Ts-jest version 24.0.0 represents a significant update from the previous stable version 23.10.5. Both versions serve as preprocessors, enabling developers to seamlessly integrate TypeScript with the Jest testing framework, complete with source map support. A key difference lies in the supported Jest versions. Version 24.0.0 requires Jest within the range of >=24 and <25, whereas version 23.10.5 supports Jest >=22 and <24. This shift necessitates an upgrade of Jest for users migrating to the newer ts-jest.
Examining the devDependencies, a notable change is the update to husky from version 0.x to 1.x. Although both versions share many of the same dependencies, including eslint,tslint, prettier and typescript, it is important to verify version compatibility for the entire toolchain when upgrading. For example, make sure that the other devDependencies like @types/jest and @types/node are compatible with the new main dependencies, specifically typescript and jest.
Developers should be aware of these peer dependency and devDependency updates when choosing a version. Version 24.0.0, released in February 2019, includes several dependency updates, likely incorporating bug fixes, performance enhancements, and new features from its dependent libraries. Conversely, version 23.10.5, released in November 2018, might lack these improvements. While the core functionalities remain consistent, developers should evaluate the trade-offs between stability with an older version and potential enhancements in the latest release. Consider testing the newer version in a non-production environment by checking for smooth migration and full toolchain compatibility.
All the vulnerabilities related to the version 24.0.0 of the package
yargs-parser Vulnerable to Prototype Pollution
Affected versions of yargs-parser are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --foo.__proto__.bar baz' adds a bar property with value baz to all objects. This is only exploitable if attackers have control over the arguments being passed to yargs-parser.
Upgrade to versions 13.1.2, 15.0.1, 18.1.1 or later.
