fix(security): bump @babel/core to the patched 7.29.6+ release - #96
Merged
Conversation
Clear GHSA-4x5r-pxfx-6jf8 (@babel/core: arbitrary file read via sourceMappingURL comment) in docs/: 7.29.0 -> 7.29.7, pinned via npm `overrides` (@babel/core is transitive). Note on the version choice: nox reports fixed_in = 8.0.0-rc.6, which is the fix for the OTHER affected range. OSV lists two ranges and the 7.x line is fixed in 7.29.6, so this is a patch bump rather than a babel 7 -> 8 ecosystem migration for a LOW-severity issue. This clears the last known dependency advisory in the repo. Verified: astro docs build passes (26 pages); nox reports 0 dependency CVEs and 0 net-new critical/high. Claude-Session: https://claude.ai/code/session_01Cr6YdzphmFF3NJqm7kSJom
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Clears GHSA-4x5r-pxfx-6jf8 — @babel/core: Arbitrary File Read via sourceMappingURL Comment (low).
docs/Pinned via npm
overrides—@babel/coreis transitive in every tree (pulled by@babel/helper-module-transforms,@vitejs/plugin-react,eslint-plugin-react-hooks, etc.).Why not 8.0.0-rc.6 (what nox suggested)
nox reports
fixed_in: 8.0.0-rc.6. That is the fix for the other affected range. OSV lists two ranges for this advisory:8.0.0-alpha.0→ fixed in8.0.0-rc.60→ fixed in7.29.6← the range these installs are actually inFollowing nox literally would have forced a babel 7 → 8 ecosystem migration — every
@babel/*plugin in the tree peer-depends oncore ^7.0.0— for a low-severity issue. Staying on7.29.6+fixes it with a patch bump and no breakage. (Same multi-rangefixed_intrap already seen with svgo, fast-uri, js-yaml, vite.)Verification
nox scan .— 0 dependency CVEs remaining and 0 net-new critical/high. This clears the last known dependency advisory in the repo.https://claude.ai/code/session_01Cr6YdzphmFF3NJqm7kSJom