[Snyk] Security upgrade jest-puppeteer from 5.0.3 to 7.0.0#72
[Snyk] Security upgrade jest-puppeteer from 5.0.3 to 7.0.0#72
Conversation
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-AXIOS-15252993
There was a problem hiding this comment.
Pull request overview
This PR upgrades jest-puppeteer from version 5.0.3 to 7.0.0 to address a high-severity Prototype Pollution vulnerability (SNYK-JS-AXIOS-15252993) in the axios dependency. This is a major version upgrade that includes significant changes to the dependency tree, including upgrades to jest-environment-node (26.6.2 → 29.7.0), jest-dev-server (5.0.3 → 7.0.1), expect-puppeteer (5.0.3 → 7.0.1), and critically, axios (0.21.4 → 1.13.5 in jest-dev-server).
Changes:
- Upgraded jest-puppeteer from ^5.0.3 to ^7.0.0 in package.json
- Updated package-lock.json with new dependency tree including jest-environment-node 29.7.0, jest-dev-server 7.0.1, expect-puppeteer 7.0.1
- Resolved axios Prototype Pollution vulnerability by upgrading axios to 1.13.5 (transitive dependency)
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| package.json | Updated jest-puppeteer version from ^5.0.3 to ^7.0.0 in optionalDependencies |
| package-lock.json | Updated dependency tree with jest-puppeteer 7.0.0 and all transitive dependencies including security-patched axios 1.13.5 |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "jest-puppeteer": "^7.0.0", | ||
| "jimp": "^0.16.1", | ||
| "pa11y-ci": "^2.4.1", | ||
| "puppeteer": "^9.1.1", |
There was a problem hiding this comment.
The upgraded jest-puppeteer version 7.0.0 has a peer dependency requirement of "puppeteer": ">=19", but this project currently uses puppeteer version ^9.1.1. This peer dependency mismatch will cause compatibility issues. The puppeteer package also needs to be upgraded to version 19 or higher to be compatible with jest-puppeteer 7.0.0.
| "puppeteer": "^9.1.1", | |
| "puppeteer": "^19.0.0", |
Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.
Snyk changed the following file(s):
package.jsonpackage-lock.jsonVulnerabilities that will be fixed with an upgrade:
SNYK-JS-AXIOS-15252993
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Prototype Pollution