build(deps): override @babel/core to ^7.29.7 (fixes Dependabot run #32779736153)

[Sbussiso]

What this fixes

Closes the failed Dependabot security-update run 32779736153 (workflow "npm_and_yarn in /frontend for @babel/core", status security_update_not_possible).

Note: this was not a build/test failure. The failing workflow is Dependabot itself — its security-update job that auto-opens a PR for @babel/core. It could not complete, so it reported failure.

Root cause

@babel/core@7.29.0 is vulnerable to GHSA-4x5r-pxfx-6jf8 — Arbitrary File Read via sourceMappingURL Comment (low, CVSS 3.2). It's pulled transitively:

eslint-plugin-react-hooks@7.1.1
  └─ @babel/helper-module-transforms@7.28.6  →  @babel/core@^7.0.0
  └─ (direct)                                 →  @babel/core@^7.24.4

Dependabot refused the only automated path it found because that path would downgrade eslint-plugin-react-hooks 7.1.1 → 5.2.0 — which it's not allowed to do for a security-only update. Hence security_update_not_possible.

Fix

Add an npm overrides entry pinning @babel/core to ^7.29.7 (the latest patched 7.x):

"overrides": {
  "postcss": "^8.5.23",
  "js-cookie": "^3.0.7",
  "@babel/core": "^7.29.7"
}

7.29.7 satisfies both constraints (^7.24.4 and ^7.0.0), so the override resolves the advisory with no downgrade of any package. This matches the existing postcss / js-cookie override pattern already in the repo, and the rationale is documented in overridesNotes alongside the others.

Verification

Check	Result
npm install	✅ clean, 222 packages
npm run build	✅ built in 370ms
npm test (vitest)	✅ 85/85 passed
npm run lint	✅ 38 pre-existing problems, 0 new (change only touches package.json overrides)
npm audit	✅ @babel/core no longer listed (7.29.0 → 7.29.7)
eslint-plugin-react-hooks version	✅ still 7.1.1 (no downgrade)
@babel/helper-module-transforms version	7.28.6 → 7.29.7 (follows @babel/core, API-stable within 7.x)

The remaining audit highs (brace-expansion@1.1.16, nanoid@3.3.16) are pre-existing (identical versions before and after this change) and unrelated to this run.

Reachability note

The advisory is not reachable in our build: Vite/Babel transforms source we author/control; there is no attacker-supplied sourceMappingURL input path. The override's primary value here is letting Dependabot's security-update job resolve cleanly (instead of hard-failing) and keeping the --audit-level gate honest.

Cleanup

Remove the override once eslint-plugin-react-hooks ships against a >=7.29.6 baseline or @babel/core 8 is adopted.

---

Automated CI triage by Hermes coder.