Ts-jest, a popular preprocessor enabling TypeScript usage with Jest, saw significant dependency changes between version 23.1.4 and 23.10.0. The later version shifted from specific versions to broader ranges in its dependencies, aiming for more flexibility. For instance, json5 moved from ^0.5.0 to 2.x, and lodash was completely replaced with lodash.set and lodash.memoize. New dependencies were introduced, including mkdirp, semver, bs-logger, make-error, buffer-from, yargs-parser, and fast-json-stable-stringify.
Development dependencies also underwent a major overhaul. Specific versions of tools like eslint, prettier, and typescript were dropped in favor of broader ranges. Key additions included @commitlint/cli, conventional-changelog-cli, glob-gitignore, and numerous type definition packages (@types/*). These changes suggest a focus on improved code quality, standardization, and developer experience. The older version had dependencies such as react and @babel/core, that are unnecesary for the functionality of the library itself.
The peer dependencies also changed. While both require jest, the ranges differ, the previous one accept versions 23 and 24 where the new release only accept 22 and 23. The newer version explicitly drops the babel-core and babel-jest peer dependencies, streamlining the configuration process. These adjustments signal a move towards a more modular and maintainable codebase, potentially reducing conflicts and simplifying integration for developers using ts-jest. The file count within the package also decreased, hinting at a smaller and potentially more efficient installation. If you're upgrading, carefully review these dependency changes.
All the vulnerabilities related to the version 23.10.0 of the package
yargs-parser Vulnerable to Prototype Pollution
Affected versions of yargs-parser are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --foo.__proto__.bar baz' adds a bar property with value baz to all objects. This is only exploitable if attackers have control over the arguments being passed to yargs-parser.
Upgrade to versions 13.1.2, 15.0.1, 18.1.1 or later.
