[Snyk] Upgrade: @babel/cli, @babel/core, @babel/node, @babel/preset-env #596

Braineanear · 2023-08-26T01:59:00Z

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to upgrade multiple dependencies.

👯 The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name	Versions	Released on
@babel/cli from 7.16.0 to 7.22.9	21 versions ahead of your current version	a month ago on 2023-07-12
@babel/core from 7.16.0 to 7.22.9	46 versions ahead of your current version	a month ago on 2023-07-12
@babel/node from 7.16.0 to 7.22.6	22 versions ahead of your current version	2 months ago on 2023-07-04
@babel/preset-env from 7.16.4 to 7.22.9	32 versions ahead of your current version	a month ago on 2023-07-12

The recommended version fixes:

Issue	PriorityScore (*)	Exploit Maturity
Prototype Poisoning SNYK-JS-QS-3153490	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-MOMENT-2944238	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Prototype Pollution SNYK-JS-MONGOOSE-2961688	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Prototype Pollution SNYK-JS-MONGOOSE-5777721	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Information Exposure SNYK-JS-SIMPLEGET-2361683	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430339	482/1000 Why? Proof of Concept exploit, CVSS 7.5	No Known Exploit
Prototype Poisoning SNYK-JS-QS-3153490	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Directory Traversal SNYK-JS-MOMENT-2440688	482/1000 Why? Proof of Concept exploit, CVSS 7.5	No Known Exploit
Information Exposure SNYK-JS-NODEFETCH-2342118	482/1000 Why? Proof of Concept exploit, CVSS 7.5	No Known Exploit
Open Redirect SNYK-JS-NODEFORGE-2330875	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Prototype Pollution SNYK-JS-NODEFORGE-2331908	482/1000 Why? Proof of Concept exploit, CVSS 7.5	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-SIDEWAYFORMULA-3317169	482/1000 Why? Proof of Concept exploit, CVSS 7.5	No Known Exploit
Prototype Pollution SNYK-JS-XML2JS-5414874	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430337	482/1000 Why? Proof of Concept exploit, CVSS 7.5	No Known Exploit
Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430341	482/1000 Why? Proof of Concept exploit, CVSS 7.5	No Known Exploit
Prototype Pollution SNYK-JS-JSON5-3182856	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-3050818	482/1000 Why? Proof of Concept exploit, CVSS 7.5	No Known Exploit
Prototype Pollution SNYK-JS-MINIMIST-2429795	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: @babel/cli

7.22.9 - 2023-07-12
v7.22.9 (2023-07-12)

🐛 Bug Fix
- babel-plugin-transform-typescript
  - #15774 fix: Infinity in enums (@ liuxingbaoyu)
- babel-helper-module-transforms, babel-helper-remap-async-to-generator, babel-helper-replace-supers, babel-helper-wrap-function
  - #15771 Simplify helper dependencies (@ JLHwung)
💅 Polish
- babel-generator
  - #15757 recordAndTupleSyntaxType defaults to "hash" (@ coderaiser)
🏠 Internal
- #15748 Migrate to eslint.config.js (@ JLHwung)
- #15758 Use Prettier 3 stable (@ nicolo-ribaudo)
Committers: 5
- Babel Bot (@ babel-bot)
- Huáng Jùnliàng (@ JLHwung)
- Nicolò Ribaudo (@ nicolo-ribaudo)
- @ liuxingbaoyu
- coderaiser (@ coderaiser)
7.22.6 - 2023-07-04
v7.22.6 (2023-07-04)

🐛 Bug Fix
- babel-compat-data, babel-helper-compilation-targets, babel-preset-env
  - #15727 Add opera mobile compat data (@ JLHwung)
- babel-plugin-transform-optional-chaining
  - #15739 Fix transform of delete a?.b in function params (@ nicolo-ribaudo)
- babel-helper-split-export-declaration, babel-plugin-transform-modules-commonjs
  - #15736 fix: Default export for duplicate names (@ liuxingbaoyu)
- babel-compat-data, babel-preset-env
  - #15726 update compat-data sources (@ JLHwung)
- babel-helpers, babel-plugin-proposal-explicit-resource-management, babel-runtime-corejs3, babel-runtime
  - #15705 Fix handling of sync error in @@ asyncDispose (@ nicolo-ribaudo)
- babel-standalone
  - #15707 fix: Support transforming Explicit Resource Management in stage-2 (@ liuxingbaoyu)
- babel-core
  - #15626 fix: Works correctly with --frozen-intrinsics (@ liuxingbaoyu)
🏠 Internal
- babel-helper-create-class-features-plugin, babel-plugin-transform-classes
  - #15700 Minor class transform cleanups (@ JLHwung)
🔬 Output optimization
- babel-plugin-bugfix-v8-spread-parameters-in-optional-chaining, babel-plugin-transform-class-properties, babel-plugin-transform-optional-chaining, babel-plugin-transform-typescript
  - #15740 Compress output for optional chain with multiple ?. (@ nicolo-ribaudo)
- babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-plugin-proposal-pipeline-operator, babel-plugin-transform-class-properties, babel-plugin-transform-nullish-coalescing-operator, babel-plugin-transform-optional-chaining, babel-plugin-transform-private-property-in-object, babel-traverse
  - #15741 Inject tmp vars in the params list of IIFEs when possible (@ nicolo-ribaudo)
Committers: 5
- Babel Bot (@ babel-bot)
- Huáng Jùnliàng (@ JLHwung)
- Joe Maffei (@ joemaffei)
- Nicolò Ribaudo (@ nicolo-ribaudo)
- @ liuxingbaoyu
7.22.5 - 2023-06-08
v7.22.5 (2023-06-08)

🐛 Bug Fix
- babel-preset-env, babel-standalone
  - #15675 Fix using syntax-unicode-sets-regex in standalone (@ nicolo-ribaudo)
💅 Polish
- babel-core
  - #15683 Suggest -transform- when resolving missing plugins (@ nicolo-ribaudo)
Committers: 4
- Avery (@ nullableVoidPtr)
- Babel Bot (@ babel-bot)
- Nicolò Ribaudo (@ nicolo-ribaudo)
- @ liuxingbaoyu
7.21.5 - 2023-04-28
7.21.4-esm.4 - 2023-04-04
7.21.4-esm.3 - 2023-04-04
7.21.4-esm.2 - 2023-04-04
7.21.4-esm.1 - 2023-04-04
7.21.4-esm - 2023-04-04
7.21.0 - 2023-02-20
7.20.7 - 2022-12-22
7.19.3 - 2022-09-27
7.18.10 - 2022-08-01
7.18.9 - 2022-07-18
7.18.6 - 2022-06-27
7.17.10 - 2022-04-29
7.17.6 - 2022-02-21
7.17.3 - 2022-02-15
7.17.0 - 2022-02-02
7.16.8 - 2022-01-10
7.16.7 - 2021-12-31
7.16.0 - 2021-10-29

from @babel/cli GitHub release notes

Package name: @babel/core

7.22.9 - 2023-07-12
v7.22.9 (2023-07-12)

🐛 Bug Fix
- babel-plugin-transform-typescript
  - #15774 fix: Infinity in enums (@ liuxingbaoyu)
- babel-helper-module-transforms, babel-helper-remap-async-to-generator, babel-helper-replace-supers, babel-helper-wrap-function
  - #15771 Simplify helper dependencies (@ JLHwung)
💅 Polish
- babel-generator
  - #15757 recordAndTupleSyntaxType defaults to "hash" (@ coderaiser)
🏠 Internal
- #15748 Migrate to eslint.config.js (@ JLHwung)
- #15758 Use Prettier 3 stable (@ nicolo-ribaudo)
Committers: 5
- Babel Bot (@ babel-bot)
- Huáng Jùnliàng (@ JLHwung)
- Nicolò Ribaudo (@ nicolo-ribaudo)
- @ liuxingbaoyu
- coderaiser (@ coderaiser)
7.22.8 - 2023-07-06
v7.22.8 (2023-07-06)

This release reverts a commit that caused all new angular installations to fail: angular/angular-cli#25496

↩️ Revert
- babel-core, babel-traverse
  - #15754 Revert "Use NodePath#hub as part of the paths cache key" (@ nicolo-ribaudo)
Committers: 1
- Nicolò Ribaudo (@ nicolo-ribaudo)
7.22.7 - 2023-07-06
v7.22.7 (2023-07-06)

🐛 Bug Fix
- babel-generator
  - #15719 fix: Avoid internally generating negative source maps columns (@ liuxingbaoyu)
- babel-core, babel-traverse
  - #15725 Use NodePath#hub as part of the paths cache key (@ nicolo-ribaudo)
- Other
  - #15747 fix: export meta from eslint-parser/experimental-worker (@ JLHwung)
🏠 Internal
- babel-core, babel-traverse
  - #15702 Refactor visitors merging (@ nullableVoidPtr)
Committers: 4
- Avery (@ nullableVoidPtr)
- Huáng Jùnliàng (@ JLHwung)
- Nicolò Ribaudo (@ nicolo-ribaudo)
- @ liuxingbaoyu
7.22.6 - 2023-07-04
v7.22.6 (2023-07-04)

🐛 Bug Fix
- babel-compat-data, babel-helper-compilation-targets, babel-preset-env
  - #15727 Add opera mobile compat data (@ JLHwung)
- babel-plugin-transform-optional-chaining
  - #15739 Fix transform of delete a?.b in function params (@ nicolo-ribaudo)
- babel-helper-split-export-declaration, babel-plugin-transform-modules-commonjs
  - #15736 fix: Default export for duplicate names (@ liuxingbaoyu)
- babel-compat-data, babel-preset-env
  - #15726 update compat-data sources (@ JLHwung)
- babel-helpers, babel-plugin-proposal-explicit-resource-management, babel-runtime-corejs3, babel-runtime
  - #15705 Fix handling of sync error in @@ asyncDispose (@ nicolo-ribaudo)
- babel-standalone
  - #15707 fix: Support transforming Explicit Resource Management in stage-2 (@ liuxingbaoyu)
- babel-core
  - #15626 fix: Works correctly with --frozen-intrinsics (@ liuxingbaoyu)
🏠 Internal
- babel-helper-create-class-features-plugin, babel-plugin-transform-classes
  - #15700 Minor class transform cleanups (@ JLHwung)
🔬 Output optimization
- babel-plugin-bugfix-v8-spread-parameters-in-optional-chaining, babel-plugin-transform-class-properties, babel-plugin-transform-optional-chaining, babel-plugin-transform-typescript
  - #15740 Compress output for optional chain with multiple ?. (@ nicolo-ribaudo)
- babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-plugin-proposal-pipeline-operator, babel-plugin-transform-class-properties, babel-plugin-transform-nullish-coalescing-operator, babel-plugin-transform-optional-chaining, babel-plugin-transform-private-property-in-object, babel-traverse
  - #15741 Inject tmp vars in the params list of IIFEs when possible (@ nicolo-ribaudo)
Committers: 5
- Babel Bot (@ babel-bot)
- Huáng Jùnliàng (@ JLHwung)
- Joe Maffei (@ joemaffei)
- Nicolò Ribaudo (@ nicolo-ribaudo)
- @ liuxingbaoyu
7.22.5 - 2023-06-08
v7.22.5 (2023-06-08)

🐛 Bug Fix
- babel-preset-env, babel-standalone
  - #15675 Fix using syntax-unicode-sets-regex in standalone (@ nicolo-ribaudo)
💅 Polish
- babel-core
  - #15683 Suggest -transform- when resolving missing plugins (@ nicolo-ribaudo)
Committers: 4
- Avery (@ nullableVoidPtr)
- Babel Bot (@ babel-bot)
- Nicolò Ribaudo (@ nicolo-ribaudo)
- @ liuxingbaoyu
7.22.1 - 2023-05-26
v7.22.1 (2023-05-26)

🐛 Bug Fix
- babel-preset-env
  - #15658 Workaround for broken babel-preset-react-app (@ nicolo-ribaudo)
Committers: 2
- Nicolò Ribaudo (@ nicolo-ribaudo)
- @ liuxingbaoyu
7.22.0 - 2023-05-26
Read more
7.21.8 - 2023-05-02
7.21.5 - 2023-04-28
7.21.4 - 2023-03-31
7.21.4-esm.4 - 2023-04-04
7.21.4-esm.3 - 2023-04-04
7.21.4-esm.2 - 2023-04-04
7.21.4-esm.1 - 2023-04-04
7.21.4-esm - 2023-04-04
7.21.3 - 2023-03-14
7.21.0 - 2023-02-20
7.20.12 - 2023-01-04
7.20.7 - 2022-12-22
7.20.5 - 2022-11-28
7.20.2 - 2022-11-04
7.19.6 - 2022-10-20
7.19.3 - 2022-09-27
7.19.1 - 2022-09-14
7.19.0 - 2022-09-05
7.18.13 - 2022-08-22
7.18.10 - 2022-08-01
7.18.9 - 2022-07-18
7.18.6 - 2022-06-27
7.18.5 - 2022-06-13
7.18.2 - 2022-05-25
7.18.0 - 2022-05-19
7.17.12 - 2022-05-16
7.17.10 - 2022-04-29
7.17.9 - 2022-04-06
7.17.8 - 2022-03-18
7.17.7 - 2022-03-14
7.17.5 - 2022-02-17
7.17.4 - 2022-02-15
7.17.3 - 2022-02-15
7.17.2 - 2022-02-08
7.17.0 - 2022-02-02
7.16.12 - 2022-01-22
7.16.10 - 2022-01-19
7.16.7 - 2021-12-31
7.16.5 - 2021-12-13
7.16.0 - 2021-10-29

from @babel/core GitHub release notes

Package name: @babel/node

7.22.6 - 2023-07-04
v7.22.6 (2023-07-04)

🐛 Bug Fix
- babel-compat-data, babel-helper-compilation-targets, babel-preset-env
  - #15727 Add opera mobile compat data (@ JLHwung)
- babel-plugin-transform-optional-chaining
  - #15739 Fix transform of delete a?.b in function params (@ nicolo-ribaudo)
- babel-helper-split-export-declaration, babel-plugin-transform-modules-commonjs
  - #15736 fix: Default export for duplicate names (@ liuxingbaoyu)
- babel-compat-data, babel-preset-env
  - #15726 update compat-data sources (@ JLHwung)
- babel-helpers, babel-plugin-proposal-explicit-resource-management, babel-runtime-corejs3, babel-runtime
  - #15705 Fix handling of sync error in @@ asyncDispose (@ nicolo-ribaudo)
- babel-standalone
  - #15707 fix: Support transforming Explicit Resource Management in stage-2 (@ liuxingbaoyu)
- babel-core
  - #15626 fix: Works correctly with --frozen-intrinsics (@ liuxingbaoyu)
🏠 Internal
- babel-helper-create-class-features-plugin, babel-plugin-transform-classes
  - #15700 Minor class transform cleanups (@ JLHwung)
🔬 Output optimization
- babel-plugin-bugfix-v8-spread-parameters-in-optional-chaining, babel-plugin-transform-class-properties, babel-plugin-transform-optional-chaining, babel-plugin-transform-typescript
  - #15740 Compress output for optional chain with multiple ?. (@ nicolo-ribaudo)
- babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-plugin-proposal-pipeline-operator, babel-plugin-transform-class-properties, babel-plugin-transform-nullish-coalescing-operator, babel-plugin-transform-optional-chaining, babel-plugin-transform-private-property-in-object, babel-traverse
  - #15741 Inject tmp vars in the params list of IIFEs when possible (@ nicolo-ribaudo)
Committers: 5
- Babel Bot (@ babel-bot)
- Huáng Jùnliàng (@ JLHwung)
- Joe Maffei (@ joemaffei)
- Nicolò Ribaudo (@ nicolo-ribaudo)
- @ liuxingbaoyu
7.22.5 - 2023-06-08
Read more
7.22.1 - 2023-05-26
Read more
7.22.0 - 2023-05-26
Read more
7.21.4-esm.4 - 2023-04-04
7.21.4-esm.3 - 2023-04-04
7.21.4-esm.2 - 2023-04-04
7.21.4-esm.1 - 2023-04-04
7.21.4-esm - 2023-04-04
7.20.7 - 2022-12-22
7.20.5 - 2022-11-28
7.20.2 - 2022-11-04
7.20.0 - 2022-10-27
7.19.1 - 2022-09-14
7.18.10 - 2022-08-01
7.18.9 - 2022-07-18
7.18.6 - 2022-06-27
7.18.5 - 2022-06-13
7.17.10 - 2022-04-29
7.16.8 - 2022-01-10
7.16.7 - 2021-12-31
7.16.5 - 2021-12-13
7.16.0 - 2021-10-29

from @babel/node GitHub release notes

Package name: @babel/preset-env

7.22.9 - 2023-07-12
Read more
7.22.7 - 2023-07-06
Read more
7.22.6 - 2023-07-04
Read more
7.22.5 - 2023-06-08
Read more
7.22.4 - 2023-05-29
Read more
7.22.2 - 2023-05-26
Read more
7.22.1 - 2023-05-26
Read more
7.22.0 - 2023-05-26
Read more
7.21.5 - 2023-04-28
7.21.4 - 2023-03-31
7.21.4-esm.4 - 2023-04-04
7.21.4-esm.3 - 2023-04-04
7.21.4-esm.2 - 2023-04-04
7.21.4-esm.1 - 2023-04-04
7.21.4-esm - 2023-04-04
7.20.2 - 2022-11-04
7.19.4 - 2022-10-10
7.19.3 - 2022-09-27
7.19.1 - 2022-09-14
7.19.0 - 2022-09-05
7.18.10 - 2022-08-01
7.18.9 - 2022-07-18
7.18.6 - 2022-06-27
7.18.2 - 2022-05-25
7.18.0 - 2022-05-19
7.17.12 - 2022-05-16
7.17.10 - 2022-04-29
7.16.11 - 2022-01-20
7.16.10 - 2022-01-19
7.16.8 - 2022-01-10
7.16.7 - 2021-12-31
7.16.5 - 2021-12-13
7.16.4 - 2021-11-16

from @babel/preset-env GitHub release notes

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

Snyk has created this PR to upgrade: - @babel/cli from 7.16.0 to 7.22.9. See this package in npm: https://www.npmjs.com/package/@babel/cli - @babel/core from 7.16.0 to 7.22.9. See this package in npm: https://www.npmjs.com/package/@babel/core - @babel/node from 7.16.0 to 7.22.6. See this package in npm: https://www.npmjs.com/package/@babel/node - @babel/preset-env from 7.16.4 to 7.22.9. See this package in npm: https://www.npmjs.com/package/@babel/preset-env See this project in Snyk: https://app.snyk.io/org/braineanear/project/1dcdcc39-d614-4f79-a17e-6ab8d8792d0d?utm_source=github&utm_medium=referral&page=upgrade-pr

[Snyk] Upgrade: @babel/cli, @babel/core, @babel/node, @babel/preset-env #596

Are you sure you want to change the base?

[Snyk] Upgrade: @babel/cli, @babel/core, @babel/node, @babel/preset-env #596

Conversation

Braineanear commented Aug 26, 2023

Snyk has created this PR to upgrade multiple dependencies.

v7.22.9 (2023-07-12)

🐛 Bug Fix

💅 Polish

🏠 Internal

Committers: 5

v7.22.6 (2023-07-04)

🐛 Bug Fix

🏠 Internal

🔬 Output optimization

Committers: 5

v7.22.5 (2023-06-08)

🐛 Bug Fix

💅 Polish

Committers: 4

v7.22.9 (2023-07-12)

🐛 Bug Fix

💅 Polish

🏠 Internal

Committers: 5

v7.22.8 (2023-07-06)

↩️ Revert

Committers: 1

v7.22.7 (2023-07-06)

🐛 Bug Fix

🏠 Internal

Committers: 4

v7.22.6 (2023-07-04)

🐛 Bug Fix

🏠 Internal

🔬 Output optimization

Committers: 5

v7.22.5 (2023-06-08)

🐛 Bug Fix

💅 Polish

Committers: 4

v7.22.1 (2023-05-26)

🐛 Bug Fix

Committers: 2

v7.22.6 (2023-07-04)

🐛 Bug Fix

🏠 Internal

🔬 Output optimization

Committers: 5