chore(deps): update dependency @babel/core to v7.29.6 [security] by renovate[bot] · Pull Request #883 · Escape-Technologies/graphql-armor

renovate · 2026-08-26T19:44:53Z

This PR contains the following updates:

Package	Change	Age	Confidence
@babel/core (source)	`7.26.10` → `7.29.6`

@babel/core: Arbitrary File Read via sourceMappingURL Comment

CVE-2026-49356 / GHSA-4x5r-pxfx-6jf8

More information

Details

Impact

Using @babel/core to compile maliciously crafted code can allow ab attacker to read any source map from the system that is running Babel, if these conditions are all true:

the attacker controls the input source code
the attacker can read the output source code
the attacker knows the path of the source map file that they want to read

Users that only compile trusted code are not impacted.

Patches

The vulnerability has been fixed in @babel/core@7.29.6 and @babel/core@8.0.0-rc.6.

Workarounds

Callers can mitigate the issue without upgrading by setting inputSourceMap: false in their Babel options.

Callers can also manually extract the #sourceMappingURL comment from the input source code, validate whether the source map that it links to is allowed to be read, and if it is pass an object to inputSourceMap (passing false when it's not).

Credits

Thanks Teodor-Cristian Radoi for reporting the vulnerability.

Severity

CVSS Score: 3.2 / 10 (Low)
Vector String: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

babel/babel (@babel/core)

`v7.29.6`

Compare Source

v7.29.6 (2026-05-25)

🐛 Bug Fix

babel-generator
- #18014 Catchup source map position in preserveFormat (@nicolo-ribaudo)
babel-core
- #18001 [7.x packport]Improve input source map handling (@JLHwung)
babel-core, babel-generator
- #17998 Preserve original identifier names from input sourcemaps (#17992) (@Andarist)

Committers: 3

Huáng Jùnliàng (@JLHwung)
Mateusz Burzyński (@Andarist)
Nicolò Ribaudo (@nicolo-ribaudo)

`v7.29.0`

Compare Source

v7.29.0 (2026-01-31)

Thanks @simbahax for your first PR!

🚀 New Feature

babel-types
- #17750 [7.x backport] Add attributes import declaration builder (@JLHwung)
babel-standalone
- #17663 [7.x backport] feat(standalone): export async transform (@JLHwung)
- #17725 [7.x backport] feat: read standalone targets from data-targets (@JLHwung)

🐛 Bug Fix

babel-parser
- #17765 fix(parser): correctly parse type assertions in extends clause (@nicolo-ribaudo)
- #17723 [7.x backport] fix(parser): improve super type argument parsing (@JLHwung)
babel-traverse
- #17708 fix(traverse): provide a hub when traversing a File or Program and no parentPath is given (@simbahax)
babel-plugin-transform-block-scoping, babel-traverse
- #17737 [7.x backport] fix: Rename switch discriminant references when body creates shadowing variable (@magic-akari)

🏃‍♀️ Performance

babel-generator, babel-runtime-corejs3
- #17642 [Babel 7] Improve generator performance (@liuxingbaoyu)

👓 Spec Compliance

babel-parser
- #17446 Allow Runtime Errors for Function Call Assignment Targets (@liuxingbaoyu)
babel-helper-validator-identifier
- #17501 fix: update identifier to unicode 17 (@fisker)

🐛 Bug Fix

babel-plugin-proposal-destructuring-private
- #17534 Allow mixing private destructuring and rest (@CO0Ki3)
babel-parser
- #17521 Improve @babel/parser error typing (@JLHwung)
- #17491 fix: improve ts-only declaration parsing (@JLHwung)
babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring
- #17519 fix: rest correctly returns plain array (@liuxingbaoyu)
babel-helper-create-class-features-plugin, babel-helper-member-expression-to-functions, babel-plugin-transform-block-scoping, babel-plugin-transform-optional-chaining, babel-traverse, babel-types
- #17503 Fix JSXIdentifier handling in isReferencedIdentifier (@JLHwung)
babel-traverse
- #17504 fix: ensure scope.push register in anonymous fn (@JLHwung)

🏠 Internal

babel-types
- #17494 Type checking babel-types scripts (@JLHwung)

🏃‍♀️ Performance

babel-core
- #17490 Faster finding of locations in buildCodeFrameError (@liuxingbaoyu)

`v7.28.4`

Compare Source

🏠 Internal

babel-core, babel-helper-check-duplicate-nodes, babel-traverse, babel-types
- #17493 Update Jest to v30.1.1 (@JLHwung)
babel-plugin-transform-regenerator
- #17455 chore: Clean up transform-regenerator (@liuxingbaoyu)
babel-core
- #17474 Switch to @jridgewell/remapping (@mrginglymus)

`v7.28.3`

Compare Source

👓 Spec Compliance

babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators, babel-plugin-transform-class-static-block, babel-preset-env
- #17443 [static blocks] Do not inject new static fields after static code (@nicolo-ribaudo)

🐛 Bug Fix

babel-parser
- #17465 fix(parser/typescript): parse import("./a", {with:{},}) (@easrng)
- #17478 fix(parser): stop subscript parsing on async arrow (@JLHwung)

💅 Polish

babel-plugin-transform-regenerator, babel-plugin-transform-runtime
- #17363 Do not save last yield in call in temp var (@nicolo-ribaudo)

📝 Documentation

#17448 move eslint-{parser,plugin} docs to the website (@JLHwung)

🏠 Internal

#17454 Enable type checking for scripts and babel-worker.cjs (@JLHwung)

🔬 Output optimization

babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions
- #17444 Optimize do expression output (@JLHwung)

`v7.28.0`

Compare Source

🚀 New Feature

babel-node
- #17147 Support top level await in node repl (@liuxingbaoyu)
babel-types
- #17258 feat(matchesPattern): support super/private/meta (@JLHwung)
babel-compat-data, babel-preset-env
- #17355 Add explicit resource management to preset-env (@JLHwung)
babel-core, babel-parser
- #17390 Support sourceType: "commonjs" (@JLHwung)
babel-generator, babel-parser
- #17346 Materialize explicitResourceManagement parser plugin (@JLHwung)
babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-plugin-transform-object-rest-spread, babel-traverse, babel-types
- #17391 LVal coverage updates (Part 2) (@JLHwung)
babel-parser, babel-traverse, babel-types
- #17378 Accept bigints in t.bigIntLiteral factory (@JLHwung)
babel-generator, babel-plugin-proposal-destructuring-private, babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring, babel-plugin-transform-explicit-resource-management, babel-plugin-transform-react-display-name, babel-types
- #17277 Transform discard binding (@JLHwung)
babel-generator, babel-parser, babel-plugin-proposal-destructuring-private, babel-plugin-transform-block-scoping, babel-plugin-transform-object-rest-spread, babel-plugin-transform-typescript, babel-traverse, babel-types
- #17163 Parse discard binding (@JLHwung)

🐛 Bug Fix

babel-helper-globals, babel-plugin-transform-classes, babel-traverse
- #17297 Create babel-helper-globals (@JLHwung)
babel-types
- #17009 feature: TSTypeOperator: keyof (#16799) (@coderaiser)

🏠 Internal

babel-compat-data, babel-plugin-proposal-decorators, babel-plugin-transform-async-generator-functions, babel-plugin-transform-json-modules, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs3
- #17403 Update babel-polyfill packages (@nicolo-ribaudo)

`v7.27.7`

Compare Source

👓 Spec Compliance

babel-parser, babel-plugin-transform-classes
- #17203 Interepret parser allow* options as top level only (@JLHwung)
babel-parser
- #17371 fix: disable using in ambient context (@JLHwung)

🐛 Bug Fix

babel-core
- #17392 Improve TS babel config loading (@JLHwung)
babel-types
- #17376 fix: support negative bigint in valueToNode (@JLHwung)
babel-plugin-transform-parameters
- #17352 fix: Params of async function* should throw synchronously (@liuxingbaoyu)

🏠 Internal

babel-plugin-transform-destructuring, babel-plugin-transform-object-rest-spread
- #17389 Use NodePath#splitExportDeclaration in destructuring transforms (@JLHwung)

`v7.27.4`

Compare Source

👓 Spec Compliance

babel-parser, babel-plugin-proposal-explicit-resource-management
- #17323 Disallow using in bare case statement (@JLHwung)

💅 Polish

babel-parser
- #17311 Improve parseExpression error messages (@JLHwung)

🔬 Output optimization

babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-classes, babel-plugin-transform-destructuring, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
- #17287 Reduce regenerator size more (@liuxingbaoyu)
babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-classes, babel-plugin-transform-destructuring, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs3
- #17334 Use shorter method names for regenerator context (@nicolo-ribaudo)
- #17268 Reduce regenerator helper size (@liuxingbaoyu)
babel-core, babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-classes, babel-plugin-transform-destructuring, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime, babel-standalone
- #17238 Split regeneratorRuntime into multiple helpers (@nicolo-ribaudo)

`v7.27.3`

Compare Source

🐛 Bug Fix

babel-generator
- #17324 Improve multiline comments handling in yield/await expression (@JLHwung)
babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3
- #17328 Correctly set .displayName on GeneratorFunction (@nicolo-ribaudo)
babel-plugin-proposal-explicit-resource-management
- #17319 fix: handle shadowed binding in for using of body (@JLHwung)
- #17317 fix: support named evaluation for using declaration (@JLHwung)
babel-plugin-proposal-decorators, babel-types
- #17321 fix(converter): Remove abstract modifiers in class declaration to expression conversion (@magic-akari)
babel-helper-module-transforms, babel-plugin-proposal-explicit-resource-management, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-umd
- #17257 Preserve class id when transforming using declarations with exported class (@JLHwung)
babel-parser
- #17312 fix(parser): properly handle optional markers in generator class methods (@magic-akari)
- #17307 fix(parser): Terminate modifier parsing at newline (@magic-akari)
babel-generator, babel-parser
- #17308 Improve import phase parsing (@JLHwung)

`v7.27.1`

Compare Source

👓 Spec Compliance

babel-parser
- #17254 Allow using of as lexical declaration within for (@JLHwung)
- #17230 Disallow get/set in TSPropertySignature (@JLHwung)
babel-parser, babel-types
- #17193 Stricter TSImportType options parsing (@JLHwung)

🐛 Bug Fix

babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-traverse
- #17137 fix: do expressions should allow early exit (@kermanx)
babel-helper-wrap-function, babel-plugin-transform-async-to-generator
- #17251 Fix: propagate argument evaluation errors through async promise chain (@magic-akari)
babel-helper-remap-async-to-generator, babel-plugin-transform-async-to-generator
- #17231 fix apply()/call() annotated as pure (@Lacsw)
babel-helper-fixtures, babel-parser
- #17233 Create ChainExpression within TSInstantiationExpression (@JLHwung)
babel-generator, babel-parser
- #17226 Fill optional AST properties when both estree and typescript parser plugin are enabled (Part 2) (@JLHwung)
babel-parser
- #17224 Fill optional AST properties when both estree and typescript parser plugin are enabled (Part 1) (@JLHwung)
- #17080 Fix start of TSParameterProperty (@JLHwung)
babel-compat-data, babel-preset-env
- #17228 Update firefox bugfix compat data (@JLHwung)
babel-traverse
- #17156 fix: Objects and arrays with multiple references should not be evaluated (@liuxingbaoyu)
babel-generator
- #17216 Fix: support const type parameter in generator (@JLHwung)

💅 Polish

babel-plugin-bugfix-v8-spread-parameters-in-optional-chaining, babel-plugin-proposal-decorators, babel-plugin-transform-arrow-functions, babel-plugin-transform-class-properties, babel-plugin-transform-destructuring, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-chaining, babel-plugin-transform-parameters, babel-traverse
- #17221 Reduce generated names size for the 10th-11th (@nicolo-ribaudo)

🏠 Internal

babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
- #17263 Remove unused regenerator-runtime dep in @babel/runtime (@nicolo-ribaudo)
babel-compat-data, babel-preset-env
- #17256 Tune plugin compat data (@JLHwung)
babel-compat-data, babel-standalone
- #17236 migrate babel-compat-data build script to mjs (@JLHwung)
Other
- #17232 Bump typescript-eslint to 8.29.1 (@JLHwung)
- #17219 test: add basic typescript-eslint integration tests (@JLHwung)
- #17205 Inline regenerator in the relevant packages (@nicolo-ribaudo)
babel-register
- #16844 Migrate @babel/register to cts (@liuxingbaoyu)
babel-cli, babel-compat-data, babel-core, babel-generator, babel-helper-compilation-targets, babel-helper-fixtures, babel-helper-module-imports, babel-helper-module-transforms, babel-helper-plugin-test-runner, babel-helper-transform-fixture-test-runner, babel-helpers, babel-node, babel-parser, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-systemjs, babel-plugin-transform-modules-umd, babel-plugin-transform-react-display-name, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-plugin-transform-typeof-symbol, babel-plugin-transform-typescript, babel-preset-env, babel-register, babel-standalone, babel-types
- #17207 Enforce node protocol import (@JLHwung)
babel-plugin-transform-regenerator
- #17205 Inline regenerator in the relevant packages (@nicolo-ribaudo)
- #17205 Inline regenerator in the relevant packages (@nicolo-ribaudo)
babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3
- #17205 Inline regenerator in the relevant packages (@nicolo-ribaudo)
babel-helpers, babel-plugin-transform-regenerator
- #17205 Inline regenerator in the relevant packages (@nicolo-ribaudo)
- #17205 Inline regenerator in the relevant packages (@nicolo-ribaudo)
babel-helpers
- #17205 Inline regenerator in the relevant packages (@nicolo-ribaudo)

🔬 Output optimization

babel-helpers, babel-plugin-transform-modules-commonjs, babel-runtime-corejs3
- #16538 Reduce interopRequireWildcard size (@liuxingbaoyu)
babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3
- #17213 Reduce regeneratorRuntime size (@liuxingbaoyu)

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

changeset-bot · 2026-08-26T19:44:59Z

⚠️ No Changeset found

Latest commit: fe6cb89

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

codecov-commenter · 2026-08-26T19:47:40Z

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.19%. Comparing base (0a8fdd6) to head (fe6cb89).
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #883   +/-   ##
=======================================
  Coverage   92.19%   92.19%           
=======================================
  Files          17       17           
  Lines         397      397           
  Branches      128      137    +9     
=======================================
  Hits          366      366           
  Misses         31       31

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

chore(deps): update dependency @babel/core to v7.29.6 [security]

fe6cb89

Navigation Menu

Uh oh!

chore(deps): update dependency @babel/core to v7.29.6 [security] - #883

chore(deps): update dependency @babel/core to v7.29.6 [security]#883
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-babel-core-vulnerability

renovate Bot commented Aug 26, 2026

Uh oh!

changeset-bot Bot commented Aug 26, 2026

Uh oh!

codecov-commenter commented Aug 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

renovate Bot commented Aug 26, 2026

@​babel/core: Arbitrary File Read via sourceMappingURL Comment

Details

Impact

Patches

Workarounds

Credits

Severity

References

Release Notes

v7.29.6 (2026-05-25)

🐛 Bug Fix

Committers: 3

v7.29.0 (2026-01-31)

🚀 New Feature

🐛 Bug Fix

🏃‍♀️ Performance

Committers: 6

👓 Spec Compliance

🐛 Bug Fix

🏠 Internal

🏃‍♀️ Performance

🏠 Internal

👓 Spec Compliance

🐛 Bug Fix

💅 Polish

📝 Documentation

🏠 Internal

🔬 Output optimization

🚀 New Feature

🐛 Bug Fix

🏠 Internal

👓 Spec Compliance

🐛 Bug Fix

🏠 Internal

👓 Spec Compliance

💅 Polish

🔬 Output optimization

🐛 Bug Fix

👓 Spec Compliance

🐛 Bug Fix

💅 Polish

🏠 Internal

🔬 Output optimization

Configuration

Uh oh!

changeset-bot Bot commented Aug 26, 2026

⚠️ No Changeset found

Uh oh!

codecov-commenter commented Aug 26, 2026

Codecov Report

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

@babel/core: Arbitrary File Read via sourceMappingURL Comment