Skip to content

[Snyk] Fix for 1 vulnerabilities#3705

Open
cc-prodsec wants to merge 1 commit intorelease-2.9.xfrom
snyk-fix-822d063b70001fcf7f3ea27249b7c24b
Open

[Snyk] Fix for 1 vulnerabilities#3705
cc-prodsec wants to merge 1 commit intorelease-2.9.xfrom
snyk-fix-822d063b70001fcf7f3ea27249b7c24b

Conversation

@cc-prodsec
Copy link
Collaborator

snyk-top-banner

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

  • packages/internal-lib-build/package.json
  • packages/internal-lib-build/package-lock.json

Vulnerabilities that will be fixed with an upgrade:

Issue Score
medium severity Incorrect Control Flow Scoping
SNYK-JS-TOOTALLNATEONCE-15250612
  633  

Breaking Change Risk

Merge Risk: High

Notice: This assessment is enhanced by AI.


Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

…-build/package-lock.json to reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-TOOTALLNATEONCE-15250612
@cc-prodsec cc-prodsec requested a review from a team as a code owner March 3, 2026 09:49
@cc-prodsec
Copy link
Collaborator Author

Merge Risk: High

This is a multi-version major upgrade for the Jest testing framework, introducing significant breaking changes that require configuration and code updates.

jest@26.6.3 → jest@28.0.0

Key Breaking Changes:

  • Node.js Version: Support for Node.js 10 and 15 is dropped. Jest 28 requires Node.js versions 12.13, 14.15, or 16.10 and above.
  • Default Environment: The default test environment has been changed from jsdom to node. If your tests rely on DOM APIs (like document or window), you must explicitly set "testEnvironment": "jsdom" in your Jest configuration.
  • Configuration Renames: Several configuration options have been renamed. For example, testURL is now testEnvironmentOptions.url.
  • expect.toHaveProperty: The behavior of toHaveProperty has changed to check for property existence rather than equality with undefined.
  • Modern Fake Timers: The default implementation for fake timers is now the "modern" one, based on @sinonjs/fake-timers.

jest-environment-jsdom@26.6.2 → jest-environment-jsdom@30.0.0

Key Breaking Changes:

  • Separate Installation: Starting with Jest 28, jest-environment-jsdom is no longer bundled with Jest and must be installed as a separate dependency.
  • JSDOM Upgrades: This upgrade spans multiple major versions of jsdom (v16 → v26), which may introduce subtle behavior changes and stricter spec compliance. Mocking window.location might be affected.
  • TypeScript Version: The minimum required TypeScript version is increased, reaching 5.4 for the latest versions.
  • Snapshot Formatting: The default snapshot format changed in v29, which will likely require you to update your existing snapshots.

Recommendation:

  1. Add jest-environment-jsdom as an explicit dev dependency to your package.json.
  2. Update your Jest configuration file (jest.config.js) to set testEnvironment: 'jsdom'.
  3. Review and update renamed configuration options like testURL.
  4. Run your test suite and expect to update snapshots due to formatting changes.
  5. Carefully review any tests that use toHaveProperty or mock window.location for behavioral changes.

Source: Jest 27 Release Notes, Jest 28 Release Notes

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

@cc-prodsec
Copy link
Collaborator Author

cc-prodsec commented Mar 3, 2026

Snyk checks have passed. No issues have been found so far.

Status Scanner Critical High Medium Low Total (0)
Open Source Security 0 0 0 0 0 issues
Licenses 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants