[Vulnerability]: npm audit reports moderate vulnerability (GHSA-hp3w-g68c-fv3c) in sprintf-js via @jest/transform → babel-plugin-istanbul #16486

Version

30.5.2

Steps to reproduce

1. npm install --save-dev [email protected]
2. Run npm audit.

Expected behavior

npm audit flags a moderate-severity vulnerability in sprintf-js for every project that installs [email protected]. The package is pulled in transitively, and there is no fix available without downgrading Jest.

Advisory: GHSA-hp3w-g68c-fv3c (sprintf-js denial of service through unbounded precision specifiers)

Dependency chain

[email protected]
└─ @jest/[email protected]
   └─ @jest/[email protected]
      └─ [email protected]
         └─ @istanbuljs/[email protected]
            └─ [email protected]
               └─ [email protected]
                  └─ [email protected]

Actual result

sprintf-js  *
Severity: moderate
sprintf-js vulnerable to denial of service through unbounded precision specifiers
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change

Actual behavior

npm audit reports no vulnerabilities from Jest's dependency tree, or Jest offers a non-breaking upgrade path.

Additional context

No response

Environment

System:
    OS: macOS 27.0
    CPU: (10) arm64 Apple M4
  Binaries:
    Node: 24.20.0 - /opt/homebrew/opt/node@24/bin/node
    npm: 11.19.0 - /opt/homebrew/opt/node@24/bin/npm
  npmPackages:
    jest: 30.5.2 => 30.5.2