Ts-jest version 24.0.1 is a patch release addressing potential issues and providing minor improvements over the previous stable version, 24.0.0. Both versions serve as preprocessors, designed to enable seamless use of TypeScript with the Jest testing framework, crucial for developers employing type-safe JavaScript. Developers can leverage features like source map support for easier debugging and a streamlined testing workflow for TypeScript projects, thanks to this integration.
Examining the package metadata, the core dependencies remain consistent between the two versions. This means the fundamental libraries that ts-jest relies on — such as json5 for JSON-like configuration, mkdirp for directory creation, and semver for version management — are unchanged. Similarly, development dependencies, including testing frameworks (Jest), linting tools (ESLint, TSLint), and TypeScript-related type definitions, are also consistent. This consistency implies that the core functionality and developer tooling support remain stable.
A notable, however small, difference lies in the unpacked size of the package, with version 24.0.1 being slightly larger. This may suggest minor code changes, updated documentation, or other non-functional adjustments. Developers who depend on minimizing package size might want to investigate the cause of the size difference further. The release date also indicates that 24.0.1 was released about a month and a half after 24.0.0, suggesting that the changes likely resolved issues discovered after the initial release of 24.0.0. Both versions maintain a peer dependency on Jest within the 24.x range, ensuring compatibility with Jest 24.x versions preventing incompatibility.
All the vulnerabilities related to the version 24.0.1 of the package
yargs-parser Vulnerable to Prototype Pollution
Affected versions of yargs-parser
are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object
, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --foo.__proto__.bar baz'
adds a bar
property with value baz
to all objects. This is only exploitable if attackers have control over the arguments being passed to yargs-parser
.
Upgrade to versions 13.1.2, 15.0.1, 18.1.1 or later.