[Bug]: Deprecated dependencies: babel-plugin-istanbul pulls in glob@7.2.3 and inflight@1.0.6 via test-exclude

[arcos-dev]

Version

v30.0.5

Steps to reproduce

1. Create a new project:
   ```bash
   mkdir jest-deprecated-test && cd jest-deprecated-test
   npm init -y

2. Install Jest (v30.0.5) and ts-jest (optional):

   npm install jest@30.0.5 ts-jest@29.4.1

3. Observe the following warnings during installation:

   npm WARN deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
   npm WARN deprecated inflight@1.0.6: This module is not supported, and leaks memory...
   

4. Run:

   npm ls inflight glob

5. Output shows the deprecated dependency chain:

   babel-plugin-istanbul@7.0.0
   └── test-exclude@6.0.0
       └── glob@7.2.3
           └── inflight@1.0.6
   

Expected behavior

Jest should avoid including deprecated dependencies such as glob@7.2.3 and inflight@1.0.6.

Updating babel-plugin-istanbul to use a newer test-exclude (which depends on glob@9+) would resolve this, removing the deprecated and unsupported packages from the dependency tree.

Actual behavior

Installing jest@30.0.5 results in deprecated dependencies being installed:

• glob@7.2.3 (deprecated)
• inflight@1.0.6 (deprecated, leaks memory)

These come from the following chain:

@jest/transform → babel-plugin-istanbul → test-exclude\@6.0.0 → glob\@7.2.3 → inflight\@1.0.6

This causes warning messages during npm install and could raise issues in automated environments (CI, audits, etc).

Additional context

Eliminating deprecated packages improves security, stability, and audit cleanliness. inflight in particular is known to leak memory and has been archived.

Modernizing these dependencies will enhance trust and reduce noise in Jest installations.

Environment

- Node.js version: v22.18.0
- npm version: 11.5.2
- Jest version: 30.0.5
- OS: Windows 11

[hainenber]

Best bet is to wait this upstream PR getting merged and a new version released.

[ahnpnl]

Not sure if we even need that Babel plugin since using coverage provider v8 shouldn’t need it no?

[hainenber]

Jest provides a babel coverage provider per default, though. The plugin is still needed ¯_(ツ)_/¯

[ahnpnl]

If we can somehow make Jest to install that plugin on demand, based on coverageProvider config value instead of installing directly via dependencies of the @jest/transform package, that would possibly help for opt-out that plugin in the dependency tree

[jmayalag]

Best bet is to wait this upstream PR getting merged and a new version released.

I wouldn't hold any hope for this, the last release was a year ago