Bump @babel/traverse from 7.20.13 to 7.23.2 #438

dependabot · 2023-10-17T04:23:34Z

Bumps @babel/traverse from 7.20.13 to 7.23.2.

Release notes

Sourced from @babel/traverse's releases.

v7.23.2 (2023-10-11)

NOTE: This release also re-publishes @babel/core, even if it does not appear in the linked release commit.

Thanks @jimmydief for your first PR!

🐛 Bug Fix

babel-traverse

#16033 Only evaluate own String/Number/Math methods (@nicolo-ribaudo)

babel-preset-typescript

#16022 Rewrite .tsx extension when using rewriteImportExtensions (@jimmydief)

babel-helpers

#16017 Fix: fallback to typeof when toString is applied to incompatible object (@JLHwung)

babel-helpers, babel-plugin-transform-modules-commonjs, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime

#16025 Avoid override mistake in namespace imports (@nicolo-ribaudo)

Committers: 5

Babel Bot (@babel-bot)

Huáng Jùnliàng (@JLHwung)

James Diefenderfer (@jimmydief)

Nicolò Ribaudo (@nicolo-ribaudo)

@liuxingbaoyu

v7.23.1 (2023-09-25)

Re-publishing @babel/helpers due to a publishing error in 7.23.0.

v7.23.0 (2023-09-25)

Thanks @lorenzoferre and @RajShukla1 for your first PRs!

🚀 New Feature

babel-plugin-proposal-import-wasm-source, babel-plugin-syntax-import-source, babel-plugin-transform-dynamic-import

#15870 Support transforming import source for wasm (@nicolo-ribaudo)

babel-helper-module-transforms, babel-helpers, babel-plugin-proposal-import-defer, babel-plugin-syntax-import-defer, babel-plugin-transform-modules-commonjs, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime, babel-standalone

#15878 Implement import defer proposal transform support (@nicolo-ribaudo)

babel-generator, babel-parser, babel-types

#15845 Implement import defer parsing support (@nicolo-ribaudo)

#15829 Add parsing support for the "source phase imports" proposal (@nicolo-ribaudo)

babel-generator, babel-helper-module-transforms, babel-parser, babel-plugin-transform-dynamic-import, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-systemjs, babel-traverse, babel-types

#15682 Add createImportExpressions parser option (@JLHwung)

babel-standalone

#15671 Pass through nonce to the transformed script element (@JLHwung)

babel-helper-function-name, babel-helper-member-expression-to-functions, babel-helpers, babel-parser, babel-plugin-proposal-destructuring-private, babel-plugin-proposal-optional-chaining-assign, babel-plugin-syntax-optional-chaining-assign, babel-plugin-transform-destructuring, babel-plugin-transform-optional-chaining, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime, babel-standalone, babel-types

#15751 Add support for optional chain in assignments (@nicolo-ribaudo)

babel-helpers, babel-plugin-proposal-decorators

#15895 Implement the "decorator metadata" proposal (@nicolo-ribaudo)

babel-traverse, babel-types

#15893 Add t.buildUndefinedNode (@liuxingbaoyu)

babel-preset-typescript

... (truncated)

Changelog

Sourced from @babel/traverse's changelog.

v7.23.2 (2023-10-11)

🐛 Bug Fix

babel-traverse

#16033 Only evaluate own String/Number/Math methods (@nicolo-ribaudo)

babel-preset-typescript

#16022 Rewrite .tsx extension when using rewriteImportExtensions (@jimmydief)

babel-helpers

#16017 Fix: fallback to typeof when toString is applied to incompatible object (@JLHwung)

babel-helpers, babel-plugin-transform-modules-commonjs, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime

#16025 Avoid override mistake in namespace imports (@nicolo-ribaudo)

v7.23.0 (2023-09-25)

🚀 New Feature

babel-plugin-proposal-import-wasm-source, babel-plugin-syntax-import-source, babel-plugin-transform-dynamic-import

#15870 Support transforming import source for wasm (@nicolo-ribaudo)

babel-helper-module-transforms, babel-helpers, babel-plugin-proposal-import-defer, babel-plugin-syntax-import-defer, babel-plugin-transform-modules-commonjs, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime, babel-standalone

#15878 Implement import defer proposal transform support (@nicolo-ribaudo)

babel-generator, babel-parser, babel-types

#15845 Implement import defer parsing support (@nicolo-ribaudo)

#15829 Add parsing support for the "source phase imports" proposal (@nicolo-ribaudo)

babel-generator, babel-helper-module-transforms, babel-parser, babel-plugin-transform-dynamic-import, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-systemjs, babel-traverse, babel-types

#15682 Add createImportExpressions parser option (@JLHwung)

babel-standalone

#15671 Pass through nonce to the transformed script element (@JLHwung)

babel-helper-function-name, babel-helper-member-expression-to-functions, babel-helpers, babel-parser, babel-plugin-proposal-destructuring-private, babel-plugin-proposal-optional-chaining-assign, babel-plugin-syntax-optional-chaining-assign, babel-plugin-transform-destructuring, babel-plugin-transform-optional-chaining, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime, babel-standalone, babel-types

#15751 Add support for optional chain in assignments (@nicolo-ribaudo)

babel-helpers, babel-plugin-proposal-decorators

#15895 Implement the "decorator metadata" proposal (@nicolo-ribaudo)

babel-traverse, babel-types

#15893 Add t.buildUndefinedNode (@liuxingbaoyu)

babel-preset-typescript

#15913 Add rewriteImportExtensions option to TS preset (@nicolo-ribaudo)

babel-parser

#15896 Allow TS tuples to have both labeled and unlabeled elements (@yukukotani)

🐛 Bug Fix

babel-plugin-transform-block-scoping

#15962 fix: transform-block-scoping captures the variables of the method in the loop (@liuxingbaoyu)

💅 Polish

babel-traverse

#15797 Expand evaluation of global built-ins in @babel/traverse (@lorenzoferre)

babel-plugin-proposal-explicit-resource-management

#15985 Improve source maps for blocks with using declarations (@nicolo-ribaudo)

🔬 Output optimization

babel-core, babel-helper-module-transforms, babel-plugin-transform-async-to-generator, babel-plugin-transform-classes, babel-plugin-transform-dynamic-import, babel-plugin-transform-function-name, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-umd, babel-plugin-transform-parameters, babel-plugin-transform-react-constant-elements, babel-plugin-transform-react-inline-elements, babel-plugin-transform-runtime, babel-plugin-transform-typescript, babel-preset-env

#15984 Inline exports.XXX = update in simple variable declarations (@nicolo-ribaudo)

v7.22.20 (2023-09-16)

... (truncated)

Commits

b4b9942 v7.23.2
b13376b Only evaluate own String/Number/Math methods (#16033)
ca58ec1 v7.23.0
0f333da Add createImportExpressions parser option (#15682)
3744545 Fix linting
c7e6806 Add t.buildUndefinedNode (#15893)
38ee8b4 Expand evaluation of global built-ins in @babel/traverse (#15797)
9f3dfd9 v7.22.20
3ed28b2 Fully support || and && in pluginToggleBooleanFlag (#15961)
77b0d73 v7.22.19
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

socket-security · 2023-10-17T04:25:35Z

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Issue	Package	Version	Note	Source
Critical CVE	@babel/traverse	7.18.5	CVE: GHSA-67hx-6x53-jw92 Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code (CRITICAL) Affected versions: < 7.23.2 Patched version: 7.23.2

Next steps

What is a critical CVE?

Contains a Critical Common Vulnerability and Exposure (CVE).

Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore [email protected] bar@* or ignore all packages with @SocketSecurity ignore-all

@SocketSecurity ignore @babel/[email protected]

Bumps [@babel/traverse](https://github.com/babel/babel/tree/HEAD/packages/babel-traverse) from 7.20.13 to 7.23.2. - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.23.2/packages/babel-traverse) --- updated-dependencies: - dependency-name: "@babel/traverse" dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]>

fallaciousreasoning

LGTM

github-actions · 2023-10-17T19:55:15Z

👋 Thanks for Submitting! This PR is available for preview at the link below.

✅ PR tip preview: https://438.pr.nala.bravesoftware.com/
✅ Commit preview: https://438.pr.nala.bravesoftware.com/commit-4873b9c51f133fd2b826e5f99d35c76f621ba1b0/

Variables Diff

--- ./tokens/css/variables.old.css	2023-10-17 19:53:25.610997756 +0000
+++ ./tokens/css/variables.css	2023-10-17 19:52:48.002383101 +0000
@@ -1,6 +1,6 @@
 /**
  * Do not edit directly
- * Generated on Tue Oct 17 2023 19:43:26 GMT+0000 (Coordinated Universal Time)
+ * Generated on Tue Oct 17 2023 19:52:48 GMT+0000 (Coordinated Universal Time)
  */
 
 :root {

dependabot bot requested review from fallaciousreasoning, petemill and AlanBreck as code owners October 17, 2023 04:23

dependabot bot added the dependencies Pull requests that update a dependency file label Oct 17, 2023

dependabot bot had a problem deploying to staging October 17, 2023 04:23 Failure

fallaciousreasoning force-pushed the dependabot/npm_and_yarn/babel/traverse-7.23.2 branch from ab88466 to 4873b9c Compare October 17, 2023 19:51

fallaciousreasoning temporarily deployed to staging October 17, 2023 19:51 — with GitHub Actions Inactive

fallaciousreasoning approved these changes Oct 17, 2023

View reviewed changes

fallaciousreasoning enabled auto-merge (squash) October 17, 2023 19:52

fallaciousreasoning merged commit 7c6bfd9 into main Oct 17, 2023
4 of 5 checks passed

fallaciousreasoning deleted the dependabot/npm_and_yarn/babel/traverse-7.23.2 branch October 17, 2023 19:55

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump @babel/traverse from 7.20.13 to 7.23.2 #438

Bump @babel/traverse from 7.20.13 to 7.23.2 #438

dependabot bot commented on behalf of github Oct 17, 2023

socket-security bot commented Oct 17, 2023

fallaciousreasoning left a comment

github-actions bot commented Oct 17, 2023

Bump @babel/traverse from 7.20.13 to 7.23.2 #438

Bump @babel/traverse from 7.20.13 to 7.23.2 #438

Conversation

dependabot bot commented on behalf of github Oct 17, 2023

v7.23.2 (2023-10-11)

🐛 Bug Fix

Committers: 5

v7.23.1 (2023-09-25)

v7.23.0 (2023-09-25)

🚀 New Feature

v7.23.2 (2023-10-11)

🐛 Bug Fix

v7.23.0 (2023-09-25)

🚀 New Feature

🐛 Bug Fix

💅 Polish

🔬 Output optimization

v7.22.20 (2023-09-16)

socket-security bot commented Oct 17, 2023

Next steps

fallaciousreasoning left a comment

Choose a reason for hiding this comment

github-actions bot commented Oct 17, 2023