fix(deps): update dependency @babel/runtime-corejs3 to v7.26.10 [security] #1025
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
7.23.2
->7.26.10
GitHub Vulnerability Alerts
CVE-2025-27789
Impact
When using Babel to compile regular expression named capturing groups, Babel will generate a polyfill for the
.replace
method that has quadratic complexity on some specific replacement pattern strings (i.e. the second argument passed to.replace
).Your generated code is vulnerable if all the following conditions are true:
.replace
method on a regular expression that contains named capturing groups.replace
If you are using
@babel/preset-env
with thetargets
option, the transform that injects the vulnerable code is automatically enabled if:You can verify what transforms
@babel/preset-env
is using by enabling thedebug
option.Patches
This problem has been fixed in
@babel/helpers
and@babel/runtime
7.26.10 and 8.0.0-alpha.17, please upgrade. It's likely that you do not directly depend on@babel/helpers
, and instead you depend on@babel/core
(which itself depends on@babel/helpers
). Upgrading to@babel/core
7.26.10 is not required, but it guarantees that you are on a new enough@babel/helpers
version.Please note that just updating your Babel dependencies is not enough: you will also need to re-compile your code.
Workarounds
If you are passing user-provided strings as the second argument of
.replace
on regular expressions that contain named capturing groups, validate the input and make sure it does not contain the substring$<
if it's then not followed by>
(possibly with other characters in between).References
This vulnerability was reported and fixed in https://github.com/babel/babel/pull/17173.
Release Notes
babel/babel (@babel/runtime-corejs3)
v7.26.10
Compare Source
👓 Spec Compliance
babel-parser
🐛 Bug Fix
babel-parser
,babel-template
babel-core
babel-parser
,babel-plugin-transform-typescript
babel-traverse
babel-generator
abstract override
(@liuxingbaoyu)babel-parser
babel-helpers
,babel-runtime
,babel-runtime-corejs2
,babel-runtime-corejs3
💅 Polish
babel-standalone
🏠 Internal
babel-parser
v7.26.9
Compare Source
🐛 Bug Fix
babel-types
TSPropertySignature.kind
(@liuxingbaoyu)babel-generator
,babel-types
🏠 Internal
babel-types
.ts
files with explicit reexports to solve name conflicts (@nicolo-ribaudo)babel-core
@types/gensync
in Babel 7 (@nicolo-ribaudo)v7.26.7
Compare Source
🐛 Bug Fix
babel-helpers
,babel-preset-env
,babel-runtime-corejs3
babel-plugin-transform-typeof-symbol
typeof
in arrow functions (@liuxingbaoyu)babel-parser
ranges
option in estree method value (@JLHwung)babel-core
babel-plugin-transform-typescript
babel-plugin-transform-typescript
,babel-traverse
,babel-types
import x = y.z
(@liuxingbaoyu)v7.26.0
Compare Source
🚀 New Feature
babel-core
,babel-generator
,babel-parser
,babel-plugin-syntax-import-assertions
,babel-plugin-syntax-import-attributes
,babel-preset-env
,babel-standalone
,babel-types
babel-core
babel-compat-data
,babel-plugin-proposal-regexp-modifiers
,babel-plugin-transform-regexp-modifiers
,babel-preset-env
,babel-standalone
transform-regexp-modifiers
topreset-env
(@JLHwung)babel-parser
startIndex
parser option (@DylanPiercey)babel-generator
,babel-parser
,babel-plugin-syntax-flow
babel-helpers
,babel-preset-typescript
,babel-runtime-corejs3
import()
inrewriteImportExtensions
(@liuxingbaoyu)babel-generator
,babel-parser
@babel/generator
(@nicolo-ribaudo)🐛 Bug Fix
babel-core
💅 Polish
babel-plugin-proposal-json-modules
,babel-plugin-transform-json-modules
,babel-standalone
proposal-json-modules
totransform-json-modules
(@nicolo-ribaudo)🏠 Internal
babel-code-frame
,babel-highlight
@babel/highlight
in@babel/code-frame
(@nicolo-ribaudo)babel-generator
,babel-parser
,babel-types
kind
toTSModuleDeclaration
(@liuxingbaoyu)🏃♀️ Performance
babel-helper-module-transforms
,babel-plugin-transform-modules-commonjs
v7.25.9
Compare Source
🐛 Bug Fix
babel-parser
,babel-template
,babel-types
syntacticPlaceholders
mode (@liuxingbaoyu)babel-helper-compilation-targets
,babel-preset-env
ClassAccessorProperty
to prevent theno-undef
rule (@victorenator)🏠 Internal
babel-helper-transform-fixture-test-runner
🏃♀️ Performance
babel-parser
,babel-types
VISITOR_KEYS
etc. faster to access (@liuxingbaoyu)v7.25.7
Compare Source
🐛 Bug Fix
babel-helper-validator-identifier
babel-traverse
babel-plugin-transform-classes
super()
check (@nicolo-ribaudo)babel-generator
infer
in compact mode (@nicolo-ribaudo)[no LineTerminator here]
after nodes (@nicolo-ribaudo)💅 Polish
babel-types
🏠 Internal
babel-core
--experimental-require-module
(@nicolo-ribaudo)babel-helper-compilation-targets
,babel-helper-plugin-utils
,babel-preset-env
babel-plugin-proposal-destructuring-private
,babel-plugin-syntax-decimal
,babel-plugin-syntax-import-reflection
,babel-standalone
babel-generator
[no LineTerminator here]
before nodes (@nicolo-ribaudo)🏃♀️ Performance
babel-plugin-transform-typescript
babel-types
BABEL_TYPES_8_BREAKING
at startup (@nicolo-ribaudo)v7.25.6
Compare Source
🐛 Bug Fix
babel-generator
babel-traverse
path.getAssignmentIdentifiers
may beundefined
(@liuxingbaoyu)babel-parser
babel-helpers
,babel-plugin-transform-optional-chaining
,babel-runtime-corejs3
superPropertyGet
helper (@nicolo-ribaudo)💅 Polish
babel-generator
,babel-plugin-transform-async-to-generator
,babel-plugin-transform-block-scoping
,babel-plugin-transform-class-properties
,babel-plugin-transform-classes
,babel-plugin-transform-duplicate-named-capturing-groups-regex
,babel-plugin-transform-named-capturing-groups-regex
,babel-plugin-transform-react-jsx-development
,babel-plugin-transform-react-jsx
,babel-plugin-transform-react-pure-annotations
,babel-plugin-transform-regenerator
,babel-plugin-transform-runtime
,babel-preset-env
(
and comments (@nicolo-ribaudo)babel-plugin-syntax-import-assertions
,babel-plugin-syntax-import-attributes
babel-generator
🏠 Internal
babel-generator
parent
params in the generator (@nicolo-ribaudo)v7.25.0
Compare Source
👓 Spec Compliance
babel-helpers
,babel-plugin-proposal-explicit-resource-management
,babel-runtime-corejs3
await using
normative updates (@JLHwung)babel-plugin-transform-typescript
🚀 New Feature
babel-helper-create-class-features-plugin
,babel-helper-function-name
,babel-helper-plugin-utils
,babel-helper-wrap-function
,babel-plugin-bugfix-safari-class-field-initializer-scope
,babel-plugin-bugfix-safari-id-destructuring-collision-in-function-expression
,babel-plugin-transform-classes
,babel-plugin-transform-function-name
,babel-preset-env
,babel-traverse
,babel-types
ensureFunctionName
toNodePath.prototype
(@nicolo-ribaudo)babel-helper-hoist-variables
,babel-helper-plugin-utils
,babel-plugin-proposal-async-do-expressions
,babel-plugin-transform-modules-systemjs
,babel-traverse
hoistVariables
toScope.prototype
(@nicolo-ribaudo)babel-helper-create-class-features-plugin
,babel-helper-module-transforms
,babel-helper-plugin-utils
,babel-helper-split-export-declaration
,babel-plugin-transform-classes
,babel-traverse
,babel-types
splitExportDeclaration
toNodePath.prototype
(@nicolo-ribaudo)babel-helper-create-class-features-plugin
,babel-helper-environment-visitor
,babel-helper-module-transforms
,babel-helper-plugin-utils
,babel-helper-remap-async-to-generator
,babel-helper-replace-supers
,babel-plugin-bugfix-firefox-class-in-computed-class-key
,babel-plugin-bugfix-v8-static-class-fields-redefine-readonly
,babel-plugin-transform-async-generator-functions
,babel-plugin-transform-classes
,babel-traverse
environment-visitor
helper into@babel/traverse
(@nicolo-ribaudo)babel-core
,babel-parser
.extra.async
(@nicolo-ribaudo)babel-compat-data
,babel-plugin-bugfix-safari-class-field-initializer-scope
,babel-preset-env
bugfix-safari-class-field-initializer-scope
(@davidtaylorhq)babel-plugin-transform-block-scoping
,babel-traverse
,babel-types
NodePath#getAssignmentIdentifiers
(@JLHwung)babel-helper-import-to-platform-api
,babel-plugin-proposal-json-modules
uncheckedRequire
option for JSON imports to CJS (@nicolo-ribaudo)babel-helper-transform-fixture-test-runner
,babel-node
babel-node --eval
(@slatereax)babel-compat-data
,babel-helper-create-regexp-features-plugin
,babel-plugin-proposal-duplicate-named-capturing-groups-regex
,babel-plugin-transform-duplicate-named-capturing-groups-regex
,babel-preset-env
,babel-standalone
duplicate-named-capturing-groups-regex
topreset-env
(@JLHwung)🐛 Bug Fix
babel-generator
babel-template
,babel-types
🏠 Internal
babel-generator
(
before ambiguous tokens (@nicolo-ribaudo)babel-helper-function-name
,babel-plugin-transform-arrow-functions
,babel-plugin-transform-function-name
,babel-preset-env
,babel-traverse
helper-function-name
logic (@nicolo-ribaudo)🏃♀️ Performance
babel-parser
,babel-plugin-proposal-pipeline-operator
🔬 Output optimization
babel-plugin-transform-classes
assertThisInitialized
(@liuxingbaoyu)babel-helper-create-class-features-plugin
,babel-helper-replace-supers
,babel-helpers
,babel-plugin-proposal-decorators
,babel-plugin-transform-class-properties
,babel-plugin-transform-classes
,babel-plugin-transform-exponentiation-operator
,babel-plugin-transform-object-super
,babel-plugin-transform-private-methods
,babel-runtime-corejs2
,babel-runtime-corejs3
,babel-runtime
super.x
output (@liuxingbaoyu)babel-plugin-transform-class-properties
,babel-plugin-transform-classes
v7.24.8
Compare Source
👓 Spec Compliance
babel-parser
declare
(@liuxingbaoyu)🐛 Bug Fix
babel-generator
in
infor
heads (@nicolo-ribaudo)await using
(@nicolo-ribaudo)babel-parser
using
declarations (@H0onnn).value: undefined
to regexp literals (@liuxingbaoyu)babel-types
ObjectTypeInternalSlot
visitor keys (@nicolo-ribaudo)babel-plugin-transform-typescript
export import x =
(@liuxingbaoyu)💅 Polish
babel-generator
async
infor await
(@nicolo-ribaudo)babel-traverse
Scope.globals
multiple times (@liuxingbaoyu)v7.24.7
Compare Source
🐛 Bug Fix
babel-node
babel-traverse
constantViolations
with destructuring (@liuxingbaoyu)babel-helper-transform-fixture-test-runner
,babel-plugin-proposal-explicit-resource-management
using
inswitch
correctly (@liuxingbaoyu)🏠 Internal
babel-helpers
,babel-runtime-corejs2
,babel-runtime-corejs3
,babel-runtime
v7.24.6
Compare Source
🐛 Bug Fix
babel-helper-create-class-features-plugin
,babel-plugin-transform-class-properties
babel-core
,babel-generator
,babel-plugin-transform-modules-commonjs
babel-helper-create-class-features-plugin
,babel-plugin-proposal-decorators
babel-helpers
,babel-plugin-proposal-decorators
,babel-runtime-corejs3
babel-parser
,babel-plugin-transform-typescript
cls.fn<C> = x
(@liuxingbaoyu)🏠 Internal
babel-core
,babel-helpers
,babel-plugin-transform-runtime
,babel-preset-env
,babel-runtime-corejs2
,babel-runtime-corejs3
,babel-runtime
babel-helpers
tsconfig.json
for@babel/helpers/src/helpers
(@nicolo-ribaudo)babel-cli
,babel-helpers
,babel-plugin-external-helpers
,babel-plugin-proposal-decorators
,babel-plugin-transform-class-properties
,babel-plugin-transform-modules-commonjs
,babel-plugin-transform-modules-systemjs
,babel-plugin-transform-runtime
,babel-preset-env
,babel-runtime-corejs2
,babel-runtime-corejs3
,babel-runtime
babel-parser
,babel-traverse
v7.24.5
Compare Source
🐛 Bug Fix
babel-plugin-transform-classes
,babel-traverse
babel-helpers
,babel-plugin-proposal-explicit-resource-management
,babel-runtime-corejs3
💅 Polish
babel-parser
using
declaration (@JLHwung)🏠 Internal
babel-parser
@babel/parser
AST types (@nicolo-ribaudo).startNode
(@nicolo-ribaudo)babel-helper-create-class-features-plugin
,babel-helper-member-expression-to-functions
,babel-helper-module-transforms
,babel-helper-split-export-declaration
,babel-helper-wrap-function
,babel-helpers
,babel-plugin-bugfix-firefox-class-in-computed-class-key
,babel-plugin-proposal-explicit-resource-management
,babel-plugin-transform-block-scoping
,babel-plugin-transform-destructuring
,babel-plugin-transform-object-rest-spread
,babel-plugin-transform-optional-chaining
,babel-plugin-transform-parameters
,babel-plugin-transform-private-property-in-object
,babel-plugin-transform-react-jsx-self
,babel-plugin-transform-typeof-symbol
,babel-plugin-transform-typescript
,babel-traverse
NodePath<T | U>
distributive (@nicolo-ribaudo)babel-plugin-proposal-partial-application
,babel-types
JSXNamespacedName
from validCallExpression
args (@nicolo-ribaudo)babel-plugin-transform-class-properties
,babel-preset-env
🏃♀️ Performance
babel-helpers
,babel-preset-env
,babel-runtime-corejs3
objectWithoutPropertiesLoose
on V8 (@romgrk)v7.24.4
Compare Source
👓 Spec Compliance
babel-parser
babel-helpers
,babel-plugin-proposal-decorators
,babel-runtime-corejs3
🐛 Bug Fix
babel-generator
{ [key in Bar]? }
(@liuxingbaoyu)TSMappedType
(@liuxingbaoyu)babel-compat-data
,babel-plugin-bugfix-firefox-class-in-computed-class-key
,babel-preset-env
babel-helper-create-class-features-plugin
,babel-plugin-proposal-decorators
super()
exists andprotoInit
is not needed (@liuxingbaoyu)babel-plugin-transform-block-scoping
for X
in loop (@liuxingbaoyu)let
when thefor
body is not a block (@liuxingbaoyu)babel-core
,babel-plugin-transform-block-scoped-functions
,babel-plugin-transform-block-scoping
v7.24.1
Compare Source
🐛 Bug Fix
babel-generator
as
/satisfies
(@nicolo-ribaudo)v7.24.0
Compare Source
🚀 New Feature
babel-standalone
@babel/standalone
(@ajihyf)babel-core
,babel-helper-create-class-features-plugin
,babel-helpers
,babel-plugin-transform-class-properties
noUninitializedPrivateFieldAccess
assumption (@nicolo-ribaudo)babel-helper-create-class-features-plugin
,babel-helpers
,babel-plugin-proposal-decorators
,babel-plugin-proposal-pipeline-operator
,babel-plugin-syntax-decorators
,babel-plugin-transform-class-properties
,babel-runtime-corejs2
,babel-runtime-corejs3
,babel-runtime
babel-preset-flow
ignoreExtensions
in Flow preset (@nicolo-ribaudo)experimental_useHermesParser
option inpreset-flow
(@liuxingbaoyu)babel-helper-import-to-platform-api
,babel-plugin-proposal-import-wasm-source
,babel-plugin-proposal-json-modules
,babel-standalone
babel-plugin-transform-runtime
moduleName
option to@babel/plugin-transform-runtime
(@nicolo-ribaudo)babel-parser
,babel-types
TSImportType
(@sosukesuzuki)🐛 Bug Fix
babel-plugin-proposal-do-expressions
,babel-traverse
popContext
on unvisited node paths (@JLHwung)babel-helper-create-class-features-plugin
,babel-plugin-transform-private-methods
,babel-plugin-transform-private-property-in-object
privateFieldsAsSymbols
(@liuxingbaoyu)babel-helper-create-class-features-plugin
,babel-plugin-transform-private-methods
arguments
in privateget/set
method (@liuxingbaoyu)babel-helper-create-class-features-plugin
,babel-helpers
,babel-plugin-proposal-decorators
babel-helper-create-class-features-plugin
,babel-plugin-proposal-decorators
static
on decorated privateaccessor
(@nicolo-ribaudo)babel-helper-create-class-features-plugin
,babel-plugin-proposal-decorators
,babel-plugin-transform-async-generator-functions
,babel-plugin-transform-private-methods
,babel-plugin-transform-private-property-in-object
,babel-plugin-transform-typescript
,babel-preset-env
privateFieldsAsProperties
(@liuxingbaoyu)babel-helpers
arguments
in a helper as a global reference (@nicolo-ribaudo)babel-helpers
,babel-plugin-proposal-decorators
access.get
for public setter decorators (@nicolo-ribaudo)💅 Polish
babel-core
,babel-helper-create-class-features-plugin
,babel-preset-env
BABEL_SHOW_CONFIG_FOR
for config problems (@nicolo-ribaudo)🏠 Internal
babel-helper-transform-fixture-test-runner
output.js
whenexec.js
throws (@liuxingbaoyu)🔬 Output optimization
babel-helper-create-class-features-plugin
,babel-plugin-proposal-decorators
babel-helper-create-class-features-plugin
,babel-helpers
,babel-plugin-proposal-decorators
,babel-plugin-proposal-pipeline-operator
,babel-plugin-transform-class-properties
babel-helper-create-class-features-plugin
,babel-helpers
,babel-plugin-transform-private-methods
classPrivateMethodGet
(@liuxingbaoyu)babel-helper-create-class-features-plugin
,babel-helpers
,babel-plugin-proposal-decorators
babel-helper-create-class-features-plugin
,babel-plugin-proposal-decorators
,babel-plugin-transform-class-properties
babel-helper-create-class-features-plugin
,babel-helper-fixtures
,babel-helpers
,babel-plugin-bugfix-v8-spread-parameters-in-optional-chaining
,babel-plugin-proposal-decorators
,babel-plugin-proposal-destructuring-private
,babel-plugin-proposal-optional-chaining-assign
,babel-plugin-transform-class-properties
,babel-plugin-transform-class-static-block
,babel-plugin-transform-private-methods
,babel-plugin-transform-private-property-in-object
,babel-preset-env
,babel-runtime-corejs2
,babel-runtime-corejs3
,babel-runtime
babel-helpers
,babel-plugin-proposal-decorators
v7.23.9
Compare Source
🐛 Bug Fix
babel-helper-transform-fixture-test-runner
,babel-plugin-transform-function-name
,babel-plugin-transform-modules-systemjs
,babel-preset-env
systemjs
re-traverses helpers (@liuxingbaoyu)babel-helper-create-class-features-plugin
,babel-plugin-proposal-decorators
babel-plugin-proposal-decorators
,babel-plugin-transform-async-generator-functions
,babel-plugin-transform-runtime
,babel-preset-env
core-js@3
imports (@nicolo-ribaudo)babel-traverse
getTypeAnnotation
when using TS+inference (@liuxingbaoyu)no-use-before-define
for class ref in fields (@nicolo-ribaudo)🏠 Internal
babel-core
,babel-parser
,babel-template
eslint-parser
to cts (@liuxingbaoyu)babel-types
@babel/types
props that are not produced by the parser (@liuxingbaoyu)🏃♀️ Performance
babel-parser
🔬 Output optimization
babel-helper-create-class-features-plugin
,babel-plugin-proposal-decorators
,babel-plugin-proposal-destructuring-private
,babel-plugin-proposal-pipeline-operator
,babel-plugin-transform-class-properties
,babel-plugin-transform-class-static-block
,babel-plugin-transform-new-target
,babel-plugin-transform-parameters
,babel-plugin-transform-private-methods
,babel-preset-env
babel-helpers
,babel-plugin-proposal-explicit-resource-management
,babel-runtime-corejs2
,babel-runtime-corejs3
,babel-runtime
using
(@liuxingbaoyu)v7.23.8
Compare Source
🐛 Bug Fix
babel-preset-env
preset-env
throws exception forexport * as x
(@liuxingbaoyu)babel-helpers
,babel-plugin-proposal-decorators
getter/setter
toctx.access
for public fields (@liuxingbaoyu)↩️ Revert
🔬 Output optimization
babel-helpers
,babel-plugin-proposal-decorators
,babel-plugin-transform-class-properties
,babel-plugin-transform-classes
,babel-plugin-transform-function-name
,babel-plugin-transform-parameters
,babel-plugin-transform-react-jsx
,babel-plugin-transform-runtime
,babel-plugin-transform-spread
,babel-plugin-transform-typescript
,babel-preset-env
,babel-runtime-corejs2
,babel-runtime-corejs3
,babel-runtime
super()
(@liuxingbaoyu)v7.23.7
Compare Source
🐛 Bug Fix
babel-traverse
Program
(@liuxingbaoyu)babel-helpers
,babel-plugin-proposal-decorators
ctx.kind
is wrong (@liuxingbaoyu)babel-plugin-proposal-decorators
babel-core
unhandledRejection
events (@nicolo-ribaudo)🏠 Internal
babel-helper-create-class-features-plugin
babel-helper-create-class-features-plugin
,babel-plugin-proposal-decorators
v7.23.6
Compare Source
👓 Spec Compliance
babel-generator
,babel-parser
,babel-types
TSPropertySignature.initializer
(@fisker)babel-helpers
,babel-plugin-proposal-decorators
,babel-plugin-transform-class-properties
,babel-plugin-transform-class-static-block
,babel-plugin-transform-runtime
,babel-preset-env
,babel-runtime-corejs2
,babel-runtime-corejs3
,babel-runtime
,babel-types
toPropertyKey
on decorator context name (@JLHwung)🐛 Bug Fix
babel-generator
retainLines
is enabled (@liuxingbaoyu)babel-helpers
,babel-plugin-proposal-explicit-resource-management
using
: Allow looking upSymbol.dispose
on a function (@odinho)babel-plugin-proposal-decorators
,babel-plugin-transform-class-properties
[[@​@​toPrimitive]]
call of a decorated class member key is invoked once (@JLHwung)babel-plugin-transform-for-of
,babel-preset-env
for of
withiterableIsArray
and shadowing variable (@liuxingbaoyu)babel-helpers
,babel-plugin-proposal-decorators
,babel-runtime-corejs2
,babel-runtime-corejs3
,babel-runtime
babel-plugin-transform-typescript
🔬 Output optimization
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.