Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(deps): update dependency @babel/runtime-corejs3 to v7.26.10 [security] #3736

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Mar 12, 2025

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
@babel/runtime-corejs3 (source) 7.22.15 -> 7.26.10 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2025-27789

Impact

When using Babel to compile regular expression named capturing groups, Babel will generate a polyfill for the .replace method that has quadratic complexity on some specific replacement pattern strings (i.e. the second argument passed to .replace).

Your generated code is vulnerable if all the following conditions are true:

  • You use Babel to compile regular expression named capturing groups or
  • You use the .replace method on a regular expression that contains named capturing groups
  • Your code uses untrusted strings as the second argument of .replace

If you are using @babel/preset-env with the targets option, the transform that injects the vulnerable code is automatically enabled if:

  • you use duplicated named capturing groups, and target any browser older than Chrome/Edge 126, Opera 112, Firefox 129, Safari 17.4, or Node.js 23
  • you use any named capturing groups, and target any browser older than Chrome 64, Opera 71, Edge 79, Firefox 78, Safari 11.1, or Node.js 10

You can verify what transforms @babel/preset-env is using by enabling the debug option.

Patches

This problem has been fixed in @babel/helpers and @babel/runtime 7.26.10 and 8.0.0-alpha.17, please upgrade. It's likely that you do not directly depend on @babel/helpers, and instead you depend on @babel/core (which itself depends on @babel/helpers). Upgrading to @babel/core 7.26.10 is not required, but it guarantees that you are on a new enough @babel/helpers version.

Please note that just updating your Babel dependencies is not enough: you will also need to re-compile your code.

Workarounds

If you are passing user-provided strings as the second argument of .replace on regular expressions that contain named capturing groups, validate the input and make sure it does not contain the substring $< if it's then not followed by > (possibly with other characters in between).

References

This vulnerability was reported and fixed in https://github.com/babel/babel/pull/17173.


Release Notes

babel/babel (@​babel/runtime-corejs3)

v7.26.10

Compare Source

👓 Spec Compliance
🐛 Bug Fix
💅 Polish
🏠 Internal

v7.26.9

Compare Source

🐛 Bug Fix
🏠 Internal

v7.26.7

Compare Source

🐛 Bug Fix

v7.26.0

Compare Source

🚀 New Feature
  • babel-core, babel-generator, babel-parser, babel-plugin-syntax-import-assertions, babel-plugin-syntax-import-attributes, babel-preset-env, babel-standalone, babel-types
  • babel-core
  • babel-compat-data, babel-plugin-proposal-regexp-modifiers, babel-plugin-transform-regexp-modifiers, babel-preset-env, babel-standalone
  • babel-parser
  • babel-generator, babel-parser, babel-plugin-syntax-flow
  • babel-helpers, babel-preset-typescript, babel-runtime-corejs3
  • babel-generator, babel-parser
🐛 Bug Fix
💅 Polish
  • babel-plugin-proposal-json-modules, babel-plugin-transform-json-modules, babel-standalone
🏠 Internal
🏃‍♀️ Performance
  • babel-helper-module-transforms, babel-plugin-transform-modules-commonjs

v7.25.9

Compare Source

🐛 Bug Fix
🏠 Internal
🏃‍♀️ Performance

v7.25.7

Compare Source

🐛 Bug Fix
💅 Polish
🏠 Internal
  • babel-core
  • babel-helper-compilation-targets, babel-helper-plugin-utils, babel-preset-env
  • babel-plugin-proposal-destructuring-private, babel-plugin-syntax-decimal, babel-plugin-syntax-import-reflection, babel-standalone
  • babel-generator
🏃‍♀️ Performance

v7.25.6

Compare Source

🐛 Bug Fix
💅 Polish
  • babel-generator, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-class-properties, babel-plugin-transform-classes, babel-plugin-transform-duplicate-named-capturing-groups-regex, babel-plugin-transform-named-capturing-groups-regex, babel-plugin-transform-react-jsx-development, babel-plugin-transform-react-jsx, babel-plugin-transform-react-pure-annotations, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env
  • babel-plugin-syntax-import-assertions, babel-plugin-syntax-import-attributes
  • babel-generator
🏠 Internal

v7.25.0

Compare Source

👓 Spec Compliance
  • babel-helpers, babel-plugin-proposal-explicit-resource-management, babel-runtime-corejs3
  • babel-plugin-transform-typescript
🚀 New Feature
  • babel-helper-create-class-features-plugin, babel-helper-function-name, babel-helper-plugin-utils, babel-helper-wrap-function, babel-plugin-bugfix-safari-class-field-initializer-scope, babel-plugin-bugfix-safari-id-destructuring-collision-in-function-expression, babel-plugin-transform-classes, babel-plugin-transform-function-name, babel-preset-env, babel-traverse, babel-types
  • babel-helper-hoist-variables, babel-helper-plugin-utils, babel-plugin-proposal-async-do-expressions, babel-plugin-transform-modules-systemjs, babel-traverse
  • babel-helper-create-class-features-plugin, babel-helper-module-transforms, babel-helper-plugin-utils, babel-helper-split-export-declaration, babel-plugin-transform-classes, babel-traverse, babel-types
  • babel-helper-create-class-features-plugin, babel-helper-environment-visitor, babel-helper-module-transforms, babel-helper-plugin-utils, babel-helper-remap-async-to-generator, babel-helper-replace-supers, babel-plugin-bugfix-firefox-class-in-computed-class-key, babel-plugin-bugfix-v8-static-class-fields-redefine-readonly, babel-plugin-transform-async-generator-functions, babel-plugin-transform-classes, babel-traverse
  • babel-core, babel-parser
  • babel-compat-data, babel-plugin-bugfix-safari-class-field-initializer-scope, babel-preset-env
  • babel-plugin-transform-block-scoping, babel-traverse, babel-types
  • babel-helper-import-to-platform-api, babel-plugin-proposal-json-modules
  • babel-helper-transform-fixture-test-runner, babel-node
  • babel-compat-data, babel-helper-create-regexp-features-plugin, babel-plugin-proposal-duplicate-named-capturing-groups-regex, babel-plugin-transform-duplicate-named-capturing-groups-regex, babel-preset-env, babel-standalone
🐛 Bug Fix
🏠 Internal
🏃‍♀️ Performance
  • babel-parser, babel-plugin-proposal-pipeline-operator
🔬 Output optimization
  • babel-plugin-transform-classes
  • babel-helper-create-class-features-plugin, babel-helper-replace-supers, babel-helpers, babel-plugin-proposal-decorators, babel-plugin-transform-class-properties, babel-plugin-transform-classes, babel-plugin-transform-exponentiation-operator, babel-plugin-transform-object-super, babel-plugin-transform-private-methods, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • babel-plugin-transform-class-properties, babel-plugin-transform-classes

v7.24.8

Compare Source

👓 Spec Compliance
🐛 Bug Fix
💅 Polish

v7.24.7

Compare Source

🐛 Bug Fix
🏠 Internal
  • babel-helpers, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime

v7.24.6

Compare Source

🐛 Bug Fix
  • babel-helper-create-class-features-plugin, babel-plugin-transform-class-properties
  • babel-core, babel-generator, babel-plugin-transform-modules-commonjs
  • babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
  • babel-helpers, babel-plugin-proposal-decorators, babel-runtime-corejs3
  • babel-parser, babel-plugin-transform-typescript
🏠 Internal
  • babel-core, babel-helpers, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • babel-helpers
  • babel-cli, babel-helpers, babel-plugin-external-helpers, babel-plugin-proposal-decorators, babel-plugin-transform-class-properties, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-systemjs, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • babel-parser, babel-traverse
  • Other

v7.24.5

Compare Source

🐛 Bug Fix
💅 Polish
🏠 Internal
  • Other
  • babel-parser
  • babel-helper-create-class-features-plugin, babel-helper-member-expression-to-functions, babel-helper-module-transforms, babel-helper-split-export-declaration, babel-helper-wrap-function, babel-helpers, babel-plugin-bugfix-firefox-class-in-computed-class-key, babel-plugin-proposal-explicit-resource-management, babel-plugin-transform-block-scoping, babel-plugin-transform-destructuring, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-chaining, babel-plugin-transform-parameters, babel-plugin-transform-private-property-in-object, babel-plugin-transform-react-jsx-self, babel-plugin-transform-typeof-symbol, babel-plugin-transform-typescript, babel-traverse
  • babel-plugin-proposal-partial-application, babel-types
  • babel-plugin-transform-class-properties, babel-preset-env
🏃‍♀️ Performance
  • babel-helpers, babel-preset-env, babel-runtime-corejs3

v7.24.4

Compare Source

👓 Spec Compliance
🐛 Bug Fix

v7.24.1

Compare Source

🐛 Bug Fix

v7.24.0

Compare Source

🚀 New Feature
  • babel-standalone
  • babel-core, babel-helper-create-class-features-plugin, babel-helpers, babel-plugin-transform-class-properties
  • babel-helper-create-class-features-plugin, babel-helpers, babel-plugin-proposal-decorators, babel-plugin-proposal-pipeline-operator, babel-plugin-syntax-decorators, babel-plugin-transform-class-properties, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • babel-preset-flow
  • babel-helper-import-to-platform-api, babel-plugin-proposal-import-wasm-source, babel-plugin-proposal-json-modules, babel-standalone
  • babel-plugin-transform-runtime
  • babel-parser, babel-types
🐛 Bug Fix
  • babel-plugin-proposal-do-expressions, babel-traverse
  • babel-helper-create-class-features-plugin, babel-plugin-transform-private-methods, babel-plugin-transform-private-property-in-object
  • babel-helper-create-class-features-plugin, babel-plugin-transform-private-methods
  • babel-helper-create-class-features-plugin, babel-helpers, babel-plugin-proposal-decorators
  • babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
  • babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators, babel-plugin-transform-async-generator-functions, babel-plugin-transform-private-methods, babel-plugin-transform-private-property-in-object, babel-plugin-transform-typescript, babel-preset-env
  • babel-helpers
  • babel-helpers, babel-plugin-proposal-decorators
💅 Polish
  • babel-core, babel-helper-create-class-features-plugin, babel-preset-env
🏠 Internal
🔬 Output optimization
  • babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
  • babel-helper-create-class-features-plugin, babel-helpers, babel-plugin-proposal-decorators, babel-plugin-proposal-pipeline-operator, babel-plugin-transform-class-properties
  • babel-helper-create-class-features-plugin, babel-helpers, babel-plugin-transform-private-methods
  • babel-helper-create-class-features-plugin, babel-helpers, babel-plugin-proposal-decorators
  • babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators, babel-plugin-transform-class-properties
  • babel-helper-create-class-features-plugin, babel-helper-fixtures, babel-helpers, babel-plugin-bugfix-v8-spread-parameters-in-optional-chaining, babel-plugin-proposal-decorators, babel-plugin-proposal-destructuring-private, babel-plugin-proposal-optional-chaining-assign, babel-plugin-transform-class-properties, babel-plugin-transform-class-static-block, babel-plugin-transform-private-methods, babel-plugin-transform-private-property-in-object, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • babel-helpers, babel-plugin-proposal-decorators

v7.23.9

Compare Source

🐛 Bug Fix
  • babel-helper-transform-fixture-test-runner, babel-plugin-transform-function-name, babel-plugin-transform-modules-systemjs, babel-preset-env
  • babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
  • babel-plugin-proposal-decorators, babel-plugin-transform-async-generator-functions, babel-plugin-transform-runtime, babel-preset-env
  • babel-traverse
  • Other
🏠 Internal
🏃‍♀️ Performance
🔬 Output optimization
  • babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators, babel-plugin-proposal-destructuring-private, babel-plugin-proposal-pipeline-operator, babel-plugin-transform-class-properties, babel-plugin-transform-class-static-block, babel-plugin-transform-new-target, babel-plugin-transform-parameters, babel-plugin-transform-private-methods, babel-preset-env
  • babel-helpers, babel-plugin-proposal-explicit-resource-management, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime

v7.23.8

Compare Source

🐛 Bug Fix
↩️ Revert
🔬 Output optimization
  • babel-helpers, babel-plugin-proposal-decorators, babel-plugin-transform-class-properties, babel-plugin-transform-classes, babel-plugin-transform-function-name, babel-plugin-transform-parameters, babel-plugin-transform-react-jsx, babel-plugin-transform-runtime, babel-plugin-transform-spread, babel-plugin-transform-typescript, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime

v7.23.7

Compare Source

🐛 Bug Fix
🏠 Internal
  • babel-helper-create-class-features-plugin
  • babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators

v7.23.6

Compare Source

👓 Spec Compliance
  • babel-generator, babel-parser, babel-types
  • babel-helpers, babel-plugin-proposal-decorators, babel-plugin-transform-class-properties, babel-plugin-transform-class-static-block, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime, babel-types
🐛 Bug Fix
  • babel-generator
  • babel-helpers, babel-plugin-proposal-explicit-resource-management
  • babel-plugin-proposal-decorators, babel-plugin-transform-class-properties
    • #​16161 Ensure the [[@&#8203;@&#8203;toPrimitive]] call of a decorated class member key is invoked once (@​JLHwung)
    • #​16148 Support named evaluation for decorated anonymous class exp (@​JLHwung)
  • babel-plugin-transform-for-of, babel-preset-env
  • babel-helpers, babel-plugin-proposal-decorators, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • babel-plugin-transform-typescript
    • #​16137 Fix references to enum values with merging ([@​nicolo-rib

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot requested a review from a team as a code owner March 12, 2025 02:35
@renovate renovate bot added the 🤖 Type: Dependencies Dependency updates or something similar label Mar 12, 2025
Copy link

vercel bot commented Mar 12, 2025

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Comments Updated (UTC)
mc-app-kit-playground ✅ Ready (Inspect) Visit Preview 💬 Add feedback Mar 12, 2025 2:36am
merchant-center-application-kit-components-playground ✅ Ready (Inspect) Visit Preview 💬 Add feedback Mar 12, 2025 2:36am

Copy link

changeset-bot bot commented Mar 12, 2025

⚠️ No Changeset found

Latest commit: 0852c68

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
🤖 Type: Dependencies Dependency updates or something similar
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants