devdeps: minor jest bump; yarn dedupe

[legobeat]

Separate supply-chain-alert-inducing bumps from #137

[socket-security]

New dependency changes detected. Learn more about Socket for GitHub ↗︎

---

🚨 Potential security issues found in this pull request. To accept the risk, merge this PR and you will not be notified again.

Bot Commands

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@* or ignore all packages with @SocketSecurity ignore-all

• @SocketSecurity ignore jsdom@16.7.0
• @SocketSecurity ignore spdx-correct@3.2.0
• @SocketSecurity ignore @tootallnate/once@1.1.2
• @SocketSecurity ignore source-map@0.7.4
• @SocketSecurity ignore sshpk@1.17.0
• @SocketSecurity ignore istanbul-lib-source-maps@4.0.1
• @SocketSecurity ignore form-data@3.0.1
• @SocketSecurity ignore fb-watchman@2.0.2
• @SocketSecurity ignore anymatch@3.1.3
• @SocketSecurity ignore fast-diff@1.3.0

⚠️ Network access

This module accesses the network.

Packages should remove all network access that isn't functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Package	Module	Location	Source
jsdom@16.7.0 (upgraded)	https	lib/jsdom/living/helpers/agent-factory.js	package.json via jest@26.6.3, ts-jest@26.5.6
jsdom@16.7.0 (upgraded)	https	lib/jsdom/living/helpers/http-request.js	package.json via jest@26.6.3, ts-jest@26.5.6
jsdom@16.7.0 (upgraded)	http-proxy-agent	lib/jsdom/living/helpers/agent-factory.js	package.json via jest@26.6.3, ts-jest@26.5.6
jsdom@16.7.0 (upgraded)	https-proxy-agent	lib/jsdom/living/helpers/agent-factory.js	package.json via jest@26.6.3, ts-jest@26.5.6

⚠️ No contributors or author data

Package does not specify a list of contributors or an author in package.json.

Add a author field or contributors array to package.json.

Package	Location	Source
spdx-correct@3.2.0 (upgraded)	package.json	package.json via jest@26.6.3, ts-jest@26.5.6

⚠️ No README

Package does not have a README. This may indicate a failed publish or a low quality package.

Add a README to to the package and publish a new version.

Package	Location	Source
@tootallnate/once@1.1.2 (added)	Package overview	package.json via jest@26.6.3, ts-jest@26.5.6

⚠️ New author

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Package	New Author	Previous Author	Source
source-map@0.7.4 (upgraded)	eemeli	loganfsmyth	package.json via jest@26.6.3, ts-jest@26.5.6
sshpk@1.17.0 (upgraded)	bahamat	arekinath	package.json via @metamask/network-controller@8.0.0
istanbul-lib-source-maps@4.0.1 (upgraded)	oss-bot	coreyfarrell	package.json via jest@26.6.3, ts-jest@26.5.6
form-data@3.0.1 (added)	niftylettuce	alexindigo	package.json via jest@26.6.3, ts-jest@26.5.6
fb-watchman@2.0.2 (upgraded)	bolinfest	wez	package.json via jest@26.6.3, ts-jest@26.5.6
anymatch@3.1.3 (upgraded)	phated	paulmillr	package.json via jest@26.6.3, ts-jest@26.5.6
fast-diff@1.3.0 (upgraded)	luin	dgreensp	package.json via @metamask/eslint-config@10.0.0, @metamask/eslint-config-jest@10.0.0, @metamask/eslint-config-nodejs@10.0.0, @metamask/eslint-config-typescript@10.0.0, eslint-plugin-prettier@4.2.1

⚠️ Unstable ownership

A new collaborator has begun publishing package versions. Package stability and security risk may be elevated.

Try to reduce the amount of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm.

Package	Author	Source
fast-diff@1.3.0 (upgraded)	luin	package.json via @metamask/eslint-config@10.0.0, @metamask/eslint-config-jest@10.0.0, @metamask/eslint-config-nodejs@10.0.0, @metamask/eslint-config-typescript@10.0.0, eslint-plugin-prettier@4.2.1

Pull request alert summary

Issue	Status
Critical CVE	✅ 0 issues
CVE	✅ 0 issues
Mild CVE	✅ 0 issues
Install scripts	✅ 0 issues
Native code	✅ 0 issues
Bin script confusion	✅ 0 issues
Bin script shell injection	✅ 0 issues
Filesystem access	✅ 0 issues
Network access	⚠️ 4 issues
Shell access	✅ 0 issues
Unresolved require	✅ 0 issues
Invalid package.json	✅ 0 issues
HTTP dependency	✅ 0 issues
Git dependency	✅ 0 issues
GitHub dependency	✅ 0 issues
No bug tracker	✅ 0 issues
No contributors or author data	⚠️ 1 issue
No README	⚠️ 1 issue
Deprecated	✅ 0 issues
New author	⚠️ 7 issues
Unstable ownership	⚠️ 1 issue
Non-existent author	✅ 0 issues
Unmaintained	✅ 0 issues
Unpublished package	✅ 0 issues
Potential typo squat	✅ 0 issues
Known Malware	✅ 0 issues
Telemetry	✅ 0 issues
Protestware/Troll package	✅ 0 issues
AI detected security risk	✅ 0 issues
AI warning	✅ 0 issues