Ts-jest version 24.1.0 introduces subtle but noteworthy changes compared to the previous stable version 24.0.2, primarily impacting the development dependencies and potentially the underlying tooling employed. While the core dependencies remain consistent, including familiar names like json5, mkdirp, and semver, the devDependencies showcase some upgrades indicating improvements in the development workflow.
A key difference lies in the update of @commitlint/cli from version 7.x to 8.x. This upgrade signals an advancement in the commit linting process, which might translate to stricter or more refined commit message enforcement, enhancing project maintainability and collaboration of developers using the library. Furthermore, the inclusion of several new @types packages, specifically @types/cross-spawn, @types/lodash.merge and @types/lodash.memoize for both version 4.x implies a refinement of the TypeScript definitions available during development when one uses these packages. The updated release date, unpacked size (reduced significantly), and the number of files also speak to changes in the bundling or optimization of the package.
For developers using ts-jest, these changes suggest a continued commitment to code quality and developer experience, while ensuring compatibility with the Jest testing framework. The upgrade to newer versions of development tools can contribute to a smoother development cycle, fewer errors, and a more robust testing environment. Developers should examine the changelog for @commitlint/cli to understand the specific impact of this update on their commit workflow.
All the vulnerabilities related to the version 24.1.0 of the package
yargs-parser Vulnerable to Prototype Pollution
Affected versions of yargs-parser
are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object
, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --foo.__proto__.bar baz'
adds a bar
property with value baz
to all objects. This is only exploitable if attackers have control over the arguments being passed to yargs-parser
.
Upgrade to versions 13.1.2, 15.0.1, 18.1.1 or later.