Skip to content

security: bump @babel/core transitive dependency to 7.29.6 #2734

@ConnorQi01

Description

@ConnorQi01

Summary

CVE-2026-49356 affects @babel/core versions <= 7.29.0 (arbitrary file read via sourceMappingURL). The package is a transitive dependency currently resolved to 7.14.2.

Proposed Changes

Add "@babel/core": "7.29.6" to the overrides section in package.json so npm resolves the patched version for all transitive consumers.

Evidence

Validation

  • Verify @babel/core resolves to 7.29.6 in package-lock.json after npm install

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions