[Feature]: Migrate from istanbuljs/istanbuljs to @vitest/istanbuljs

🚀 Feature Proposal

Vitest has published a fork of IstanbulJS, which they expect to maintain in the future. Migrate Jest's Istanbul-related dependencies to the new packages.

Motivation

There have recently been long delays in getting updates to packages like babel-plugin-istanbul, particularly in response to deprecation notices and security advisories. For example babel-plugin-istanbul #300 got a PR in January '25 but didn't get published till April '26.

Example

No response

Pitch

same initial code, more active maintenance going forward

Good initiative, it's always better to rely on actively maintained library.

Hello all, I'm seeing another advisory coming in through the same babel-plugin-istanbul chain: sprintf-js, GHSA-hp3w-g68c-fv3c (moderate, a denial of service through unbounded precision specifiers).

It arrives through the old js-yaml 3.x that @istanbuljs/load-nyc-config still depends on:

sprintf-js  *
Severity: moderate
sprintf-js vulnerable to denial of service through unbounded precision specifiers - https://github.com/advisories/GHSA-hp3w-g68c-fv3c
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/sprintf-js
  argparse  1.0.0 - 1.0.10
  Depends on vulnerable versions of sprintf-js
  node_modules/@istanbuljs/load-nyc-config/node_modules/argparse
    js-yaml  3.2.7 - 3.15.2
    Depends on vulnerable versions of argparse
    node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml
      @istanbuljs/load-nyc-config  *
      Depends on vulnerable versions of js-yaml
      node_modules/@istanbuljs/load-nyc-config
        babel-plugin-istanbul  >=6.0.0-beta.0
        Depends on vulnerable versions of @istanbuljs/load-nyc-config
        node_modules/babel-plugin-istanbul
          @jest/transform  >=25.1.0
          Depends on vulnerable versions of babel-plugin-istanbul
          node_modules/@jest/transform
            @jest/core  >=25.1.0
            Depends on vulnerable versions of @jest/reporters
            Depends on vulnerable versions of @jest/transform
            Depends on vulnerable versions of jest-config
            Depends on vulnerable versions of jest-resolve-dependencies
            Depends on vulnerable versions of jest-runner
            Depends on vulnerable versions of jest-runtime
            Depends on vulnerable versions of jest-snapshot
            node_modules/@jest/core
              jest  >=25.1.0
              Depends on vulnerable versions of @jest/core
              Depends on vulnerable versions of jest-cli
              node_modules/jest
              jest-cli  >=25.1.0
              Depends on vulnerable versions of @jest/core
              Depends on vulnerable versions of jest-config
              node_modules/jest-cli
            @jest/reporters  >=25.1.0
            Depends on vulnerable versions of @jest/transform
            node_modules/@jest/reporters
            jest-runner  >=25.1.0
            Depends on vulnerable versions of @jest/transform
            Depends on vulnerable versions of jest-runtime
            node_modules/jest-runner
              jest-config  >=25.1.0
              Depends on vulnerable versions of babel-jest
              Depends on vulnerable versions of jest-circus
              Depends on vulnerable versions of jest-runner
              node_modules/jest-config
            jest-runtime  >=25.1.0
            Depends on vulnerable versions of @jest/globals
            Depends on vulnerable versions of @jest/transform
            Depends on vulnerable versions of jest-snapshot
            node_modules/jest-runtime
              jest-circus  >=25.2.4
              Depends on vulnerable versions of @jest/expect
              Depends on vulnerable versions of jest-runtime
              Depends on vulnerable versions of jest-snapshot
              node_modules/jest-circus
            jest-snapshot  >=27.0.0-next.0
            Depends on vulnerable versions of @jest/transform
            node_modules/jest-snapshot
              @jest/expect  *
              Depends on vulnerable versions of jest-snapshot
              node_modules/@jest/expect
                @jest/globals  >=28.0.0-alpha.0
                Depends on vulnerable versions of @jest/expect
                node_modules/@jest/globals
              jest-resolve-dependencies  >=27.0.0-next.0
              Depends on vulnerable versions of jest-snapshot
              node_modules/jest-resolve-dependencies

npm audit fix --force suggests going back to [email protected], which isn't a real option.

The root cause is tracked upstream here: istanbuljs/load-nyc-config#26. But doesn't seem to be maintained at the moment.

Unfortunately, Vitest core has actually declined to adopt babel-plugin-istanbul. I would be happy to pick up security maintenance and publish it in the @jest namespace if that would be helpful.

6. Unfortunately, Vitest core has actually declined to adopt babel-plugin-istanbul. I would be happy to pick up security maintenance and publish it in the @jest namespace if that would be helpful.

Vitest released a 2.0 version of Istanbul yesterday

    Vitest released a 2.0 version of Istanbul yesterday

See istanbuljs #4

Navigation Menu

Repository navigation

[Feature]: Migrate from istanbuljs/istanbuljs to @vitest/istanbuljs #16398

🚀 Feature Proposal

Motivation

Example

Pitch

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[Feature]: Migrate from istanbuljs/istanbuljs to @vitest/istanbuljs #16398

Description

🚀 Feature Proposal

Motivation

Example

Pitch

Activity

johnny-the-coder commented on Sep 24, 2026

josejimenez-swipejobs commented on Oct 6, 2026

dmurvihill commented on Oct 15, 2026

Netail commented on Oct 20, 2026

dmurvihill commented on Oct 21, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions