[Bug]: Deprecated inflight@1.0.6 and glob@7.2.3 used

[gbudge]

Version

29.7.0

Steps to reproduce

1. Clear out node_modules
2. Install jest

Expected behavior

user@macbook:~$ rm -rf node_modules
user@macbook:~$ npm install jest --save-dev

added 414 packages, and audited 415 packages in 23s

70 packages are looking for funding
  run `npm fund` for details

found 0 vulnerabilities
user@macbook:~$

Actual behavior

user@macbook:~$ rm -rf node_modules
user@macbook:~$ npm install jest --save-dev
npm warn deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
npm warn deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm warn deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm warn deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm warn deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported

added 414 packages, and audited 415 packages in 23s

70 packages are looking for funding
  run `npm fund` for details

found 0 vulnerabilities
user@macbook:~$

Additional context

No response

Environment

System:
    OS: macOS 14.8.2
    CPU: (4) x64 Intel(R) Core(TM) i5-8210Y CPU @ 1.60GHz
  Binaries:
    Node: 23.11.0 - /usr/local/bin/node
    npm: 10.9.2 - /usr/local/bin/npm
    Deno: 2.5.6 - /usr/local/bin/deno
  npmPackages:
    jest: ^29.7.0 => 29.7.0

[BakkarAnas]

this can also be done by updating your eslint package and then remove node modules , package-lock.json and .next folder

after doing this run npm install and then npm run dev

[raheel-iso365]

Issue:
npm warn deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported

And as per my investigation, here how jest is contributing to it.

> npm ls glob  
└─┬ ts-jest@29.4.6
  └─┬ @jest/transform@30.2.0
    └─┬ babel-plugin-istanbul@7.0.1
      └─┬ test-exclude@6.0.0
           └── glob@7.2.3

npm ls babel-plugin-istanbul
└─┬ ts-jest@29.4.6
  ├─┬ @jest/transform@30.2.0
  │ └── babel-plugin-istanbul@7.0.1
  └─┬ babel-jest@30.2.0
    └── babel-plugin-istanbul@7.0.1 deduped

In this tree,

• test-exclude@7x started using newer glob@10x
• babel-plugin-istanbul@8x started using newer test-exclude@7x
• However, @jest/transform@latest and babel-jest are still using babel-plugin-istanbul@7x which is causing the issue.

[raheel-iso365]

As far as inflight is concerned, its coming from old glob package. They removed inflight usage starting from glob ver 9.

[gbudge]

yeah, the babel-plugin-istanbul@v8.0 CHANGELOG mentioned breaking changes but not what to do about them. Will take a look over the coming days & weeks.

[raheel-iso365]

Hi.
Any update on this? :)

[gbudge]

Upgrading babel-plugin-istanbul is blocked because of a rediculous permission issue on its repo, preventing babel-plugin-istanbul@8.x being published to NPM (istanbuljs/babel-plugin-istanbul#325).

Any update? I also reported this a while ago

[gbudge]

The Tidelift Security team are looking into this. Here's the process document: https://support.tidelift.com/hc/en-us/articles/4406287910036-Security-process

[DutchBen]

bump

[glushkova91]

@gbudge babel-plugin-istanbul's team posted that the new version is available in @direct-democracy-solutions/babel-plugin-istanbul
istanbuljs/babel-plugin-istanbul#325 (comment)

[SchroederSteffen]

babel-plugin-istanbul@8 has been released 🥳

• Publish 8.0.0 - 8.0.2 to NPM registry istanbuljs/babel-plugin-istanbul#325 (comment)

Now we just need the dependency update for Jest.