Skip to content

[Snyk] Upgrade: @babel/core, @babel/plugin-proposal-object-rest-spread, @babel/plugin-transform-runtime, @babel/preset-env, @babel/runtime#4

Open
snyk-bot wants to merge 1 commit into
masterfrom
snyk-upgrade-af1b7bacef3ef4d2d5f2d77382803b17
Open

[Snyk] Upgrade: @babel/core, @babel/plugin-proposal-object-rest-spread, @babel/plugin-transform-runtime, @babel/preset-env, @babel/runtime#4
snyk-bot wants to merge 1 commit into
masterfrom
snyk-upgrade-af1b7bacef3ef4d2d5f2d77382803b17

Conversation

@snyk-bot
Copy link
Copy Markdown

@snyk-bot snyk-bot commented Jul 10, 2020

Snyk has created this PR to upgrade multiple dependencies.

👯‍♂ The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name Versions Released on
@babel/core
from 7.9.6 to 7.10.2		 3 versions ahead of your current version a month ago
on 2020-05-30
@babel/plugin-proposal-object-rest-spread
from 7.9.6 to 7.10.1		 2 versions ahead of your current version a month ago
on 2020-05-27
@babel/plugin-transform-runtime
from 7.9.6 to 7.10.1		 2 versions ahead of your current version a month ago
on 2020-05-27
@babel/preset-env
from 7.9.6 to 7.10.2		 3 versions ahead of your current version a month ago
on 2020-05-30
@babel/runtime
from 7.9.6 to 7.10.2		 3 versions ahead of your current version a month ago
on 2020-05-30
Release notes
Package name: @babel/core
  • 7.10.2 - 2020-05-30

    v7.10.2 (2020-05-30)

    Thanks @fivetanley and @hamlim for their first PRs!

    🐛 Bug Fix

    • babel-helper-compilation-targets
      • #11648 fix: don't mutate InputTarget's passed to @babel/helper-compilation-targets (@fivetanley)
    • babel-helper-create-class-features-plugin, babel-preset-env
    • babel-generator
    • babel-generator, babel-types
    • babel-plugin-syntax-module-attributes, babel-standalone
      • #11631 Fix moduleAttributesVersion errors with stage-0 preset in babel standalone (@hamlim)

    💅 Polish

    • babel-core
      • #11643 fix: add new plugin names to missing plugin helpers (@JLHwung)

    🏠 Internal

    • babel-parser
      • #11653 refactor: split locationParser into ParserErrors and error message (@JLHwung)

    Committers: 6

  • 7.10.1 - 2020-05-27

    v7.10.1 (2020-05-27)

    This releases includes fixes for two bugs introduced in 7.10.0. There are still a few known bugs, and we'll fix them soon.

    Thanks @saulosantiago for your first PR!

    🐛 Bug Fix

    • babel-preset-env
    • babel-standalone

    🏠 Internal

    Committers: 3

  • 7.10.0 - 2020-05-26

    v7.10.0 (2020-05-26)

    Thanks @AndrewLeedham, @fisker, @kik-o, @kitos, @lazytype for their first PRs!

    We are also releasing the first experimental version of the new polyfills plugins: you can check them out at babel/babel-polyfills.

    👓 Spec Compliance

    • babel-plugin-proposal-logical-assignment-operators
      • #11370 logical-assignment: Do not assign names to anonymous functions (@arku)

    🚀 New Feature

    • babel-helper-create-class-features-plugin, babel-helper-member-expression-to-functions, babel-helper-optimise-call-expression, babel-helper-replace-supers, babel-parser, babel-plugin-proposal-class-properties
    • babel-standalone
      • #11593 feat: add privatePropertyInObject to babel-standalone (@JLHwung)
      • #11466 Support data-type="module" to generate native <script type="module"> (@dfabulich)
    • babel-cli, babel-helper-create-class-features-plugin, babel-parser, babel-plugin-proposal-private-property-in-object, babel-types
    • babel-compat-data, babel-plugin-transform-template-literals, babel-plugin-transform-unicode-escapes, babel-preset-env, babel-standalone
    • babel-parser, babel-plugin-syntax-module-attributes, babel-standalone
    • babel-helper-compilation-targets, babel-preset-env
    • babel-cli
    • babel-helpers, babel-plugin-transform-destructuring, babel-plugin-transform-spread, babel-traverse
    • babel-helpers, babel-plugin-transform-for-of, babel-preset-env
    • babel-parser
    • babel-plugin-transform-react-pure-annotations, babel-preset-react
      • #11428 Implement plugin-transform-react-pure-annotations and add to preset-react (@devongovett)
    • babel-compat-data, babel-preset-env

    🐛 Bug Fix

    • babel-traverse
    • babel-plugin-proposal-optional-chaining
      • #10961 fix: optional-chaining should work correctly with ts non-null operator (@macabeus)
    • babel-parser, babel-types
      • #11547 refactor: add isLiteralPropertyName to parser utils (@JLHwung)
    • babel-plugin-transform-typescript
    • babel-plugin-proposal-object-rest-spread
      • #11550 fix(plugin-proposal-object-rest-spread): use computed memberExpression for literal keys (@kitos)
    • babel-plugin-transform-runtime
    • babel-generator
      • #11502 getters and setters support in generator for declare class statement (@zxbodya)

    💅 Polish

    • babel-helpers, babel-plugin-proposal-class-properties, babel-plugin-proposal-decorators, babel-plugin-transform-classes, babel-plugin-transform-function-name, babel-plugin-transform-parameters, babel-plugin-transform-react-jsx, babel-plugin-transform-runtime, babel-plugin-transform-typescript, babel-preset-env
      • #11514 [helpers] Add a private function name within createSuper (@cpojer)

    🏠 Internal

    • Other
    • babel-parser
      • #11597 Fix comments for smartPipeline topic-forbidding contexts (@lazytype)
    • babel-core, babel-generator, babel-helper-compilation-targets, babel-helpers, babel-parser, babel-plugin-proposal-decorators, babel-plugin-proposal-json-strings, babel-plugin-transform-block-scoping, babel-plugin-transform-flow-comments, babel-plugin-transform-modules-systemjs, babel-plugin-transform-react-jsx-source, babel-plugin-transform-runtime, babel-preset-env, babel-standalone, babel-template, babel-traverse, babel-types

    🏃‍♀️ Performance

    • babel-plugin-proposal-object-rest-spread

    ↩️ Revert

    Committers: 18

  • 7.9.6 - 2020-04-29
    Read more
from @babel/core GitHub release notes
Package name: @babel/plugin-proposal-object-rest-spread from @babel/plugin-proposal-object-rest-spread GitHub release notes
Package name: @babel/plugin-transform-runtime from @babel/plugin-transform-runtime GitHub release notes
Package name: @babel/preset-env from @babel/preset-env GitHub release notes
Package name: @babel/runtime from @babel/runtime GitHub release notes
Commit messages
Package name: @babel/core

Compare

Package name: @babel/plugin-proposal-object-rest-spread

Compare

Package name: @babel/plugin-transform-runtime

Compare

Package name: @babel/preset-env

Compare

Package name: @babel/runtime

Compare

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

@snyk-bot
fix: upgrade multiple dependencies with Snyk
e90b197 
Snyk has created this PR to upgrade:
  - @babel/core from 7.9.6 to 7.10.2.
    See this package in NPM: https://www.npmjs.com/package/@babel/core
  - @babel/plugin-proposal-object-rest-spread from 7.9.6 to 7.10.1.
    See this package in NPM: https://www.npmjs.com/package/@babel/plugin-proposal-object-rest-spread
  - @babel/plugin-transform-runtime from 7.9.6 to 7.10.1.
    See this package in NPM: https://www.npmjs.com/package/@babel/plugin-transform-runtime
  - @babel/preset-env from 7.9.6 to 7.10.2.
    See this package in NPM: https://www.npmjs.com/package/@babel/preset-env
  - @babel/runtime from 7.9.6 to 7.10.2.
    See this package in NPM: https://www.npmjs.com/package/@babel/runtime

See this project in Snyk:
https://app.snyk.io/org/hiranp/project/dee5e8ac-38d5-4363-95c3-29f9b09a10bf?utm_source=github&utm_medium=upgrade-pr
hiranp pushed a commit that referenced this pull request Apr 17, 2026
@ZPascal
[SECURITY] Toolchain Update to Go 1.25.6 (go-gitea#36480)
1adf8b3 
## Overview
This PR updates the Go toolchain version from `1.25.5` to `1.25.6` for
the Gitea project.

## Changes

### Toolchain Update
- **Go Toolchain**: Updated from `go1.25.5` to `go1.25.6`

This is a minor toolchain version bump that ensures the project uses the
latest patch release of Go 1.25.

## Security Improvements

While this PR primarily addresses the toolchain update, the project
maintains a strong security posture through:

### Current Security Measures
```log
Vulnerability #1: GO-2026-4342                                                                                                                                                                                                      
    Excessive CPU consumption when building archive index in archive/zip
  More info: https://pkg.go.dev/vuln/GO-2026-4342
  Standard library
    Found in: archive/zip@go1.25.5
    Fixed in: archive/zip@go1.25.6
    Example traces found:
      #1: modules/packages/nuget/metadata.go:217:25: nuget.ParseNuspecMetaData calls zip.Reader.Open                                                                                                                                

Vulnerability #2: GO-2026-4341
    Memory exhaustion in query parameter parsing in net/url
  More info: https://pkg.go.dev/vuln/GO-2026-4341
  Standard library
    Found in: net/url@go1.25.5
    Fixed in: net/url@go1.25.6
    Example traces found:
      #1: modules/storage/minio.go:284:34: storage.MinioStorage.URL calls url.ParseQuery                                                                                                                                            
      #2: routers/api/v1/repo/action.go:1640:29: repo.DownloadArtifactRaw calls url.URL.Query

Vulnerability #3: GO-2026-4340
    Handshake messages may be processed at the incorrect encryption level in
    crypto/tls
  More info: https://pkg.go.dev/vuln/GO-2026-4340
  Standard library
    Found in: crypto/tls@go1.25.5
    Fixed in: crypto/tls@go1.25.6
    Example traces found:
      #1: services/auth/source/ldap/source_search.go:129:25: ldap.dial calls ldap.Conn.StartTLS, which calls tls.Conn.Handshake                                                                                                     
      #2: modules/graceful/server.go:156:14: graceful.Server.Serve calls http.Server.Serve, which eventually calls tls.Conn.HandshakeContext
      #3: modules/lfs/content_store.go:132:27: lfs.hashingReader.Read calls tls.Conn.Read
      #4: modules/proxyprotocol/conn.go:91:21: proxyprotocol.Conn.Write calls tls.Conn.Write
      #5: modules/session/virtual.go:168:39: session.VirtualStore.Release calls couchbase.CouchbaseProvider.Exist, which eventually calls tls.Dial
      #6: services/auth/source/ldap/source_search.go:120:22: ldap.dial calls ldap.DialTLS, which calls tls.DialWithDialer
      #7: services/migrations/gogs.go:114:34: migrations.client calls http.Transport.RoundTrip, which eventually calls tls.Dialer.DialContext
```

## Breaking Changes
None expected. This is a minor toolchain patch update.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@snyk-bot