[mtrezza]

Security

This lock-file-only change updates three development dependencies to address open Dependabot alerts. It was generated with npm update npm brace-expansion @babel/core --ignore-scripts --package-lock-only. npm prints "up to date", but the lock file changes.

Package	From	To	Parent
npm	11.18.0	11.21.1	@semantic-release/npm 13.1.5 (^11.6.2)
brace-expansion	5.0.7	5.0.12	minimatch 10.2.5 (^5.0.5)
@babel/core	7.24.8	7.29.7	istanbul-lib-instrument 6.0.3 (via nyc)

All three packages are development-only: npm ls --omit=dev does not list any of them.

Most alerts concern copies bundled inside the npm tarball (inBundle entries). Those copies can only change through an npm release, so npm itself is updated. The 13 bundled entries in the new lock file match the npm 11.21.1 tarball exactly.

This change addresses these open alerts:

Alert	Package (lock entry)	Advisory	Severity	Vulnerable range	Version after this change
alert 473	postcss-selector-parser (bundled in npm)	GHSA-rj75-hqrm-r3gf	medium	>= 7.0.0, < 7.1.6	7.1.6
alert 455	undici (bundled in npm)	GHSA-r53p-7pc4-xj5r	low	< 6.28.1	6.29.0
alert 426	undici (bundled in npm)	GHSA-m8rv-5g2x-5cg5	medium	< 6.28.0	6.29.0
alert 427	undici (bundled in npm)	GHSA-8xcm-r25x-g524	medium	< 6.28.0	6.29.0
alert 428	undici (bundled in npm)	GHSA-v3r7-h72x-cjcm	medium	< 6.28.0	6.29.0
alert 460	http-cache-semantics (bundled in npm)	GHSA-ch52-4w7c-c8xp	high	<= 4.2.0	4.3.0 (see note)
alert 458	ip-address (bundled in npm)	GHSA-j6r3-76f7-8jcv	medium	<= 10.7.0	10.7.2
alert 442	ip-address (bundled in npm)	GHSA-rpw4-54j3-4h4q	medium	<= 10.5.0	10.7.2
alert 439	ip-address (bundled in npm)	GHSA-2vr4-cq9g-pvrc	medium	>= 10.2.0, <= 10.5.0	10.7.2
alert 425	ip-address (bundled in npm)	GHSA-mwp4-54f8-5fhr	high	<= 10.3.0	10.7.2
alert 418	ip-address (bundled in npm)	GHSA-4xrf-jv44-h6hh	medium	>= 10.1.1, <= 10.2.1	10.7.2
alert 417	ip-address (bundled in npm)	GHSA-22jq-vg5j-6vgg	medium	>= 10.1.1, <= 10.2.0	10.7.2
alert 456	brace-expansion (top level and bundled in npm)	GHSA-q2hr-2g5m-vwhr	medium	>= 4.0.0, < 5.0.12	5.0.12
alert 398	@babel/core	GHSA-4x5r-pxfx-6jf8	low	<= 7.29.0 (first patched 7.29.6)	7.29.7

Note on alert 460: GHSA-ch52-4w7c-c8xp is disputed and lists no patched version. The alert closes only because http-cache-semantics 4.3.0 is outside the listed range <= 4.2.0. No fix has been confirmed.

This change also resolves these auto-dismissed alerts:

• alert 457: ip-address GHSA-h3mg-xc3c-68pw, <= 10.7.0, bundled 10.7.2
• alert 454: undici GHSA-rfgv-xxqx-mfg5, >= 6.7.0, < 6.28.1, bundled 6.29.0
• alert 441: undici GHSA-3wwx-pv8p-q78v, >= 6.25.0, < 6.28.1, bundled 6.29.0
• alert 448: brace-expansion GHSA-qhr7-859c-m2p7, >= 4.0.0, < 5.0.11, 5.0.12
• alert 447: brace-expansion GHSA-6j4f-fj2g-mc7p, >= 4.0.0, < 5.0.10, 5.0.12
• alert 424: brace-expansion GHSA-rgw5-rvv9-x895, >= 4.0.0, < 5.0.9, 5.0.12
• alert 416: brace-expansion GHSA-mh99-v99m-4gvg, >= 4.0.0, < 5.0.8, 5.0.12

These advisories still match after this change:

• alert 472 (open, undici GHSA-xjj6-f33q-929c, high, >= 6.23.0, < 6.29.1) and alert 471 (auto-dismissed, undici GHSA-4qv8-2p9j-2685, >= 6.5.0, < 6.29.1).
  • The match is the undici 6.29.0 bundled in npm 11.21.1.
  • No npm 11.x release bundles undici 6.29.1 or newer: 11.21.1 is the latest 11.x.
  • npm 12 is outside the ^11.6.2 range of @semantic-release/npm.
• GHSA-9fm3-97px-rjf6 (medium), GHSA-qrxm-fqhp-jwvm (high) and GHSA-2m5v-pch6-74hx (high).
  • These are three undici advisories for < 6.29.1, published on 2026-10-27.
  • This repository has no alerts for them yet.
  • They match the bundled undici 6.29.0 just as they match the current 6.27.0, for the same reason.
  • The top-level undici 6.29.1 and the production undici 7.30.1 are outside their ranges.
• alert 468 (auto-dismissed, ip-address GHSA-rxp7-6hxx-x8q5, <= 10.7.3).
  • The match is the ip-address 10.7.2 bundled in npm 11.21.1, the latest 11.x.
  • The production ip-address 10.7.4 is not affected.
• alert 414 (auto-dismissed, tar GHSA-r292-9mhp-454m, <= 7.5.20).
  • The bundled tar moves from 7.5.19 to 7.5.22.
  • The top-level tar 7.5.20 still matches. It is outside this change.

Lock File Scope

Every changed, added or removed entry is inside the dependency tree of npm, brace-expansion or @babel/core:

• npm 11.18.0 → 11.21.1, and 13 entries bundled in it:
  • undici 6.27.0 → 6.29.0
  • ip-address 10.2.0 → 10.7.2
  • http-cache-semantics 4.2.0 → 4.3.0
  • postcss-selector-parser 7.1.4 → 7.1.6
  • brace-expansion 5.0.7 → 5.0.12
  • tar 7.5.19 → 7.5.22
  • @npmcli/arborist 9.9.0 → 9.9.3
  • @npmcli/config 10.12.0 → 10.14.0
  • libnpmdiff 8.1.11 → 8.1.14
  • libnpmexec 10.3.1 → 10.3.4
  • libnpmfund 7.0.25 → 7.0.28
  • libnpmpack 9.1.11 → 9.1.15
  • libnpmpublish 11.2.0 → 11.2.1
• brace-expansion (top level) 5.0.7 → 5.0.12.
• @babel/core 7.24.8 → 7.29.7, with its own dependency tree:
  • @babel/* packages move to 7.29.x.
  • @jridgewell/gen-mapping 0.3.13, @jridgewell/resolve-uri 3.1.2, @jridgewell/sourcemap-codec 1.6.0 and @jridgewell/trace-mapping 0.3.31.
  • @jridgewell/remapping 2.3.5 replaces @ampproject/remapping.
  • jsesc 2.5.2 → 3.1.0, which @babel/generator 7.29.8 requires.
  • browserslist 4.29.4 → 4.29.5, baseline-browser-mapping 2.11.32 → 2.11.34 and electron-to-chromium 1.5.464 → 1.5.466.
  • lru-cache and yallist only gain a license field.
  • Six Babel helpers that newer Babel no longer uses are removed, along with @jridgewell/set-array and a nested globals 11.12.0.

Usage in This Repository

• npm
  • The release job runs semantic-release with @semantic-release/npm and npmPublish: false. With that setting the plugin skips npm authentication, publishing and dist-tags.
  • The bundled npm only runs npm version <version> --no-git-tag-version --allow-same-version in the prepare step of a release. It is called through execa with preferLocal, so it resolves to node_modules/.bin/npm.
  • None of the npm changes below affect npm version. No CI step and no npm script used in CI invokes npm.
• brace-expansion
  • It is loaded through minimatch 10.2.5 by ESLint and typescript-eslint in the Lint job, and by glob (jasmine) in the Tests job. nodemon and nyc (test-exclude) also load it.
  • Releases 5.0.8 to 5.0.12 cap expansion at 4,000,000 characters of output, a nesting depth of 1,000 and 1,000 {a},b} rewrites. Above a cap, the expansion is truncated instead of exhausting memory, stack or CPU.
  • The two versions were compared through minimatch 10.2.5 (braceExpand, Minimatch#makeRe, and matching against project paths). The comparison covered 27 project patterns: ESLint files/ignores and defaults, jasmine **/*[sS]pec.ts, nyc and test-exclude defaults, and the nodemon extensions. It also covered 27 malformed inputs such as {a,b, a}, {}, {a},b}, escaped braces and invalid ranges.
  • Results were identical for every project pattern and every malformed input. They differ only for inputs beyond the new caps, for example 200 {a},b} rewrites, which took 9.5 s with 5.0.7 and 75 ms with 5.0.12.
• @babel/core
  • @babel/core and @babel/parser are only used by istanbul-lib-instrument through nyc, which only runs in the coverage script. No workflow runs that script (CI runs npm run lint and npm test), so CI does not load them.
  • @babel/code-frame is also loaded by parse-json (through read-pkg and cosmiconfig) in the release job, where it only formats JSON parse errors.
• Engines
  • brace-expansion 5.0.8 and later declare engines.node as 20 || >=22, while this repository's engines.node still includes Node 18.20.4.
  • The package is development-only and CI runs Node 22 only, so this does not affect consumers or CI.
  • The engines ranges of npm 11 (^20.17.0 || >=22.9.0) and @babel/core (>=6.9.0) are unchanged.

Changes

npm 11.18.0 → 11.21.1 (including the bundled @npmcli/arborist, @npmcli/config, libnpmpack and libnpmpublish releases):

• 11.19.0
  • install-scripts: use install-scripts as the warning log title (feat(install-scripts): use install-scripts as the warning log title (backport to v11) npm/cli#9698)
  • pack: honor min-release-age-exclude (fix(pack): honor min-release-age-exclude npm/cli#9811)
  • owner: use the scoped registry for user lookup (fix(owner): use scoped registry for user lookup npm/cli#9810)
  • @npmcli/arborist 9.9.1: avoid a crash when peer back-off detaches a node (fix(arborist): avoid crash when peer back-off detaches a node npm/cli#9808), and allow audit fix to install safe downgrades (fix(arborist): allow audit fix to install safe downgrades npm/cli#9791)
• 11.19.1
  • Exempt explicit pack targets from allow-directory (fix: exempt explicit pack targets from allow-directory npm/cli#9916)
  • Bundled undici 6.28.0, ip-address 10.5.0, brace-expansion 5.0.9 and tar 7.5.22
• 11.20.0
  • token: support read-write-stage-only granular access tokens (feat(token): support read-write-stage-only granular access tokens npm/cli#9994)
  • stage: display staged package status (feat(stage): display staged package status npm/cli#9920)
  • provenance-file takes precedence over OIDC auto-generated provenance (fix: provenance-file takes precedence over OIDC auto-generated provenance npm/cli#9947)
  • config: avoid exporting persistent allow-scripts (fix(config): avoid exporting persistent allow-scripts npm/cli#9937)
  • @npmcli/arborist 9.9.2: reject uninstall args that carry a version (fix(arborist): reject uninstall args that carry a version npm/cli#9930), match allowScripts keys for local paths (fix(arborist): match allowScripts keys for local paths npm/cli#9929), and do not fetch packuments for uninstallable optional peer dependencies (fix(arborist): don't fetch packuments for uninstallable optional peer deps npm/cli#9903)
  • Keep dry-run output valid JSON (fix: keep dry-run output valid json npm/cli#9928)
  • Do not print the funding message for global installs (fix: don't print the funding message for global installs npm/cli#9927)
  • Chores: select the pack workspace through config, plus node-gyp and integration workflow updates
• 11.21.0
  • dist-tag: support OIDC authentication (feat(dist-tag): support OIDC authentication npm/cli#10056)
  • Documentation for npm stage
• 11.21.1
  • Write registry allowScripts keys under install-strategy=linked (fix: write registry allowScripts keys under install-strategy=linked npm/cli#10059)
  • @npmcli/arborist 9.9.3: report ETARGET instead of ERESOLVE for unresolvable peer targets (fix(arborist): report ETARGET instead of ERESOLVE for unresolvable peer targets npm/cli#10118)
  • Bundled http-cache-semantics 4.3.0, undici 6.29.0, postcss-selector-parser 7.1.6, ip-address 10.7.2 and brace-expansion 5.0.12

brace-expansion 5.0.7 → 5.0.12:

• 5.0.8: Fix a DoS via unbounded expansion length (GHSA-mh99-v99m-4gvg). Removes Node.js 18 support (Remove Node.js 18 support juliangruber/brace-expansion#110).
• 5.0.9: Fix a DoS via unbounded intermediate arrays (GHSA-rgw5-rvv9-x895).
• 5.0.10: Fix a DoS via uncontrolled recursion in parseCommaParts (GHSA-6j4f-fj2g-mc7p).
• 5.0.11: Fix a DoS via uncontrolled recursion on nested brace groups (GHSA-qhr7-859c-m2p7).
• 5.0.12: Fix quadratic-time expansion of the {a},b} rewrite (GHSA-q2hr-2g5m-vwhr).
• Other entries: documentation, test, formatting and development dependency updates.

@babel/core 7.24.8 → 7.29.7:

• The security fix for GHSA-4x5r-pxfx-6jf8 (arbitrary file read via a sourceMappingURL comment) is "Improve input source map handling" in 7.29.6 ([7.x packport]Improve input source map handling babel/babel#18001).
• 7.29.7 re-releases all packages with npm provenance attestations.
• Several packages in the tree resolve to newer patch releases than @babel/core: @babel/generator 7.29.8, @babel/traverse and @babel/helpers 7.29.10, and @babel/parser, @babel/types and @babel/helper-string-parser 7.29.11. Their release notes up to 7.29.11 are included below.
• No entry in this range is a breaking change. The release notes list the following entries for the packages in this lock file's Babel tree. Entries for Babel plugins and presets that this repository does not install are omitted.

Babel 7.24.9 to 7.29.11 entries for the installed packages

• 7.24.9
  • Bug Fix: Avoid require() call in @babel/standalone bundle (Avoid require() call in @babel/standalone bundle babel/babel#16639; @babel/core)
  • Bug Fix: fix: provide legacy typings for TS < 4.1 (fix: provide legacy typings for TS < 4.1 babel/babel#16638; @babel/types)
  • Polish: Avoid extra parens in TS as/satisfies (Avoid extra parens in TS as/satisfies babel/babel#16617; @babel/generator)
  • Grouped: internal 1 (internal or docs)
• 7.24.10
  • Bug Fix: Fix parens detection for object&function in as/satisfies (Fix parens detection for object&function in as/satisfies babel/babel#16648; @babel/generator)
• 7.25.0
  • Spec Compliance: await using normative updates (await using normative updates babel/babel#16537; @babel/helpers)
  • New Feature: Move ensureFunctionName to NodePath.prototype (Move ensureFunctionName to NodePath.prototype babel/babel#16658; @babel/traverse, @babel/types)
  • New Feature: Move hoistVariables to Scope.prototype (Move hoistVariables to Scope.prototype babel/babel#16644; @babel/traverse)
  • New Feature: Move splitExportDeclaration to NodePath.prototype (Move splitExportDeclaration to NodePath.prototype babel/babel#16645; @babel/helper-module-transforms, @babel/traverse, @babel/types)
  • New Feature: Move environment-visitor helper into @babel/traverse (Move environment-visitor helper into @babel/traverse babel/babel#16649; @babel/helper-module-transforms, @babel/traverse)
  • New Feature: Expose wether a module has TLA or not as .extra.async (Expose wether a module has TLA or not as .extra.async babel/babel#16480; @babel/core, @babel/parser)
  • New Feature: Introduce bugfix-safari-class-field-initializer-scope (Introduce bugfix-safari-class-field-initializer-scope babel/babel#16569; @babel/compat-data)
  • New Feature: Add NodePath#getAssignmentIdentifiers (Add NodePath#getAssignmentIdentifiers babel/babel#16551; @babel/traverse, @babel/types)
  • New Feature: Add duplicate-named-capturing-groups-regex to preset-env (Add duplicate-named-capturing-groups-regex to preset-env babel/babel#16445; @babel/compat-data)
  • Bug Fix: Print parens around as expressions on the LHS (Print parens around as expressions on the LHS babel/babel#16678; @babel/generator)
  • Bug Fix: fix: Props are lost when the template replaces the node (fix: Props are lost when the template replaces the node babel/babel#15286; @babel/template, @babel/types)
  • Performance: Some minor parser performance improvements for ts (Some minor parser performance improvements for ts babel/babel#16461; @babel/parser)
  • Output optimization: Improve super.x output (Improve super.x output babel/babel#16374; @babel/helpers)
  • Grouped: internal 2 (internal or docs)
• 7.25.1
  • Bug Fix: fix: fixed issue16583 + test (fix: fixed issue16583 + test babel/babel#16587; @babel/traverse)
• 7.25.2
  • Bug Fix: Ensure that requeueComputedKeyAndDecorators is available (Ensure that requeueComputedKeyAndDecorators is available babel/babel#16695; @babel/core, @babel/traverse)
• 7.25.3
  • Bug Fix: Avoid validating visitors produced by traverse.visitors.merge (Avoid validating visitors produced by traverse.visitors.merge babel/babel#16699; @babel/traverse)
  • Grouped: internal 1 (internal or docs)
• 7.25.4
  • Bug Fix: fix: Skip computed key when renaming (fix: Skip computed key when renaming babel/babel#16756; @babel/traverse)
  • Bug Fix: Visit AST fields nodes according to their syntactical order (Visit AST fields nodes according to their syntactical order babel/babel#16710; @babel/types)
  • Bug Fix: Print semicolon after TS export namespace as A (Print semicolon after TS export namespace as A babel/babel#16709; @babel/generator)
  • Polish: Avoid unnecessary parens around sequence expressions (Avoid unnecessary parens around sequence expressions babel/babel#16722; @babel/generator, @babel/traverse)
  • Polish: Avoid unnecessary parens around exported arrow functions (Avoid unnecessary parens around exported arrow functions babel/babel#16714; @babel/generator)
  • Polish: Avoid printing unnecessary parens around object destructuring (Avoid printing unnecessary parens around object destructuring babel/babel#16712; @babel/generator)
  • Output optimization: Avoid extra spaces between comments/regexps in compact mode (Avoid extra spaces between comments/regexps in compact mode babel/babel#16740; @babel/generator)
• 7.25.5
  • Bug Fix: fix: Generate sequence expression parentheses correctly (fix: Generate parentheses correctly babel/babel#16764; @babel/generator, @babel/traverse)
  • Polish: Only force-parenthesize satisfies's LHS if it has newlines (Only force-parenthesize satisfies's LHS if it has newlines babel/babel#16738; @babel/generator)
• 7.25.6
  • Bug Fix: Properly print inner comments in TS array types (Properly print inner comments in TS array types babel/babel#16783; @babel/generator)
  • Bug Fix: fix: jsx whitespace is not properly preserved when retainLines (fix: jsx whitespace is not properly preserved when retainLines babel/babel#16775; @babel/generator)
  • Bug Fix: fix: path.getAssignmentIdentifiers may be undefined (fix: path.getAssignmentIdentifiers may be undefined babel/babel#16727; @babel/traverse)
  • Bug Fix: fix: improve static canFollowModifier checks (fix: improve static canFollowModifier checks babel/babel#16761; @babel/parser)
  • Bug Fix: Only wrap functions in superPropertyGet helper (Only wrap functions in superPropertyGet helper babel/babel#16769; @babel/helpers)
  • Polish: Do not enforce printing space between ( and comments (Do not enforce printing space between ( and comments babel/babel#16780; @babel/generator)
  • Polish: TS union/intersection nested in union does not need parens (TS union/intersection nested in union does not need parens babel/babel#16782; @babel/generator)
  • Grouped: internal 1 (internal or docs)
• 7.25.7
  • Bug Fix: fix: update identifier to unicode 16 (fix: update identifier to unicode 16 babel/babel#16825; @babel/helper-validator-identifier)
  • Bug Fix: fix: issue with node path keys updated on unrelated paths (fix: issue with node path keys updated on unrelated paths babel/babel#16814; @babel/traverse)
  • Bug Fix: Fix printing of TS infer in compact mode (Fix printing of TS infer in compact mode babel/babel#16788; @babel/generator)
  • Bug Fix: Print TS type annotations for destructuring in assignment pattern (Print TS type annotations for destructuring in assignment pattern babel/babel#16785; @babel/generator)
  • Bug Fix: Respect [no LineTerminator here] after nodes (Respect [no LineTerminator here] after nodes babel/babel#16778; @babel/generator)
  • Polish: Add deprecated JSDOC for fields (Add deprecated JSDOC for fields babel/babel#16852; @babel/types)
  • Performance: perf: Improve @babel/types builders (perf: Improve @babel/types builders babel/babel#16842; @babel/types)
  • Performance: Only access BABEL_TYPES_8_BREAKING at startup (Only access BABEL_TYPES_8_BREAKING at startup babel/babel#16828; @babel/types)
  • Grouped: internal 3 (internal or docs)
• 7.25.8
  • Bug Fix: Restore public API of resolvePlugin/resolvePreset (Restore public API of resolvePlugin/resolvePreset babel/babel#16888; @babel/core)
  • Grouped: internal 1 (internal or docs)
• 7.25.9
  • Bug Fix: fix: Keep type annotations in syntacticPlaceholders mode (fix: Keep type annotations in syntacticPlaceholders mode babel/babel#16905; @babel/parser, @babel/template, @babel/types)
  • Bug Fix: fix: support BROWSERSLIST{,_CONFIG} env (fix: support BROWSERSLIST{,_CONFIG} env babel/babel#16907; @babel/helper-compilation-targets)
  • Performance: perf: Make VISITOR_KEYS etc. faster to access (perf: Make VISITOR_KEYS etc. faster to access babel/babel#16918; @babel/parser, @babel/types)
• 7.26.0
  • New Feature: Enable import attributes parsing by default (Enable import attributes parsing by default babel/babel#16850; @babel/core, @babel/generator, @babel/parser, @babel/types)
  • New Feature: feat: support async plugin's pre/post (feat: support async plugin's pre/post babel/babel#16862; @babel/core)
  • New Feature: Add transform-regexp-modifiers to preset-env (Add transform-regexp-modifiers to preset-env babel/babel#16692; @babel/compat-data)
  • New Feature: feat: add startIndex parser option (feat: add startIndex parser option babel/babel#16849; @babel/parser)
  • New Feature: Always enable parsing of Flow enums (Always enable parsing of Flow enums babel/babel#16841; @babel/generator, @babel/parser)
  • New Feature: Support import() in rewriteImportExtensions (Support import() in rewriteImportExtensions babel/babel#16794; @babel/helpers)
  • New Feature: Add experimental format-preserving mode to @babel/generator (Add experimental format-preserving mode to @babel/generator babel/babel#16708; @babel/generator, @babel/parser)
  • Bug Fix: Workaround Node.js bug for parallel loading of TLA modules (Workaround Node.js bug for parallel loading of TLA modules babel/babel#16928; @babel/core)
  • Bug Fix: Fix loading of modules with TLA in Node.js 23 (Fix loading of modules with TLA in Node.js 23 babel/babel#16926; @babel/core)
  • Performance: perf: Improve module transforms (perf: Improve module transforms babel/babel#16882; @babel/helper-module-transforms)
  • Grouped: internal 2 (internal or docs)
• 7.26.1
  • Bug Fix: fix(parser): offset internal index locations by startIndex (fix(parser): offset internal index locations by startIndex babel/babel#16936; @babel/parser)
• 7.26.2
  • Bug Fix: fix: Parse placeholder for TS namespace (fix: Parse placeholder for TS namespace babel/babel#16903; @babel/parser)
  • Bug Fix: fix: Account for offsets when creating new Position instances (fix: Account for offsets when creating new Position instances babel/babel#16937; @babel/parser)
  • Bug Fix: Fix mapping of tokens with generated nodes in between (Fix mapping of tokens with generated nodes in between babel/babel#16948; @babel/generator)
• 7.26.3
  • Bug Fix: [preserveFormat] force semicolons when invalidating ASI ([preserveFormat] force semicolons when invalidating ASI babel/babel#16958; @babel/generator)
  • Performance: perf: Reduce the use of temporary objects (perf: Reduce the use of temporary objects babel/babel#16959; @babel/generator)
  • Performance: perf: Improve scope information collection performance (perf: Improve scope information collection performance babel/babel#16923; @babel/traverse)
  • Performance: perf: Avoid repeated traversal when creating scope (perf: Avoid repeated traversal when creating scope babel/babel#16964; @babel/traverse)
• 7.26.4
  • Revert: Revert "perf: Improve scope information collection performance" (Revert "perf: Improve scope information collection performance" babel/babel#17005; @babel/traverse)
• 7.26.5
  • Spec Compliance: Allow the dynamic import.defer() form of import defer (Allow the dynamic import.defer() form of import defer babel/babel#17011; @babel/parser)
  • Bug Fix: [estree] Unify method type parameters handling ([estree] Unify method type parameters handling babel/babel#17045; @babel/parser)
  • Bug Fix: fix: Correctly set position for @(a.b)() (fix: Correctly set position for @(a.b)() babel/babel#17013; @babel/parser)
  • Bug Fix: [estree] Adjust the start loc of class methods with type params ([estree] Adjust the start loc of class methods with type params babel/babel#16996; @babel/parser)
  • Bug Fix: Support flow jsx opening element type arguments (Support flow jsx opening element type arguments babel/babel#17028; @babel/generator, @babel/parser, @babel/types)
  • Bug Fix: fix: More accurate transform-typeof-symbol compat data (fix: More accurate transform-typeof-symbol compat data babel/babel#17031; @babel/compat-data)
  • Bug Fix: Fix incomplete visitor keys (Fix incomplete visitor keys babel/babel#17019; @babel/generator, @babel/parser, @babel/types)
• 7.26.6: no entries for these packages
• 7.26.7
  • Bug Fix: Make "object without properties" helpers ES6-compatible (Make "object without properties" helpers ES6-compatible babel/babel#17086; @babel/helpers)
  • Bug Fix: Respect ranges option in estree method value (Respect ranges option in estree method value babel/babel#17079; @babel/parser)
  • Bug Fix: Do not try to parse .ts configs as JSON if natively supported (Do not try to parse .ts configs as JSON if natively supported babel/babel#17052; @babel/core)
  • Bug Fix: fix: Remove type-only import x = y.z (fix: Remove type-only import x = y.z babel/babel#17025; @babel/traverse, @babel/types)
• 7.26.8: no entries for these packages
• 7.26.9
  • Bug Fix: fix: Definition for TSPropertySignature.kind (fix: Definition for TSPropertySignature.kind babel/babel#17103; @babel/types)
  • Bug Fix: Print TypeScript optional/definite in ClassPrivateProperty (Print TypeScript optional/definite in ClassPrivateProperty babel/babel#17062; @babel/generator, @babel/types)
  • Grouped: internal 2 (internal or docs)
• 7.26.10
  • Spec Compliance: Disallow decorator in array pattern (Disallow decorator in array pattern babel/babel#17159; @babel/parser)
  • Bug Fix: Fix: always initialize ExportDeclaration attributes (Fix: always initialize ExportDeclaration attributes babel/babel#17164; @babel/parser, @babel/template)
  • Bug Fix: fix: "Map maximum size exceeded" in deepClone (fix: "Map maximum size exceeded" in deepClone babel/babel#17142; @babel/core)
  • Bug Fix: Update typescript parser tests (Update typescript parser tests babel/babel#17154; @babel/parser)
  • Bug Fix: fix: Should not evaluate vars in child scope (fix: Should not evaluate vars in child scope babel/babel#17151; @babel/traverse)
  • Bug Fix: fix: Correctly generate abstract override (fix: Correctly generate abstract override babel/babel#17153; @babel/generator)
  • Bug Fix: Fix source type detection when parsing TypeScript (Fix source type detection when parsing TypeScript babel/babel#17107; @babel/parser)
  • Bug Fix: Fix processing of replacement pattern with named capture groups (Fix processing of replacement pattern with named capture groups babel/babel#17173; @babel/helpers)
  • Grouped: internal 1 (internal or docs)
• 7.27.0
  • Spec Compliance: Default importAttributesKeyword to with (Default importAttributesKeyword to with babel/babel#16977; @babel/generator, @babel/parser)
  • New Feature: Allow traverseFast to exit early (Allow traverseFast to exit early babel/babel#17169; @babel/traverse, @babel/types)
  • New Feature: Add ImportAttributes to Standardized and move its parser test fixtures (Add ImportAttributes to Standardized and move its parser test fixtures babel/babel#17110; @babel/parser, @babel/types)
  • New Feature: fix(babel-generator): add named export of generate function (fix(babel-generator): add named export of generate function babel/babel#17100; @babel/generator)
  • New Feature: Add allowYieldOutsideFunction to parser (Add allowYieldOutsideFunction to parser babel/babel#17149; @babel/parser, @babel/template)
  • New Feature: feat: Add upToScope parameter to hasBinding (feat: Add upToScope parameter to hasBinding babel/babel#17102; @babel/traverse)
  • New Feature: Support ESTree AccessorProperty (Support ESTree AccessorProperty babel/babel#17082; @babel/parser)
  • New Feature: feat(babel-types): Add support for BigInt literal conversion in valueToNode (feat(babel-types): Add support for BigInt literal conversion in valueToNode babel/babel#17162; @babel/types)
  • Bug Fix: fix: Reset child scopes when scope.crawl() (fix: Reset child scopes when scope.crawl() babel/babel#17170; @babel/traverse)
  • Bug Fix: Fix: align behaviour to tsc rewriteRelativeImportExtensions (Fix: align behaviour to tsc rewriteRelativeImportExtensions babel/babel#17118; @babel/helpers)
  • Bug Fix: Generate computed proto key (Generate computed proto key babel/babel#17175; @babel/types)
  • Performance: perf: Improve builders of @babel/types (perf: Improve builders of @babel/types babel/babel#16870; @babel/types)
• 7.27.1
  • Spec Compliance: Allow using of as lexical declaration within for (Allow using of as lexical declaration within for babel/babel#17254; @babel/parser)
  • Spec Compliance: Disallow get/set in TSPropertySignature (Disallow get/set in TSPropertySignature babel/babel#17230; @babel/parser)
  • Spec Compliance: Stricter TSImportType options parsing (Stricter TSImportType options parsing babel/babel#17193; @babel/parser, @babel/types)
  • Bug Fix: fix: do expressions should allow early exit (fix: do expressions should allow early exit babel/babel#17137; @babel/traverse)
  • Bug Fix: Create ChainExpression within TSInstantiationExpression (Create ChainExpression within TSInstantiationExpression babel/babel#17233; @babel/parser)
  • Bug Fix: Fill optional AST properties when both estree and typescript parser plugin are enabled (Part 2) (Fill optional AST properties when both estree and typescript parser plugin are enabled (Part 2) babel/babel#17226; @babel/generator, @babel/parser)
  • Bug Fix: Fill optional AST properties when both estree and typescript parser plugin are enabled (Part 1) (Fill optional AST properties when both estree and typescript parser plugin are enabled (Part 1) babel/babel#17224; @babel/parser)
  • Bug Fix: Fix start of TSParameterProperty (Fix start of TSParameterProperty babel/babel#17080; @babel/parser)
  • Bug Fix: Update firefox bugfix compat data (Update firefox bugfix compat data babel/babel#17228; @babel/compat-data)
  • Bug Fix: fix: Objects and arrays with multiple references should not be evaluated (fix: Objects and arrays with multiple references should not be evaluated babel/babel#17156; @babel/traverse)
  • Bug Fix: Fix: support const type parameter in generator (Fix: support const type parameter in generator babel/babel#17216; @babel/generator)
  • Polish: Reduce generated names size for the 10th-11th (Reduce generated names size for the 10th-11th babel/babel#17221; @babel/traverse)
  • Output optimization: Reduce interopRequireWildcard size (Reduce interopRequireWildcard size babel/babel#16538; @babel/helpers)
  • Output optimization: Reduce regeneratorRuntime size (Reduce regeneratorRuntime size babel/babel#17213; @babel/helpers)
  • Grouped: internal 4 (internal or docs)
• 7.27.2
  • Bug Fix: fix: @babel/parser/bin/index.js contains node: protocol require (fix: @babel/parser/bin/index.js contains node: protocol require babel/babel#17289; @babel/parser)
  • Bug Fix: fix: Private class method not found when TS and estree (fix: Private class method not found when TS and estree babel/babel#17291; @babel/parser)
  • Bug Fix: fix(babel-template): Properly handle empty string replacements (fix(babel-template): Properly handle empty string replacements babel/babel#17284; @babel/template)
• 7.27.3
  • Bug Fix: Improve multiline comments handling in yield/await expression (Improve multiline comments handling in yield/await expression babel/babel#17324; @babel/generator)
  • Bug Fix: Correctly set .displayName on GeneratorFunction (Correctly set .displayName on GeneratorFunction babel/babel#17328; @babel/helpers)
  • Bug Fix: fix(converter): Remove abstract modifiers in class declaration to expression conversion (fix(converter): Remove abstract modifiers in class declaration to expression conversion babel/babel#17321; @babel/types)
  • Bug Fix: Preserve class id when transforming using declarations with exported class (Preserve class id when transforming using declarations with exported class babel/babel#17257; @babel/helper-module-transforms)
  • Bug Fix: fix(parser): properly handle optional markers in generator class methods (fix(parser): properly handle optional markers in generator class methods babel/babel#17312; @babel/parser)
  • Bug Fix: fix(parser): Terminate modifier parsing at newline (fix(parser): Terminate modifier parsing at newline babel/babel#17307; @babel/parser)
  • Bug Fix: Improve import phase parsing (Improve import phase parsing babel/babel#17308; @babel/generator, @babel/parser)
• 7.27.4
  • Spec Compliance: Disallow using in bare case statement (Disallow using in bare case statement babel/babel#17323; @babel/parser)
  • Polish: Improve parseExpression error messages (Improve parseExpression error messages babel/babel#17311; @babel/parser)
  • Output optimization: Reduce regenerator size more (Reduce regenerator size more babel/babel#17287; @babel/helpers)
  • Output optimization: Use shorter method names for regenerator context (Use shorter method names for regenerator context babel/babel#17334; @babel/helpers)
  • Output optimization: Reduce regenerator helper size (Reduce regenerator helper size babel/babel#17268; @babel/helpers)
  • Output optimization: Split regeneratorRuntime into multiple helpers (Split regeneratorRuntime into multiple helpers babel/babel#17238; @babel/core, @babel/helpers)
• 7.27.5
  • Polish: Improve using declaration errors (Improve using declaration errors babel/babel#17333; @babel/parser)
• 7.27.6
  • Bug Fix: fix: finally causes unexpected return value (fix: finally causes unexpected return value babel/babel#17366; @babel/helpers)
  • Bug Fix: Ensure syntactic ordering when visiting array-type AST nodes (Ensure syntactic ordering when visiting array-type AST nodes babel/babel#17357; @babel/generator, @babel/parser, @babel/types)
• 7.27.7
  • Spec Compliance: Interepret parser allow* options as top level only (Interepret parser allow* options as top level only babel/babel#17203; @babel/parser)
  • Spec Compliance: fix: disable using in ambient context (fix: disable using in ambient context babel/babel#17371; @babel/parser)
  • Bug Fix: Improve TS babel config loading (Improve TS babel config loading babel/babel#17392; @babel/core)
  • Bug Fix: fix: support negative bigint in valueToNode (fix: support negative bigint in valueToNode babel/babel#17376; @babel/types)
• 7.28.0
  • New Feature: feat(matchesPattern): support super/private/meta (feat(matchesPattern): support super/private/meta babel/babel#17258; @babel/types)
  • New Feature: Add explicit resource management to preset-env (Add explicit resource management to preset-env babel/babel#17355; @babel/compat-data)
  • New Feature: Support sourceType: "commonjs" (Support sourceType: "commonjs" babel/babel#17390; @babel/core, @babel/parser)
  • New Feature: Materialize explicitResourceManagement parser plugin (Materialize explicitResourceManagement parser plugin babel/babel#17346; @babel/generator, @babel/parser)
  • New Feature: LVal coverage updates (Part 2) (LVal coverage updates (Part 2) babel/babel#17391; @babel/traverse, @babel/types)
  • New Feature: Accept bigints in t.bigIntLiteral factory (Accept bigints in t.bigIntLiteral factory babel/babel#17378; @babel/parser, @babel/traverse, @babel/types)
  • New Feature: Transform discard binding (Transform discard binding babel/babel#17277; @babel/generator, @babel/types)
  • New Feature: Parse discard binding (Parse discard binding babel/babel#17163; @babel/generator, @babel/parser, @babel/traverse, @babel/types)
  • Bug Fix: Create babel-helper-globals (Create babel-helper-globals babel/babel#17297; @babel/helper-globals, @babel/traverse)
  • Bug Fix: feature: TSTypeOperator: keyof ([Bug]: TSTypeQuery ignores second argument: operator babel/babel#16799) (feature: TSTypeOperator: keyof (#16799) babel/babel#17009; @babel/types)
  • Grouped: internal 1 (internal or docs)
• 7.28.1
  • Revert: Do not mark OptionalMemberExpresion as LVal (Do not mark OptionalMemberExpresion as LVal babel/babel#17432; @babel/types)
  • Grouped: documentation 1 (internal or docs)
• 7.28.2
  • Bug Fix: [babel 7] Make operator param in t.tsTypeOperator optional ([babel 7] Make operator param in t.tsTypeOperator optional babel/babel#17445; @babel/types)
  • Bug Fix: fix: regeneratorDefine compatibility with es5 strict mode (fix: regeneratorDefine compatibility with es5 strict mode babel/babel#17441; @babel/helpers)
• 7.28.3
  • Bug Fix: fix(parser/typescript): parse import("./a", {with:{},}) (fix(parser/typescript): parse import("./a", {with:{},}) babel/babel#17465; @babel/parser)
  • Bug Fix: fix(parser): stop subscript parsing on async arrow (fix(parser): stop subscript parsing on async arrow babel/babel#17478; @babel/parser)
• 7.28.4
  • Grouped: internal 2 (internal or docs)
• 7.28.5
  • Spec Compliance: Allow Runtime Errors for Function Call Assignment Targets (Allow Runtime Errors for Function Call Assignment Targets babel/babel#17446; @babel/parser)
  • Spec Compliance: fix: update identifier to unicode 17 (fix: update identifier to unicode 17 babel/babel#17501; @babel/helper-validator-identifier)
  • Bug Fix: Improve @babel/parser error typing (Improve @babel/parser error typing babel/babel#17521; @babel/parser)
  • Bug Fix: fix: improve ts-only declaration parsing (fix: improve ts-only declaration parsing babel/babel#17491; @babel/parser)
  • Bug Fix: Fix JSXIdentifier handling in isReferencedIdentifier (Fix JSXIdentifier handling in isReferencedIdentifier babel/babel#17503; @babel/traverse, @babel/types)
  • Bug Fix: fix: ensure scope.push register in anonymous fn (fix: ensure scope.push register in anonymous fn babel/babel#17504; @babel/traverse)
  • Performance: Faster finding of locations in buildCodeFrameError (Faster finding of locations in buildCodeFrameError babel/babel#17490; @babel/core)
  • Grouped: internal 1 (internal or docs)
• 7.28.6
  • Bug Fix: Improve Unicode handling in code-frame tokenizer (Improve Unicode handling in code-frame tokenizer babel/babel#17589; @babel/code-frame, @babel/core, @babel/traverse, @babel/types)
  • Polish: Polish(standalone): improve message on invalid preset/plugin (Polish(standalone): improve message on invalid preset/plugin babel/babel#17606; @babel/core)
• 7.29.0
  • New Feature: [7.x backport] Add attributes import declaration builder ([7.x backport] Add attributes import declaration builder babel/babel#17750; @babel/types)
  • Bug Fix: fix(parser): correctly parse type assertions in extends clause (fix(parser): correctly parse type assertions in extends clause babel/babel#17765; @babel/parser)
  • Bug Fix: [7.x backport] fix(parser): improve super type argument parsing ([7.x backport] fix(parser): improve super type argument parsing babel/babel#17723; @babel/parser)
  • Bug Fix: fix(traverse): provide a hub when traversing a File or Program and no parentPath is given (fix(traverse): provide a hub when traversing a File or Program and no parentPath is given babel/babel#17708; @babel/traverse)
  • Bug Fix: [7.x backport] fix: Rename switch discriminant references when body creates shadowing variable ([7.x backport] fix: Rename switch discriminant references when body creates shadowing variable babel/babel#17737; @babel/traverse)
  • Performance: [Babel 7] Improve generator performance ([Babel 7] Improve generator performance babel/babel#17642; @babel/generator)
• 7.29.1
  • Bug Fix: [7.x backport] Fix undefined when 64 indents ([7.x backport] Fix undefined when 64 indents babel/babel#17776; @babel/generator)
• 7.29.2
  • Spec Compliance: [7.x backport] async x => {} must be in leading pos ([7.x backport] async x => {} must be in leading pos babel/babel#17840; @babel/parser)
  • Bug Fix: [7.x backport] fix: Properly handle await in finally ([7.x backport] fix: Properly handle await in finally babel/babel#17805; @babel/helpers)
• 7.29.3
  • Spec Compliance: Support flow extends bound (Support flow extends bound babel/babel#17923; @babel/parser)
  • Bug Fix: Add bugfix plugin for Safari array rest destructuring bug (Add bugfix plugin for Safari array rest destructuring bug babel/babel#17788; @babel/compat-data)
  • Polish: Improve trailing comma comment handling (Improve trailing comma comment handling babel/babel#17782; @babel/parser)
• 7.29.4: no entries for these packages
• 7.29.5: no entries for these packages
• 7.29.6
  • Bug Fix: Catchup source map position in preserveFormat (Catchup source map position in preserveFormat babel/babel#18014; @babel/generator)
  • Bug Fix: [7.x packport]Improve input source map handling ([7.x packport]Improve input source map handling babel/babel#18001; @babel/core)
  • Bug Fix: Preserve original identifier names from input sourcemaps (Preserve original identifier names from input sourcemaps babel/babel#17992) (Preserve original identifier names from input sourcemaps (#17992) babel/babel#17998; @babel/core, @babel/generator)
• 7.29.7: provenance re-release, no other entries for these packages
• 7.29.8 (@babel/generator, @babel/parser, @babel/traverse, @babel/types)
  • Spec Compliance: disallow a super call after new (Disallow super call after new babel/babel#17871)
  • Bug Fix: improve the parentheses check for new callees in the generator
• 7.29.9 (@babel/parser)
  • Bug Fix: parse arrow function parameters inside ternaries with Flow
• 7.29.10 (@babel/traverse, @babel/helpers)
  • Bug Fix: path.evaluate no longer evaluates destructured bindings (fix(traverse): do not evaluate destructured bindings in path.evaluate babel/babel#18281)
  • Bug Fix: guard @@toPrimitive usage in the toPrimitive helper
  • Internal: simplify the interopRequireWildcard helper
• 7.29.11 (@babel/parser, @babel/types)
  • Spec Compliance (5 parser entries): disallow eval and arguments as class names, const x followed by a line break and of, named specifiers after * as ns, delete (x) with createParenthesizedExpressions: true, and call expressions as arrow function parameters in sloppy mode
  • Bug Fix (6 parser entries): ASI between an arrow body and a /= regex, ASI after export default from without exportDefaultFrom, ASI between a property initializer and an escaped in, arguments as a label in a class, skipping HTML-like comments in the character lookahead, and registering the function id of labeled function declarations
  • Bug Fix: @babel/types visits the decorators of TSParameterProperty

Breaking Changes

None

Code Changes Required

None. Only package-lock.json changes; package.json and the code are unchanged.

Summary by CodeRabbit

• Chores
  • This update contains no changes to user-facing features or behavior. There are no new capabilities, bug fixes, or interface changes to highlight in the release notes.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: 2db9e145-4c8d-4a9d-adcb-45d436e4a40c

Commits

Reviewing files that changed from the base of the PR and between a60b259 and fa5b475.

Files selected for processing: 1

• package-lock.json

Included review availability: This review used your included allowance. Your plan provides up to 5 included reviews per hour; 3 remain after this review.

Walkthrough

The lockfile updates Babel, source-map, browser-data, npm, and related dependency records. It adds and removes dependency entries and adjusts package versions, requirements, and metadata.

Changes: Dependency lockfile refresh

Layer / File(s)	Summary
Babel and source-map dependency graph package-lock.json	Babel and source-map package records and dependency requirements are updated. The graph adds @babel/helper-globals and @jridgewell/remapping, and removes entries including @ampproject/remapping and @jridgewell/set-array.
Browser data and related packages package-lock.json	Browser-data packages, brace-expansion, jsesc, and other dependency records receive version or metadata updates.
npm and bundled dependencies package-lock.json	npm changes from 11.18.0 to 11.21.1. Its dependency requirements and bundled package records are updated.

Priority: Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: semantic-release-bot

Merge Risk: Minimal · up to fa5b4

No actionable regression from this lockfile update remains identified; it is mergeable after normal checks.

Pre-merge checks: 6

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title begins with the allowed prefix "refactor:" and uses a capitalized first word. It accurately describes the dependency version updates in the pull request.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Security Check		The pull request changes only package-lock.json. The root dependencies and devDependency declarations remain unchanged. All changed packages are marked dev-only, and resolved artifacts use the npm reg…
Engage In Review Feedback		No review feedback required engagement. The supplied review data reports no returned review threads and zero actionable findings in the current review.

Full details: Security Check

Explanation

The pull request changes only package-lock.json. The root dependencies and devDependency declarations remain unchanged. All changed packages are marked dev-only, and resolved artifacts use the npm registry with integrity hashes. Security-relevant versions increase, including @babel/core 7.24.8→7.29.7, brace-expansion 5.0.7→5.0.12, and npm 11.18.0→11.21.1. Bundled npm copies also update undici, ip-address, postcss-selector-parser, http-cache-semantics, and tar. No new install-script flag, non-registry source, or application code pattern was introduced.

Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}