Bump @babel/plugin-transform-modules-systemjs from 7.25.9 to 7.29.8 - #188
Bump @babel/plugin-transform-modules-systemjs from 7.25.9 to 7.29.8#188dependabot[bot] wants to merge 2 commits into
Conversation
dependabot
Bot
added
dependencies
|
@dependabot rebase |
Bumps [@babel/plugin-transform-modules-systemjs](https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs) from 7.25.9 to 7.29.8. - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.8/packages/babel-plugin-transform-modules-systemjs) --- updated-dependencies: - dependency-name: "@babel/plugin-transform-modules-systemjs" dependency-version: 7.29.8 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
fa23e11 to
afa8e79
Compare
rhit-kapilaar
left a comment
rhit-kapilaar
left a comment
There was a problem hiding this comment.
This is a fairly high risk vulnerability because if an attacker uses babel or the specific plugin involved to compile malicious code, they can cause it to generate output that runs arbitrary code.
The fix itself was made in version 7.29.4 although the PR suggests bumping up to an even higher subversion presumably because of couple other bug fixes and improvements made in later versions.
There seem to be quite a lot of additions made for the fix as can be seen in babel/babel@32ebd5a and it isn't immediately clear how it fixes the vulnerability.
It is also interesting because it passes all checks for GitHub Actions but fails when I try to build locally for iOS. (Around time of writing also built app for other PRs and fixes and they work locally as well).
1 participant
Bumps @babel/plugin-transform-modules-systemjs from 7.25.9 to 7.29.8.
Release notes
Sourced from @babel/plugin-transform-modules-systemjs's releases.
... (truncated)
Commits
5de11cav7.29.8f08d434fix(systemjs): support proto as an export name (#18044)4fba754v7.29.7a458f66v7.29.432ebd5a[7.x backport]fix(systemjs): improve module string name support (#17974)aa8394ev7.29.00053db6Update polyfill packages (#17727)61647aev7.28.5a177d55[Babel 8] Uset.traverseFastto replace somepath.traverse(#17518)eebd3a0v7.27.1Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for
@babel/plugin-transform-modules-systemjssince your current version.