Skip to content

chore(deps-dev): bump @babel/core from 7.29.6 to 8.0.1 - #20890

Open
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/npm_and_yarn/babel/core-8.0.1
Open

chore(deps-dev): bump @babel/core from 7.29.6 to 8.0.1#20890
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/npm_and_yarn/babel/core-8.0.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps @babel/core from 7.29.6 to 8.0.1.

Release notes

Sourced from @​babel/core's releases.

v8.0.1 (2026-06-17)

This release includes a breaking change that was in the Babel 8 migration guide's Getting ready section and in the release post, but the actual removal of the feature from the codebase was accidentally not complete.

💥 Breaking Change

  • babel-core, babel-plugin-transform-object-rest-spread, babel-plugin-transform-runtime, babel-preset-env, babel-standalone

Committers: 2

v8.0.0 (2026-06-16)

NOTE: The changelog below is relative to v8.0.0-rc.6. You can find a summary of all the breaking changes shipped in the Babel 8 release line in the migration guide for users and migration guide for plugin developers.

Read the release blog post at http://babeljs.io/blog/2026/06/16/8.0.0!

👓 Spec Compliance

💥 Breaking Change

  • babel-cli, babel-node, babel-plugin-proposal-decorators, babel-plugin-transform-classes, babel-plugin-transform-function-name, babel-plugin-transform-modules-commonjs, babel-plugin-transform-object-rest-spread, babel-plugin-transform-parameters, babel-plugin-transform-react-constant-elements, babel-plugin-transform-regenerator, babel-preset-env, babel-register
  • babel-plugin-transform-runtime, babel-runtime-corejs3, babel-runtime
  • babel-parser

🐛 Bug Fix

  • babel-generator
  • babel-plugin-transform-modules-systemjs

📝 Documentation

🏠 Internal

🏃‍♀️ Performance

Committers: 6

... (truncated)

Changelog

Sourced from @​babel/core's changelog.

v8.0.1 (2026-06-17)

💥 Breaking Change

  • babel-core, babel-plugin-transform-object-rest-spread, babel-plugin-transform-runtime, babel-preset-env, babel-standalone

v8.0.0 (2026-06-16)

👓 Spec Compliance

💥 Breaking Change

  • babel-cli, babel-node, babel-plugin-proposal-decorators, babel-plugin-transform-classes, babel-plugin-transform-function-name, babel-plugin-transform-modules-commonjs, babel-plugin-transform-object-rest-spread, babel-plugin-transform-parameters, babel-plugin-transform-react-constant-elements, babel-plugin-transform-regenerator, babel-preset-env, babel-register
  • babel-plugin-transform-runtime, babel-runtime-corejs3, babel-runtime
  • babel-parser

🐛 Bug Fix

  • babel-generator
  • babel-plugin-transform-modules-systemjs

📝 Documentation

🏠 Internal

🏃‍♀️ Performance

v8.0.0-rc.6 (2026-05-25)

🐛 Bug Fix

🏠 Internal

  • babel-core
  • babel-compat-data, babel-register
  • babel-helper-transform-fixture-test-runner, babel-node

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file maintenance labels Jul 20, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner July 20, 2026 06:24
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file maintenance labels Jul 20, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jul 21, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't parse your yarn.lock. Because of this, Dependabot cannot update this pull request.

@dependabot
chore(deps-dev): bump @babel/core from 7.29.6 to 8.0.1
64712c9 
Bumps [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) from 7.29.6 to 8.0.1.
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v8.0.1/packages/babel-core)

---
updated-dependencies:
- dependency-name: "@babel/core"
  dependency-version: 8.0.1
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/babel/core-8.0.1 branch from 31e2358 to 64712c9 Compare July 21, 2026 17:35
@mozilla-blender

mozilla-blender Bot commented Jul 25, 2026

Copy link
Copy Markdown
Contributor

Reviewing this major version bump. Workflow run

@mozilla-blender

mozilla-blender Bot commented Jul 25, 2026

Copy link
Copy Markdown
Contributor

Note: This PR has failing CircleCI checks.
BLEnder cannot access CircleCI log output, so it
may not be able to diagnose or fix the failure.
Consider migrating CI to GitHub Actions so BLEnder
can read failure logs directly.

@mozilla-blender

mozilla-blender Bot commented Jul 25, 2026

Copy link
Copy Markdown
Contributor

BLEnder picked up this PR. Workflow run

@mozilla-blender

mozilla-blender Bot commented Jul 25, 2026

Copy link
Copy Markdown
Contributor

NO_VERDICT: could not evaluate this major version bump — manual review needed.

@mozilla-blender

mozilla-blender Bot commented Jul 25, 2026

Copy link
Copy Markdown
Contributor

Reviewing this major version bump. Workflow run

@mozilla-blender

mozilla-blender Bot commented Jul 25, 2026

Copy link
Copy Markdown
Contributor

Note: This PR has failing CircleCI checks.
BLEnder cannot access CircleCI log output, so it
may not be able to diagnose or fix the failure.
Consider migrating CI to GitHub Actions so BLEnder
can read failure logs directly.

@mozilla-blender

mozilla-blender Bot commented Jul 25, 2026

Copy link
Copy Markdown
Contributor

BLEnder picked up this PR. Workflow run

@mozilla-blender

mozilla-blender Bot commented Jul 28, 2026

Copy link
Copy Markdown
Contributor

BLEnder investigated: This dependency has an open security alert, but the repo is not affected.

@babel/core is a build/test-time devDependency (root package.json declares the patched ^7.29.6; a vulnerable 7.27.7 copy remains only transitively via Jest/Storybook/webpack tooling). The sourceMappingURL arbitrary-file-read vulnerability requires compiling attacker-controlled source and returning the output to the attacker, with a known source-map path. FXA only compiles its own trusted first-party code at build time and exposes no runtime Babel-transform code path over untrusted input, so the advisory's stated preconditions ('Users that only compile trusted code are not impacted') are not met.

This PR can be reviewed and merged as a normal dependency update.

@mozilla-blender

mozilla-blender Bot commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

BLEnder investigated: This dependency has an open security alert, but the repo is not affected.

@babel/core is a build/test-time devDependency only (Jest, webpack/grunt, @babel/cli, presets) and never a runtime dependency in any FxA package. The advisory only impacts callers that compile maliciously crafted, attacker-controlled source code and can read the output plus know the source map path — it explicitly states users compiling only trusted code are not impacted. FxA compiles trusted first-party source at build time, so the vulnerable path is never exercised with untrusted input. The root direct dependency already resolves to the patched 7.29.6; only a stale transitive copy (7.27.7) falls in the vulnerable range, and it too is used solely on trusted build inputs.

This PR can be reviewed and merged as a normal dependency update.

@mozilla-blender

mozilla-blender Bot commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

BLEnder investigated: This dependency has an open security alert, but the repo is not affected.

@babel/core is a build/dev/test-time devDependency only (consumed by babel-jest, babel-loader, @babel/cli, grunt-babel, Storybook), never a runtime dependency. The advisory's arbitrary-file-read requires an attacker to control input source code, read the compiled output, and know a source-map path; FXA only ever compiles its own trusted first-party source during build/test, so the vulnerable inputSourceMap path is never exposed to untrusted input ('Users that only compile trusted code are not impacted'). The lockfile still resolves a vulnerable 7.27.7 alongside a patched 7.29.7, so a bump/lockfile refresh is good hygiene but there is no real impact.

This PR can be reviewed and merged as a normal dependency update.

@mozilla mozilla deleted a comment from mozilla-blender Bot Jul 30, 2026
@mozilla-blender

mozilla-blender Bot commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

BLEnder investigated: This dependency has an open security alert, but the repo is not affected.

@babel/core is a build-time-only devDependency (Jest/ESLint/Storybook/webpack tooling) with no runtime dependency anywhere in the app; the root package.json already pins ^7.29.6 (patched). The advisory's arbitrary-file-read via sourceMappingURL only impacts callers that compile attacker-controlled source with inputSourceMap enabled — FXA only compiles its own trusted first-party code at build/test time, so the vulnerable code path is never exercised. A transitive vulnerable resolution (7.27.7) still lingers in yarn.lock alongside patched 7.29.6/7.29.7, warranting a bump/dedupe for hygiene but posing no runtime exposure.

This PR can be reviewed and merged as a normal dependency update.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file maintenance

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants