Ts-jest version 23.10.4 is a minor update to the popular TypeScript preprocessor for the Jest testing framework, building upon the functionality offered in version 23.10.3. Both versions provide seamless integration of TypeScript into Jest testing workflows, boasting features like source map support for accurate debugging and compatibility with various TypeScript versions (3.x). Developers leveraging ts-jest can write their unit and integration tests in TypeScript, taking advantage of static typing and modern language features.
The core dependencies in both versions remain consistent, including essential packages like json5, mkdirp, semver, bs-logger, make-error, buffer-from, yargs-parser, and fast-json-stable-stringify, ensuring a stable foundation for processing TypeScript code. Similarly, the development dependencies, which encompass testing, linting, and build tools such as jest, eslint, tslint, prettier, and various @types definitions, are largely unchanged. This suggests that the update primarily addresses internal improvements or bug fixes rather than introducing significant new features or modifications to the core development environment.
Notably, the dist object reveals a slight increase in fileCount (from 70 to 76) and unpackedSize (from 216292 to 223668 bytes) in version 23.10.4. This indicates the addition of new files and potentially some code expansion, although without further context, the precise nature of these changes remains unclear. The release date also indicates that version 23.10.4 came out one week after version 23.10.3. Developers upgrading should consider reviewing the detailed changelog for specific fixes or enhancements.
All the vulnerabilities related to the version 23.10.4 of the package
yargs-parser Vulnerable to Prototype Pollution
Affected versions of yargs-parser are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --foo.__proto__.bar baz' adds a bar property with value baz to all objects. This is only exploitable if attackers have control over the arguments being passed to yargs-parser.
Upgrade to versions 13.1.2, 15.0.1, 18.1.1 or later.
