Ts-jest transitioned from version 24.3.0 to 25.0.0, primarily upgrading its peer dependency on Jest, the testing framework it preprocesses TypeScript code for. Version 24.3.0 had a peer dependency requiring Jest versions greater than or equal to 24 but less than 25. The newer 25.0.0 broadened this to Jest versions greater than or equal to 25 but less than 26, aligning with the Jest ecosystem's advancements.
Both versions maintain identical core dependencies, including essentials like json5, mkdirp, semver, resolve, bs-logger, make-error, buffer-from, yargs-parser, lodash.memoize, and fast-json-stable-stringify. These underpin the core functionality of transpiling and processing TypeScript for Jest. Similarly, their development dependencies showcase a consistent suite of tools focused on linting, formatting, and build processes. Core dev tools included typescript, eslint, prettier, tslint, and related type definitions.
Developers upgrading to ts-jest 25.0.0 should primarily verify their Jest version compatibility. Staying within the >=25 <26 range ensures seamless integration. The consistent dependency structure otherwise suggests a smooth transition, with changes largely contained within the peer dependency definition to track the evolution of Jest. This ensures ongoing compatibility and support for the latest Jest features within a TypeScript testing environment. Both versions offer the same MIT license and are accessible via the same GitHub repository.
All the vulnerabilities related to the version 25.0.0 of the package
yargs-parser Vulnerable to Prototype Pollution
Affected versions of yargs-parser are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --foo.__proto__.bar baz' adds a bar property with value baz to all objects. This is only exploitable if attackers have control over the arguments being passed to yargs-parser.
Upgrade to versions 13.1.2, 15.0.1, 18.1.1 or later.
