Skip to content

chore(deps): retire Babel 6 and patch Babel 7 - #238

Merged
infeng merged 1 commit into
masterfrom
maintenance/critical-babel-stack
Sep 9, 2026
Merged

chore(deps): retire Babel 6 and patch Babel 7#238
infeng merged 1 commit into
masterfrom
maintenance/critical-babel-stack

Conversation

@infeng

@infeng infeng commented Sep 9, 2026

Copy link
Copy Markdown
Owner

Jest 23 installs Babel 6, which has no patch for the critical traversal-code-execution advisory. Both build fixtures also lock vulnerable Babel 7 traversal versions. Move the Jest/babel-jest/ts-jest adapters to their compatible Jest 24 versions and update Babel core to 7.29.7 in both installs, resolving traversal to 7.29.8. This removes Babel 6 and targets Dependabot alerts #163, #145 and #146.

Update ts-jest's configuration key and explicitly load Jest types for tests. Limit ambient TypeScript types to the repository's Node, React and Jest types so newer build-tool-only Babel declarations are not parsed by the existing TypeScript 3 compiler. Application source, TypeScript/React/webpack versions and public props remain unchanged.

Validation:

  • Clean public-registry install; npm run verify passed: all 42 regression tests, lint, library/types/demo/SSR builds, default-export and hydration checks, and package dry run.
  • Chrome 149: demo open/zoom/rotation/flip/navigation/close/inline mode and server HTML + interactive SSR hydration passed with no page errors.
  • Both lockfiles contain no babel-traverse; every @babel/traverse is 7.29.8. Public-only registry and git diff --check checks passed.
  • Rebasing onto the merged parent batch preserved the exact tested tree.

Upstream advisory and Babel 6 patch status. Jest 24 is a bounded migration to remove this critical dependency; further test-tool modernization remains separate maintenance work.

@infeng
infeng merged commit 877477e into master Sep 9, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant