← All tasks
javascriptkulshekhar/ts-jest #4168Not a task: already works

[Bug]: Security issues in the underlying packages

envgap__kulshekhar__ts-jest-4168

01 / FAILURE SIGNATURE

As reported upstream

No identifying execution failure has been captured.
Not a benchmark task.
  • The project already builds and runs before the fix, so there is nothing to repair.

02 / ENVIRONMENT RECIPE

Base commit
f4f7daeafd8bc4adada99e569a7ab3097ac238b5
Manifest
package.json
Reproduce
Awaiting issue-specific recipe
Run under trace
Awaiting a meaningful runtime command

03 / ORIGINAL ISSUE TEXT

kulshekhar/ts-jest #4168 · read the original issue
### Version

29.1.0

### Steps to reproduce

Before yesterday, `npm i` reported only 4 low vulnerabilities. But yesterday it suddenly started showing 32 moderate vulnerabilities.



This package is flagged, but additional issues might need to be created on the dependency packages.



P.S. you guys need a [Security] issue template.



```bash

semver  <7.5.2

Severity: moderate

semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw

fix available via `npm audit fix --force`

Will install ts-jest@27.0.3, which is a breaking change

node_modules/@babel/core/node_modules/semver

node_modules/@babel/helper-compilation-targets/node_modules/semver

node_modules/child-process-ext/node_modules/semver

node_modules/istanbul-lib-instrument/node_modules/semver

node_modules/make-dir/node_modules/semver

  @babel/core  *

  Depends on vulnerable versions of @babel/helper-compilation-targets

  Depends on vulnerable versions of semver

  node_modules/@babel/core

    @babel/helper-compilation-targets  *

    Depends on vulnerable versions of @babel/core

    Depends on vulnerable versions of semver

    node_modules/@babel/helper-compilation-targets

    @jest/transform  *

    Depends on vulnerable versions of @babel/core

    Depends on vulnerable versions of babel-plugin-istanbul

    node_modules/@jest/transform

      @jest/core  *

      Depends on vulnerable versions of @jest/reporters

      Depends on vulnerable versions of @jest/transform

      Depends on vulnerable versions of jest-config

      Depends on vulnerable versions of jest-resolve-dependencies

      Depends on vulnerable versions of jest-runner

      Depends on vulnerable versions of jest-runtime

      Depends on vulnerable versions of jest-snapshot

      node_modules/@jest/core

        jest  >=24.0.0-alpha.0

        Depends on vulnerable versions of @jest/core

        Depends on vulnerable versions of jest-cli

        node_modules/jest

          ts-jest  >=25.10.0-alpha.1

          Depends on vulnerable versions of babel-jest

          Depends on vulnerable versions of jest

          node_modules/ts-jest

        jest-cli  >=24.0.0-alpha.0

        Depends on vulnerable versions of @jest/core

        Depends on vulnerable versions of jest-config

        node_modules/jest-cli

      babel-jest  >=18.5.0-alpha.7da3df39

      Depends on vulnerable versions of @babel/core

      Depends on vulnerable versions of @jest/transform

      Depends on vulnerable versions of babel-plugin-istanbul

      Depends on vulnerable versions of babel-preset-jest

      node_modules/babel-jest

      jest-runner  >=24.2.0-alpha.0

      Depends on vulnerable versions of @jest/transform

      Depends on vulnerable versions of jest-runtime

      node_modules/jest-runner

        jest-config  >=24.0.0-alpha.0

        Depends on vulnerable versions of @babel/core

        Depends on vulnerable versions of babel-jest

        Depends on vulnerable versions of jest-circus

        Depends on vulnerable versions of jest-runner

        node_modules/jest-config

      jest-runtime  >=24.2.0-alpha.0

      Depends on vulnerable versions of @jest/globals

      Depends on vulnerable versions of @jest/transform

      Depends on vulnerable versions of jest-snapshot

      node_modules/jest-runtime

        jest-circus  >=25.2.4

        Depends on vulnerable versions of @jest/expect

        Depends on vulnerable versions of jest-runtime

        Depends on vulnerable versions of jest-snapshot

        node_modules/jest-circus

    babel-preset-current-node-syntax  *

    Depends on vulnerable versions of @babel/core

    node_modules/babel-preset-current-node-syntax

      babel-preset-jest  >=24.2.0-alpha.0

      Depends on vulnerable versions of @babel/core

      Depends on vulnerable versions of babel-preset-current-node-syntax

      node_modules/babel-preset-jest

    istanbul-lib-instrument  >=1.2.0

    Depends on vulnerable versions of @babel/core

    Depends on vulnerable versions of semver

    node_modules/istanbul-lib-instrument

      @jest/reporters  *

      Depends on vulnerable versions of @jest/transform

      Depends on vulnerable versions of istanbul-lib-instrument

      Depends on vulnerable versions of istanbul-lib-report

      Depends on vulnerable versions of istanbul-reports

      node_modules/@jest/reporters

      babel-plugin-istanbul  >=3.1.0-candidate.0

      Depends on vulnerable versions of istanbul-lib-instrument

      node_modules/babel-plugin-istanbul

    jest-snapshot  >=27.0.0-next.0

    Depends on vulnerable versions of @babel/core

    Depends on vulnerable versions of @jest/transform

    Depends on vulnerable versions of babel-preset-current-node-syntax

    node_modules/jest-snapshot

      @jest/expect  *

      Depends on vulnerable versions of jest-snapshot

      node_modules/@jest/expect

        @jest/globals  >=28.0.0-alpha.0

        Depends on vulnerable versions of @jest/expect

        node_modules/@jest/globals

      jest-resolve-dependencies  >=27.0.0-next.0

      Depends on vulnerable versions of jest-snapshot

      node_modules/jest-resolve-dependencies

  cross-spawn  6.0.0 - 6.0.5

  Depends on vulnerable versions of semver

  node_modules/child-process-ext/node_modules/cross-spawn

    child-process-ext  *

    Depends on vulnerable versions of cross-spawn

    node_modules/child-process-ext

      @serverless/dashboard-plugin  *

      Depends on vulnerable versions of @serverless/utils

      Depends on vulnerable versions of child-process-ext

      node_modules/@serverless/dashboard-plugin

        serverless  >=1.61.0

        Depends on vulnerable versions of @serverless/dashboard-plugin

        Depends on vulnerable versions of @serverless/utils

        Depends on vulnerable versions of child-process-ext

        node_modules/serverless

          serverless-plugin-typescript  2.0.0 - 2.1.5

          Depends on vulnerable versions of serverless

          node_modules/serverless-plugin-typescript

  make-dir  2.0.0 - 3.1.0

  Depends on vulnerable versions of semver

  node_modules/make-dir

    @serverless/utils  >=5.1.0

    Depends on vulnerable versions of make-dir

    node_modules/@serverless/utils

      serverless-offline  >=9.0.0

      Depends on vulnerable versions of @serverless/utils

      Depends on vulnerable versions of serverless

      node_modules/serverless-offline

    istanbul-lib-report  >=2.0.5

    Depends on vulnerable versions of make-dir

    node_modules/istanbul-lib-report

      istanbul-reports  >=3.0.0-alpha.0

      Depends on vulnerable versions of istanbul-lib-report

      node_modules/istanbul-reports



36 vulnerabilities (4 low, 32 moderate)

```

### Expected behavior

There should be no vulnerabilities.

### Actual behavior

There are 32 new vulnerabilities.

### Debug log

None

### Additional context

_No response_

### Environment

```shell
OS: Linux, Windows, Mac

Node: 16 and 18
```
Continue on GitHub ↗

04 / LABELS

Labels from the report text only; not yet run

No supported category has been assigned.

Label rules and the text that matched
[]