Skip to content

[Snyk] Security upgrade babel-jest from 26.6.3 to 27.0.0#3807

Open
cc-prodsec wants to merge 1 commit into
release-2.11.xfrom
snyk-fix-8e52a24eea8ca9605fd3de63b0ba19ec
Open

[Snyk] Security upgrade babel-jest from 26.6.3 to 27.0.0#3807
cc-prodsec wants to merge 1 commit into
release-2.11.xfrom
snyk-fix-8e52a24eea8ca9605fd3de63b0ba19ec

Conversation

@cc-prodsec

Copy link
Copy Markdown
Collaborator

snyk-top-banner

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

  • packages/internal-lib-build/package.json
  • packages/internal-lib-build/package-lock.json

Vulnerabilities that will be fixed with an upgrade:

Issue Score
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-CROSSSPAWN-8303230
  756  

Breaking Change Risk

Merge Risk: High

Notice: This assessment is enhanced by AI.


Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)

…-build/package-lock.json to reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230
@cc-prodsec

Copy link
Copy Markdown
Collaborator Author

Merge Risk: High

This major version upgrade is part of the Jest 27 release, which introduces significant breaking changes and new defaults. Developer action is required to ensure tests continue to pass.

Key Breaking Changes:

  • Default Test Environment: The default test environment has changed from jsdom to node. [3] If your tests rely on browser APIs like document or window, you must explicitly set "testEnvironment": "jsdom" in your Jest configuration to avoid failures. [3]
  • babel-jest Transformer Usage: If you use createTransformer, the import has changed due to the package's migration to ESM. You must now use require('babel-jest').default.createTransformer(...). [1, 10]
  • Stricter Test Execution: Jest 27 is stricter and will now fail tests in the following cases: calling the done() callback more than once, mixing done() with a returned Promise, or returning a value from a describe block. [1, 3, 5]
  • Fake Timers: The 'modern' implementation of fake timers is now the default, which could affect tests relying on jest.useFakeTimers(). The previous behavior can be restored by using jest.useFakeTimers('legacy') or setting "timers": "legacy" in the configuration. [3, 10]

Recommendation: Review your Jest configuration to set the testEnvironment. Inspect tests for patterns that are no longer allowed, such as returning values from describe blocks or misusing the done callback. Update any custom transformer creation to use the new default import. [5, 10]

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

@cc-prodsec cc-prodsec requested a review from a team as a code owner April 28, 2026 09:09
@git2gus

git2gus Bot commented Apr 28, 2026

Copy link
Copy Markdown

Git2Gus App is installed but the .git2gus/config.json doesn't have right values. You should add the required configuration.

@cc-prodsec

cc-prodsec commented Apr 28, 2026

Copy link
Copy Markdown
Collaborator Author

Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
Open Source Security 0 0 0 0 0 issues
Licenses 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants