Bump ts-jest from 29.4.11 to 29.4.12

[dependabot]

Bumps ts-jest from 29.4.11 to 29.4.12.

Release notes

Sourced from ts-jest's releases.

v29.4.12

Please refer to CHANGELOG.md for details.

Changelog

Sourced from ts-jest's changelog.

29.4.12 (2026-07-22)

Features

• compiler: support TypeScript 7 projects through compatibility aliases (#5386)

Commits

• 3f05625 chore(release): 29.4.12
• df28b27 docs: clarify TypeScript version prerequisites
• c8a614a docs: mention TypeScript 7 setup in README
• 06c79d4 fix: address TypeScript 7 review feedback
• f107460 docs: explain TypeScript 7 compatibility setup
• 3388227 test(e2e): add TypeScript compatibility matrix
• 891dc73 fix(compiler): support TypeScript 7 compatibility aliases
• eb135eb build(deps-dev): bump shell-quote from 1.8.4 to 1.10.0 in /examples
• d5d80a3 ci: pin google osv scan action at v2.3.5
• 6bf293f build(deps): bump shell-quote from 1.8.4 to 1.10.0 in /website
• Additional commits viewable in compare view

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	ts-jest@​29.4.11 ⏵ 29.4.12	+1		+1	+3

View full report

[socket-security]

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Block		Potential code anomaly (AI signal): npm ts-jest is 60.0% likely to have a medium risk anomaly Notes: No clear evidence of malware (e.g., network exfiltration, command execution, or credential theft) is present in this fragment. However, it implements a high-impact extensibility mechanism: it dynamically imports and executes a hook module specified by the TS_JEST_HOOKS environment variable and passes it full source code and transformer configuration. If the environment variable or hook file can be influenced by an attacker (common in compromised CI/dev environments), this becomes an arbitrary code execution vector during Jest/ts-jest transformation. Additionally, cache-key material and logs may expose sensitive project data if cache/log artifacts are accessible. Confidence: 0.60 Severity: 0.55 From: package-lock.json → npm/ts-jest@29.4.12 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ts-jest@29.4.12. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Embedded URLs or IPs: npm ts-jest URLs: https://kulshekhar.github.io/ts-jest/docs/getting-started/options/diagnostics, ES2020.Date, ES2017.Date, https://kulshekhar.github.io/ts-jest/docs/getting-started/presets#advanced, https://www.typescriptlang.org/tsconfig/#isolatedModules, https://blogs.msdn.microsoft.com/typescript/2018/01/31/announcing-typescript-2-7/#easier-ecmascript-module-interoperability, https://github.com/microsoft/TypeScript/wiki/Node-Target-Mapping, https://github.com/jestjs/jest/issues/3845 Location: Package overview From: package-lock.json → npm/ts-jest@29.4.12 ℹ Read more on: This package | This alert | What are URL strings? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ts-jest@29.4.12. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[guibranco]

Automatically approved by gstraccini[bot]

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud