[Bug]: Optional peer dependency on ts-node pulls in vulnerable diff, cannot be excluded

[weikangchia]

Version

Jest: various versions that depend on jest-config requiring ts-node as a peer

Steps to reproduce

Install jest

Expected behavior

Actual behavior

Additional context

No response

Environment

-

[raheel-iso365]

yep, I got it too.

npm audit
# npm audit report

diff  <8.0.3
jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch - https://github.com/advisories/GHSA-73rr-hh4g-fpgx
fix available via `npm audit fix --force`
Will install ts-node@1.7.1, which is a breaking change
node_modules/diff
  ts-node  <=1.4.3 || >=1.7.2
  Depends on vulnerable versions of diff
  node_modules/ts-node
    jest-config  >=26.6.0
    Depends on vulnerable versions of ts-node
    node_modules/jest-config
      @jest/core  >=26.6.0
      Depends on vulnerable versions of jest-config
      node_modules/@jest/core
        jest  >=26.6.0
        Depends on vulnerable versions of @jest/core
        Depends on vulnerable versions of jest-cli
        node_modules/jest
          ts-jest  >=27.0.0-alpha.0
          Depends on vulnerable versions of jest
          node_modules/ts-jest
      jest-cli  >=26.6.0
      Depends on vulnerable versions of @jest/core
      Depends on vulnerable versions of jest-config
      node_modules/jest-cli

[raheel-iso365]

Unfortunately, the ts-node repo is not maintained anymore, I can see someone already created a PR for this. So looks like you guys will have to either:

• clone and create your own ts-node repo
• find alternate ts-node package
• rid of the use of ts-node

[weikangchia]

One way I tried is to remove jest and re-install jest again. Then the ts-node should not be in your package-lock.json

npm uninstall jest
npm install -D jest

[raheel-iso365]

actually you might be right @weikangchia
its an optional dependency and I was also able to get rid of it.