chore(deps): update dependency @babel/traverse to v7.23.2 [security] by renovate[bot] · Pull Request #1206 · quirrel-dev/quirrel

renovate · 2026-08-29T20:17:43Z

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@babel/traverse (source)	`7.19.4` → `7.23.2`

Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code

CVE-2023-45133 / GHSA-67hx-6x53-jw92

More information

Details

Impact

Using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the path.evaluate()or path.evaluateTruthy() internal Babel methods.

Known affected plugins are:

@babel/plugin-transform-runtime
@babel/preset-env when using its useBuiltIns option
Any "polyfill provider" plugin that depends on @babel/helper-define-polyfill-provider, such as babel-plugin-polyfill-corejs3, babel-plugin-polyfill-corejs2, babel-plugin-polyfill-es-shims, babel-plugin-polyfill-regenerator

No other plugins under the @babel/ namespace are impacted, but third-party plugins might be.

Users that only compile trusted code are not impacted.

Patches

The vulnerability has been fixed in @babel/traverse@7.23.2.

Babel 6 does not receive security fixes anymore (see Babel's security policy), hence there is no patch planned for babel-traverse@6.

Workarounds

Upgrade @babel/traverse to v7.23.2 or higher. You can do this by deleting it from your package manager's lockfile and re-installing the dependencies. @babel/core >=7.23.2 will automatically pull in a non-vulnerable version.
If you cannot upgrade @babel/traverse and are using one of the affected packages mentioned above, upgrade them to their latest version to avoid triggering the vulnerable code path in affected @babel/traverse versions:
- @babel/plugin-transform-runtime v7.23.2
- @babel/preset-env v7.23.2
- @babel/helper-define-polyfill-provider v0.4.3
- babel-plugin-polyfill-corejs2 v0.4.6
- babel-plugin-polyfill-corejs3 v0.8.5
- babel-plugin-polyfill-es-shims v0.10.0
- babel-plugin-polyfill-regenerator v0.5.3

Severity

CVSS Score: 9.3 / 10 (Critical)
Vector String: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

babel/babel (@babel/traverse)

`v7.23.2`

Compare Source

v7.23.2 (2023-10-11)

NOTE: This release also re-publishes @babel/core, even if it does not appear in the linked release commit.

Thanks @jimmydief for your first PR!

🐛 Bug Fix

babel-traverse
- #16033 Only evaluate own String/Number/Math methods (@nicolo-ribaudo)
babel-preset-typescript
- #16022 Rewrite .tsx extension when using rewriteImportExtensions (@jimmydief)
babel-helpers
- #16017 Fix: fallback to typeof when toString is applied to incompatible object (@JLHwung)
babel-helpers, babel-plugin-transform-modules-commonjs, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
- #16025 Avoid override mistake in namespace imports (@nicolo-ribaudo)

Committers: 5

Babel Bot (@babel-bot)
Huáng Jùnliàng (@JLHwung)
James Diefenderfer (@jimmydief)
Nicolò Ribaudo (@nicolo-ribaudo)
@liuxingbaoyu

`v7.23.0`

Compare Source

v7.23.0 (2023-09-25)

Thanks @lorenzoferre and @RajShukla1 for your first PRs!

🚀 New Feature

babel-plugin-proposal-import-wasm-source, babel-plugin-syntax-import-source, babel-plugin-transform-dynamic-import
- #15870 Support transforming import source for wasm (@nicolo-ribaudo)
babel-helper-module-transforms, babel-helpers, babel-plugin-proposal-import-defer, babel-plugin-syntax-import-defer, babel-plugin-transform-modules-commonjs, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime, babel-standalone
- #15878 Implement import defer proposal transform support (@nicolo-ribaudo)
babel-generator, babel-parser, babel-types
- #15845 Implement import defer parsing support (@nicolo-ribaudo)
- #15829 Add parsing support for the "source phase imports" proposal (@nicolo-ribaudo)
babel-generator, babel-helper-module-transforms, babel-parser, babel-plugin-transform-dynamic-import, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-systemjs, babel-traverse, babel-types
- #15682 Add createImportExpressions parser option (@JLHwung)
babel-standalone
- #15671 Pass through nonce to the transformed script element (@JLHwung)
babel-helper-function-name, babel-helper-member-expression-to-functions, babel-helpers, babel-parser, babel-plugin-proposal-destructuring-private, babel-plugin-proposal-optional-chaining-assign, babel-plugin-syntax-optional-chaining-assign, babel-plugin-transform-destructuring, babel-plugin-transform-optional-chaining, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime, babel-standalone, babel-types
- #15751 Add support for optional chain in assignments (@nicolo-ribaudo)
babel-helpers, babel-plugin-proposal-decorators
- #15895 Implement the "decorator metadata" proposal (@nicolo-ribaudo)
babel-traverse, babel-types
- #15893 Add t.buildUndefinedNode (@liuxingbaoyu)
babel-preset-typescript
- #15913 Add rewriteImportExtensions option to TS preset (@nicolo-ribaudo)
babel-parser
- #15896 Allow TS tuples to have both labeled and unlabeled elements (@yukukotani)

🐛 Bug Fix

babel-plugin-transform-block-scoping
- #15962 fix: transform-block-scoping captures the variables of the method in the loop (@liuxingbaoyu)

💅 Polish

babel-traverse
- #15797 Expand evaluation of global built-ins in @babel/traverse (@lorenzoferre)
babel-plugin-proposal-explicit-resource-management
- #15985 Improve source maps for blocks with using declarations (@nicolo-ribaudo)

🔬 Output optimization

babel-core, babel-helper-module-transforms, babel-plugin-transform-async-to-generator, babel-plugin-transform-classes, babel-plugin-transform-dynamic-import, babel-plugin-transform-function-name, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-umd, babel-plugin-transform-parameters, babel-plugin-transform-react-constant-elements, babel-plugin-transform-react-inline-elements, babel-plugin-transform-runtime, babel-plugin-transform-typescript, babel-preset-env
- #15984 Inline exports.XXX = update in simple variable declarations (@nicolo-ribaudo)

Committers: 7

Babel Bot (@babel-bot)
Huáng Jùnliàng (@JLHwung)
Lorenzo Ferretti (@lorenzoferre)
Nicolò Ribaudo (@nicolo-ribaudo)
Raj Pawan Shukla (@RajShukla1)
Yuku Kotani (@yukukotani)
@liuxingbaoyu

`v7.22.20`

Compare Source

v7.22.20 (2023-09-16)

🏠 Internal

babel-helper-validator-identifier
- #15973 Remove special-casing of U+200C and U+200D (@nicolo-ribaudo)
babel-plugin-transform-dotall-regex
- #15974 Update Unicode test fixtures (@JLHwung)

↩️ Revert

babel-helper-remap-async-to-generator, babel-helper-wrap-function, babel-plugin-proposal-explicit-resource-management, babel-plugin-proposal-function-sent, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-class-properties, babel-plugin-transform-classes, babel-plugin-transform-parameters, babel-plugin-transform-runtime, babel-preset-env
- #15979 Revert "Improve output when wrapping functions" (@jjonescz)

Committers: 3

Huáng Jùnliàng (@JLHwung)
Jan Jones (@jjonescz)
Nicolò Ribaudo (@nicolo-ribaudo)

`v7.22.19`

Compare Source

v7.22.19 (2023-09-14)

Re-published 7.22.18, due to a releasing error.

`v7.22.18`

Compare Source

v7.22.18 (2023-09-14)

NOTE: This release had a publishing problem -- it has been re-published as 7.22.19.

Thanks @dhlolo for your first PR!

🐛 Bug Fix

babel-helper-validator-identifier
- #15957 Update identifier name definitions to Unicode 15.1 (@JLHwung)
babel-helper-module-transforms, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-umd
- #15898 Fix transform of named import with shadowed namespace import (@dhlolo)

↩️ Revert

#15965 Revert Node.js 20.6.0 bug workaround (@nicolo-ribaudo)

Committers: 3

Huáng Jùnliàng (@JLHwung)
Int (@dhlolo)
Nicolò Ribaudo (@nicolo-ribaudo)

`v7.22.17`

Compare Source

v7.22.17 (2023-09-08)

Thanks @jordanbtucker for your first PR!

🐛 Bug Fix

babel-core
- #15947 Fix compatibility with Node.js 20.6 (@nicolo-ribaudo)
babel-helper-module-transforms, babel-plugin-transform-modules-commonjs
- #15941 Fix compiling duplicate ns imports to lazy CommonJS (@nicolo-ribaudo)
babel-types
- #15920 Make ClassDeclaration["id"] optional in babel-types (@jordanbtucker)

🔬 Output optimization

babel-helper-remap-async-to-generator, babel-helper-wrap-function, babel-plugin-proposal-explicit-resource-management, babel-plugin-proposal-function-sent, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-class-properties, babel-plugin-transform-classes, babel-plugin-transform-parameters, babel-plugin-transform-runtime, babel-preset-env
- #15922 Improve output when wrapping functions (e.g. async functions) (@liuxingbaoyu)

Committers: 3

Jordan Tucker (@jordanbtucker)
Nicolò Ribaudo (@nicolo-ribaudo)
@liuxingbaoyu

`v7.22.15`

Compare Source

v7.22.15 (2023-09-04)

🐛 Bug Fix

babel-core
- #15923 Only perform config loading re-entrancy check for cjs (@nicolo-ribaudo)

🏠 Internal

Every package
- #15892 Add explicit .ts/.js extension to all imports in src (@nicolo-ribaudo)

Committers: 4

Babel Bot (@babel-bot)
Huáng Jùnliàng (@JLHwung)
Nicolò Ribaudo (@nicolo-ribaudo)
@liuxingbaoyu

`v7.22.11`

Compare Source

v7.22.11 (2023-08-24)

Thanks @0o001 and @yangguansen for your first PRs!

🐛 Bug Fix

babel-plugin-transform-typescript
- #15882 Fix: fully remove TS nested type-only exported namespaces (@yangguansen)
babel-types
- #15867 fix: definition of TS function type params (@danez)
babel-plugin-transform-async-generator-functions, babel-plugin-transform-class-static-block, babel-plugin-transform-dynamic-import, babel-plugin-transform-export-namespace-from, babel-plugin-transform-json-strings, babel-plugin-transform-logical-assignment-operators, babel-plugin-transform-nullish-coalescing-operator, babel-plugin-transform-numeric-separator, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-catch-binding, babel-plugin-transform-optional-chaining, babel-plugin-transform-private-property-in-object
- #15858 fix(standalone): strip archived syntax plugins (@JLHwung)
babel-core
- #15850 Support configuring cache in ESM configs (@nicolo-ribaudo)

🏠 Internal

babel-parser
- #10940 Do not record trailing comma pos when maybeAsyncArrow: false (@JLHwung)
babel-core, babel-helper-compilation-targets, babel-parser, babel-plugin-proposal-destructuring-private, babel-plugin-syntax-decorators, babel-preset-env, babel-preset-react, babel-register, babel-traverse, babel-types
- #15872 enable jest/no-standalone-expect (@JLHwung)
babel-core, babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-modules-commonjs, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
- #15833 bump json5, terser and webpack, further minimize babel helpers (@JLHwung)
Other
- #15846 Use Babel 8.0 alpha to build babel (@JLHwung)
- #15856 Exclude redundant files from publish process (@JLHwung)

🔬 Output optimization

babel-plugin-bugfix-v8-spread-parameters-in-optional-chaining, babel-plugin-transform-class-properties, babel-plugin-transform-classes, babel-plugin-transform-optional-chaining, babel-preset-env
- #15871 Simplify ?. output when chain result is ignored (@nicolo-ribaudo)

Committers: 7

Babel Bot (@babel-bot)
Daniel Tschinder (@danez)
Huáng Jùnliàng (@JLHwung)
Mustafa Ateş Uzun (@0o001)
Nicolò Ribaudo (@nicolo-ribaudo)
@liuxingbaoyu
sanmu (@yangguansen)

`v7.22.10`

Compare Source

v7.22.10 (2023-08-07)

Thanks @DimitriPapadopoulos, @FabianWarnecke, @JoshuaKGoldberg, and @YYvanYang for your first pull requests!

🐛 Bug Fix

babel-plugin-transform-typescript
- #15799 [ts] Strip type-only namespaces (@nicolo-ribaudo)
- #15798 [ts] Fix compiling extended exported nested namespace (@nicolo-ribaudo)
babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators, babel-plugin-proposal-destructuring-private, babel-plugin-transform-class-properties, babel-plugin-transform-class-static-block, babel-plugin-transform-new-target, babel-plugin-transform-private-methods, babel-preset-env
- #15701 Memoize class binding when compiling private methods and static elements (@JLHwung)

💅 Polish

babel-cli
- #15824 Add meta object to @babel/eslint-plugin (@JLHwung)
babel-traverse, babel-types
- #15661 Improve the type definition of path.isX (@liuxingbaoyu)
babel-generator, babel-types
- #15776 improve SourceLocation typing (@JLHwung)

🏠 Internal

Other
- #15818 build: generate flow typings in prepublish job (@JLHwung)
- #15777 chore: bump dev dependencies and remove .eslintignore (@JLHwung)
babel-cli, babel-core, babel-generator, babel-helper-builder-react-jsx, babel-preset-env, babel-standalone
- #15794 Enable @typescript-eslint/no-redundant-type-constituents rule (@JLHwung)
babel-helper-compilation-targets
- #15811 Remove @babel/core peerDep from helper-compilation-targets (@nicolo-ribaudo)
babel-parser
- #15793 Use const enum in babel-parser (@JLHwung)
babel-plugin-transform-runtime, babel-traverse, babel-types
- #15716 chore: Use typescript-eslint@v6 with reworked configs (@JoshuaKGoldberg)

🔬 Output optimization

babel-plugin-transform-block-scoping, babel-plugin-transform-parameters, babel-plugin-transform-regenerator
- #15746 Reduce transform-block-scoping loops output size (@liuxingbaoyu)

Committers: 9

Babel Bot (@babel-bot)
Dimitri Papadopoulos Orfanos (@DimitriPapadopoulos)
Huáng Jùnliàng (@JLHwung)
Josh Goldberg ✨ (@JoshuaKGoldberg)
Nicolò Ribaudo (@nicolo-ribaudo)
Tianlan Zhou (@SuperSodaSea)
@FabianWarnecke
@YYvanYang
@liuxingbaoyu

`v7.22.8`

Compare Source

v7.22.8 (2023-07-06)

This release reverts a commit that caused all new angular installations to fail: angular/angular-cli#25496

↩️ Revert

babel-core, babel-traverse
- #15754 Revert "Use NodePath#hub as part of the paths cache key" (@nicolo-ribaudo)

Committers: 1

Nicolò Ribaudo (@nicolo-ribaudo)

`v7.22.7`

Compare Source

v7.22.7 (2023-07-06)

🐛 Bug Fix

babel-generator
- #15719 fix: Avoid internally generating negative source maps columns (@liuxingbaoyu)
babel-core, babel-traverse
- #15725 Use NodePath#hub as part of the paths cache key (@nicolo-ribaudo)
Other
- #15747 fix: export meta from eslint-parser/experimental-worker (@JLHwung)

🏠 Internal

babel-core, babel-traverse
- #15702 Refactor visitors merging (@nullableVoidPtr)

Committers: 4

Avery (@nullableVoidPtr)
Huáng Jùnliàng (@JLHwung)
Nicolò Ribaudo (@nicolo-ribaudo)
@liuxingbaoyu

`v7.22.6`

Compare Source

v7.22.6 (2023-07-04)

🐛 Bug Fix

babel-compat-data, babel-helper-compilation-targets, babel-preset-env
- #15727 Add opera mobile compat data (@JLHwung)
babel-plugin-transform-optional-chaining
- #15739 Fix transform of delete a?.b in function params (@nicolo-ribaudo)
babel-helper-split-export-declaration, babel-plugin-transform-modules-commonjs
- #15736 fix: Default export for duplicate names (@liuxingbaoyu)
babel-compat-data, babel-preset-env
- #15726 update compat-data sources (@JLHwung)
babel-helpers, babel-plugin-proposal-explicit-resource-management, babel-runtime-corejs3, babel-runtime
- #15705 Fix handling of sync error in @@asyncDispose (@nicolo-ribaudo)
babel-standalone
- #15707 fix: Support transforming Explicit Resource Management in stage-2 (@liuxingbaoyu)
babel-core
- #15626 fix: Works correctly with --frozen-intrinsics (@liuxingbaoyu)

🏠 Internal

babel-helper-create-class-features-plugin, babel-plugin-transform-classes
- #15700 Minor class transform cleanups (@JLHwung)

🔬 Output optimization

babel-plugin-bugfix-v8-spread-parameters-in-optional-chaining, babel-plugin-transform-class-properties, babel-plugin-transform-optional-chaining, babel-plugin-transform-typescript
- #15740 Compress output for optional chain with multiple ?. (@nicolo-ribaudo)
babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-plugin-proposal-pipeline-operator, babel-plugin-transform-class-properties, babel-plugin-transform-nullish-coalescing-operator, babel-plugin-transform-optional-chaining, babel-plugin-transform-private-property-in-object, babel-traverse
- #15741 Inject tmp vars in the params list of IIFEs when possible (@nicolo-ribaudo)

Committers: 5

Babel Bot (@babel-bot)
Huáng Jùnliàng (@JLHwung)
Joe Maffei (@joemaffei)
Nicolò Ribaudo (@nicolo-ribaudo)
@liuxingbaoyu

`v7.22.5`

Compare Source

v7.22.5 (2023-06-08)

🐛 Bug Fix

babel-preset-env, babel-standalone
- #15675 Fix using syntax-unicode-sets-regex in standalone (@nicolo-ribaudo)

💅 Polish

babel-core
- #15683 Suggest -transform- when resolving missing plugins (@nicolo-ribaudo)

Committers: 4

Avery (@nullableVoidPtr)
Babel Bot (@babel-bot)
Nicolò Ribaudo (@nicolo-ribaudo)
@liuxingbaoyu

`v7.22.4`

Compare Source

v7.22.4 (2023-05-29)

🐛 Bug Fix

babel-traverse
- #15649 Set shorthand: false when renaming an identifier inside an object property (@coderaiser)

🏠 Internal

babel-types
- #15666 Add missing attributes/assertions to VISITOR_KEYS (@nicolo-ribaudo)
babel-parser
- #15667 Mark assert attributes with extra.deprecatedAssertSyntax (@nicolo-ribaudo)

Committers: 3

Huáng Jùnliàng (@JLHwung)
Nicolò Ribaudo (@nicolo-ribaudo)
coderaiser (@coderaiser)

`v7.22.1`

Compare Source

v7.22.1 (2023-05-26)

🐛 Bug Fix

babel-preset-env
- #15658 Workaround for broken babel-preset-react-app (@nicolo-ribaudo)

Committers: 2

Nicolò Ribaudo (@nicolo-ribaudo)
@liuxingbaoyu

`v7.22.0`

Compare Source

v7.22.0 (2023-05-26)

🚀 New Feature

babel-parser, babel-plugin-transform-typescript
- #15497 [ts] Support import ... = and export = in scripts (@nicolo-ribaudo)
babel-compat-data, babel-core, babel-plugin-proposal-unicode-sets-regex, babel-plugin-transform-unicode-sets-regex, babel-preset-env, babel-standalone
- #15636 Add unicode-sets-regex transform to preset-env (@JLHwung)
babel-helpers, babel-plugin-proposal-explicit-resource-management, babel-plugin-transform-runtime, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime, babel-standalone
- #15633 Implement transform support for using declarations (@nicolo-ribaudo)
babel-plugin-proposal-import-attributes-to-assertions
- #15620 Create @babel/plugin-proposal-import-attributes-to-assertions (@nicolo-ribaudo)
babel-core, babel-generator, babel-parser, babel-plugin-syntax-import-attributes, babel-preset-env, babel-standalone, babel-types
- #15536 Add support for the updated import attributes proposal (@nicolo-ribaudo)
babel-generator, babel-parser, babel-traverse, babel-types
- #15520 Parse await using declarations (@JLHwung)
babel-core, babel-helper-create-regexp-features-plugin, babel-parser
- #15638 Enable regexp unicode sets parsing by default (@JLHwung)
babel-helpers, babel-plugin-proposal-decorators, babel-plugin-syntax-decorators, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
- #15570 Add decorators version 2023-05 (@nicolo-ribaudo)

💅 Polish

babel-plugin-transform-react-constant-elements, babel-plugin-transform-react-jsx, babel-traverse, babel-types
- #15549 Improve type definitions for validators (@liuxingbaoyu)

🏠 Internal

babel-parser
- #15630 Unify parsing of import/export modifiers (type/typeof/module) (@nicolo-ribaudo)
babel-compat-data, babel-helper-transform-fixture-test-runner, babel-node, babel-plugin-proposal-decorators, babel-plugin-proposal-duplicate-named-capturing-groups-regex, babel-plugin-transform-async-generator-functions, babel-plugin-transform-named-capturing-groups-regex, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs3
- #15531 Allow polyfill providers to specify custom @babel/runtime pkg (@nicolo-ribaudo)
babel-core, babel-plugin-proposal-async-generator-functions, babel-plugin-proposal-class-properties, babel-plugin-proposal-class-static-block, babel-plugin-proposal-decorators, babel-plugin-proposal-dynamic-import, babel-plugin-proposal-export-namespace-from, babel-plugin-proposal-function-sent, babel-plugin-proposal-json-strings, babel-plugin-proposal-logical-assignment-operators, babel-plugin-proposal-nullish-coalescing-operator, babel-plugin-proposal-numeric-separator, babel-plugin-proposal-object-rest-spread, babel-plugin-proposal-optional-catch-binding, babel-plugin-proposal-optional-chaining, babel-plugin-proposal-pipeline-operator, babel-plugin-proposal-private-methods, babel-plugin-proposal-private-property-in-object, babel-plugin-proposal-unicode-property-regex, babel-preset-env, babel-standalone
- #15614 Rename -proposal-s that became standard to -transform- (@nicolo-ribaudo)

Committers: 4

Babel Bot (@babel-bot)
Huáng Jùnliàng (@JLHwung)
Nicolò Ribaudo (@nicolo-ribaudo)
@liuxingbaoyu

`v7.21.5`

Compare Source

v7.21.5 (2023-04-28)

👓 Spec Compliance

babel-generator, babel-parser, babel-types
- #15539 fix: Remove mixins and implements for DeclareInterface and InterfaceDeclaration (@liuxingbaoyu)

🐛 Bug Fix

babel-core, babel-generator, babel-plugin-transform-modules-commonjs, babel-plugin-transform-react-jsx
- #15515 fix: ) position with createParenthesizedExpressions (@liuxingbaoyu)
babel-preset-env
- #15580 Add syntax import meta to preset env (@JLHwung)

💅 Polish

babel-types
- #15546 Improve the layout of generated validators (@liuxingbaoyu)
babel-core
- #15535 Use lt instead of lte to check TS version for .cts config (@nicolo-ribaudo)

🏠 Internal

babel-core
- #15575 Use synchronous import.meta.resolve (@nicolo-ribaudo)
babel-helper-fixtures, babel-preset-typescript
- #15568 Handle .overrides and .env when resolving plugins/presets from fixture options (@JLHwung)
babel-helper-create-class-features-plugin, babel-helper-create-regexp-features-plugin
- #15548 Use semver package to compare versions (@nicolo-ribaudo)

Committers: 4

Babel Bot (@babel-bot)
Huáng Jùnliàng (@JLHwung)
Nicolò Ribaudo (@nicolo-ribaudo)
@liuxingbaoyu

`v7.21.4`

Compare Source

v7.21.4 (2023-03-31)

🐛 Bug Fix

babel-core, babel-helper-module-imports, babel-preset-typescript
- #15478 Fix support for import/export in .cts files (@liuxingbaoyu)
babel-generator
- #15496 Fix compact printing of non-null assertion operators (@rtsao)

💅 Polish

babel-helper-create-class-features-plugin, babel-plugin-proposal-class-properties, babel-plugin-transform-typescript, babel-traverse
- #15427 Fix moving comments of removed nodes (@nicolo-ribaudo)

🏠 Internal

Other
- #15519 Update Prettier integration test (@fisker)
babel-parser
- #15510 refactor: introduce lookaheadInLineCharCode (@JLHwung)
babel-code-frame, babel-highlight
- #15499 Polish babel-code-frame highlight test (@JLHwung)

Committers: 6

Babel Bot (@babel-bot)
Huáng Jùnliàng (@JLHwung)
Nicolò Ribaudo (@nicolo-ribaudo)
Ryan Tsao (@rtsao)
@liuxingbaoyu
fisker Cheung (@fisker)

`v7.21.3`

Compare Source

v7.21.3 (2023-03-14)

Thanks @amoeller, @Harpica, and @nzakas for your first PRs!

👓 Spec Compliance

babel-parser
- #15479 disallow mixins/implements in flow interface (@JLHwung)

🐛 Bug Fix

babel-parser
- #15423 [ts] Allow keywords in tuple labels (@Harpica)
babel-plugin-transform-typescript
- #15489 Register var decls generated by import ... = TS transform (@amoeller)
- #15494 fix: Consider export { type foo } as type-only usage (@magic-akari)

💅 Polish

babel-traverse, babel-types
- #15484 Skip node deprecation warnings when used by an old @babel package (@nicolo-ribaudo)
babel-generator
- #15480 chore: Improve jsonCompatibleStrings deprecation (@liuxingbaoyu)

🏠 Internal

#15465 Add ESLint-readable package name (@nzakas)

🔬 Output optimization

babel-plugin-transform-typescript, babel-preset-typescript
- #15467 Optimize TS enums output (@liuxingbaoyu)

Committers: 8

Alexandra Kadykova (@Harpica)
Anders Møller (@amoeller)
Babel Bot (@babel-bot)
Huáng Jùnliàng (@JLHwung)
Nicholas C. Zakas (@nzakas)
Nicolò Ribaudo (@nicolo-ribaudo)
@liuxingbaoyu
magic-akari (@magic-akari)

`v7.21.2`

Compare Source

v7.21.2 (2023-02-23)

👓 Spec Compliance

babel-parser
- #15439 fix: Throws on new foo?.bar!() (@liuxingbaoyu)

💅 Polish

babel-traverse, babel-types
- #15448 Reduce warnings for deprecated node aliases (@nicolo-ribaudo)

🏠 Internal

babel-types
- #15451 Update babel-types docs generator (@JLHwung)

🔬 Output optimization

babel-helper-module-transforms, babel-plugin-transform-modules-commonjs
- #15449 Avoid unnecessary code for unused lazy imports (@nicolo-ribaudo)

Committers: 3

Huáng Jùnliàng (@JLHwung)
Nicolò Ribaudo (@nicolo-ribaudo)
@liuxingbaoyu

`v7.21.0`

Compare Source

v7.21.0 (2023-02-20)

Thanks @azizghuloum, @ehoogeveen-medweb, @fwienber, and @Lioness100 for your first PRs!

🚀 New Feature

babel-core, babel-helper-create-class-features-plugin, babel-plugin-proposal-class-properties, babel-plugin-proposal-private-methods, babel-plugin-proposal-private-property-in-object
- #15435 feat: Implement privateFieldsAsSymbols assumption for classes (@fwienber)
babel-helper-create-regexp-features-plugin, babel-plugin-proposal-regexp-modifiers, babel-standalone
- #15226 feat: Support regexp modifiers proposal (@liuxingbaoyu)
babel-cli, babel-core, babel-generator, babel-plugin-transform-destructuring, babel-plugin-transform-modules-commonjs, babel-plugin-transform-react-jsx, babel-traverse
- #15022 feat: Generate sourcemaps of friendly call frames (@liuxingbaoyu)
babel-parser, babel-types
- #15384 [ts] Support const modifier in type parameters (@nicolo-ribaudo)
babel-generator, babel-helpers, babel-parser, babel-plugin-proposal-decorators, babel-plugin-syntax-decorators, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
- #15405 Implement decorators as presented at 2023-01 TC39 meeting (@nicolo-ribaudo)
babel-parser
- #15114 Parser option to allow new.target outside functions (@overlookmotel)
- #15320 Add annexb: false parser option to disable Annex B (@nicolo-ribaudo)
babel-core
- #15283 feat: Support .cts as configuration file (@liuxingbaoyu)
babel-generator, babel-parser, babel-plugin-transform-typescript
- #15381 [ts] Support export type * from (@nicolo-ribaudo)

🐛 Bug Fix

babel-plugin-transform-typescript
- #15379 [ts5.0] Better inlining of constants in enums (@liuxingbaoyu)
babel-core
- #15366 handling circular/shared structures in deep-clone (@azizghuloum)
babel-helper-create-class-features-plugin, babel-plugin-proposal-class-properties, babel-plugin-proposal-class-static-block, babel-plugin-proposal-private-methods, babel-plugin-transform-classes, babel-plugin-transform-new-target
- #15406 Preserve class elements comments in class transform (@JLHwung)
babel-parser, babel-plugin-transform-flow-comments, babel-plugin-transform-flow-strip-types, babel-types
- #15414 [ts] Fix restrictions for optional parameters (@nicolo-ribaudo)

💅 Polish

babel-parser
- #15400 polish: improve "await as identifier" error in modules (@JLHwung)

🏠 Internal

babel-core
- #15137 Improve CJS compat with ESM-based @babel/core (@nicolo-ribaudo)

🔬 Output optimization

babel-plugin-transform-typescript
- #15418 [ts] Handle exponentiation operator in constant folding (@ehoogeveen-medweb)

Committers: 11

Abdulaziz Ghuloum (@azizghuloum)
Babel Bot (@babel-bot)
Emanuel Hoogeveen (@ehoogeveen-medweb)
Frank Wienberg (@fwienber)
Huáng Jùnliàng (@JLHwung)
Mateusz Burzyński (@Andarist)
Nicolò Ribaudo (@nicolo-ribaudo)
@Lioness100
@liuxingbaoyu
@overlookmotel
fisker Cheung (@fisker)

`v7.20.13`

Compare Source

v7.20.13 (2023-01-21)

🐛 Bug Fix

babel-helpers, babel-plugin-proposal-decorators, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
- #15332 Ensure class decorators can access decorated non-static members (@JLHwung)
babel-plugin-transform-typescript
- #15349 fix: Preserve import {type T} from 'x' when onlyRemoveTypeImports:true (@liuxingbaoyu)
- #15344 fix: Properties that are abstract should not be initialized. (@liuxingbaoyu)
babel-parser
- #15338 Allow negative number in ambient const initializer (@JLHwung)

↩️ Revert

babel-plugin-transform-react-inline-elements, babel-plugin-transform-react-jsx-development, babel-plugin-transform-react-jsx
- #15355 Reverts "Re-use common JSX element transform for <>...</>" (@JLHwung)

Committers: 4

Babel Bot ([@babel-bot](https

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

netlify · 2026-08-29T20:17:48Z

✅ Deploy Preview for quirrel-docs canceled.

Name	Link
🔨 Latest commit	`eba4f8d`
🔍 Latest deploy log	https://app.netlify.com/projects/quirrel-docs/deploys/6adfdadc11c9047d059d0d38

netlify · 2026-08-29T20:17:48Z

✅ Deploy Preview for quirrel-development-ui canceled.

Name	Link
🔨 Latest commit	`eba4f8d`
🔍 Latest deploy log	https://app.netlify.com/projects/quirrel-development-ui/deploys/6adfdadc8bc6528b4a1e3b84

renovate Bot added the dependencies Pull requests that update a dependency file label Aug 29, 2026

renovate Bot force-pushed the renovate/npm-babel-traverse-vulnerability branch 2 times, most recently from 77e1bc0 to 284d280 Compare September 18, 2026 23:07

renovate Bot force-pushed the renovate/npm-babel-traverse-vulnerability branch from 284d280 to b91c7b8 Compare September 24, 2026 21:01

chore(deps): update dependency @babel/traverse to v7.23.2 [security]

eba4f8d

renovate Bot force-pushed the renovate/npm-babel-traverse-vulnerability branch from b91c7b8 to eba4f8d Compare October 26, 2026 22:57

Navigation Menu

Repository navigation

chore(deps): update dependency @babel/traverse to v7.23.2 [security] - #1206

chore(deps): update dependency @babel/traverse to v7.23.2 [security]#1206
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-babel-traverse-vulnerability

renovate Bot commented Aug 29, 2026 •

edited

Loading

Uh oh!

netlify Bot commented Aug 29, 2026 •

edited

Loading

Uh oh!

netlify Bot commented Aug 29, 2026 •

edited

Loading

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Aug 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code

Details

Impact

Patches

Workarounds

Severity

References

Release Notes

v7.23.2 (2023-10-11)

🐛 Bug Fix

Committers: 5

v7.23.0 (2023-09-25)

🚀 New Feature

🐛 Bug Fix

💅 Polish

🔬 Output optimization

Committers: 7

v7.22.20 (2023-09-16)

🏠 Internal

↩️ Revert

Committers: 3

v7.22.19 (2023-09-14)

v7.22.18 (2023-09-14)

🐛 Bug Fix

↩️ Revert

Committers: 3

v7.22.17 (2023-09-08)

🐛 Bug Fix

🔬 Output optimization

Committers: 3

v7.22.15 (2023-09-04)

🐛 Bug Fix

🏠 Internal

Committers: 4

v7.22.11 (2023-08-24)

🐛 Bug Fix

🏠 Internal

🔬 Output optimization

Committers: 7

v7.22.10 (2023-08-07)

🐛 Bug Fix

💅 Polish

🏠 Internal

🔬 Output optimization

Committers: 9

v7.22.8 (2023-07-06)

↩️ Revert

Committers: 1

v7.22.7 (2023-07-06)

🐛 Bug Fix

🏠 Internal

Committers: 4

v7.22.6 (2023-07-04)

🐛 Bug Fix

🏠 Internal

🔬 Output optimization

Committers: 5

v7.22.5 (2023-06-08)

🐛 Bug Fix

💅 Polish

Committers: 4

v7.22.4 (2023-05-29)

🐛 Bug Fix

🏠 Internal

Committers: 3

v7.22.1 (2023-05-26)

🐛 Bug Fix

Committers: 2

v7.22.0 (2023-05-26)

🚀 New Feature

💅 Polish

🏠 Internal

Committers: 4

v7.21.5 (2023-04-28)

👓 Spec Compliance

🐛 Bug Fix

💅 Polish

renovate Bot commented Aug 29, 2026 •

edited

Loading

netlify Bot commented Aug 29, 2026 •

edited

Loading

netlify Bot commented Aug 29, 2026 •

edited

Loading