Ts-jest version 24.0.2 brings subtle improvements over its predecessor, version 24.0.1, aimed at enhancing the developer experience when using TypeScript with Jest. Both versions provide a preprocessor with source maps, facilitating debugging TypeScript code within Jest tests. Developers relying on ts-jest for seamless integration of TypeScript in their testing workflow will find these releases valuable.
A close examination reveals identical dependency and devDependency listings, suggesting that the core functionality and development tooling remain consistent between the two versions. The peer dependency for Jest remains the same, requiring a version greater or equal to 24 and less than 25, ensuring compatibility within that Jest range. The key differences lie in the nuanced aspects of the release. The unpacked size of version 24.0.2 is marginally bigger at 223511 bytes, compared to 222969 bytes which can point to some code changes even thought it's probably a small change, indicating slight internal code adjustments or refinements. The release date of version 24.0.2 is April 5, 2019, while version 24.0.1 was released on March 30, 2019, showcasing a relatively short interval between releases. This suggests a potentially quick response to bug fixes or minor enhancements identified shortly after the 24.0.1 release. Developers should investigate commit logs between these versions for granular details on the implemented changes. The file count is the same for both versions, which is 75 files. Although this is not a big difference, it is important to know it in case of trying to debug or comparing both version features.
All the vulnerabilities related to the version 24.0.2 of the package
yargs-parser Vulnerable to Prototype Pollution
Affected versions of yargs-parser are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --foo.__proto__.bar baz' adds a bar property with value baz to all objects. This is only exploitable if attackers have control over the arguments being passed to yargs-parser.
Upgrade to versions 13.1.2, 15.0.1, 18.1.1 or later.
