Skip to content

refactor: Bump @babel/core from 7.12.3 to 7.29.7 - #992

Merged
mtrezza merged 1 commit into
parse-community:gh-pagesfrom
mtrezza:refactor/babel-core-7.29.7
Oct 24, 2026
Merged

mtrezza merged 1 commit into
parse-community:gh-pagesfrom
mtrezza:refactor/babel-core-7.29.7

Conversation

@mtrezza

@mtrezza mtrezza commented Oct 24, 2026 •

Copy link
Copy Markdown
Member

Closes #982

Upgrades @babel/core (devDependency, pinned) from 7.12.3 to 7.29.7. This replaces the Dependabot PR with a lock file regenerated on the current gh-pages.

This resolves Dependabot alert GHSA-4x5r-pxfx-6jf8 (low: arbitrary file read via a sourceMappingURL comment, @babel/core <= 7.29.0, fixed in 7.29.6 by babel/babel#18001). @babel/core is a development-only dependency, so this does not trigger a release.

Lock file

The lock file was regenerated on the current gh-pages with npm install @babel/core@7.29.7 --save-exact. The bot's lock file predates #990 and #991 and would have reverted browserslist (4.29.4 → 4.28.1) and fast-uri (3.1.9 → 3.1.2), as well as caniuse-lite, electron-to-chromium, node-releases, update-browserslist-db and baseline-browser-mapping. Here the diff is limited to @babel/core and its own dependencies, and lockfileVersion stays at 2.

Package Before After
@babel/core 7.12.3 7.29.7
@babel/code-frame 7.29.0 7.29.7
@babel/compat-data 7.12.1 7.29.7
@babel/generator 7.29.1 7.29.8
@babel/helper-compilation-targets 7.12.1 7.29.7
@babel/helper-globals 7.28.0 7.29.7
@babel/helper-module-imports 7.28.6 7.29.7
@babel/helper-module-transforms 7.28.6 7.29.7
@babel/helper-string-parser 7.27.1 7.29.11
@babel/helper-validator-identifier 7.28.5 7.29.7
@babel/helper-validator-option 7.12.1 7.29.7
@babel/helpers 7.12.1 7.29.10
@babel/parser 7.29.3 7.29.11
@babel/template 7.28.6 7.29.7
@babel/traverse 7.29.0 7.29.10
@babel/types 7.29.0 7.29.11
gensync 1.0.0-beta.1 1.0.0-beta.2
convert-source-map 1.7.0 (nested) 2.0.0
@jridgewell/remapping, lru-cache, yallist, semver 6.3.1 (nested) – added
source-map 0.5.6, safe-buffer 5.1.2 (nested) – removed (only needed by @babel/core 7.12.3)

Build check

The repository has no CI build, so the bundle was compared locally:

  • npm ci --ignore-scripts followed by npm run webpack (production mode) was run on gh-pages and on this branch, and both builds compile.
  • The resulting bundle.js is byte-identical (sha256 0f4418eea4b11335be13d8c5bee0ad6d691a28e0145e8bc34798000d2a462a33), and so is bundle.js.LICENSE.txt.
  • Running Babel on _app/main.js, _app/UI.js and _app/echo.js with the webpack config's preset (@babel/preset-env, babel-loader caller flags) gives the same output under 7.12.3 and 7.29.7. The sources only use template literals and const/let, so no Babel helpers are injected.

This PR therefore does not need a rebuilt assets/js/bundle.js. One unrelated observation: the committed assets/js/bundle.js on gh-pages already differs from a fresh build of gh-pages itself, and this PR does not touch it.

@babel/preset-env stays at 7.12.1

  • The effective Babel config is only the babel-loader options in webpack.config.js (presets: ['@babel/preset-env'], no targets). The repo has no .babelrc, babel.config.* or browserslist config. babel-preset-es2015 and babel-preset-react are not referenced anywhere.
  • @babel/preset-env 7.12.1 declares the peer dependency @babel/core ^7.0.0-0, which 7.29.7 satisfies. A newer Babel 7 core runs older plugins and presets.
  • The upgrade moves packages that @babel/preset-env shares with @babel/core (@babel/compat-data, @babel/helper-compilation-targets and @babel/helper-validator-option, each from 7.12.1 to 7.29.7) within the caret ranges @babel/preset-env 7.12.1 declares.
    • @babel/preset-env 7.12.1 ignores plugin names in @babel/compat-data that it does not know.
    • @babel/compat-data 7.29.7 still contains all 40 plugin entries that @babel/preset-env 7.12.1 uses, so no transform is dropped.
    • The identical build output confirms this.
  • Upgrading @babel/preset-env itself is a separate change and is not needed for this fix.

Changes

Release notes from babel/babel releases, v7.12.4 to v7.29.11. The list only covers packages whose installed version changes in this PR, each within its own version range, for example @babel/core and @babel/helpers from 7.12.x but @babel/parser only from 7.29.3. Features, fixes, spec compliance, performance, output optimization, polish and revert entries are listed individually. Internal and documentation entries are grouped as counts. Versions with no entries for these packages are omitted.

Relevance for this repository: the 7.29.6 source map fixes contain the security fix, and the build uses no source maps. Helper changes (e.g. babel/babel#12115, babel/babel#15182, babel/babel#18287) only apply when helpers are injected, which is not the case here. The 7.25.9 entry babel/babel#16907 (support for the BROWSERSLIST / BROWSERSLIST_CONFIG environment variables) restores support that later 7.x versions had lost. The installed @babel/helper-compilation-targets 7.12.1 already honored these variables when no targets are configured, so the net effect from 7.12.1 to 7.29.7 is no change.

Breaking Changes

None

Code Changes Required

None. The upgrade is a drop-in replacement, and the built bundle is unchanged.

@coderabbitai

coderabbitai Bot commented Oct 24, 2026

Copy link
Copy Markdown

Warning

Review limit reached

The included review limit has been reached and this organization has disabled usage-based review continuation. Wait for reviews to reset or ask a billing admin to change After included review limits.

  • Ask an admin to enable usage-based reviews

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Next included review available in 19 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 2 included reviews currently available. Your 54 included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

Learn how review limits work.

Review configuration:

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: CHILL
  • Plan: Essentials
  • Run ID: 4527b100-175e-4b30-a20b-07f702ad5d16
Commits

Reviewing files that changed from the base of the PR and between 8c32252 and 359bd2e.

Files selected for processing: 2
  • package-lock.json
  • package.json
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

@mtrezza
mtrezza merged commit 2e7ad53 into parse-community:gh-pages Oct 24, 2026
1 check passed
@mtrezza
mtrezza deleted the refactor/babel-core-7.29.7 branch October 24, 2026 19:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant