Ts-jest version 25.2.1 is a minor update to the popular TypeScript preprocessor for Jest, building upon version 25.2.0. Both versions aim to seamlessly integrate TypeScript testing into Jest projects, providing source maps for accurate debugging and a streamlined development experience.
Key differences between the versions lie primarily in the dependency updates. Version 25.2.1 upgrades yargs-parser to version ^16.1.0 and introduces a new dev dependency @types/yargs-parser with version ^15.0.0. In contrast, version 25.2.0 utilizes yargs-parser version 10.x. Additionally, husky was updated from 1.x to 3.x. These updates likely address bug fixes, performance improvements, or security vulnerabilities within the respective packages.
For developers using ts-jest, these changes translate to potentially improved command-line argument parsing, enhanced tooling for contributors, and an overall more stable testing environment. While the core functionality of ts-jest remains consistent – allowing Jest to understand and execute TypeScript tests – staying up-to-date with the latest minor version ensures that developers benefit from the most recent enhancements and security patches within the dependency tree. Furthermore, the peer dependency on Jest remains at ">=25 <26" signifying compatibility with the Jest 25.x series. Developers should thus carefully evaluate the benefits of these minor updates of ts-jest in relation to their existing dependency management strategy.
All the vulnerabilities related to the version 25.2.1 of the package
yargs-parser Vulnerable to Prototype Pollution
Affected versions of yargs-parser are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --foo.__proto__.bar baz' adds a bar property with value baz to all objects. This is only exploitable if attackers have control over the arguments being passed to yargs-parser.
Upgrade to versions 13.1.2, 15.0.1, 18.1.1 or later.
