chore(deps): update dependency @babel/core to v7.29.6 [security] (master) by renovate[bot] · Pull Request #266 · researchgate/inline-stylesheet

renovate · 2026-06-25T02:43:18Z

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@babel/core (source)	`7.20.12` → `7.29.6`

@babel/core: Arbitrary File Read via sourceMappingURL Comment

CVE-2026-49356 / GHSA-4x5r-pxfx-6jf8

More information

Details

Impact

Using @babel/core to compile maliciously crafted code can allow ab attacker to read any source map from the system that is running Babel, if these conditions are all true:

the attacker controls the input source code
the attacker can read the output source code
the attacker knows the path of the source map file that they want to read

Users that only compile trusted code are not impacted.

Patches

The vulnerability has been fixed in @babel/core@7.29.6 and @babel/core@8.0.0-rc.6.

Workarounds

Callers can mitigate the issue without upgrading by setting inputSourceMap: false in their Babel options.

Callers can also manually extract the #sourceMappingURL comment from the input source code, validate whether the source map that it links to is allowed to be read, and if it is pass an object to inputSourceMap (passing false when it's not).

Credits

Thanks Teodor-Cristian Radoi for reporting the vulnerability.

Severity

CVSS Score: 3.2 / 10 (Low)
Vector String: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

babel/babel (@babel/core)

`v7.29.6`

Compare Source

v7.29.6 (2026-05-25)

🐛 Bug Fix

babel-generator
- #18014 Catchup source map position in preserveFormat (@nicolo-ribaudo)
babel-core
- #18001 [7.x packport]Improve input source map handling (@JLHwung)
babel-core, babel-generator
- #17998 Preserve original identifier names from input sourcemaps (#17992) (@Andarist)

Committers: 3

Huáng Jùnliàng (@JLHwung)
Mateusz Burzyński (@Andarist)
Nicolò Ribaudo (@nicolo-ribaudo)

`v7.29.0`

Compare Source

v7.29.0 (2026-01-31)

Thanks @simbahax for your first PR!

🚀 New Feature

babel-types
- #17750 [7.x backport] Add attributes import declaration builder (@JLHwung)
babel-standalone
- #17663 [7.x backport] feat(standalone): export async transform (@JLHwung)
- #17725 [7.x backport] feat: read standalone targets from data-targets (@JLHwung)

🐛 Bug Fix

babel-parser
- #17765 fix(parser): correctly parse type assertions in extends clause (@nicolo-ribaudo)
- #17723 [7.x backport] fix(parser): improve super type argument parsing (@JLHwung)
babel-traverse
- #17708 fix(traverse): provide a hub when traversing a File or Program and no parentPath is given (@simbahax)
babel-plugin-transform-block-scoping, babel-traverse
- #17737 [7.x backport] fix: Rename switch discriminant references when body creates shadowing variable (@magic-akari)

🏃‍♀️ Performance

babel-generator, babel-runtime-corejs3
- #17642 [Babel 7] Improve generator performance (@liuxingbaoyu)

Committers: 6

David (@simbahax)
Huáng Jùnliàng (@JLHwung)
Nicolò Ribaudo (@nicolo-ribaudo)
@liuxingbaoyu
@magic-akari

`v7.28.6`

Compare Source

v7.28.6 (2026-01-12)

Thanks @kadhirash and @kolvian for your first PRs!

🐛 Bug Fix

babel-cli, babel-code-frame, babel-core, babel-helper-check-duplicate-nodes, babel-helper-fixtures, babel-helper-plugin-utils, babel-node, babel-plugin-transform-flow-comments, babel-plugin-transform-modules-commonjs, babel-plugin-transform-property-mutators, babel-preset-env, babel-traverse, babel-types
- #17589 Improve Unicode handling in code-frame tokenizer (@JLHwung)
babel-plugin-transform-regenerator
- #17556 fix: transform-regenerator correctly handles scope (@liuxingbaoyu)
babel-plugin-transform-react-jsx
- #17538 fix: Keep jsx comments (@liuxingbaoyu)

💅 Polish

babel-core, babel-standalone
- #17606 Polish(standalone): improve message on invalid preset/plugin (@JLHwung)

🏠 Internal

babel-plugin-bugfix-v8-static-class-fields-redefine-readonly, babel-plugin-proposal-decorators, babel-plugin-proposal-import-attributes-to-assertions, babel-plugin-proposal-import-wasm-source, babel-plugin-syntax-async-do-expressions, babel-plugin-syntax-decorators, babel-plugin-syntax-destructuring-private, babel-plugin-syntax-do-expressions, babel-plugin-syntax-explicit-resource-management, babel-plugin-syntax-export-default-from, babel-plugin-syntax-flow, babel-plugin-syntax-function-bind, babel-plugin-syntax-function-sent, babel-plugin-syntax-import-assertions, babel-plugin-syntax-import-attributes, babel-plugin-syntax-import-defer, babel-plugin-syntax-import-source, babel-plugin-syntax-jsx, babel-plugin-syntax-module-blocks, babel-plugin-syntax-optional-chaining-assign, babel-plugin-syntax-partial-application, babel-plugin-syntax-pipeline-operator, babel-plugin-syntax-throw-expressions, babel-plugin-syntax-typescript, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-class-properties, babel-plugin-transform-class-static-block, babel-plugin-transform-dotall-regex, babel-plugin-transform-duplicate-named-capturing-groups-regex, babel-plugin-transform-explicit-resource-management, babel-plugin-transform-exponentiation-operator, babel-plugin-transform-json-strings, babel-plugin-transform-logical-assignment-operators, babel-plugin-transform-nullish-coalescing-operator, babel-plugin-transform-numeric-separator, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-catch-binding, babel-plugin-transform-optional-chaining, babel-plugin-transform-private-methods, babel-plugin-transform-private-property-in-object, babel-plugin-transform-regexp-modifiers, babel-plugin-transform-unicode-property-regex, babel-plugin-transform-unicode-sets-regex
- #17580 Allow Babel 8 in compatible Babel 7 plugins (@nicolo-ribaudo)

🏃‍♀️ Performance

babel-plugin-transform-react-jsx
- #17555 perf: Use lighter traversal for jsx __source,__self (@liuxingbaoyu)

Committers: 7

Babel Bot (@babel-bot)
Eliot Pontarelli (@kolvian)
Huáng Jùnliàng (@JLHwung)
Kadhirash Sivakumar (@kadhirash)
Nicolò Ribaudo (@nicolo-ribaudo)
@liuxingbaoyu
coderaiser (@coderaiser)

`v7.28.5`

Compare Source

v7.28.5 (2025-10-23)

Thank you @CO0Ki3, @Olexandr88, and @youthfulhps for your first PRs!

👓 Spec Compliance

babel-parser
- #17446 Allow Runtime Errors for Function Call Assignment Targets (@liuxingbaoyu)
babel-helper-validator-identifier
- #17501 fix: update identifier to unicode 17 (@fisker)

🐛 Bug Fix

babel-plugin-proposal-destructuring-private
- #17534 Allow mixing private destructuring and rest (@CO0Ki3)
babel-parser
- #17521 Improve @babel/parser error typing (@JLHwung)
- #17491 fix: improve ts-only declaration parsing (@JLHwung)
babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring
- #17519 fix: rest correctly returns plain array (@liuxingbaoyu)
babel-helper-create-class-features-plugin, babel-helper-member-expression-to-functions, babel-plugin-transform-block-scoping, babel-plugin-transform-optional-chaining, babel-traverse, babel-types
- #17503 Fix JSXIdentifier handling in isReferencedIdentifier (@JLHwung)
babel-traverse
- #17504 fix: ensure scope.push register in anonymous fn (@JLHwung)

🏠 Internal

babel-types
- #17494 Type checking babel-types scripts (@JLHwung)

🏃‍♀️ Performance

babel-core
- #17490 Faster finding of locations in buildCodeFrameError (@liuxingbaoyu)

Committers: 8

Babel Bot (@babel-bot)
Byeongho Yoo (@youthfulhps)
Huáng Jùnliàng (@JLHwung)
Hyeon Dokko (@CO0Ki3)
Nicolò Ribaudo (@nicolo-ribaudo)
@Olexandr88
@liuxingbaoyu
fisker Cheung (@fisker)

`v7.28.4`

Compare Source

v7.28.4 (2025-09-05)

Thanks @gwillen and @mrginglymus for your first PRs!

🏠 Internal

babel-core, babel-helper-check-duplicate-nodes, babel-traverse, babel-types
- #17493 Update Jest to v30.1.1 (@JLHwung)
babel-plugin-transform-regenerator
- #17455 chore: Clean up transform-regenerator (@liuxingbaoyu)
babel-core
- #17474 Switch to @jridgewell/remapping (@mrginglymus)

Committers: 5

Babel Bot (@babel-bot)
Bill Collins (@mrginglymus)
Glenn Willen (@gwillen)
Huáng Jùnliàng (@JLHwung)
@liuxingbaoyu

`v7.28.3`

Compare Source

v7.28.3 (2025-08-14)

👓 Spec Compliance

babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators, babel-plugin-transform-class-static-block, babel-preset-env
- #17443 [static blocks] Do not inject new static fields after static code (@nicolo-ribaudo)

🐛 Bug Fix

babel-parser
- #17465 fix(parser/typescript): parse import("./a", {with:{},}) (@easrng)
- #17478 fix(parser): stop subscript parsing on async arrow (@JLHwung)

💅 Polish

babel-plugin-transform-regenerator, babel-plugin-transform-runtime
- #17363 Do not save last yield in call in temp var (@nicolo-ribaudo)

📝 Documentation

#17448 move eslint-{parser,plugin} docs to the website (@JLHwung)

🏠 Internal

#17454 Enable type checking for scripts and babel-worker.cjs (@JLHwung)

🔬 Output optimization

babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions
- #17444 Optimize do expression output (@JLHwung)

Committers: 5

Babel Bot (@babel-bot)
Huáng Jùnliàng (@JLHwung)
Jam Balaya (@JamBalaya56562)
Nicolò Ribaudo (@nicolo-ribaudo)
easrng (@easrng)

`v7.28.0`

Compare Source

v7.28.0 (2025-07-02)

🚀 New Feature

babel-node
- #17147 Support top level await in node repl (@liuxingbaoyu)
babel-types
- #17258 feat(matchesPattern): support super/private/meta (@JLHwung)
babel-compat-data, babel-preset-env
- #17355 Add explicit resource management to preset-env (@JLHwung)
babel-core, babel-parser
- #17390 Support sourceType: "commonjs" (@JLHwung)
babel-generator, babel-parser
- #17346 Materialize explicitResourceManagement parser plugin (@JLHwung)
babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-plugin-transform-object-rest-spread, babel-traverse, babel-types
- #17391 LVal coverage updates (Part 2) (@JLHwung)
babel-parser, babel-traverse, babel-types
- #17378 Accept bigints in t.bigIntLiteral factory (@JLHwung)
babel-generator, babel-plugin-proposal-destructuring-private, babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring, babel-plugin-transform-explicit-resource-management, babel-plugin-transform-react-display-name, babel-types
- #17277 Transform discard binding (@JLHwung)
babel-generator, babel-parser, babel-plugin-proposal-destructuring-private, babel-plugin-transform-block-scoping, babel-plugin-transform-object-rest-spread, babel-plugin-transform-typescript, babel-traverse, babel-types
- #17163 Parse discard binding (@JLHwung)

🐛 Bug Fix

babel-helper-globals, babel-plugin-transform-classes, babel-traverse
- #17297 Create babel-helper-globals (@JLHwung)
babel-types
- #17009 feature: TSTypeOperator: keyof (#16799) (@coderaiser)

🏠 Internal

babel-compat-data, babel-plugin-proposal-decorators, babel-plugin-transform-async-generator-functions, babel-plugin-transform-json-modules, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs3
- #17403 Update babel-polyfill packages (@nicolo-ribaudo)

Committers: 5

Babel Bot (@babel-bot)
Huáng Jùnliàng (@JLHwung)
Nicolò Ribaudo (@nicolo-ribaudo)
@liuxingbaoyu
coderaiser (@coderaiser)

`v7.27.7`

Compare Source

v7.27.7 (2025-06-26)

Thanks @arthur-mountain and @evankanderson for your first PRs!

👓 Spec Compliance

babel-parser, babel-plugin-transform-classes
- #17203 Interepret parser allow* options as top level only (@JLHwung)
babel-parser
- #17371 fix: disable using in ambient context (@JLHwung)

🐛 Bug Fix

babel-core
- #17392 Improve TS babel config loading (@JLHwung)
babel-types
- #17376 fix: support negative bigint in valueToNode (@JLHwung)
babel-plugin-transform-parameters
- #17352 fix: Params of async function* should throw synchronously (@liuxingbaoyu)

🏠 Internal

babel-plugin-transform-destructuring, babel-plugin-transform-object-rest-spread
- #17389 Use NodePath#splitExportDeclaration in destructuring transforms (@JLHwung)

Committers: 6

Arthur (@arthur-mountain)
Babel Bot (@babel-bot)
Evan Anderson (@evankanderson)
Huáng Jùnliàng (@JLHwung)
Nicolò Ribaudo (@nicolo-ribaudo)
@liuxingbaoyu

`v7.27.4`

Compare Source

v7.27.4 (2025-05-30)

👓 Spec Compliance

babel-parser, babel-plugin-proposal-explicit-resource-management
- #17323 Disallow using in bare case statement (@JLHwung)

💅 Polish

babel-parser
- #17311 Improve parseExpression error messages (@JLHwung)

🔬 Output optimization

babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-classes, babel-plugin-transform-destructuring, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
- #17287 Reduce regenerator size more (@liuxingbaoyu)
babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-classes, babel-plugin-transform-destructuring, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs3
- #17334 Use shorter method names for regenerator context (@nicolo-ribaudo)
- #17268 Reduce regenerator helper size (@liuxingbaoyu)
babel-core, babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-classes, babel-plugin-transform-destructuring, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime, babel-standalone
- #17238 Split regeneratorRuntime into multiple helpers (@nicolo-ribaudo)

Committers: 4

Babel Bot (@babel-bot)
Huáng Jùnliàng (@JLHwung)
Nicolò Ribaudo (@nicolo-ribaudo)
@liuxingbaoyu

`v7.27.3`

Compare Source

v7.27.3 (2025-05-27)

🐛 Bug Fix

babel-generator
- #17324 Improve multiline comments handling in yield/await expression (@JLHwung)
babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3
- #17328 Correctly set .displayName on GeneratorFunction (@nicolo-ribaudo)
babel-plugin-proposal-explicit-resource-management
- #17319 fix: handle shadowed binding in for using of body (@JLHwung)
- #17317 fix: support named evaluation for using declaration (@JLHwung)
babel-plugin-proposal-decorators, babel-types
- #17321 fix(converter): Remove abstract modifiers in class declaration to expression conversion (@magic-akari)
babel-helper-module-transforms, babel-plugin-proposal-explicit-resource-management, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-umd
- #17257 Preserve class id when transforming using declarations with exported class (@JLHwung)
babel-parser
- #17312 fix(parser): properly handle optional markers in generator class methods (@magic-akari)
- #17307 fix(parser): Terminate modifier parsing at newline (@magic-akari)
babel-generator, babel-parser
- #17308 Improve import phase parsing (@JLHwung)

Committers: 7

Babel Bot (@babel-bot)
Huáng Jùnliàng (@JLHwung)
Nicolò Ribaudo (@nicolo-ribaudo)
Vik R (@vikr01)
@liuxingbaoyu
@magic-akari
fisker Cheung (@fisker)

`v7.27.1`

Compare Source

v7.27.1 (2025-04-30)

Thanks @kermanx and @woaitsAryan for your first PRs!

👓 Spec Compliance

babel-parser
- #17254 Allow using of as lexical declaration within for (@JLHwung)
- #17230 Disallow get/set in TSPropertySignature (@JLHwung)
babel-parser, babel-types
- #17193 Stricter TSImportType options parsing (@JLHwung)

🐛 Bug Fix

babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-traverse
- #17137 fix: do expressions should allow early exit (@kermanx)
babel-helper-wrap-function, babel-plugin-transform-async-to-generator
- #17251 Fix: propagate argument evaluation errors through async promise chain (@magic-akari)
babel-helper-remap-async-to-generator, babel-plugin-transform-async-to-generator
- #17231 fix apply()/call() annotated as pure (@Lacsw)
babel-helper-fixtures, babel-parser
- #17233 Create ChainExpression within TSInstantiationExpression (@JLHwung)
babel-generator, babel-parser
- #17226 Fill optional AST properties when both estree and typescript parser plugin are enabled (Part 2) (@JLHwung)
babel-parser
- #17224 Fill optional AST properties when both estree and typescript parser plugin are enabled (Part 1) (@JLHwung)
- #17080 Fix start of TSParameterProperty (@JLHwung)
babel-compat-data, babel-preset-env
- #17228 Update firefox bugfix compat data (@JLHwung)
babel-traverse
- #17156 fix: Objects and arrays with multiple references should not be evaluated (@liuxingbaoyu)
babel-generator
- #17216 Fix: support const type parameter in generator (@JLHwung)

💅 Polish

babel-plugin-bugfix-v8-spread-parameters-in-optional-chaining, babel-plugin-proposal-decorators, babel-plugin-transform-arrow-functions, babel-plugin-transform-class-properties, babel-plugin-transform-destructuring, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-chaining, babel-plugin-transform-parameters, babel-traverse
- #17221 Reduce generated names size for the 10th-11th (@nicolo-ribaudo)

🏠 Internal

babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
- #17263 Remove unused regenerator-runtime dep in @babel/runtime (@nicolo-ribaudo)
babel-compat-data, babel-preset-env
- #17256 Tune plugin compat data (@JLHwung)
babel-compat-data, babel-standalone
- #17236 migrate babel-compat-data build script to mjs (@JLHwung)
babel-register
- #16844 Migrate @babel/register to cts (@liuxingbaoyu)
babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3
- #17205 Inline regenerator in the relevant packages (@nicolo-ribaudo)
All packages
- #17207 Enforce node protocol import (@JLHwung)

🔬 Output optimization

babel-helpers, babel-plugin-transform-modules-commonjs, babel-runtime-corejs3
- #16538 Reduce interopRequireWildcard size (@liuxingbaoyu)
babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3
- #17213 Reduce regeneratorRuntime size (@liuxingbaoyu)

Committers: 9

Aryan Bharti (@woaitsAryan)
Babel Bot (@babel-bot)
Frolov Roman (@Lacsw)
Huáng Jùnliàng (@JLHwung)
Nicolò Ribaudo (@nicolo-ribaudo)
@liuxingbaoyu
@magic-akari
_Kerman (@kermanx)
fisker Cheung (@fisker)

`v7.26.10`

Compare Source

v7.26.10 (2025-03-11)

Thanks @jordan-choi and @mmmsssttt404 for your first PRs!

This release includes a fix for GHSA-968p-4wvh-cqc8, a security vulnerability which affects the .replace method of transpiled regular expressions that use named capturing groups.

👓 Spec Compliance

babel-parser
- #17159 Disallow decorator in array pattern (@JLHwung)

🐛 Bug Fix

babel-parser, babel-template
- #17164 Fix: always initialize ExportDeclaration attributes (@JLHwung)
babel-core
- #17142 fix: "Map maximum size exceeded" in deepClone (@liuxingbaoyu)
babel-parser, babel-plugin-transform-typescript
- #17154 Update typescript parser tests (@JLHwung)
babel-traverse
- #17151 fix: Should not evaluate vars in child scope (@liuxingbaoyu)
babel-generator
- #17153 fix: Correctly generate abstract override (@liuxingbaoyu)
babel-parser
- #17107 Fix source type detection when parsing TypeScript (@JLHwung)
babel-helpers, babel-runtime, babel-runtime-corejs2, babel-runtime-corejs3
- #17173 Fix processing of replacement pattern with named capture groups (@mmmsssttt404)

💅 Polish

babel-standalone
- #17158 Avoid warnings when re-bundling @babel/standalone with webpack (@liuxingbaoyu)

🏠 Internal

babel-parser
- #17160 Left-value parsing cleanup (@JLHwung)

Committers: 6

Babel Bot (@babel-bot)
Huáng Jùnliàng (@JLHwung)
Nicolò Ribaudo (@nicolo-ribaudo)
Yunyoung Jordan Choi (@jordan-choi)
@liuxingbaoyu
@mmmsssttt404

`v7.26.9`

Compare Source

v7.26.9 (2025-02-14)

🐛 Bug Fix

babel-types
- #17103 fix: Definition for TSPropertySignature.kind (@liuxingbaoyu)
babel-generator, babel-types
- #17062 Print TypeScript optional/definite in ClassPrivateProperty (@jamiebuilds-signal)

🏠 Internal

babel-types
- #17130 Use .ts files with explicit reexports to solve name conflicts (@nicolo-ribaudo)
babel-core
- #17127 Do not depend on @types/gensync in Babel 7 (@nicolo-ribaudo)

Committers: 5

Babel Bot (@babel-bot)
Huáng Jùnliàng (@JLHwung)
Jamie Kyle (@jamiebuilds-signal)
Nicolò Ribaudo (@nicolo-ribaudo)
@liuxingbaoyu

`v7.26.8`

Compare Source

v7.26.8 (2025-02-08)

🏠 Internal

babel-preset-env
- #17097 Update dependency babel-plugin-polyfill-corejs3 to ^0.11.0

`v7.26.7`

Compare Source

v7.26.7 (2025-01-24)

Thanks @branchseer and @tquetano-netflix for your first PRs!

🐛 Bug Fix

babel-helpers, babel-preset-env, babel-runtime-corejs3
- #17086 Make "object without properties" helpers ES6-compatible (@tquetano-netflix)
babel-plugin-transform-typeof-symbol
- #17085 fix: Correctly handle typeof in arrow functions (@liuxingbaoyu)
babel-parser
- #17079 Respect ranges option in estree method value (@JLHwung)
babel-core
- #17052 Do not try to parse .ts configs as JSON if natively supported (@nicolo-ribaudo)
babel-plugin-transform-typescript
- #17050 fix: correctly resolve references to non-constant enum members (@branchseer)
babel-plugin-transform-typescript, babel-traverse, babel-types
- #17025 fix: Remove type-only import x = y.z (@liuxingbaoyu)

Committers: 6

Babel Bot (@babel-bot)
Huáng Jùnliàng (@JLHwung)
Nicolò Ribaudo (@nicolo-ribaudo)
Tony Quetano (@tquetano-netflix)
@branchseer
@liuxingbaoyu

`v7.26.0`

Compare Source

v7.26.0 (2024-10-25)

Thanks @timofei-iatsenko for your first PR!

You can find the release blog post with some highlights at https://babeljs.io/blog/2024/10/25/7.26.0.

🚀 New Feature

babel-core, babel-generator, babel-parser, babel-plugin-syntax-import-assertions, babel-plugin-syntax-import-attributes, babel-preset-env, babel-standalone, babel-types
- #16850 Enable import attributes parsing by default (@nicolo-ribaudo)
babel-core
- #16862 feat: support async plugin's pre/post (@timofei-iatsenko)
babel-compat-data, babel-plugin-proposal-regexp-modifiers, babel-plugin-transform-regexp-modifiers, babel-preset-env, babel-standalone
- #16692 Add transform-regexp-modifiers to preset-env (@JLHwung)
babel-parser
- #16849 feat: add startIndex parser option (@DylanPiercey)
babel-generator, babel-parser, babel-plugin-syntax-flow
- #16841 Always enable parsing of Flow enums (@nicolo-ribaudo)
babel-helpers, babel-preset-typescript, babel-runtime-corejs3
- #16794 Support import() in rewriteImportExtensions (@liuxingbaoyu)
babel-generator, babel-parser
- #16708 Add experimental format-preserving mode to @babel/generator (@nicolo-ribaudo)

🐛 Bug Fix

babel-core
- #16928 Workaround Node.js bug for parallel loading of TLA modules (@nicolo-ribaudo)
- #16926 Fix loading of modules with TLA in Node.js 23 (@nicolo-ribaudo)

💅 Polish

babel-plugin-proposal-json-modules, babel-plugin-transform-json-modules, babel-standalone
- #16924 Rename proposal-json-modules to transform-json-modules (@nicolo-ribaudo)

🏠 Internal

babel-code-frame, babel-highlight
- #16896 Inline @babel/highlight in @babel/code-frame (@nicolo-ribaudo)
babel-generator, babel-parser, babel-types
- #16732 Add kind to TSModuleDeclaration (@liuxingbaoyu)

🏃‍♀️ Performance

babel-helper-module-transforms, babel-plugin-transform-modules-commonjs
- #16882 perf: Improve module transforms (@liuxingbaoyu)

Committers: 5

Dylan Piercey (@DylanPiercey)
Huáng Jùnliàng (@JLHwung)
Nicolò Ribaudo (@nicolo-ribaudo)
Timofei Iatsenko (@timofei-iatsenko)
@liuxingbaoyu

`v7.25.9`

Compare Source

v7.25.9 (2024-10-22)

Thanks @victorenator for your first PR!

🐛 Bug Fix

`babel-p

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Europe/Berlin)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Copilot

🔵 Needs a closer look

The compiler and transitive dependency upgrades need CI validation with the existing Babel plugins and Node.js 14 workflow.

No open issues 🎉

What changed in this PR

Updates the project’s Babel development dependency to address the source-map file-read vulnerability described in CVE-2026-49356.

Changes:

Raises @babel/core from 7.20.12 to 7.29.6.
Refreshes transitive Babel, source-map, and browser compatibility dependencies in the Yarn lockfile.

File	Description
yarn.lock	Locks the updated compiler and its transitive dependencies.
package.json	Pins `@babel/core` to the security-patched version.

_{Review effort: Balanced}

renovate Bot added the dependencies Pull requests that update a dependency file label Jun 25, 2026

renovate Bot force-pushed the renovate/master-npm-babel-core-vulnerability branch 2 times, most recently from cf2cbf7 to 544618a Compare July 16, 2026 17:40

renovate Bot force-pushed the renovate/master-npm-babel-core-vulnerability branch 2 times, most recently from a8eab71 to 90215f2 Compare July 24, 2026 21:09

renovate Bot force-pushed the renovate/master-npm-babel-core-vulnerability branch from 90215f2 to a7b23b5 Compare July 30, 2026 18:42

renovate Bot force-pushed the renovate/master-npm-babel-core-vulnerability branch 2 times, most recently from 33ebc76 to 69e5165 Compare August 14, 2026 17:10

renovate Bot force-pushed the renovate/master-npm-babel-core-vulnerability branch 2 times, most recently from bb617f4 to 49a5e10 Compare September 2, 2026 16:16

renovate Bot force-pushed the renovate/master-npm-babel-core-vulnerability branch 3 times, most recently from 999b0df to 81ba31c Compare September 10, 2026 16:42

renovate Bot force-pushed the renovate/master-npm-babel-core-vulnerability branch 2 times, most recently from e805a2e to 0a1e7e7 Compare September 18, 2026 22:16

renovate Bot force-pushed the renovate/master-npm-babel-core-vulnerability branch 2 times, most recently from 763962e to 8f574bf Compare October 1, 2026 14:54

renovate Bot force-pushed the renovate/master-npm-babel-core-vulnerability branch from 8f574bf to ad9502e Compare October 5, 2026 21:10

renovate Bot force-pushed the renovate/master-npm-babel-core-vulnerability branch 2 times, most recently from 24ff6f0 to 0ea3cc2 Compare October 20, 2026 09:48

renovate Bot force-pushed the renovate/master-npm-babel-core-vulnerability branch from 0ea3cc2 to e75780e Compare October 22, 2026 16:03

Copilot AI balanced review requested due to automatic review settings October 22, 2026 16:03

Copilot started reviewing October 22, 2026 16:04

View session

Copilot AI reviewed Oct 22, 2026

View reviewed changes

renovate Bot force-pushed the renovate/master-npm-babel-core-vulnerability branch from e75780e to 57dfb8c Compare October 27, 2026 00:36

renovate Bot force-pushed the renovate/master-npm-babel-core-vulnerability branch from 57dfb8c to f0ad7e5 Compare November 5, 2026 22:53

chore(deps): update dependency @babel/core to v7.29.6 [security]

9ff2183

renovate Bot force-pushed the renovate/master-npm-babel-core-vulnerability branch from f0ad7e5 to 9ff2183 Compare November 11, 2026 20:35

Navigation Menu

Repository navigation

chore(deps): update dependency @babel/core to v7.29.6 [security] (master) - #266

chore(deps): update dependency @babel/core to v7.29.6 [security] (master)#266
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/master-npm-babel-core-vulnerability

renovate Bot commented Jun 25, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate Bot commented Jun 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

@​babel/core: Arbitrary File Read via sourceMappingURL Comment

Details

Impact

Patches

Workarounds

Credits

Severity

References

Release Notes

v7.29.6 (2026-05-25)

🐛 Bug Fix

Committers: 3

v7.29.0 (2026-01-31)

🚀 New Feature

🐛 Bug Fix

🏃‍♀️ Performance

Committers: 6

v7.28.6 (2026-01-12)

🐛 Bug Fix

💅 Polish

🏠 Internal

🏃‍♀️ Performance

Committers: 7

v7.28.5 (2025-10-23)

👓 Spec Compliance

🐛 Bug Fix

🏠 Internal

🏃‍♀️ Performance

Committers: 8

v7.28.4 (2025-09-05)

🏠 Internal

Committers: 5

v7.28.3 (2025-08-14)

👓 Spec Compliance

🐛 Bug Fix

💅 Polish

📝 Documentation

🏠 Internal

🔬 Output optimization

Committers: 5

v7.28.0 (2025-07-02)

🚀 New Feature

🐛 Bug Fix

🏠 Internal

Committers: 5

v7.27.7 (2025-06-26)

👓 Spec Compliance

🐛 Bug Fix

🏠 Internal

Committers: 6

v7.27.4 (2025-05-30)

👓 Spec Compliance

💅 Polish

🔬 Output optimization

Committers: 4

v7.27.3 (2025-05-27)

🐛 Bug Fix

Committers: 7

v7.27.1 (2025-04-30)

👓 Spec Compliance

🐛 Bug Fix

💅 Polish

🏠 Internal

🔬 Output optimization

Committers: 9

v7.26.10 (2025-03-11)

👓 Spec Compliance

🐛 Bug Fix

💅 Polish

🏠 Internal

Committers: 6

v7.26.9 (2025-02-14)

🐛 Bug Fix

🏠 Internal

Committers: 5

v7.26.8 (2025-02-08)

🏠 Internal

renovate Bot commented Jun 25, 2026 •

edited

Loading

@babel/core: Arbitrary File Read via sourceMappingURL Comment