Skip to content

overwrite babel/runtime version - #4177

Merged
felipeelia merged 1 commit into
developfrom
fix/overwrite-babel-runtime-version
Jul 23, 2025
Merged

overwrite babel/runtime version#4177
felipeelia merged 1 commit into
developfrom
fix/overwrite-babel-runtime-version

Conversation

@hugosolar

Copy link
Copy Markdown

Description of the Change

Due to a vulnerability, we need to overwrite @babel/runtime package. This package is a dependency from several @WordPress core packages and it seems like there's an ongoing discussion around this topic but it's not expected to be fixed soon. Because of that we're adding an overwrite to package.json
Also noting that dependabot tried to fix this here https://github.com/10up/ElasticPress/security/dependabot/83 but cannot

How to test the Change

  • Clone the repo
  • run npm install
  • validate node_modules/@babel/runtime is the expected version: 7.27.6

Changelog Entry

Security - Vulnerability
Overwrite package @babel/runtime coming from core packages due to a vulnerability

Credits

Props @hugosolar

Checklist:

@hugosolar
hugosolar requested a review from felipeelia July 23, 2025 12:34
@felipeelia felipeelia added this to the 5.3.0 milestone Jul 23, 2025
@felipeelia
felipeelia merged commit 08687b6 into develop Jul 23, 2025
21 of 24 checks passed
@felipeelia
felipeelia deleted the fix/overwrite-babel-runtime-version branch July 23, 2025 12:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants