Skip to content

[LOW] Bump @babel/core to 7.29.7 - #58334

Open
OskarEichler wants to merge 1 commit into
react:mainfrom
OskarEichler:codex/security-babel-core
Open

[LOW] Bump @babel/core to 7.29.7#58334
OskarEichler wants to merge 1 commit into
react:mainfrom
OskarEichler:codex/security-babel-core

Conversation

@OskarEichler

Copy link
Copy Markdown
Contributor

Summary:

Bumps @babel/core from the vulnerable 7.28.0 lockfile resolution to 7.29.7, resolving GHSA-4x5r-pxfx-6jf8 / CVE-2026-49356. The reviewed advisory allows malicious source code compiled by Babel to read a known local source-map path when the attacker can observe the generated output.

All compatible workspace and transitive ranges are consolidated on 7.29.7. The Babel preset fixture is regenerated to capture the updated async-generator helper emitted by the patched Babel toolchain.

Changelog:

[INTERNAL] [SECURITY] - Update @babel/core to a release that prevents source-map path file reads from crafted input.

Test Plan:

  • yarn install --frozen-lockfile --ignore-scripts
  • yarn why @babel/core confirms compatible consumers resolve to 7.29.7
  • yarn audit --groups dependencies no longer reports GHSA-4x5r-pxfx-6jf8
  • yarn build
  • Focused Babel, transformer, and codegen Jest suites:
    • 72 suites passed
    • 3,285 tests passed
    • 1,309 snapshots passed
  • git diff --check

@meta-cla meta-cla Bot added the CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. label Sep 4, 2026
@facebook-github-tools facebook-github-tools Bot added the Shared with Meta Applied via automation to indicate that an Issue or Pull Request has been shared with the team. label Sep 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. Shared with Meta Applied via automation to indicate that an Issue or Pull Request has been shared with the team.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant