chore(deps): retire Babel 6 and patch Babel 7 - #238
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Jest 23 installs Babel 6, which has no patch for the critical traversal-code-execution advisory. Both build fixtures also lock vulnerable Babel 7 traversal versions. Move the Jest/babel-jest/ts-jest adapters to their compatible Jest 24 versions and update Babel core to 7.29.7 in both installs, resolving traversal to 7.29.8. This removes Babel 6 and targets Dependabot alerts #163, #145 and #146.
Update ts-jest's configuration key and explicitly load Jest types for tests. Limit ambient TypeScript types to the repository's Node, React and Jest types so newer build-tool-only Babel declarations are not parsed by the existing TypeScript 3 compiler. Application source, TypeScript/React/webpack versions and public props remain unchanged.
Validation:
npm run verifypassed: all 42 regression tests, lint, library/types/demo/SSR builds, default-export and hydration checks, and package dry run.babel-traverse; every@babel/traverseis 7.29.8. Public-only registry andgit diff --checkchecks passed.Upstream advisory and Babel 6 patch status. Jest 24 is a bounded migration to remove this critical dependency; further test-tool modernization remains separate maintenance work.