Repository navigation
sec(frontend): upgrade @babel/core past 7.29.0 to fix GHSA-4x5r-pxfx-6jf8 (arbitrary file read) #1270
Description
Summary
After PR #872 pinned `@babel/core` to `7.28.5` (matching the existing lockfile), `npm audit` reports:
GHSA-4x5r-pxfx-6jf8 — @babel/core: Arbitrary File Read via sourceMappingURL Comment
Affected: <=7.29.0
Fix: upgrade to 7.29.7+
The fix requires `--force` because 7.29.7 is outside the range `^7.23.0` the project previously used (but the range constraint was the old package.json; after #872 the version is pinned). The fix is: update `@babel/core`, `@babel/preset-env`, `@babel/preset-typescript` to `>=7.29.7` in both `package.json` and run `npm install` to regenerate `package-lock.json`.
Note: this CVE was present in `main`'s lockfile before #872; it is NOT introduced by #872.
Steps
npm install @babel/core@^7.29.7 @babel/preset-env@^7.29.7 @babel/preset-typescript@^7.29.7 --save-dev- Pin the new resolved versions (exact) in
package.jsonto maintain supply-chain discipline from sec(frontend): pin npm dependencies to exact versions (closes #425) #872. - Run
npm testto confirm no breakage.
Activity
cristim commentedon Jul 27, 2026
Verification sweep against
main(101f099fb) on 2026-07-27 finds this already resolved.@babel/core is pinned to 7.29.7, past the fix version for GHSA-4x5r-pxfx-6jf8.
Evidence: commit d29a3e0 (PR #872).
Recommending close.
cristim commentedon Sep 2, 2026
Verified resolved at 3c0f8ac: @babel/core is pinned to 7.29.7 in package.json and the lockfile resolves only that version, which is past the GHSA-4x5r-pxfx-6jf8 fix (7.29.7+). Evidence: frontend/package.json:19, frontend/package-lock.json:80 (#872 commit d29a3e0). Residual axes checked: no nested second @babel/core in the lockfile; @babel/preset-env and @babel/preset-typescript stay at 7.28.5 but are not affected by this advisory. Closing as completed; reopen if the behaviour recurs.