Bump @babel/plugin-transform-modules-systemjs from 7.29.0 to 7.29.4#5319
Conversation
Patches GHSA-fv7c-fp4j-7gwp (high) — generates arbitrary code when compiling malicious input. Vulnerable range <=7.29.3; bun.lock pinned 7.29.0 transitively via @babel/preset-env's ^7.29.0 constraint. Open dependabot PRs #5319 + #5320 only touch package-lock.json (not the source of truth in this repo); use the existing overrides block to nudge bun's resolution to ^7.29.4 instead.
Bumps [@babel/plugin-transform-modules-systemjs](https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs) from 7.29.0 to 7.29.4. - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.4/packages/babel-plugin-transform-modules-systemjs) --- updated-dependencies: - dependency-name: "@babel/plugin-transform-modules-systemjs" dependency-version: 7.29.4 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dc711e5 to
c190335
Compare
|
Superseded by lockfile / override applied directly on develop. Closing as no longer needed; dependabot will reopen if a new advisory bumps the floor. |
1 similar comment
|
Superseded by lockfile / override applied directly on develop. Closing as no longer needed; dependabot will reopen if a new advisory bumps the floor. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
Bumps @babel/plugin-transform-modules-systemjs from 7.29.0 to 7.29.4.
Release notes
Sourced from @babel/plugin-transform-modules-systemjs's releases.
... (truncated)
Commits
a458f66v7.29.432ebd5a[7.x backport]fix(systemjs): improve module string name support (#17974)