Skip to content

[Snyk] Security upgrade jest from 22.4.3 to 26.0.0 #109

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: next
Choose a base branch
from
Open

[Snyk] Security upgrade jest from 22.4.3 to 26.0.0 #109

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion packages/react-scripts/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@
"html-webpack-plugin": "3.2.0",
"identity-obj-proxy": "3.0.0",
"loader-utils": "^1.1.0",
"jest": "22.4.3",
"jest": "26.0.0",
Copy link

@gemini-code-assist gemini-code-assist bot Jul 26, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

While upgrading jest is necessary for security, this major version jump from 22.x to 26.x introduces several breaking changes that will likely break the test suite. The automated update only changes the jest package, but other changes are required for this to work.

Here are the critical issues that need to be addressed:

  1. babel-jest incompatibility: The babel-jest package version should match the jest major version. It is currently 22.4.3 (line 29) and needs to be upgraded to 26.0.0 to be compatible with [email protected].

  2. Jest configuration breaking change: Jest 24 renamed the setupTestFrameworkScriptFile configuration option to setupFilesAfterEnv. The current configuration in packages/react-scripts/scripts/utils/createJestConfig.js (line 29) uses the old key, which will be ignored by Jest 26. This will prevent test setup files from running, likely causing test failures.

  3. Potentially obsolete workaround: The script packages/react-scripts/scripts/test.js contains a workaround (lines 61-113) for a Jest issue (Add Cluster Module to Webpack node Configuration facebook/create-react-app#5913) that was fixed in Jest 23. This workaround may no longer be necessary and could cause issues with Jest 26.

I strongly recommend addressing these issues in this PR to ensure the tests continue to function correctly after this upgrade.

"mini-css-extract-plugin": "^0.4.0",
"object-assign": "4.1.1",
"postcss-flexbugs-fixes": "3.3.1",
Expand Down