[Snyk] Upgrade @babel/generator from 7.1.3 to 7.26.3 #112

nerdy-tech-com-gitub · 2024-12-29T01:29:17Z

Snyk has created this PR to upgrade @babel/generator from 7.1.3 to 7.26.3.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 133 versions ahead of your current version.
The recommended version was released 25 days ago.

Issues fixed by the recommended upgrade:

Issue	Score	Exploit Maturity
Inefficient Regular Expression Complexity SNYK-JS-MICROMATCH-6838728	124	No Known Exploit
Prototype Pollution SNYK-JS-AJV-584908	124	No Known Exploit
Incomplete List of Disallowed Inputs SNYK-JS-BABELTRAVERSE-5962462	124	Proof of Concept
Uncontrolled resource consumption SNYK-JS-BRACES-6838727	124	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-CROSSSPAWN-8303230	124	Proof of Concept
Denial of Service (DoS) SNYK-JS-DECODEURICOMPONENT-3149970	124	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-HAWK-2808852	124	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	124	Proof of Concept
Prototype Pollution SNYK-JS-UNSETVALUE-2400660	124	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-GLOBPARENT-1016905	124	Proof of Concept
Authentication Bypass SNYK-JS-HAWK-6969142	124	Proof of Concept
Prototype Poisoning SNYK-JS-QS-3153490	124	Proof of Concept
Insecure Randomness npm:cryptiles:20180710	124	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-PATHTOREGEXP-7925106	124	Proof of Concept

Release notes

Package name: @babel/generator

7.26.3 - 2024-12-04
v7.26.3 (2024-12-04)

🐛 Bug Fix
- babel-generator
  - #16958 [preserveFormat] force semicolons when invalidating ASI (@ nicolo-ribaudo)
🏠 Internal
- babel-helper-builder-binary-assignment-operator-visitor, babel-plugin-transform-exponentiation-operator
  - #16895 Remove helper-builder-binary-assignment-operator-visitor (@ nicolo-ribaudo)
🏃‍♀️ Performance
- babel-generator
  - #16959 perf: Reduce the use of temporary objects (@ liuxingbaoyu)
- babel-traverse
  - #16923 perf: Improve scope information collection performance (@ liuxingbaoyu)
  - #16964 perf: Avoid repeated traversal when creating scope (@ liuxingbaoyu)
- babel-plugin-transform-modules-commonjs
  - #16954 perf: Remove use of simplifyAccess (@ liuxingbaoyu)
Committers: 4
- Babel Bot (@ babel-bot)
- Huáng Jùnliàng (@ JLHwung)
- Nicolò Ribaudo (@ nicolo-ribaudo)
- @ liuxingbaoyu
7.26.2 - 2024-10-30
v7.26.2 (2024-10-30)

🐛 Bug Fix
- babel-parser
  - #16903 fix: Parse placeholder for TS namespace (@ liuxingbaoyu)
  - #16937 fix: Account for offsets when creating new Position instances (@ DylanPiercey)
- babel-generator
  - #16948 Fix mapping of tokens with generated nodes in between (@ nicolo-ribaudo)
Committers: 6
- Babel Bot (@ babel-bot)
- Dylan Piercey (@ DylanPiercey)
- Huáng Jùnliàng (@ JLHwung)
- Nicolò Ribaudo (@ nicolo-ribaudo)
- @ liuxingbaoyu
- fisker Cheung (@ fisker)
7.26.0 - 2024-10-25
v7.26.0 (2024-10-25)

Thanks @ timofei-iatsenko for your first PR!

You can find the release blog post with some highlights at https://babeljs.io/blog/2024/10/25/7.26.0.

🚀 New Feature
- babel-core, babel-generator, babel-parser, babel-plugin-syntax-import-assertions, babel-plugin-syntax-import-attributes, babel-preset-env, babel-standalone, babel-types
  - #16850 Enable import attributes parsing by default (@ nicolo-ribaudo)
- babel-core
  - #16862 feat: support async plugin's pre/post (@ timofei-iatsenko)
- babel-compat-data, babel-plugin-proposal-regexp-modifiers, babel-plugin-transform-regexp-modifiers, babel-preset-env, babel-standalone
  - #16692 Add transform-regexp-modifiers to preset-env (@ JLHwung)
- babel-parser
  - #16849 feat: add startIndex parser option (@ DylanPiercey)
- babel-generator, babel-parser, babel-plugin-syntax-flow
  - #16841 Always enable parsing of Flow enums (@ nicolo-ribaudo)
- babel-helpers, babel-preset-typescript, babel-runtime-corejs3
  - #16794 Support import() in rewriteImportExtensions (@ liuxingbaoyu)
- babel-generator, babel-parser
  - #16708 Add experimental format-preserving mode to @ babel/generator (@ nicolo-ribaudo)
🐛 Bug Fix
- babel-core
  - #16928 Workaround Node.js bug for parallel loading of TLA modules (@ nicolo-ribaudo)
  - #16926 Fix loading of modules with TLA in Node.js 23 (@ nicolo-ribaudo)
💅 Polish
- babel-plugin-proposal-json-modules, babel-plugin-transform-json-modules, babel-standalone
  - #16924 Rename proposal-json-modules to transform-json-modules (@ nicolo-ribaudo)
🏠 Internal
- babel-code-frame, babel-highlight
  - #16896 Inline @ babel/highlight in @ babel/code-frame (@ nicolo-ribaudo)
- babel-generator, babel-parser, babel-types
  - #16732 Add kind to TSModuleDeclaration (@ liuxingbaoyu)
🏃‍♀️ Performance
- babel-helper-module-transforms, babel-plugin-transform-modules-commonjs
  - #16882 perf: Improve module transforms (@ liuxingbaoyu)
Committers: 5
- Dylan Piercey (@ DylanPiercey)
- Huáng Jùnliàng (@ JLHwung)
- Nicolò Ribaudo (@ nicolo-ribaudo)
- Timofei Iatsenko (@ timofei-iatsenko)
- @ liuxingbaoyu
7.25.9 - 2024-10-22
v7.25.9 (2024-10-22)

Thanks @ victorenator for your first PR!

🐛 Bug Fix
- babel-parser, babel-template, babel-types
  - #16905 fix: Keep type annotations in syntacticPlaceholders mode (@ liuxingbaoyu)
- babel-helper-compilation-targets, babel-preset-env
  - #16907 fix: support BROWSERSLIST{,_CONFIG} env (@ JLHwung)
- Other
  - #16884 Analyze ClassAccessorProperty to prevent the no-undef rule (@ victorenator)
🏠 Internal
- babel-helper-transform-fixture-test-runner
  - #16914 remove test options flaky (@ JLHwung)
- Every package
  - #16917 fix: Accidentally published tsconfig files (@ liuxingbaoyu)
🏃‍♀️ Performance
- babel-parser, babel-types
  - #16918 perf: Make VISITOR_KEYS etc. faster to access (@ liuxingbaoyu)
Committers: 4
- Babel Bot (@ babel-bot)
- Huáng Jùnliàng (@ JLHwung)
- Viktar Vaŭčkievič (@ victorenator)
- @ liuxingbaoyu
7.25.7 - 2024-10-02
v7.25.7 (2024-10-02)

Thanks @ DylanPiercey and @ YuHyeonWook for your first PRs!

🐛 Bug Fix
- babel-helper-validator-identifier
  - #16825 fix: update identifier to unicode 16 (@ JLHwung)
- babel-traverse
  - #16814 fix: issue with node path keys updated on unrelated paths (@ DylanPiercey)
- babel-plugin-transform-classes
  - #16797 Use an inclusion rather than exclusion list for super() check (@ nicolo-ribaudo)
- babel-generator
  - #16788 Fix printing of TS infer in compact mode (@ nicolo-ribaudo)
  - #16785 Print TS type annotations for destructuring in assignment pattern (@ nicolo-ribaudo)
  - #16778 Respect [no LineTerminator here] after nodes (@ nicolo-ribaudo)
💅 Polish
- babel-types
  - #16852 Add deprecated JSDOC for fields (@ liuxingbaoyu)
🏠 Internal
- babel-core
  - #16820 Allow sync loading of ESM when --experimental-require-module (@ nicolo-ribaudo)
- babel-helper-compilation-targets, babel-helper-plugin-utils, babel-preset-env
  - #16858 Add browserslist config to external dependency (@ JLHwung)
- babel-plugin-proposal-destructuring-private, babel-plugin-syntax-decimal, babel-plugin-syntax-import-reflection, babel-standalone
  - #16809 Archive syntax-import-reflection and syntax-decimal (@ nicolo-ribaudo)
- babel-generator
  - #16779 Simplify logic for [no LineTerminator here] before nodes (@ nicolo-ribaudo)
🏃‍♀️ Performance
- babel-plugin-transform-typescript
  - #16875 perf: Avoid extra cloning of namespaces (@ liuxingbaoyu)
- babel-types
  - #16842 perf: Improve @ babel/types builders (@ liuxingbaoyu)
  - #16828 Only access BABEL_TYPES_8_BREAKING at startup (@ nicolo-ribaudo)
Committers: 8
- Babel Bot (@ babel-bot)
- Dylan Piercey (@ DylanPiercey)
- Huáng Jùnliàng (@ JLHwung)
- Nicolò Ribaudo (@ nicolo-ribaudo)
- @ liuxingbaoyu
- coderaiser (@ coderaiser)
- fisker Cheung (@ fisker)
- hwook (@ YuHyeonWook)
7.25.6 - 2024-08-29
v7.25.6 (2024-08-29)

Thanks @ j4k0xb for your first PR!

🐛 Bug Fix
- babel-generator
  - #16783 Properly print inner comments in TS array types (@ nicolo-ribaudo)
  - #16775 fix: jsx whitespace is not properly preserved when retainLines (@ liuxingbaoyu)
- babel-traverse
  - #16727 fix: path.getAssignmentIdentifiers may be undefined (@ liuxingbaoyu)
- babel-parser
  - #16761 fix: improve static canFollowModifier checks (@ JLHwung)
- babel-helpers, babel-plugin-transform-optional-chaining, babel-runtime-corejs3
  - #16769 Only wrap functions in superPropertyGet helper (@ nicolo-ribaudo)
💅 Polish
- babel-generator, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-class-properties, babel-plugin-transform-classes, babel-plugin-transform-duplicate-named-capturing-groups-regex, babel-plugin-transform-named-capturing-groups-regex, babel-plugin-transform-react-jsx-development, babel-plugin-transform-react-jsx, babel-plugin-transform-react-pure-annotations, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env
  - #16780 Do not enforce printing space between ( and comments (@ nicolo-ribaudo)
- babel-plugin-syntax-import-assertions, babel-plugin-syntax-import-attributes
  - #16781 Don't throw when enabling both syntax-import-{assertions,attributes} (@ nicolo-ribaudo)
- babel-generator
  - #16782 TS union/intersection nested in union does not need parens (@ nicolo-ribaudo)
🏠 Internal
- babel-generator
  - #16777 Remove unused parent params in the generator (@ nicolo-ribaudo)
Committers: 5
- Babel Bot (@ babel-bot)
- Huáng Jùnliàng (@ JLHwung)
- Nicolò Ribaudo (@ nicolo-ribaudo)
- @ j4k0xb
- @ liuxingbaoyu
7.25.5 - 2024-08-23
7.25.4 - 2024-08-22
7.25.0 - 2024-07-26
7.24.10 - 2024-07-16
7.24.9 - 2024-07-15
7.24.8 - 2024-07-11
7.24.7 - 2024-06-05
7.24.6 - 2024-05-24
7.24.5 - 2024-04-29
7.24.4 - 2024-04-03
7.24.1 - 2024-03-19
7.23.6 - 2023-12-11
7.23.5 - 2023-11-29
7.23.4 - 2023-11-20
7.23.3 - 2023-11-09
7.23.0 - 2023-09-25
7.22.15 - 2023-09-04
7.22.10 - 2023-08-07
7.22.9 - 2023-07-12
7.22.7 - 2023-07-06
7.22.5 - 2023-06-08
7.22.3 - 2023-05-27
7.22.0 - 2023-05-26
7.21.9 - 2023-05-22
7.21.5 - 2023-04-28
7.21.4 - 2023-03-31
7.21.4-esm.4 - 2023-04-04
7.21.4-esm.3 - 2023-04-04
7.21.4-esm.2 - 2023-04-04
7.21.4-esm.1 - 2023-04-04
7.21.4-esm - 2023-04-04
7.21.3 - 2023-03-14
7.21.1 - 2023-02-20
7.21.0 - 2023-02-20
7.20.14 - 2023-01-27
7.20.7 - 2022-12-22
7.20.5 - 2022-11-28
7.20.4 - 2022-11-08
7.20.3 - 2022-11-07
7.20.2 - 2022-11-04
7.20.1 - 2022-11-01
7.20.0 - 2022-10-27
7.19.6 - 2022-10-20
7.19.5 - 2022-10-10
7.19.4 - 2022-10-10
7.19.3 - 2022-09-27
7.19.0 - 2022-09-05
7.18.13 - 2022-08-22
7.18.12 - 2022-08-05
7.18.10 - 2022-08-01
7.18.9 - 2022-07-18
7.18.7 - 2022-06-28
7.18.6 - 2022-06-27
7.18.2 - 2022-05-25
7.18.0 - 2022-05-19
7.17.12 - 2022-05-16
7.17.10 - 2022-04-29
7.17.9 - 2022-04-06
7.17.7 - 2022-03-14
7.17.3 - 2022-02-15
7.17.0 - 2022-02-02
7.16.8 - 2022-01-10
7.16.7 - 2021-12-31
7.16.5 - 2021-12-13
7.16.0 - 2021-10-29
7.15.8 - 2021-10-06
7.15.4 - 2021-09-02
7.15.0 - 2021-08-04
7.14.9 - 2021-08-01
7.14.8 - 2021-07-20
7.14.5 - 2021-06-09
7.14.3 - 2021-05-17
7.14.2 - 2021-05-12
7.14.1 - 2021-05-04
7.14.0 - 2021-04-29
7.13.16 - 2021-04-20
7.13.9 - 2021-03-01
7.13.0 - 2021-02-22
7.12.17 - 2021-02-18
7.12.15 - 2021-02-04
7.12.13 - 2021-02-03
7.12.11 - 2020-12-15
7.12.10 - 2020-12-09
7.12.5 - 2020-11-03
7.12.1 - 2020-10-15
7.12.0 - 2020-10-14
7.11.6 - 2020-09-03
7.11.5 - 2020-08-31
7.11.4 - 2020-08-20
7.11.0 - 2020-07-30
7.10.5 - 2020-07-14
7.10.4 - 2020-06-30
7.10.3 - 2020-06-19
7.10.2 - 2020-05-30
7.10.1 - 2020-05-27
7.10.0 - 2020-05-26
7.9.6 - 2020-04-29
7.9.5 - 2020-04-07
7.9.4 - 2020-03-24
7.9.3 - 2020-03-22
7.9.0 - 2020-03-20
7.8.8 - 2020-03-12
7.8.7 - 2020-03-05
7.8.6 - 2020-02-27
7.8.4 - 2020-01-30
7.8.3 - 2020-01-13
7.8.0 - 2020-01-12
7.7.7 - 2019-12-19
7.7.4 - 2019-11-22
7.7.2 - 2019-11-06
7.7.0 - 2019-11-05
7.6.4 - 2019-10-10
7.6.3 - 2019-10-08
7.6.2 - 2019-09-23
7.6.0 - 2019-09-06
7.5.5 - 2019-07-17
7.5.0 - 2019-07-04
7.4.4 - 2019-04-26
7.4.0 - 2019-03-19
7.3.4 - 2019-02-25
7.3.3 - 2019-02-15
7.3.2 - 2019-02-04
7.3.0 - 2019-01-21
7.2.2 - 2018-12-15
7.2.0 - 2018-12-03
7.1.6 - 2018-11-13
7.1.5 - 2018-11-06
7.1.3 - 2018-10-11

from @babel/generator GitHub release notes

Important

Check the changes in this PR to ensure they won't cause issues with your project.
This PR was automatically created by Snyk using the credentials of a real user.
Max score is 1000. Note that the real score may have changed since the PR was raised.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

📜 Customise PR templates

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

Summary by Sourcery

Upgrade @babel/generator from 7.1.3 to 7.26.3.

Bug Fixes:

Fix inefficient regular expression complexity (SNYK-JS-MICROMATCH-6838728).
Fix prototype pollution (SNYK-JS-AJV-584908).
Fix incomplete list of disallowed inputs (SNYK-JS-BABELTRAVERSE-5962462).
Fix uncontrolled resource consumption (SNYK-JS-BRACES-6838727).
Fix regular expression denial of service (ReDoS) (SNYK-JS-CROSSSPAWN-8303230).
Fix denial of service (DoS) (SNYK-JS-DECODEURICOMPONENT-3149970).
Fix regular expression denial of service (ReDoS) (SNYK-JS-HAWK-2808852).
Fix regular expression denial of service (ReDoS) (SNYK-JS-SEMVER-3247795).
Fix prototype pollution (SNYK-JS-UNSETVALUE-2400660).
Fix regular expression denial of service (ReDoS) (SNYK-JS-GLOBPARENT-1016905).
Fix authentication bypass (SNYK-JS-HAWK-6969142).
Fix prototype poisoning (SNYK-JS-QS-3153490).
Fix insecure randomness (npm:cryptiles:20180710).
Fix regular expression denial of service (ReDoS) (SNYK-JS-PATHTOREGEXP-7925106).

Snyk has created this PR to upgrade @babel/generator from 7.1.3 to 7.26.3. See this package in npm: @babel/generator See this project in Snyk: https://app.snyk.io/org/nerds-github/project/5c08c7f3-e081-4b45-bb54-aed4a1afcddf?utm_source=github&utm_medium=referral&page=upgrade-pr

sourcery-ai · 2024-12-29T01:29:24Z

Reviewer's Guide by Sourcery

This pull request upgrades @babel/generator from 7.1.3 to 7.26.3. This upgrade fixes 14 vulnerabilities, including Prototype Pollution, Incomplete List of Disallowed Inputs, and Authentication Bypass.

No diagrams generated as the changes look simple and do not need a visual representation.

File-Level Changes

Change	Details	Files
Upgrade @babel/generator	The `@babel/generator` dependency was upgraded from version 7.1.3 to 7.26.3 in the package.json file to address security vulnerabilities and improve performance.	`deps/v8/tools/clusterfuzz/js_fuzzer/package.json`

Tips and commands

Interacting with Sourcery

Trigger a new review: Comment @sourcery-ai review on the pull request.
Continue discussions: Reply directly to Sourcery's review comments.
Generate a GitHub issue from a review comment: Ask Sourcery to create an
issue from a review comment by replying to it.
Generate a pull request title: Write @sourcery-ai anywhere in the pull
request title to generate a title at any time.
Generate a pull request summary: Write @sourcery-ai summary anywhere in
the pull request body to generate a PR summary at any time. You can also use
this command to specify where the summary should be inserted.

Customizing Your Experience

Access your dashboard to:

Enable or disable review features such as the Sourcery-generated pull request
summary, the reviewer's guide, and others.
Change the review language.
Add, remove or edit custom review instructions.
Adjust other review settings.

Getting Help

Contact our support team for questions or feedback.
Visit our documentation for detailed guides and information.
Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

sourcery-ai

We have skipped reviewing this pull request. Here's why:

It seems to have been created by a bot ('[Snyk]' found in title). We assume it knows what it's doing!
We don't review packaging changes - Let us know if you'd like us to change this.

sourcery-ai bot reviewed Dec 29, 2024

View reviewed changes

[Snyk] Upgrade @babel/generator from 7.1.3 to 7.26.3 #112

Are you sure you want to change the base?

[Snyk] Upgrade @babel/generator from 7.1.3 to 7.26.3 #112

Conversation

nerdy-tech-com-gitub commented Dec 29, 2024 • edited by sourcery-ai bot Loading

Snyk has created this PR to upgrade @babel/generator from 7.1.3 to 7.26.3.

Issues fixed by the recommended upgrade:

v7.26.3 (2024-12-04)

🐛 Bug Fix

🏠 Internal

🏃‍♀️ Performance

Committers: 4

v7.26.2 (2024-10-30)

🐛 Bug Fix

Committers: 6

v7.26.0 (2024-10-25)

🚀 New Feature

🐛 Bug Fix

💅 Polish

🏠 Internal

🏃‍♀️ Performance

Committers: 5

v7.25.9 (2024-10-22)

🐛 Bug Fix

🏠 Internal

🏃‍♀️ Performance

Committers: 4

v7.25.7 (2024-10-02)

🐛 Bug Fix

💅 Polish

🏠 Internal

🏃‍♀️ Performance

Committers: 8

v7.25.6 (2024-08-29)

🐛 Bug Fix

💅 Polish

🏠 Internal

Committers: 5

Summary by Sourcery

sourcery-ai bot commented Dec 29, 2024 • edited Loading

Reviewer's Guide by Sourcery

File-Level Changes

Interacting with Sourcery

Customizing Your Experience

Getting Help

sourcery-ai bot left a comment

Choose a reason for hiding this comment

nerdy-tech-com-gitub commented Dec 29, 2024 •

edited by sourcery-ai bot

Loading

sourcery-ai bot commented Dec 29, 2024 •

edited

Loading