chore(deps): update dependency @babel/runtime to v7.26.10 [security] - autoclosed #125
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
renovate
bot
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
7.22.5->7.26.10GitHub Vulnerability Alerts
CVE-2025-27789
Impact
When using Babel to compile regular expression named capturing groups, Babel will generate a polyfill for the
.replacemethod that has quadratic complexity on some specific replacement pattern strings (i.e. the second argument passed to.replace).Your generated code is vulnerable if all the following conditions are true:
.replacemethod on a regular expression that contains named capturing groups.replaceIf you are using
@babel/preset-envwith thetargetsoption, the transform that injects the vulnerable code is automatically enabled if:You can verify what transforms
@babel/preset-envis using by enabling thedebugoption.Patches
This problem has been fixed in
@babel/helpersand@babel/runtime7.26.10 and 8.0.0-alpha.17, please upgrade. It's likely that you do not directly depend on@babel/helpers, and instead you depend on@babel/core(which itself depends on@babel/helpers). Upgrading to@babel/core7.26.10 is not required, but it guarantees that you are on a new enough@babel/helpersversion.Please note that just updating your Babel dependencies is not enough: you will also need to re-compile your code.
Workarounds
If you are passing user-provided strings as the second argument of
.replaceon regular expressions that contain named capturing groups, validate the input and make sure it does not contain the substring$<if it's then not followed by>(possibly with other characters in between).References
This vulnerability was reported and fixed in https://github.com/babel/babel/pull/17173.
Release Notes
babel/babel (@babel/runtime)
v7.26.10Compare Source
👓 Spec Compliance
babel-parser🐛 Bug Fix
babel-parser,babel-templatebabel-corebabel-parser,babel-plugin-transform-typescriptbabel-traversebabel-generatorabstract override(@liuxingbaoyu)babel-parserbabel-helpers,babel-runtime,babel-runtime-corejs2,babel-runtime-corejs3💅 Polish
babel-standalone🏠 Internal
babel-parserv7.26.9Compare Source
🐛 Bug Fix
babel-typesTSPropertySignature.kind(@liuxingbaoyu)babel-generator,babel-types🏠 Internal
babel-types.tsfiles with explicit reexports to solve name conflicts (@nicolo-ribaudo)babel-core@types/gensyncin Babel 7 (@nicolo-ribaudo)v7.26.7Compare Source
🐛 Bug Fix
babel-helpers,babel-preset-env,babel-runtime-corejs3babel-plugin-transform-typeof-symboltypeofin arrow functions (@liuxingbaoyu)babel-parserrangesoption in estree method value (@JLHwung)babel-corebabel-plugin-transform-typescriptbabel-plugin-transform-typescript,babel-traverse,babel-typesimport x = y.z(@liuxingbaoyu)v7.26.0Compare Source
🚀 New Feature
babel-core,babel-generator,babel-parser,babel-plugin-syntax-import-assertions,babel-plugin-syntax-import-attributes,babel-preset-env,babel-standalone,babel-typesbabel-corebabel-compat-data,babel-plugin-proposal-regexp-modifiers,babel-plugin-transform-regexp-modifiers,babel-preset-env,babel-standalonetransform-regexp-modifierstopreset-env(@JLHwung)babel-parserstartIndexparser option (@DylanPiercey)babel-generator,babel-parser,babel-plugin-syntax-flowbabel-helpers,babel-preset-typescript,babel-runtime-corejs3import()inrewriteImportExtensions(@liuxingbaoyu)babel-generator,babel-parser@babel/generator(@nicolo-ribaudo)🐛 Bug Fix
babel-core💅 Polish
babel-plugin-proposal-json-modules,babel-plugin-transform-json-modules,babel-standaloneproposal-json-modulestotransform-json-modules(@nicolo-ribaudo)🏠 Internal
babel-code-frame,babel-highlight@babel/highlightin@babel/code-frame(@nicolo-ribaudo)babel-generator,babel-parser,babel-typeskindtoTSModuleDeclaration(@liuxingbaoyu)🏃♀️ Performance
babel-helper-module-transforms,babel-plugin-transform-modules-commonjsv7.25.9Compare Source
🐛 Bug Fix
babel-parser,babel-template,babel-typessyntacticPlaceholdersmode (@liuxingbaoyu)babel-helper-compilation-targets,babel-preset-envClassAccessorPropertyto prevent theno-undefrule (@victorenator)🏠 Internal
babel-helper-transform-fixture-test-runner🏃♀️ Performance
babel-parser,babel-typesVISITOR_KEYSetc. faster to access (@liuxingbaoyu)v7.25.7Compare Source
🐛 Bug Fix
babel-helper-validator-identifierbabel-traversebabel-plugin-transform-classessuper()check (@nicolo-ribaudo)babel-generatorinferin compact mode (@nicolo-ribaudo)[no LineTerminator here]after nodes (@nicolo-ribaudo)💅 Polish
babel-types🏠 Internal
babel-core--experimental-require-module(@nicolo-ribaudo)babel-helper-compilation-targets,babel-helper-plugin-utils,babel-preset-envbabel-plugin-proposal-destructuring-private,babel-plugin-syntax-decimal,babel-plugin-syntax-import-reflection,babel-standalonebabel-generator[no LineTerminator here]before nodes (@nicolo-ribaudo)🏃♀️ Performance
babel-plugin-transform-typescriptbabel-typesBABEL_TYPES_8_BREAKINGat startup (@nicolo-ribaudo)v7.25.6Compare Source
🐛 Bug Fix
babel-generatorbabel-traversepath.getAssignmentIdentifiersmay beundefined(@liuxingbaoyu)babel-parserbabel-helpers,babel-plugin-transform-optional-chaining,babel-runtime-corejs3superPropertyGethelper (@nicolo-ribaudo)💅 Polish
babel-generator,babel-plugin-transform-async-to-generator,babel-plugin-transform-block-scoping,babel-plugin-transform-class-properties,babel-plugin-transform-classes,babel-plugin-transform-duplicate-named-capturing-groups-regex,babel-plugin-transform-named-capturing-groups-regex,babel-plugin-transform-react-jsx-development,babel-plugin-transform-react-jsx,babel-plugin-transform-react-pure-annotations,babel-plugin-transform-regenerator,babel-plugin-transform-runtime,babel-preset-env(and comments (@nicolo-ribaudo)babel-plugin-syntax-import-assertions,babel-plugin-syntax-import-attributesbabel-generator🏠 Internal
babel-generatorparentparams in the generator (@nicolo-ribaudo)v7.25.4Compare Source
🐛 Bug Fix
babel-traversebabel-helper-create-class-features-plugin,babel-plugin-proposal-decoratorsbabel-typesbabel-generatorexport namespace as A(@nicolo-ribaudo)💅 Polish
babel-generator,babel-plugin-proposal-decorators,babel-plugin-proposal-destructuring-private,babel-plugin-proposal-pipeline-operator,babel-plugin-transform-class-properties,babel-plugin-transform-destructuring,babel-plugin-transform-optional-chaining,babel-plugin-transform-private-methods,babel-plugin-transform-private-property-in-object,babel-plugin-transform-typescript,babel-runtime-corejs2,babel-runtime,babel-traversebabel-generator,babel-plugin-transform-class-propertiesbabel-generator,babel-plugin-proposal-decorators,babel-plugin-proposal-destructuring-private,babel-plugin-transform-object-rest-spread🔬 Output optimization
babel-generatorv7.25.0Compare Source
👓 Spec Compliance
babel-helpers,babel-plugin-proposal-explicit-resource-management,babel-runtime-corejs3await usingnormative updates (@JLHwung)babel-plugin-transform-typescript🚀 New Feature
babel-helper-create-class-features-plugin,babel-helper-function-name,babel-helper-plugin-utils,babel-helper-wrap-function,babel-plugin-bugfix-safari-class-field-initializer-scope,babel-plugin-bugfix-safari-id-destructuring-collision-in-function-expression,babel-plugin-transform-classes,babel-plugin-transform-function-name,babel-preset-env,babel-traverse,babel-typesensureFunctionNametoNodePath.prototype(@nicolo-ribaudo)babel-helper-hoist-variables,babel-helper-plugin-utils,babel-plugin-proposal-async-do-expressions,babel-plugin-transform-modules-systemjs,babel-traversehoistVariablestoScope.prototype(@nicolo-ribaudo)babel-helper-create-class-features-plugin,babel-helper-module-transforms,babel-helper-plugin-utils,babel-helper-split-export-declaration,babel-plugin-transform-classes,babel-traverse,babel-typessplitExportDeclarationtoNodePath.prototype(@nicolo-ribaudo)babel-helper-create-class-features-plugin,babel-helper-environment-visitor,babel-helper-module-transforms,babel-helper-plugin-utils,babel-helper-remap-async-to-generator,babel-helper-replace-supers,babel-plugin-bugfix-firefox-class-in-computed-class-key,babel-plugin-bugfix-v8-static-class-fields-redefine-readonly,babel-plugin-transform-async-generator-functions,babel-plugin-transform-classes,babel-traverseenvironment-visitorhelper into@babel/traverse(@nicolo-ribaudo)babel-core,babel-parser.extra.async(@nicolo-ribaudo)babel-compat-data,babel-plugin-bugfix-safari-class-field-initializer-scope,babel-preset-envbugfix-safari-class-field-initializer-scope(@davidtaylorhq)babel-plugin-transform-block-scoping,babel-traverse,babel-typesNodePath#getAssignmentIdentifiers(@JLHwung)babel-helper-import-to-platform-api,babel-plugin-proposal-json-modulesuncheckedRequireoption for JSON imports to CJS (@nicolo-ribaudo)babel-helper-transform-fixture-test-runner,babel-nodebabel-node --eval(@slatereax)babel-compat-data,babel-helper-create-regexp-features-plugin,babel-plugin-proposal-duplicate-named-capturing-groups-regex,babel-plugin-transform-duplicate-named-capturing-groups-regex,babel-preset-env,babel-standaloneduplicate-named-capturing-groups-regextopreset-env(@JLHwung)🐛 Bug Fix
babel-generatorbabel-template,babel-types🏠 Internal
babel-generator(before ambiguous tokens (@nicolo-ribaudo)babel-helper-function-name,babel-plugin-transform-arrow-functions,babel-plugin-transform-function-name,babel-preset-env,babel-traversehelper-function-namelogic (@nicolo-ribaudo)🏃♀️ Performance
babel-parser,babel-plugin-proposal-pipeline-operator🔬 Output optimization
babel-plugin-transform-classesassertThisInitialized(@liuxingbaoyu)babel-helper-create-class-features-plugin,babel-helper-replace-supers,babel-helpers,babel-plugin-proposal-decorators,babel-plugin-transform-class-properties,babel-plugin-transform-classes,babel-plugin-transform-exponentiation-operator,babel-plugin-transform-object-super,babel-plugin-transform-private-methods,babel-runtime-corejs2,babel-runtime-corejs3,babel-runtimesuper.xoutput (@liuxingbaoyu)babel-plugin-transform-class-properties,babel-plugin-transform-classesv7.24.8Compare Source
👓 Spec Compliance
babel-parserdeclare(@liuxingbaoyu)🐛 Bug Fix
babel-generatorininforheads (@nicolo-ribaudo)await using(@nicolo-ribaudo)babel-parserusingdeclarations (@H0onnn).value: undefinedto regexp literals (@liuxingbaoyu)babel-typesObjectTypeInternalSlotvisitor keys (@nicolo-ribaudo)babel-plugin-transform-typescriptexport import x =(@liuxingbaoyu)💅 Polish
babel-generatorasyncinfor await(@nicolo-ribaudo)babel-traverseScope.globalsmultiple times (@liuxingbaoyu)v7.24.7Compare Source
🐛 Bug Fix
babel-nodebabel-traverseconstantViolationswith destructuring (@liuxingbaoyu)babel-helper-transform-fixture-test-runner,babel-plugin-proposal-explicit-resource-managementusinginswitchcorrectly (@liuxingbaoyu)🏠 Internal
babel-helpers,babel-runtime-corejs2,babel-runtime-corejs3,babel-runtimev7.24.6Compare Source
🐛 Bug Fix
babel-helper-create-class-features-plugin,babel-plugin-transform-class-propertiesbabel-core,babel-generator,babel-plugin-transform-modules-commonjsbabel-helper-create-class-features-plugin,babel-plugin-proposal-decoratorsbabel-helpers,babel-plugin-proposal-decorators,babel-runtime-corejs3babel-parser,babel-plugin-transform-typescriptcls.fn<C> = x(@liuxingbaoyu)🏠 Internal
babel-core,babel-helpers,babel-plugin-transform-runtime,babel-preset-env,babel-runtime-corejs2,babel-runtime-corejs3,babel-runtimebabel-helperstsconfig.jsonfor@babel/helpers/src/helpers(@nicolo-ribaudo)babel-cli,babel-helpers,babel-plugin-external-helpers,babel-plugin-proposal-decorators,babel-plugin-transform-class-properties,babel-plugin-transform-modules-commonjs,babel-plugin-transform-modules-systemjs,babel-plugin-transform-runtime,babel-preset-env,babel-runtime-corejs2,babel-runtime-corejs3,babel-runtimebabel-parser,babel-traversev7.24.5Compare Source
🐛 Bug Fix
babel-plugin-transform-classes,babel-traversebabel-helpers,babel-plugin-proposal-explicit-resource-management,babel-runtime-corejs3💅 Polish
babel-parserusingdeclaration (@JLHwung)🏠 Internal
babel-parser@babel/parserAST types (@nicolo-ribaudo).startNode(@nicolo-ribaudo)babel-helper-create-class-features-plugin,babel-helper-member-expression-to-functions,babel-helper-module-transforms,babel-helper-split-export-declaration,babel-helper-wrap-function,babel-helpers,babel-plugin-bugfix-firefox-class-in-computed-class-key,babel-plugin-proposal-explicit-resource-management,babel-plugin-transform-block-scoping,babel-plugin-transform-destructuring,babel-plugin-transform-object-rest-spread,babel-plugin-transform-optional-chaining,babel-plugin-transform-parameters,babel-plugin-transform-private-property-in-object,babel-plugin-transform-react-jsx-self,babel-plugin-transform-typeof-symbol,babel-plugin-transform-typescript,babel-traverseNodePath<T | U>distributive (@nicolo-ribaudo)babel-plugin-proposal-partial-application,babel-typesJSXNamespacedNamefrom validCallExpressionargs (@nicolo-ribaudo)babel-plugin-transform-class-properties,babel-preset-env🏃♀️ Performance
babel-helpers,babel-preset-env,babel-runtime-corejs3objectWithoutPropertiesLooseon V8 (@romgrk)v7.24.4Compare Source
👓 Spec Compliance
babel-parserbabel-helpers,babel-plugin-proposal-decorators,babel-runtime-corejs3🐛 Bug Fix
babel-generator{ [key in Bar]? }(@liuxingbaoyu)TSMappedType(@liuxingbaoyu)babel-compat-data,babel-plugin-bugfix-firefox-class-in-computed-class-key,babel-preset-envbabel-helper-create-class-features-plugin,babel-plugin-proposal-decoratorssuper()exists andprotoInitis not needed (@liuxingbaoyu)babel-plugin-transform-block-scopingfor Xin loop (@liuxingbaoyu)letwhen theforbody is not a block (@liuxingbaoyu)babel-core,babel-plugin-transform-block-scoped-functions,babel-plugin-transform-block-scopingv7.24.1Compare Source
🐛 Bug Fix
babel-generatoras/satisfies(@nicolo-ribaudo)v7.24.0Compare Source
🚀 New Feature
babel-standalone@babel/standalone(@ajihyf)babel-core,babel-helper-create-class-features-plugin,babel-helpers,babel-plugin-transform-class-propertiesnoUninitializedPrivateFieldAccessassumption (@nicolo-ribaudo)babel-helper-create-class-features-plugin,babel-helpers,babel-plugin-proposal-decorators,babel-plugin-proposal-pipeline-operator,babel-plugin-syntax-decorators,babel-plugin-transform-class-properties,babel-runtime-corejs2,babel-runtime-corejs3,babel-runtimebabel-preset-flowignoreExtensionsin Flow preset (@nicolo-ribaudo)experimental_useHermesParseroption inpreset-flow(@liuxingbaoyu)babel-helper-import-to-platform-api,babel-plugin-proposal-import-wasm-source,babel-plugin-proposal-json-modules,babel-standalonebabel-plugin-transform-runtimemoduleNameoption to@babel/plugin-transform-runtime(@nicolo-ribaudo)babel-parser,babel-typesTSImportType(@sosukesuzuki)🐛 Bug Fix
babel-plugin-proposal-do-expressions,babel-traversepopContexton unvisited node paths (@JLHwung)babel-helper-create-class-features-plugin,babel-plugin-transform-private-methods,babel-plugin-transform-private-property-in-objectprivateFieldsAsSymbols(@liuxingbaoyu)babel-helper-create-class-features-plugin,babel-plugin-transform-private-methodsargumentsin privateget/setmethod (@liuxingbaoyu)babel-helper-create-class-features-plugin,babel-helpers,babel-plugin-proposal-decoratorsbabel-helper-create-class-features-plugin,babel-plugin-proposal-decoratorsstaticon decorated privateaccessor(@nicolo-ribaudo)babel-helper-create-class-features-plugin,babel-plugin-proposal-decorators,babel-plugin-transform-async-generator-functions,babel-plugin-transform-private-methods,babel-plugin-transform-private-property-in-object,babel-plugin-transform-typescript,babel-preset-envprivateFieldsAsProperties(@liuxingbaoyu)babel-helpersargumentsin a helper as a global reference (@nicolo-ribaudo)babel-helpers,babel-plugin-proposal-decoratorsaccess.getfor public setter decorators (@nicolo-ribaudo)💅 Polish
babel-core,babel-helper-create-class-features-plugin,babel-preset-envBABEL_SHOW_CONFIG_FORfor config problems (@nicolo-ribaudo)🏠 Internal
babel-helper-transform-fixture-test-runneroutput.jswhenexec.jsthrows (@liuxingbaoyu)🔬 Output optimization
babel-helper-create-class-features-plugin,babel-plugin-proposal-decoratorsbabel-helper-create-class-features-plugin,babel-helpers,babel-plugin-proposal-decorators,babel-plugin-proposal-pipeline-operator,babel-plugin-transform-class-propertiesbabel-helper-create-class-features-plugin,babel-helpers,babel-plugin-transform-private-methodsclassPrivateMethodGet(@liuxingbaoyu)babel-helper-create-class-features-plugin,babel-helpers,babel-plugin-proposal-decoratorsbabel-helper-create-class-features-plugin,babel-plugin-proposal-decorators,babel-plugin-transform-class-propertiesbabel-helper-create-class-features-plugin,babel-helper-fixtures,babel-helpers,babel-plugin-bugfix-v8-spread-parameters-in-optional-chaining,babel-plugin-proposal-decorators,babel-plugin-proposal-destructuring-private,babel-plugin-proposal-optional-chaining-assign,babel-plugin-transform-class-properties,babel-plugin-transform-class-static-block,babel-plugin-transform-private-methods,babel-plugin-transform-private-property-in-object,babel-preset-env,babel-runtime-corejs2,babel-runtime-corejs3,babel-runtimebabel-helpers,babel-plugin-proposal-decoratorsv7.23.9Compare Source
🐛 Bug Fix
babel-helper-transform-fixture-test-runner,babel-plugin-transform-function-name,babel-plugin-transform-modules-systemjs,babel-preset-envsystemjsre-traverses helpers (@liuxingbaoyu)babel-helper-create-class-features-plugin,babel-plugin-proposal-decoratorsbabel-plugin-proposal-decorators,babel-plugin-transform-async-generator-functions,babel-plugin-transform-runtime,babel-preset-envcore-js@3imports (@nicolo-ribaudo)babel-traversegetTypeAnnotationwhen using TS+inference (@liuxingbaoyu)no-use-before-definefor class ref in fields (@nicolo-ribaudo)🏠 Internal
babel-core,babel-parser,babel-templateeslint-parserto cts (@liuxingbaoyu)babel-types@babel/typesprops that are not produced by the parser (@liuxingbaoyu)🏃♀️ Performance
babel-parser🔬 Output optimization
babel-helper-create-class-features-plugin,babel-plugin-proposal-decorators,babel-plugin-proposal-destructuring-private,babel-plugin-proposal-pipeline-operator,babel-plugin-transform-class-properties,babel-plugin-transform-class-static-block,babel-plugin-transform-new-target,babel-plugin-transform-parameters,babel-plugin-transform-private-methods,babel-preset-envbabel-helpers,babel-plugin-proposal-explicit-resource-management,babel-runtime-corejs2,babel-runtime-corejs3,babel-runtimeusing(@liuxingbaoyu)v7.23.8Compare Source
🐛 Bug Fix
babel-preset-envpreset-envthrows exception forexport * as x(@liuxingbaoyu)babel-helpers,babel-plugin-proposal-decoratorsgetter/settertoctx.accessfor public fields (@liuxingbaoyu)↩️ Revert
🔬 Output optimization
babel-helpers,babel-plugin-proposal-decorators,babel-plugin-transform-class-properties,babel-plugin-transform-classes,babel-plugin-transform-function-name,babel-plugin-transform-parameters,babel-plugin-transform-react-jsx,babel-plugin-transform-runtime,babel-plugin-transform-spread,babel-plugin-transform-typescript,babel-preset-env,babel-runtime-corejs2,babel-runtime-corejs3,babel-runtimesuper()(@liuxingbaoyu)v7.23.7Compare Source
🐛 Bug Fix
babel-traverseProgram(@liuxingbaoyu)babel-helpers,babel-plugin-proposal-decoratorsctx.kindis wrong (@liuxingbaoyu)babel-plugin-proposal-decoratorsbabel-coreConfiguration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.