Skip to content

chore(deps): update dependency ts-jest to v29.4.12 - autoclosed - #10318

Closed
metamask-ci[bot] wants to merge 1 commit into
mainfrom
renovate/ts-jest-29.x-lockfile
Closed

metamask-ci[bot] wants to merge 1 commit into
mainfrom
renovate/ts-jest-29.x-lockfile

Conversation

@metamask-ci

@metamask-ci metamask-ci Bot commented Sep 21, 2026 •

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
ts-jest (source) 29.4.11 → 29.4.12 age confidence

Release Notes

kulshekhar/ts-jest (ts-jest)

v29.4.12

Compare Source

Features
  • compiler: support TypeScript 7 projects through compatibility aliases (#​5386)

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.


Note

Cursor Bugbot is generating a summary for commit 8aadb64. Configure here.

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatedts-jest@​29.4.11 ⏵ 29.4.1297 +110095 +192100

View full report

@socket-security

Copy link
Copy Markdown

Warning

MetaMask internal reviewing guidelines:

  • Do not ignore-all
  • Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
  • Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
    @SocketSecurity ignore npm/PACKAGE@VERSION
Action Severity Alert  (click "▶" to expand/collapse)
Warn Low
Potential code anomaly (AI signal): npm ts-jest is 60.0% likely to have a medium risk anomaly

Notes: No clear evidence of malware (e.g., network exfiltration, command execution, or credential theft) is present in this fragment. However, it implements a high-impact extensibility mechanism: it dynamically imports and executes a hook module specified by the TS_JEST_HOOKS environment variable and passes it full source code and transformer configuration. If the environment variable or hook file can be influenced by an attacker (common in compromised CI/dev environments), this becomes an arbitrary code execution vector during Jest/ts-jest transformation. Additionally, cache-key material and logs may expose sensitive project data if cache/log artifacts are accessible.

Confidence: 0.60

Severity: 0.55

From: packages/messenger/package.json → npm/ts-jest@29.4.12

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ts-jest@29.4.12. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@metamask-ci metamask-ci Bot changed the title chore(deps): update dependency ts-jest to v29.4.12 chore(deps): update dependency ts-jest to v29.4.12 - autoclosed Sep 21, 2026
@metamask-ci metamask-ci Bot closed this Sep 21, 2026
@metamask-ci
metamask-ci Bot deleted the renovate/ts-jest-29.x-lockfile branch September 21, 2026 18:11
pull Bot pushed a commit to Reality2byte/core that referenced this pull request Sep 21, 2026
## Explanation

By default Renovate leaves a manifest alone when the new version already
satisfies the declared range, so MetaMask#10318 bumped `ts-jest` to 29.4.12 in
`yarn.lock` and touched no `package.json` at all. That keeps the
declared minimum at the old version and produces no changelog entry,
since nothing published changed.

We want a changelog entry for every dependency bump, so `rangeStrategy:
bump` moves the range with the release: `^29.4.11` becomes `^29.4.12`
across every workspace that declares it, the same as Dependabot does
today. Out of range updates like MetaMask#10320 already behaved this way.

`peerDependencies` are exempted back to `widen`. An explicit
`rangeStrategy` overrides Renovate's peer handling
([`npm/range.ts`](https://github.com/renovatebot/renovate/blob/main/lib/modules/manager/npm/range.ts)),
and 11 peer entries here have simple ranges that would be narrowed
rather than broadened, `@babel/runtime ^7.0.0` most obviously. The other
11 are complex ranges like `^16.8.0 || ^17.0.0` and widen regardless.

The cost is diff size. A single patch now rewrites the same line in
every manifest that declares the dependency, and each of those packages
needs an entry. MetaMask#10322 is what writes them.

> [!IMPORTANT]
> Depends on MetaMask#10322. Without it the repair workflow still skips Renovate
pull requests, and every one of them lands red on `Check changelog`.

## References

Depends on MetaMask#10322. Follows MetaMask#10317. Part of WPC-1161.

## Checklist

- [ ] I've updated the test suite for new or updated code as appropriate
- [x] I've updated documentation (JSDoc, Markdown, etc.) for new or
updated code as appropriate
- [ ] I've communicated my changes to consumers by [updating changelogs
for packages I've
changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md)
- [ ] I've introduced [breaking
changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md)
in this PR and have prepared draft pull requests for clients and
consumer packages to resolve them

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Tooling-only change to Renovate; it does not alter runtime code, but
it will enlarge dependency PR diffs across workspaces.
> 
> **Overview**
> Renovate is configured to **raise semver ranges in `package.json`**
when a newer release still satisfies the existing constraint
(`rangeStrategy: bump`), matching Dependabot behavior so lockfile-only
bumps no longer skip manifest updates and downstream changelog tooling
can see a published change.
> 
> A **peer-only override** sets `rangeStrategy: widen` for
`peerDependencies`, undoing the global bump so wide peer ranges stay
broadened instead of tightened.
> 
> **Note:** This is meant to work with the changelog repair workflow in
MetaMask#10322; without that, Renovate PRs may fail `Check changelog`.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
9ab221a. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

This branch was previously deployed

1 inactive deployment
default-branch — 8aadb644 Deployed Sep 21, 2026 by metamask-ci[bot] via Determine whether this PR is a release PR #4307
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants