[Bug]: Security issues in the underlying packages
envgap__kulshekhar__ts-jest-4168
01 / FAILURE SIGNATURE
As reported upstream
No identifying execution failure has been captured.
Not a benchmark task.
- The project already builds and runs before the fix, so there is nothing to repair.
02 / ENVIRONMENT RECIPE
- Base commit
f4f7daeafd8bc4adada99e569a7ab3097ac238b5- Manifest
package.json- Reproduce
Awaiting issue-specific recipe- Run under trace
Awaiting a meaningful runtime command
03 / ORIGINAL ISSUE TEXT
kulshekhar/ts-jest #4168 · read the original issue
### Version
29.1.0
### Steps to reproduce
Before yesterday, `npm i` reported only 4 low vulnerabilities. But yesterday it suddenly started showing 32 moderate vulnerabilities.
This package is flagged, but additional issues might need to be created on the dependency packages.
P.S. you guys need a [Security] issue template.
```bash
semver <7.5.2
Severity: moderate
semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
fix available via `npm audit fix --force`
Will install ts-jest@27.0.3, which is a breaking change
node_modules/@babel/core/node_modules/semver
node_modules/@babel/helper-compilation-targets/node_modules/semver
node_modules/child-process-ext/node_modules/semver
node_modules/istanbul-lib-instrument/node_modules/semver
node_modules/make-dir/node_modules/semver
@babel/core *
Depends on vulnerable versions of @babel/helper-compilation-targets
Depends on vulnerable versions of semver
node_modules/@babel/core
@babel/helper-compilation-targets *
Depends on vulnerable versions of @babel/core
Depends on vulnerable versions of semver
node_modules/@babel/helper-compilation-targets
@jest/transform *
Depends on vulnerable versions of @babel/core
Depends on vulnerable versions of babel-plugin-istanbul
node_modules/@jest/transform
@jest/core *
Depends on vulnerable versions of @jest/reporters
Depends on vulnerable versions of @jest/transform
Depends on vulnerable versions of jest-config
Depends on vulnerable versions of jest-resolve-dependencies
Depends on vulnerable versions of jest-runner
Depends on vulnerable versions of jest-runtime
Depends on vulnerable versions of jest-snapshot
node_modules/@jest/core
jest >=24.0.0-alpha.0
Depends on vulnerable versions of @jest/core
Depends on vulnerable versions of jest-cli
node_modules/jest
ts-jest >=25.10.0-alpha.1
Depends on vulnerable versions of babel-jest
Depends on vulnerable versions of jest
node_modules/ts-jest
jest-cli >=24.0.0-alpha.0
Depends on vulnerable versions of @jest/core
Depends on vulnerable versions of jest-config
node_modules/jest-cli
babel-jest >=18.5.0-alpha.7da3df39
Depends on vulnerable versions of @babel/core
Depends on vulnerable versions of @jest/transform
Depends on vulnerable versions of babel-plugin-istanbul
Depends on vulnerable versions of babel-preset-jest
node_modules/babel-jest
jest-runner >=24.2.0-alpha.0
Depends on vulnerable versions of @jest/transform
Depends on vulnerable versions of jest-runtime
node_modules/jest-runner
jest-config >=24.0.0-alpha.0
Depends on vulnerable versions of @babel/core
Depends on vulnerable versions of babel-jest
Depends on vulnerable versions of jest-circus
Depends on vulnerable versions of jest-runner
node_modules/jest-config
jest-runtime >=24.2.0-alpha.0
Depends on vulnerable versions of @jest/globals
Depends on vulnerable versions of @jest/transform
Depends on vulnerable versions of jest-snapshot
node_modules/jest-runtime
jest-circus >=25.2.4
Depends on vulnerable versions of @jest/expect
Depends on vulnerable versions of jest-runtime
Depends on vulnerable versions of jest-snapshot
node_modules/jest-circus
babel-preset-current-node-syntax *
Depends on vulnerable versions of @babel/core
node_modules/babel-preset-current-node-syntax
babel-preset-jest >=24.2.0-alpha.0
Depends on vulnerable versions of @babel/core
Depends on vulnerable versions of babel-preset-current-node-syntax
node_modules/babel-preset-jest
istanbul-lib-instrument >=1.2.0
Depends on vulnerable versions of @babel/core
Depends on vulnerable versions of semver
node_modules/istanbul-lib-instrument
@jest/reporters *
Depends on vulnerable versions of @jest/transform
Depends on vulnerable versions of istanbul-lib-instrument
Depends on vulnerable versions of istanbul-lib-report
Depends on vulnerable versions of istanbul-reports
node_modules/@jest/reporters
babel-plugin-istanbul >=3.1.0-candidate.0
Depends on vulnerable versions of istanbul-lib-instrument
node_modules/babel-plugin-istanbul
jest-snapshot >=27.0.0-next.0
Depends on vulnerable versions of @babel/core
Depends on vulnerable versions of @jest/transform
Depends on vulnerable versions of babel-preset-current-node-syntax
node_modules/jest-snapshot
@jest/expect *
Depends on vulnerable versions of jest-snapshot
node_modules/@jest/expect
@jest/globals >=28.0.0-alpha.0
Depends on vulnerable versions of @jest/expect
node_modules/@jest/globals
jest-resolve-dependencies >=27.0.0-next.0
Depends on vulnerable versions of jest-snapshot
node_modules/jest-resolve-dependencies
cross-spawn 6.0.0 - 6.0.5
Depends on vulnerable versions of semver
node_modules/child-process-ext/node_modules/cross-spawn
child-process-ext *
Depends on vulnerable versions of cross-spawn
node_modules/child-process-ext
@serverless/dashboard-plugin *
Depends on vulnerable versions of @serverless/utils
Depends on vulnerable versions of child-process-ext
node_modules/@serverless/dashboard-plugin
serverless >=1.61.0
Depends on vulnerable versions of @serverless/dashboard-plugin
Depends on vulnerable versions of @serverless/utils
Depends on vulnerable versions of child-process-ext
node_modules/serverless
serverless-plugin-typescript 2.0.0 - 2.1.5
Depends on vulnerable versions of serverless
node_modules/serverless-plugin-typescript
make-dir 2.0.0 - 3.1.0
Depends on vulnerable versions of semver
node_modules/make-dir
@serverless/utils >=5.1.0
Depends on vulnerable versions of make-dir
node_modules/@serverless/utils
serverless-offline >=9.0.0
Depends on vulnerable versions of @serverless/utils
Depends on vulnerable versions of serverless
node_modules/serverless-offline
istanbul-lib-report >=2.0.5
Depends on vulnerable versions of make-dir
node_modules/istanbul-lib-report
istanbul-reports >=3.0.0-alpha.0
Depends on vulnerable versions of istanbul-lib-report
node_modules/istanbul-reports
36 vulnerabilities (4 low, 32 moderate)
```
### Expected behavior
There should be no vulnerabilities.
### Actual behavior
There are 32 new vulnerabilities.
### Debug log
None
### Additional context
_No response_
### Environment
```shell
OS: Linux, Windows, Mac
Node: 16 and 18
```
04 / LABELS
Labels from the report text only; not yet run
No supported category has been assigned.
Label rules and the text that matched
[]