability: Denial of Service (DoS) in `jsdiff`

### Vulnerability Overview
A vulnerability has been identified in `jsdiff` where certain line break characters can lead to an infinite loop and potential memory exhaustion.

| Detail | Description |
| :--- | :--- |
| **Package** | `diff` (npm: `jsdiff`) |
| **Affected Versions** | `< 8.0.3` |
| **Patched Version** | `8.0.3` |

---

### Impact
The `parsePatch` method is vulnerable to an **infinite loop** when processing filename headers containing specific line break characters: `\r`, `\u2028`, or `\u2029`.

**Key risks:**
* **Memory Exhaustion:** The process will consume memory indefinitely until it crashes (Out of Memory).
* **Denial of Service (DoS):** Attackers can trigger this with a very small payload; size limits on user input do **not** provide protection.
* **Affected Methods:** Both `parsePatch` and `applyPatch` (when used with string inputs) are affected.
* **Secondary Issue:** A lesser **ReDOS** (Regular Expression Denial of Service) exists in the patch header parsing, which can lead to $O(n^3)$ time complexity.

---

### Patches
✅ All identified vulnerabilities have been fixed in **v8.0.3**.

Users are strongly encouraged to upgrade as soon as possible:
```bash
npm install diff@8.0.3
```

See: https://github.com/kpdecker/jsdiff/pull/649

Start by checking BackstopJS's dependency declaration for the npm package `diff` and confirm which version is installed. Review the `parsePatch` and `applyPatch` vulnerability details, then verify that the dependency is at least 8.0.3 and that the project’s relevant tests still pass.

Written by the indexing model from the issue text.