chore(mwpw-144652): bump Jest to 24.9 to remove vulnerable babel-traverse path #315
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Core Web Vitals Metrics
Recorded at: 2025-08-21T22:30:45.404Z |
Core Web Vitals Metrics
Recorded at: 2025-08-21T22:32:49.489Z |
Core Web Vitals Metrics
Recorded at: 2025-08-21T22:40:06.259Z |
Core Web Vitals Metrics
Recorded at: 2025-08-21T22:41:19.234Z |
thedoc31
approved these changes
Aug 22, 2025
Contributor
thedoc31
left a comment
There was a problem hiding this comment.
Any idea why GHA is flagging all these unexpected console statement and Dangerous property 'dangerouslySetInnerHTML' found?
jedjedjedM
approved these changes
Aug 22, 2025
Collaborator
Author
|
Those comments come from linting rules as warnings but we use these APIs such as |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary: Updates Jest to 24.9 to eliminate a Critical vulnerability in the tra nsitive dependency chain that pulled in
[email protected]. There is no fix ed version ofbabel-traverse, so the mitigation is to move off the dependencypath entirely.
Why: Kodiak flagged “Incomplete List of Disallowed Inputs vulnerability in babel-traverse” via the chain
[email protected] › [email protected] › [email protected] › [email protected] › [email protected] › [email protected]. Jest 24 updates the Istanbul/Babel toolchain, removing this path.
Changes:
jestto24.9.x.babel-traverse@6is no longer resolved.119a181f4c2761aa0c65f30f86b11e7ac43135d0,59f7346cfec4d de7378cd0365f26f02280840877.Impact: Test/dev-only dependency; no production runtime impact expected.
Validation:
npm ls babel-traverseshows no instances.npm audit(or Kodiak re-scan) no longer flags the issue.Notes for reviewers:
setupTestFrameworkScriptFile, ensure it’s migrated tose tupFilesAfterEnvfor Jest 24.Rollback plan: Revert this PR and re-install dependencies.