turbo
50fb1c52 - fix: Upgrade jest to v30 to resolve brace-expansion ReDoS vulnerability (#11706)

Commit
3 days ago
fix: Upgrade jest to v30 to resolve brace-expansion ReDoS vulnerability (#11706) ## Summary - Upgrades `jest` from `29.7.0` to `30.2.0` across all workspace packages and examples to eliminate the `brace-expansion@1.1.11` ReDoS vulnerability (TURBO-5238) - Upgrades `@jest/globals`, `jest-mock`, `@jest/types`, and `jest-environment-jsdom` to matching v30 releases - `ts-jest@29.4.6` is retained as-is since it already declares `jest@^30.0.0` in its peerDependencies ### Why not a patch or override? The vulnerable `brace-expansion@1.1.11` was pulled in transitively through jest's dependency chain (`jest > @jest/core > ... > glob@7.2.3 > minimatch@3.1.2 > brace-expansion@1.1.11`). Jest 30 dropped its own internal `glob` usage, and `pnpm update brace-expansion` bumped the remaining transitive resolution from `1.1.11` to `1.1.12` (the patched version). ### Verification - `pnpm why brace-expansion -r` confirms no `1.1.11` remains in the lockfile - Tests pass across multiple packages (`eslint-plugin-turbo`: 109 tests, `turbo-ignore`: 74 tests, `create-turbo`: 22 tests) Ref: TURBO-5238
Author
Parents
Loading