@angular-builders/jest: Setup and Dependency Security

@angular-builders/jest is a community builder that lets you run ng test with Jest instead of the default Karma and Jasmine setup, with near-zero configuration. It plugs into the Angular CLI's builder system so your existing ng test command runs the Jest test runner, keeping your workspace free of the boilerplate that manual Jest wiring usually requires.

For teams that want Jest's speed, snapshot testing, and large ecosystem without ripping out the Angular CLI, this builder is the standard path. You will also see it written without the scope, as angular-builders/jest, in older tutorials.

What it does under the hood

The Angular CLI runs tasks through "builders," pluggable programs that implement commands like build, serve, and test. By default ng test uses the Karma builder. This package swaps in a Jest builder so the same command drives Jest instead:

// angular.json
{
  "projects": {
    "my-app": {
      "architect": {
        "test": {
          "builder": "@angular-builders/jest:run",
          "options": {
            "configPath": "./jest.config.js"
          }
        }
      }
    }
  }
}

Install and switch in two steps:

npm install -D @angular-builders/jest jest @types/jest
# then point the test target at the jest builder in angular.json

The builder handles the TypeScript and Angular preset wiring so you do not hand-configure ts-jest and the Angular testing environment yourself.

The version-alignment rule people miss

The most common source of grief with this package is version mismatch. The major version of @angular-builders/jest must track the major version of your Angular. Angular 19 wants @angular-builders/jest 19.x, Angular 20 wants 20.x, and so on. The package has kept pace, with recent releases up into the 22.x line matching current Angular majors.

If you upgrade Angular and forget to bump the builder, you get confusing errors that look like Jest problems but are really compatibility problems. Make the two upgrades a single step:

# Upgrade Angular and the builder together
ng update @angular/core @angular/cli
npm install -D @angular-builders/jest@<matching-major>

Wrap the version token in backticks in your own docs so a placeholder like a major number is never mistaken for markup.

Why the dependency tree matters here

A test builder is a dev dependency, which sometimes lulls teams into ignoring its security. That is a mistake. Dev dependencies run on developer machines and, critically, inside CI runners that often hold registry tokens, cloud credentials, and signing keys. A compromised or vulnerable package in the test toolchain is a supply-chain foothold, not just a testing inconvenience.

@angular-builders/jest itself is a thin builder, but it pulls in Jest and a chain of transitive dependencies. Those transitive packages are where most real advisories land. This is exactly the case for scanning dev dependencies, not just production ones. An SCA tool such as Safeguard can flag a vulnerable transitive package in your test toolchain and show which top-level dependency introduced it.

Keeping it secure in practice

A few habits keep this builder and its tree healthy:

1. Scan dev dependencies in CI, not just runtime ones. Run software composition analysis across the full node_modules graph.
2. Keep the builder aligned with Angular on every upgrade so you stay on a maintained, patched line rather than an abandoned old major.
3. Commit your lockfile and review lockfile diffs in pull requests. A surprising change to a transitive version is worth a second look.
4. Prefer npm ci in CI so builds install exactly what the lockfile pins, with no silent drift.

When to reconsider

The builder is well maintained and widely used, so there is rarely a reason to abandon it. Two situations do warrant a rethink. First, if you are on a very old Angular major that the current builder line no longer supports, you are stuck on an old builder release that will not receive fixes; upgrading Angular is the real remedy. Second, Angular's own tooling has been evolving its testing story, so on brand-new projects it is worth checking whether the CLI's current defaults already meet your needs before adding a builder. Either way, treat the decision as a normal dependency review rather than a reflex. The security academy has a checklist for evaluating build-time dependencies.

FAQ

What does @angular-builders/jest actually do?

It provides an Angular CLI builder that runs your tests with Jest instead of the default Karma and Jasmine, so ng test drives Jest with minimal configuration and no manual ts-jest wiring.

Why does my @angular-builders/jest setup break after upgrading Angular?

Almost always a version mismatch. The builder's major version must match your Angular major. Upgrade both together, installing the builder version whose major matches your Angular core version.

Should I scan dev dependencies like this builder for vulnerabilities?

Yes. Dev dependencies run in CI runners that often hold credentials and signing keys, making them a real supply-chain target. Scan the full dependency graph, including transitive test-toolchain packages, not just runtime dependencies.

Is @angular-builders/jest actively maintained?

Yes. It has kept pace with Angular releases, publishing matching major versions, with recent releases in the 22.x range aligning to current Angular majors. Staying on the matching major keeps you on a patched line.