Update all npm dependencies (major)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@babel/standalone (source)	7.29.7 → 8.0.4
npm (source)	11.18.0 → 12.0.1

---

Release Notes

babel/babel (@​babel/standalone)

v8.0.4

Compare Source

👓 Spec Compliance

• babel-parser, babel-plugin-transform-typescript
  • #​18120 fix(parser): disallow declare module M {} (@​JLHwung)
• babel-generator, babel-parser, babel-plugin-transform-typescript
  • #​18100 fix(parser): forbid let x! and let x! = (@​JLHwung)

🐛 Bug Fix

• babel-traverse
  • #​18122 fix: replaceWith in Visitor#exit should not stop traversal (@​liuxingbaoyu)

🏠 Internal

• babel-helper-validator-identifier
  • #​18084 refactor: Shrink validator identifier size (@​JLHwung)

v8.0.3

Compare Source

🐛 Bug Fix

• babel-core, babel-plugin-syntax-typescript
  • #​18089 fix: Remove isTSX from babel-plugin-syntax-typescript types (@​liuxingbaoyu)
• babel-standalone
  • #​18086 fix: Use runtime: 'classic' in the browser for React (@​liuxingbaoyu)

v8.0.2

Compare Source

🐛 Bug Fix

• Other
  • #​18083 Use the @babel/core version when asserting version in @babel/standalone (@​nicolo-ribaudo)
• babel-helper-validator-identifier
  • #​18075 fix(identifier): avoid double escaping slash (@​JLHwung)

🏠 Internal

• babel-plugin-proposal-decorators, babel-plugin-transform-regenerator, babel-preset-env
  • #​18081 Update @babel/preset-modules and polyfill packages (@​nicolo-ribaudo)

v8.0.1

Compare Source

💥 Breaking Change

• babel-core, babel-plugin-transform-object-rest-spread, babel-plugin-transform-runtime, babel-preset-env, babel-standalone
  • #​18079 Actually remove preset-env's useBuiltIns (@​nicolo-ribaudo)

v8.0.0

Compare Source

👓 Spec Compliance

• babel-core
  • #​18039 perf: Only extract source map comments at the end of the file (@​liuxingbaoyu)

💥 Breaking Change

• babel-cli, babel-node, babel-plugin-proposal-decorators, babel-plugin-transform-classes, babel-plugin-transform-function-name, babel-plugin-transform-modules-commonjs, babel-plugin-transform-object-rest-spread, babel-plugin-transform-parameters, babel-plugin-transform-react-constant-elements, babel-plugin-transform-regenerator, babel-preset-env, babel-register
  • #​18069 Fallback to assuming ESM support with modules: auto (@​nicolo-ribaudo)
• babel-plugin-transform-runtime, babel-runtime-corejs3, babel-runtime
  • #​18036 Remove corejs exports for @babe/runtime-corejs3 (@​liuxingbaoyu)
• babel-parser
  • #​18034 Remove locations: "packed" (@​liuxingbaoyu)

🐛 Bug Fix

• babel-generator
  • #​18046 fix(generator): improve new callee parens check (@​JLHwung)
• babel-plugin-transform-modules-systemjs
  • #​18032 fix(systemjs): support proto as an export name (@​JLHwung)

📝 Documentation

• #​18070 Add EOL date for Babel 7 (end of June 2027) to SECURITY.md (@​nicolo-ribaudo)

🏠 Internal

• #​18018 ci: enforce yarn integrity (@​JLHwung)

🏃‍♀️ Performance

• babel-core
  • #​18039 perf: Only extract source map comments at the end of the file (@​liuxingbaoyu)

npm/cli (npm)

v12.0.1

Compare Source

Bug Fixes

• ecb02a8 #​9745 view: avoid wrapping array results (#​9745) (@​reggi, @​martinrrm, @​Copilot)
• 47fc8b1 #​9740 correct bundled sigstore from dev dependency conflict (#​9740) (@​james-pre)

Dependencies

• workspace: @npmcli/arborist@10.0.1
• workspace: libnpmdiff@9.0.1
• workspace: libnpmexec@11.0.1
• workspace: libnpmfund@8.0.1
• workspace: libnpmpack@10.0.1

v12.0.0

Compare Source

⚠️ BREAKING CHANGES

• npm view --json now always returns an array.
• npm sbom --sbom-format=cyclonedx now reports the name field from each package's package.json instead of the on-disk directory name. The name, bom-ref, and purl of the root component and of aliased dependencies may change.
• npm no longer registers man pages with the system when installed globally. man npm-install will no longer work, but npm help install is unaffected.
• The npm pkg output is no longer forced to json. This means you can get single values without having to worry about wrapping of the values. It also outputs non-json content more similarly to npm view.
• npm shrinkwrap is removed, the shrinkwrap config alias is removed, and npm-shrinkwrap.json is no longer loaded or honored at the project root or from inside dependency tarballs. Rename project-root npm-shrinkwrap.json to package-lock.json; use bundleDependencies if you need to ship a locked dependency tree.
• The Twitter and Freenode profile fields have been removed from the npm registry. This means that users will no longer be able to set or view these fields in their npm profiles.
• npm will no longer attempt to resolve the path to node via whichnode. process.execPath is already set by Node to the resolved real path of the node binary, so the lookup was redundant. Scripts that expected npm to override process.execPath with a PATH-resolved (potentially symlinked) node path may be affected.
• the --json output of npm pack and npm publish have changed. They are now always consistent, and in the same format.
• the star, stars and unstar commands have been removed
• The npm adduser command has been removed. Create and manage user accounts on the npm website, and use npm login to authenticate on the command line.
• Preserve https protocol when working with git (#​8703)
• The default license for npm init has been changed from "ISC" to an empty string. If not set, the license field will be omitted from new packages.
• npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0
• allow-git and allow-remote now default to "none"; set them to "all" (or "root") to install git or user-supplied tarball-URL dependencies.
• root `preinstall` now runs before dependencies are installed.
• unknown configs in .npmrc, unknown CLI flags, abbreviated flags, and single-hyphen multi-char shorthands now throw instead of warning.

Chores

• b77b532 #​9735 remove pre-release mode from npm 12 and workspaces (#​9735) (@​reggi, @​Copilot)

Dependencies

• workspace: @npmcli/arborist@10.0.0
• workspace: @npmcli/config@11.0.0
• workspace: libnpmaccess@11.0.0
• workspace: libnpmdiff@9.0.0
• workspace: libnpmexec@11.0.0
• workspace: libnpmfund@8.0.0
• workspace: libnpmorg@9.0.0
• workspace: libnpmpack@10.0.0
• workspace: libnpmpublish@12.0.0
• workspace: libnpmsearch@10.0.0
• workspace: libnpmteam@9.0.0
• workspace: libnpmversion@9.0.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "on monday at 10:00am"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm warn cli npm v12.0.1 does not support Node.js v18.20.8. This version of npm supports the following node versions: `^22.22.2 || ^24.15.0 || >=26.0.0`. You can find the latest version at https://nodejs.org/.
npm error code ERR_REQUIRE_ESM
npm error require() of ES Module /opt/containerbase/tools/npm/12.0.1/18.20.8/node_modules/npm/node_modules/@npmcli/agent/node_modules/http-proxy-agent/dist/index.js from /opt/containerbase/tools/npm/12.0.1/18.20.8/node_modules/npm/node_modules/@npmcli/agent/lib/proxy.js not supported.
npm error Instead change the require of index.js in /opt/containerbase/tools/npm/12.0.1/18.20.8/node_modules/npm/node_modules/@npmcli/agent/lib/proxy.js to a dynamic import() which is available in all CommonJS modules.
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-07-10T21_17_25_929Z-debug-0.log

[github-actions]

Build size report

This PR does not change the size of the minified bundles.

Bundle	Minified	Gzip	Brotli
playcanvas.min.js	2279.7 KB —	587.6 KB —	457.0 KB —
playcanvas.min.mjs	2277.1 KB —	586.7 KB —	456.5 KB —