Update dependency @babel/core to v7.29.6 [SECURITY]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@babel/core (source)	7.12.3 → 7.29.6

---

@​babel/core: Arbitrary File Read via sourceMappingURL Comment

CVE-2026-49356 / GHSA-4x5r-pxfx-6jf8

More information

Details

Impact

Using @babel/core to compile maliciously crafted code can allow ab attacker to read any source map from the system that is running Babel, if these conditions are all true:

• the attacker controls the input source code
• the attacker can read the output source code
• the attacker knows the path of the source map file that they want to read

Users that only compile trusted code are not impacted.

Patches

The vulnerability has been fixed in @babel/core@7.29.6 and @babel/core@8.0.0-rc.6.

Workarounds

Callers can mitigate the issue without upgrading by setting inputSourceMap: false in their Babel options.

Callers can also manually extract the #sourceMappingURL comment from the input source code, validate whether the source map that it links to is allowed to be read, and if it is pass an object to inputSourceMap (passing false when it's not).

Credits

Thanks Teodor-Cristian Radoi for reporting the vulnerability.

Severity

• CVSS Score: 3.2 / 10 (Low)
• Vector String: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

References

• https://github.com/babel/babel/security/advisories/GHSA-4x5r-pxfx-6jf8
• https://babeljs.io/docs/options#inputsourcemap
• https://nvd.nist.gov/vuln/detail/CVE-2026-49356
• https://github.com/advisories/GHSA-4x5r-pxfx-6jf8

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

babel/babel (@​babel/core)

v7.29.6

Compare Source

v7.29.6 (2026-05-25)

🐛 Bug Fix

• babel-generator
  • #​18014 Catchup source map position in preserveFormat (@​nicolo-ribaudo)
• babel-core
  • #​18001 [7.x packport]Improve input source map handling (@​JLHwung)
• babel-core, babel-generator
  • #​17998 Preserve original identifier names from input sourcemaps (#​17992) (@​Andarist)

Committers: 3

• Huáng Jùnliàng (@​JLHwung)
• Mateusz Burzyński (@​Andarist)
• Nicolò Ribaudo (@​nicolo-ribaudo)

v7.29.0

Compare Source

v7.29.0 (2026-01-31)

Thanks @​simbahax for your first PR!

🚀 New Feature

• babel-types
  • #​17750 [7.x backport] Add attributes import declaration builder (@​JLHwung)
• babel-standalone
  • #​17663 [7.x backport] feat(standalone): export async transform (@​JLHwung)
  • #​17725 [7.x backport] feat: read standalone targets from data-targets (@​JLHwung)

🐛 Bug Fix

• babel-parser
  • #​17765 fix(parser): correctly parse type assertions in extends clause (@​nicolo-ribaudo)
  • #​17723 [7.x backport] fix(parser): improve super type argument parsing (@​JLHwung)
• babel-traverse
  • #​17708 fix(traverse): provide a hub when traversing a File or Program and no parentPath is given (@​simbahax)
• babel-plugin-transform-block-scoping, babel-traverse
  • #​17737 [7.x backport] fix: Rename switch discriminant references when body creates shadowing variable (@​magic-akari)

🏃‍♀️ Performance

• babel-generator, babel-runtime-corejs3
  • #​17642 [Babel 7] Improve generator performance (@​liuxingbaoyu)

Committers: 6

• David (@​simbahax)
• Huáng Jùnliàng (@​JLHwung)
• Nicolò Ribaudo (@​nicolo-ribaudo)
• @​liuxingbaoyu
• @​magic-akari

v7.28.6

Compare Source

v7.28.5

Compare Source

👓 Spec Compliance

• babel-parser
  • #​17446 Allow Runtime Errors for Function Call Assignment Targets (@​liuxingbaoyu)
• babel-helper-validator-identifier
  • #​17501 fix: update identifier to unicode 17 (@​fisker)

🐛 Bug Fix

• babel-plugin-proposal-destructuring-private
  • #​17534 Allow mixing private destructuring and rest (@​CO0Ki3)
• babel-parser
  • #​17521 Improve @babel/parser error typing (@​JLHwung)
  • #​17491 fix: improve ts-only declaration parsing (@​JLHwung)
• babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring
  • #​17519 fix: rest correctly returns plain array (@​liuxingbaoyu)
• babel-helper-create-class-features-plugin, babel-helper-member-expression-to-functions, babel-plugin-transform-block-scoping, babel-plugin-transform-optional-chaining, babel-traverse, babel-types
  • #​17503 Fix JSXIdentifier handling in isReferencedIdentifier (@​JLHwung)
• babel-traverse
  • #​17504 fix: ensure scope.push register in anonymous fn (@​JLHwung)

🏠 Internal

• babel-types
  • #​17494 Type checking babel-types scripts (@​JLHwung)

🏃‍♀️ Performance

• babel-core
  • #​17490 Faster finding of locations in buildCodeFrameError (@​liuxingbaoyu)

v7.28.4

Compare Source

🏠 Internal

• babel-core, babel-helper-check-duplicate-nodes, babel-traverse, babel-types
  • #​17493 Update Jest to v30.1.1 (@​JLHwung)
• babel-plugin-transform-regenerator
  • #​17455 chore: Clean up transform-regenerator (@​liuxingbaoyu)
• babel-core
  • #​17474 Switch to @​jridgewell/remapping (@​mrginglymus)

v7.28.3

Compare Source

👓 Spec Compliance

• babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators, babel-plugin-transform-class-static-block, babel-preset-env
  • #​17443 [static blocks] Do not inject new static fields after static code (@​nicolo-ribaudo)

🐛 Bug Fix

• babel-parser
  • #​17465 fix(parser/typescript): parse import("./a", {with:{},}) (@​easrng)
  • #​17478 fix(parser): stop subscript parsing on async arrow (@​JLHwung)

💅 Polish

• babel-plugin-transform-regenerator, babel-plugin-transform-runtime
  • #​17363 Do not save last yield in call in temp var (@​nicolo-ribaudo)

📝 Documentation

• #​17448 move eslint-{parser,plugin} docs to the website (@​JLHwung)

🏠 Internal

• #​17454 Enable type checking for scripts and babel-worker.cjs (@​JLHwung)

🔬 Output optimization

• babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions
  • #​17444 Optimize do expression output (@​JLHwung)

v7.28.0

Compare Source

🚀 New Feature

• babel-node
  • #​17147 Support top level await in node repl (@​liuxingbaoyu)
• babel-types
  • #​17258 feat(matchesPattern): support super/private/meta (@​JLHwung)
• babel-compat-data, babel-preset-env
  • #​17355 Add explicit resource management to preset-env (@​JLHwung)
• babel-core, babel-parser
  • #​17390 Support sourceType: "commonjs" (@​JLHwung)
• babel-generator, babel-parser
  • #​17346 Materialize explicitResourceManagement parser plugin (@​JLHwung)
• babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-plugin-transform-object-rest-spread, babel-traverse, babel-types
  • #​17391 LVal coverage updates (Part 2) (@​JLHwung)
• babel-parser, babel-traverse, babel-types
  • #​17378 Accept bigints in t.bigIntLiteral factory (@​JLHwung)
• babel-generator, babel-plugin-proposal-destructuring-private, babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring, babel-plugin-transform-explicit-resource-management, babel-plugin-transform-react-display-name, babel-types
  • #​17277 Transform discard binding (@​JLHwung)
• babel-generator, babel-parser, babel-plugin-proposal-destructuring-private, babel-plugin-transform-block-scoping, babel-plugin-transform-object-rest-spread, babel-plugin-transform-typescript, babel-traverse, babel-types
  • #​17163 Parse discard binding (@​JLHwung)

🐛 Bug Fix

• babel-helper-globals, babel-plugin-transform-classes, babel-traverse
  • #​17297 Create babel-helper-globals (@​JLHwung)
• babel-types
  • #​17009 feature: TSTypeOperator: keyof (#​16799) (@​coderaiser)

🏠 Internal

• babel-compat-data, babel-plugin-proposal-decorators, babel-plugin-transform-async-generator-functions, babel-plugin-transform-json-modules, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs3
  • #​17403 Update babel-polyfill packages (@​nicolo-ribaudo)

v7.27.7

Compare Source

👓 Spec Compliance

• babel-parser, babel-plugin-transform-classes
  • #​17203 Interepret parser allow* options as top level only (@​JLHwung)
• babel-parser
  • #​17371 fix: disable using in ambient context (@​JLHwung)

🐛 Bug Fix

• babel-core
  • #​17392 Improve TS babel config loading (@​JLHwung)
• babel-types
  • #​17376 fix: support negative bigint in valueToNode (@​JLHwung)
• babel-plugin-transform-parameters
  • #​17352 fix: Params of async function* should throw synchronously (@​liuxingbaoyu)

🏠 Internal

• babel-plugin-transform-destructuring, babel-plugin-transform-object-rest-spread
  • #​17389 Use NodePath#splitExportDeclaration in destructuring transforms (@​JLHwung)

v7.27.4

Compare Source

👓 Spec Compliance

• babel-parser, babel-plugin-proposal-explicit-resource-management
  • #​17323 Disallow using in bare case statement (@​JLHwung)

💅 Polish

• babel-parser
  • #​17311 Improve parseExpression error messages (@​JLHwung)

🔬 Output optimization

• babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-classes, babel-plugin-transform-destructuring, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • #​17287 Reduce regenerator size more (@​liuxingbaoyu)
• babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-classes, babel-plugin-transform-destructuring, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs3
  • #​17334 Use shorter method names for regenerator context (@​nicolo-ribaudo)
  • #​17268 Reduce regenerator helper size (@​liuxingbaoyu)
• babel-core, babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-classes, babel-plugin-transform-destructuring, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime, babel-standalone
  • #​17238 Split regeneratorRuntime into multiple helpers (@​nicolo-ribaudo)

v7.27.3

Compare Source

🐛 Bug Fix

• babel-generator
  • #​17324 Improve multiline comments handling in yield/await expression (@​JLHwung)
• babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3
  • #​17328 Correctly set .displayName on GeneratorFunction (@​nicolo-ribaudo)
• babel-plugin-proposal-explicit-resource-management
  • #​17319 fix: handle shadowed binding in for using of body (@​JLHwung)
  • #​17317 fix: support named evaluation for using declaration (@​JLHwung)
• babel-plugin-proposal-decorators, babel-types
  • #​17321 fix(converter): Remove abstract modifiers in class declaration to expression conversion (@​magic-akari)
• babel-helper-module-transforms, babel-plugin-proposal-explicit-resource-management, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-umd
  • #​17257 Preserve class id when transforming using declarations with exported class (@​JLHwung)
• babel-parser
  • #​17312 fix(parser): properly handle optional markers in generator class methods (@​magic-akari)
  • #​17307 fix(parser): Terminate modifier parsing at newline (@​magic-akari)
• babel-generator, babel-parser
  • #​17308 Improve import phase parsing (@​JLHwung)

v7.27.1

Compare Source

👓 Spec Compliance

• babel-parser
  • #​17254 Allow using of as lexical declaration within for (@​JLHwung)
  • #​17230 Disallow get/set in TSPropertySignature (@​JLHwung)
• babel-parser, babel-types
  • #​17193 Stricter TSImportType options parsing (@​JLHwung)

🐛 Bug Fix

• babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-traverse
  • #​17137 fix: do expressions should allow early exit (@​kermanx)
• babel-helper-wrap-function, babel-plugin-transform-async-to-generator
  • #​17251 Fix: propagate argument evaluation errors through async promise chain (@​magic-akari)
• babel-helper-remap-async-to-generator, babel-plugin-transform-async-to-generator
  • #​17231 fix apply()/call() annotated as pure (@​Lacsw)
• babel-helper-fixtures, babel-parser
  • #​17233 Create ChainExpression within TSInstantiationExpression (@​JLHwung)
• babel-generator, babel-parser
  • #​17226 Fill optional AST properties when both estree and typescript parser plugin are enabled (Part 2) (@​JLHwung)
• babel-parser
  • #​17224 Fill optional AST properties when both estree and typescript parser plugin are enabled (Part 1) (@​JLHwung)
  • #​17080 Fix start of TSParameterProperty (@​JLHwung)
• babel-compat-data, babel-preset-env
  • #​17228 Update firefox bugfix compat data (@​JLHwung)
• babel-traverse
  • #​17156 fix: Objects and arrays with multiple references should not be evaluated (@​liuxingbaoyu)
• babel-generator
  • #​17216 Fix: support const type parameter in generator (@​JLHwung)

💅 Polish

• babel-plugin-bugfix-v8-spread-parameters-in-optional-chaining, babel-plugin-proposal-decorators, babel-plugin-transform-arrow-functions, babel-plugin-transform-class-properties, babel-plugin-transform-destructuring, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-chaining, babel-plugin-transform-parameters, babel-traverse
  • #​17221 Reduce generated names size for the 10th-11th (@​nicolo-ribaudo)

🏠 Internal

• babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • #​17263 Remove unused regenerator-runtime dep in @babel/runtime (@​nicolo-ribaudo)
• babel-compat-data, babel-preset-env
  • #​17256 Tune plugin compat data (@​JLHwung)
• babel-compat-data, babel-standalone
  • #​17236 migrate babel-compat-data build script to mjs (@​JLHwung)
• Other
  • #​17232 Bump typescript-eslint to 8.29.1 (@​JLHwung)
  • #​17219 test: add basic typescript-eslint integration tests (@​JLHwung)
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
• babel-register
  • #​16844 Migrate @babel/register to cts (@​liuxingbaoyu)
• babel-cli, babel-compat-data, babel-core, babel-generator, babel-helper-compilation-targets, babel-helper-fixtures, babel-helper-module-imports, babel-helper-module-transforms, babel-helper-plugin-test-runner, babel-helper-transform-fixture-test-runner, babel-helpers, babel-node, babel-parser, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-systemjs, babel-plugin-transform-modules-umd, babel-plugin-transform-react-display-name, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-plugin-transform-typeof-symbol, babel-plugin-transform-typescript, babel-preset-env, babel-register, babel-standalone, babel-types
  • #​17207 Enforce node protocol import (@​JLHwung)
• babel-plugin-transform-regenerator
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
• babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
• babel-helpers, babel-plugin-transform-regenerator
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
• babel-helpers
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)

🔬 Output optimization

• babel-helpers, babel-plugin-transform-modules-commonjs, babel-runtime-corejs3
  • #​16538 Reduce interopRequireWildcard size (@​liuxingbaoyu)
• babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3
  • #​17213 Reduce regeneratorRuntime size (@​liuxingbaoyu)

v7.26.10

Compare Source

👓 Spec Compliance

• babel-parser
  • #​17159 Disallow decorator in array pattern (@​JLHwung)

🐛 Bug Fix

• babel-parser, babel-template
  • #​17164 Fix: always initialize ExportDeclaration attributes (@​JLHwung)
• babel-core
  • #​17142 fix: "Map maximum size exceeded" in deepClone (@​liuxingbaoyu)
• babel-parser, babel-plugin-transform-typescript
  • #​17154 Update typescript parser tests (@​JLHwung)
• babel-traverse
  • #​17151 fix: Should not evaluate vars in child scope (@​liuxingbaoyu)
• babel-generator
  • #​17153 fix: Correctly generate abstract override (@​liuxingbaoyu)
• babel-parser
  • #​17107 Fix source type detection when parsing TypeScript (@​JLHwung)
• babel-helpers, babel-runtime, babel-runtime-corejs2, babel-runtime-corejs3
  • #​17173 Fix processing of replacement pattern with named capture groups (@​mmmsssttt404)

💅 Polish

• babel-standalone
  • #​17158 Avoid warnings when re-bundling @​babel/standalone with webpack (@​liuxingbaoyu)

🏠 Internal

• babel-parser
  • #​17160 Left-value parsing cleanup (@​JLHwung)

v7.26.9

Compare Source

🐛 Bug Fix

• babel-types
  • #​17103 fix: Definition for TSPropertySignature.kind (@​liuxingbaoyu)
• babel-generator, babel-types
  • #​17062 Print TypeScript optional/definite in ClassPrivateProperty (@​jamiebuilds-signal)

🏠 Internal

• babel-types
  • #​17130 Use .ts files with explicit reexports to solve name conflicts (@​nicolo-ribaudo)
• babel-core
  • #​17127 Do not depend on @types/gensync in Babel 7 (@​nicolo-ribaudo)

v7.26.8

Compare Source

v7.26.8 (2025-02-08)

🏠 Internal

• babel-preset-env
  • #​17097 Update dependency babel-plugin-polyfill-corejs3 to ^0.11.0

v7.26.7

Compare Source

🐛 Bug Fix

• babel-helpers, babel-preset-env, babel-runtime-corejs3
  • #​17086 Make "object without properties" helpers ES6-compatible (@​tquetano-netflix)
• babel-plugin-transform-typeof-symbol
  • #​17085 fix: Correctly handle typeof in arrow functions (@​liuxingbaoyu)
• babel-parser
  • #​17079 Respect ranges option in estree method value (@​JLHwung)
• babel-core
  • #​17052 Do not try to parse .ts configs as JSON if natively supported (@​nicolo-ribaudo)
• babel-plugin-transform-typescript
  • #​17050 fix: correctly resolve references to non-constant enum members (@​branchseer)
• babel-plugin-transform-typescript, babel-traverse, babel-types
  • #​17025 fix: Remove type-only import x = y.z (@​liuxingbaoyu)

v7.26.0

Compare Source

🚀 New Feature

• babel-core, babel-generator, babel-parser, babel-plugin-syntax-import-assertions, babel-plugin-syntax-import-attributes, babel-preset-env, babel-standalone, babel-types
  • #​16850 Enable import attributes parsing by default (@​nicolo-ribaudo)
• babel-core
  • #​16862 feat: support async plugin's pre/post (@​timofei-iatsenko)
• babel-compat-data, babel-plugin-proposal-regexp-modifiers, babel-plugin-transform-regexp-modifiers, babel-preset-env, babel-standalone
  • #​16692 Add transform-regexp-modifiers to preset-env (@​JLHwung)
• babel-parser
  • #​16849 feat: add startIndex parser option (@​DylanPiercey)
• babel-generator, babel-parser, babel-plugin-syntax-flow
  • #​16841 Always enable parsing of Flow enums (@​nicolo-ribaudo)
• babel-helpers, babel-preset-typescript, babel-runtime-corejs3
  • #​16794 Support import() in rewriteImportExtensions (@​liuxingbaoyu)
• babel-generator, babel-parser
  • #​16708 Add experimental format-preserving mode to @babel/generator (@​nicolo-ribaudo)

🐛 Bug Fix

• babel-core
  • #​16928 Workaround Node.js bug for parallel loading of TLA modules (@​nicolo-ribaudo)
  • #​16926 Fix loading of modules with TLA in Node.js 23 (@​nicolo-ribaudo)

💅 Polish

• babel-plugin-proposal-json-modules, babel-plugin-transform-json-modules, babel-standalone
  • #​16924 Rename proposal-json-modules to transform-json-modules (@​nicolo-ribaudo)

🏠 Internal

• babel-code-frame, babel-highlight
  • #​16896 Inline @babel/highlight in @babel/code-frame (@​nicolo-ribaudo)
• babel-generator, babel-parser, babel-types
  • #​16732 Add kind to TSModuleDeclaration (@​liuxingbaoyu)

🏃‍♀️ Performance

• babel-helper-module-transforms, babel-plugin-transform-modules-commonjs
  • #​16882 perf: Improve module transforms (@​liuxingbaoyu)

v7.25.9

Compare Source

🐛 Bug Fix

• babel-parser, babel-template, babel-types
  • #​16905 fix: Keep type annotations in syntacticPlaceholders mode (@​liuxingbaoyu)
• babel-helper-compilation-targets, babel-preset-env
  • #​16907 fix: support BROWSERSLIST{,_CONFIG} env (@​JLHwung)
• Other
  • #​16884 Analyze ClassAccessorProperty to prevent the no-undef rule (@​victorenator)

🏠 Internal

• babel-helper-transform-fixture-test-runner
  • #​16914 remove test options flaky (@​JLHwung)

🏃‍♀️ Performance

• babel-parser, babel-types
  • #​16918 perf: Make VISITOR_KEYS etc. faster to access (@​liuxingbaoyu)

v7.25.8

Compare Source

🐛 Bug Fix

• babel-core
  • #​16888 Restore public API of resolvePlugin/resolvePreset (@​nicolo-ribaudo)

🏠 Internal

• babel-parser, babel-plugin-proposal-async-do-expressions, babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-plugin-proposal-explicit-resource-management, babel-plugin-proposal-export-default-from, babel-plugin-proposal-function-bind, babel-plugin-proposal-function-sent, babel-plugin-proposal-import-defer, babel-plugin-proposal-partial-application, babel-plugin-proposal-throw-expressions, babel-plugin-transform-async-generator-functions, babel-plugin-transform-class-static-block, babel-plugin-transform-dynamic-import, babel-plugin-transform-export-namespace-from, babel-plugin-transform-json-strings, babel-plugin-transform-logical-assignment-operators, babel-plugin-transform-nullish-coalescing-operator, babel-plugin-transform-numeric-separator, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-catch-binding, babel-plugin-transform-optional-chaining, babel-plugin-transform-private-property-in-object, babel-preset-env
  • #​16824 Inline one-line syntax plugins (@​nicolo-ribaudo)

v7.25.7

Compare Source

🐛 Bug Fix

• babel-helper-validator-identifier
  • #​16825 fix: update identifier to unicode 16 (@​JLHwung)
• babel-traverse
  • #​16814 fix: issue with node path keys updated on unrelated paths (@​DylanPiercey)
• babel-plugin-transform-classes
  • #​16797 Use an inclusion rather than exclusion list for super() check (@​nicolo-ribaudo)
• babel-generator
  • #​16788 Fix printing of TS infer in compact mode (@​nicolo-ribaudo)
  • #​16785 Print TS type annotations for destructuring in assignment pattern (@​nicolo-ribaudo)
  • #​16778 Respect [no LineTerminator here] after nodes (@​nicolo-ribaudo)

💅 Polish

• babel-types
  • #​16852 Add deprecated JSDOC for fields (@​liuxingbaoyu)

🏠 Internal

• babel-core
  • #​16820 Allow sync loading of ESM when --experimental-require-module (@​nicolo-ribaudo)
• babel-helper-compilation-targets, babel-helper-plugin-utils, babel-preset-env
  • #​16858 Add browserslist config to external dependency (@​JLHwung)
• babel-plugin-proposal-destructuring-private, babel-plugin-syntax-decimal, babel-plugin-syntax-import-reflection, babel-standalone
  • #​16809 Archive syntax-import-reflection and syntax-decimal (@​nicolo-ribaudo)
• babel-generator
  • #​16779 Simplify logic for [no LineTerminator here] before nodes (@​nicolo-ribaudo)

🏃‍♀️ Performance

• babel-plugin-transform-typescript
  • #​16875 perf: Avoid extra cloning of namespaces (@​liuxingbaoyu)
• babel-types
  • #​16842 perf: Improve @​babel/types builders (@​liuxingbaoyu)
  • #​16828 Only access BABEL_TYPES_8_BREAKING at startup (@​nicolo-ribaudo)

v7.25.2

Compare Source

🐛 Bug Fix

• babel-core, babel-traverse
  • #​16695 Ensure that requeueComputedKeyAndDecorators is available (@​nicolo-ribaudo)

v7.24.9

Compare Source

🐛 Bug Fix

• babel-core, babel-standalone
  • #​16639 Avoid require() call in @babel/standalone bundle (@​nicolo-ribaudo)
• babel-types
  • #​16638 fix: provide legacy typings for TS < 4.1 (@​JLHwung)

💅 Polish

• babel-generator, babel-plugin-transform-optional-chaining
  • #​16617 Avoid extra parens in TS as/satisfies (@​nicolo-ribaudo)

🏠 Internal

• babel-helper-module-transforms
  • #​16629 Lazy top-level initializations for module transforms (@​guybedford)

v7.24.8

Compare Source

👓 Spec Compliance

• babel-parser
  • #​16567 Do not use strict mode in TS declare (@​liuxingbaoyu)

🐛 Bug Fix

• babel-generator
  • #​16630 Correctly print parens around in in for heads (@​nicolo-ribaudo)
  • #​16626 Fix printing of comments in await using (@​nicolo-ribaudo)
  • #​16591 fix typescript code generation for yield expression inside type expre… (@​SreeXD)
• babel-parser
  • #​16613 Disallow destructuring assignment in using declarations (@​H0onnn)
  • #​16490 fix: do not add .value: undefined to regexp literals (@​liuxingbaoyu)
• babel-types
  • #​16615 Remove boolean props from ObjectTypeInternalSlot visitor keys (@​nicolo-ribaudo)
• babel-plugin-transform-typescript
  • #​16566 fix: Correctly handle export import x = (@​liuxingbaoyu)

💅 Polish

• babel-generator
  • #​16625 Avoid unnecessary parens around async in for await (@​nicolo-ribaudo)
• babel-traverse
  • #​16619 Avoid checking Scope.globals multiple times (@​liuxingbaoyu)

v7.24.7

Compare Source

🐛 Bug Fix

• babel-node
  • #​16554 Allow extra flags in babel-node (@​nicolo-ribaudo)
• babel-traverse
  • #​16522 fix: incorrect constantViolations with destructuring (@​liuxingbaoyu)
• babel-helper-transform-fixture-test-runner, babel-plugin-proposal-explicit-resource-management
  • #​16524 fix: Transform using in switch correctly (@​liuxingbaoyu)

🏠 Internal

• babel-helpers, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • #​16525 Delete unused array helpers (@​blakewilson)

v7.24.6

Compare Source

🐛 Bug Fix

• babel-helper-create-class-features-plugin, babel-plugin-transform-class-properties
  • #​16514 Fix source maps for private member expressions (@​nicolo-ribaudo)
• babel-core, babel-generator, babel-plugin-transform-modules-commonjs
  • #​16515 Fix source maps for template literals (@​nicolo-ribaudo)
• babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
  • #​16485 Support undecorated static accessor in anonymous classes (@​JLHwung)
  • #​16484 Fix decorator bare yield await (@​JLHwung)
• babel-helpers, babel-plugin-proposal-decorators, babel-runtime-corejs3
  • #​16483 Fix: throw TypeError if addInitializer is called after finished (@​JLHwung)
• babel-parser, babel-plugin-transform-typescript
  • #​16476 fix: Correctly parse cls.fn<C> = x (@​liuxingbaoyu)

🏠 Internal

• babel-core, babel-helpers, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • #​16501 Generate helper metadata at build time (@​nicolo-ribaudo)
• babel-helpers
  • #​16499 Add tsconfig.json for @babel/helpers/src/helpers (@​nicolo-ribaudo)
• babel-cli, babel-helpers, babel-plugin-external-helpers, babel-plugin-proposal-decorators, babel-plugin-transform-class-properties, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-systemjs, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • #​16495 Move all runtime helpers to individual files (@​nicolo-ribaudo)
• babel-parser, babel-traverse
  • #​16482 Statically generate boilerplate for bitfield accessors (@​nicolo-ribaudo)
• Other
  • #​16466 Migrate import assertions syntax (@​JLHwung)

v7.24.5

Compare Source

🐛 Bug Fix

• babel-plugin-transform-classes, babel-traverse
  • #​16377 fix: TypeScript annotation affects output (@​liuxingbaoyu)
• babel-helpers, babel-plugin-proposal-explicit-resource-management, babel-runtime-corejs3
  • #​16440 Fix suppressed error order (@​sossost)
  • #​16408 Await nullish async disposable (@​JLHwung)

💅 Polish

• babel-parser
  • #​16407 Recover from exported using declaration (@​JLHwung)

🏠 Internal

• Other
  • #​16414 Relax ESLint peerDependency constraint to allow v9 (@​liuxingbaoyu)
• babel-parser
  • #​16425 Improve @babel/parser AST types (@​nicolo-ribaudo)
  • #​16417 Always pass type argument to .startNode (@​nicolo-ribaudo)
• babel-helper-create-class-features-plugin, babel-helper-member-expression-to-functions, babel-helper-module-transforms, babel-helper-split-export-declaration, babel-helper-wrap-function, babel-helpers, babel-plugin-bugfix-firefox-class-in-computed-class-key, babel-plugin-proposal-explicit-resource-management, babel-plugin-transform-block-scoping, babel-plugin-transform-destructuring, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-chaining, babel-plugin-transform-parameters, babel-plugin-transform-private-property-in-object, babel-plugin-transform-react-jsx-self, babel-plugin-transform-typeof-symbol, babel-plugin-transform-typescript, babel-traverse
  • [#​16439](https://redirect.github.com

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@babel/core (source)	7.12.3 → 7.29.6

---

@​babel/core: Arbitrary File Read via sourceMappingURL Comment

CVE-2026-49356 / GHSA-4x5r-pxfx-6jf8

More information

Details

Impact

Using @babel/core to compile maliciously crafted code can allow ab attacker to read any source map from the system that is running Babel, if these conditions are all true:

• the attacker controls the input source code
• the attacker can read the output source code
• the attacker knows the path of the source map file that they want to read

Users that only compile trusted code are not impacted.

Patches

The vulnerability has been fixed in @babel/core@7.29.6 and @babel/core@8.0.0-rc.6.

Workarounds

Callers can mitigate the issue without upgrading by setting inputSourceMap: false in their Babel options.

Callers can also manually extract the #sourceMappingURL comment from the input source code, validate whether the source map that it links to is allowed to be read, and if it is pass an object to inputSourceMap (passing false when it's not).

Credits

Thanks Teodor-Cristian Radoi for reporting the vulnerability.

Severity

• CVSS Score: 3.2 / 10 (Low)
• Vector String: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

References

• https://github.com/babel/babel/security/advisories/GHSA-4x5r-pxfx-6jf8
• https://babeljs.io/docs/options#inputsourcemap
• https://nvd.nist.gov/vuln/detail/CVE-2026-49356
• https://github.com/advisories/GHSA-4x5r-pxfx-6jf8

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

babel/babel (@​babel/core)

v7.29.6

Compare Source

v7.29.6 (2026-05-25)

🐛 Bug Fix

• babel-generator
  • #​18014 Catchup source map position in preserveFormat (@​nicolo-ribaudo)
• babel-core
  • #​18001 [7.x packport]Improve input source map handling (@​JLHwung)
• babel-core, babel-generator
  • #​17998 Preserve original identifier names from input sourcemaps (#​17992) (@​Andarist)

Committers: 3

• Huáng Jùnliàng (@​JLHwung)
• Mateusz Burzyński (@​Andarist)
• Nicolò Ribaudo (@​nicolo-ribaudo)

v7.29.0

Compare Source

v7.29.0 (2026-01-31)

Thanks @​simbahax for your first PR!

🚀 New Feature

• babel-types
  • #​17750 [7.x backport] Add attributes import declaration builder (@​JLHwung)
• babel-standalone
  • #​17663 [7.x backport] feat(standalone): export async transform (@​JLHwung)
  • #​17725 [7.x backport] feat: read standalone targets from data-targets (@​JLHwung)

🐛 Bug Fix

• babel-parser
  • #​17765 fix(parser): correctly parse type assertions in extends clause (@​nicolo-ribaudo)
  • #​17723 [7.x backport] fix(parser): improve super type argument parsing (@​JLHwung)
• babel-traverse
  • #​17708 fix(traverse): provide a hub when traversing a File or Program and no parentPath is given (@​simbahax)
• babel-plugin-transform-block-scoping, babel-traverse
  • #​17737 [7.x backport] fix: Rename switch discriminant references when body creates shadowing variable (@​magic-akari)

🏃‍♀️ Performance

• babel-generator, babel-runtime-corejs3
  • #​17642 [Babel 7] Improve generator performance (@​liuxingbaoyu)

Committers: 6

• David (@​simbahax)
• Huáng Jùnliàng (@​JLHwung)
• Nicolò Ribaudo (@​nicolo-ribaudo)
• @​liuxingbaoyu
• @​magic-akari

v7.28.6

Compare Source

v7.28.5

Compare Source

👓 Spec Compliance

• babel-parser
  • #​17446 Allow Runtime Errors for Function Call Assignment Targets (@​liuxingbaoyu)
• babel-helper-validator-identifier
  • #​17501 fix: update identifier to unicode 17 (@​fisker)

🐛 Bug Fix

• babel-plugin-proposal-destructuring-private
  • #​17534 Allow mixing private destructuring and rest (@​CO0Ki3)
• babel-parser
  • #​17521 Improve @babel/parser error typing (@​JLHwung)
  • #​17491 fix: improve ts-only declaration parsing (@​JLHwung)
• babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring
  • #​17519 fix: rest correctly returns plain array (@​liuxingbaoyu)
• babel-helper-create-class-features-plugin, babel-helper-member-expression-to-functions, babel-plugin-transform-block-scoping, babel-plugin-transform-optional-chaining, babel-traverse, babel-types
  • #​17503 Fix JSXIdentifier handling in isReferencedIdentifier (@​JLHwung)
• babel-traverse
  • #​17504 fix: ensure scope.push register in anonymous fn (@​JLHwung)

🏠 Internal

• babel-types
  • #​17494 Type checking babel-types scripts (@​JLHwung)

🏃‍♀️ Performance

• babel-core
  • #​17490 Faster finding of locations in buildCodeFrameError (@​liuxingbaoyu)

v7.28.4

Compare Source

🏠 Internal

• babel-core, babel-helper-check-duplicate-nodes, babel-traverse, babel-types
  • #​17493 Update Jest to v30.1.1 (@​JLHwung)
• babel-plugin-transform-regenerator
  • #​17455 chore: Clean up transform-regenerator (@​liuxingbaoyu)
• babel-core
  • #​17474 Switch to @​jridgewell/remapping (@​mrginglymus)

v7.28.3

Compare Source

👓 Spec Compliance

• babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators, babel-plugin-transform-class-static-block, babel-preset-env
  • #​17443 [static blocks] Do not inject new static fields after static code (@​nicolo-ribaudo)

🐛 Bug Fix

• babel-parser
  • #​17465 fix(parser/typescript): parse import("./a", {with:{},}) (@​easrng)
  • #​17478 fix(parser): stop subscript parsing on async arrow (@​JLHwung)

💅 Polish

• babel-plugin-transform-regenerator, babel-plugin-transform-runtime
  • #​17363 Do not save last yield in call in temp var (@​nicolo-ribaudo)

📝 Documentation

• #​17448 move eslint-{parser,plugin} docs to the website (@​JLHwung)

🏠 Internal

• #​17454 Enable type checking for scripts and babel-worker.cjs (@​JLHwung)

🔬 Output optimization

• babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions
  • #​17444 Optimize do expression output (@​JLHwung)

v7.28.0

Compare Source

🚀 New Feature

• babel-node
  • #​17147 Support top level await in node repl (@​liuxingbaoyu)
• babel-types
  • #​17258 feat(matchesPattern): support super/private/meta (@​JLHwung)
• babel-compat-data, babel-preset-env
  • #​17355 Add explicit resource management to preset-env (@​JLHwung)
• babel-core, babel-parser
  • #​17390 Support sourceType: "commonjs" (@​JLHwung)
• babel-generator, babel-parser
  • #​17346 Materialize explicitResourceManagement parser plugin (@​JLHwung)
• babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-plugin-transform-object-rest-spread, babel-traverse, babel-types
  • #​17391 LVal coverage updates (Part 2) (@​JLHwung)
• babel-parser, babel-traverse, babel-types
  • #​17378 Accept bigints in t.bigIntLiteral factory (@​JLHwung)
• babel-generator, babel-plugin-proposal-destructuring-private, babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring, babel-plugin-transform-explicit-resource-management, babel-plugin-transform-react-display-name, babel-types
  • #​17277 Transform discard binding (@​JLHwung)
• babel-generator, babel-parser, babel-plugin-proposal-destructuring-private, babel-plugin-transform-block-scoping, babel-plugin-transform-object-rest-spread, babel-plugin-transform-typescript, babel-traverse, babel-types
  • #​17163 Parse discard binding (@​JLHwung)

🐛 Bug Fix

• babel-helper-globals, babel-plugin-transform-classes, babel-traverse
  • #​17297 Create babel-helper-globals (@​JLHwung)
• babel-types
  • #​17009 feature: TSTypeOperator: keyof (#​16799) (@​coderaiser)

🏠 Internal

• babel-compat-data, babel-plugin-proposal-decorators, babel-plugin-transform-async-generator-functions, babel-plugin-transform-json-modules, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs3
  • #​17403 Update babel-polyfill packages (@​nicolo-ribaudo)

v7.27.7

Compare Source

👓 Spec Compliance

• babel-parser, babel-plugin-transform-classes
  • #​17203 Interepret parser allow* options as top level only (@​JLHwung)
• babel-parser
  • #​17371 fix: disable using in ambient context (@​JLHwung)

🐛 Bug Fix

• babel-core
  • #​17392 Improve TS babel config loading (@​JLHwung)
• babel-types
  • #​17376 fix: support negative bigint in valueToNode (@​JLHwung)
• babel-plugin-transform-parameters
  • #​17352 fix: Params of async function* should throw synchronously (@​liuxingbaoyu)

🏠 Internal

• babel-plugin-transform-destructuring, babel-plugin-transform-object-rest-spread
  • #​17389 Use NodePath#splitExportDeclaration in destructuring transforms (@​JLHwung)

v7.27.4

Compare Source

👓 Spec Compliance

• babel-parser, babel-plugin-proposal-explicit-resource-management
  • #​17323 Disallow using in bare case statement (@​JLHwung)

💅 Polish

• babel-parser
  • #​17311 Improve parseExpression error messages (@​JLHwung)

🔬 Output optimization

• babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-classes, babel-plugin-transform-destructuring, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • #​17287 Reduce regenerator size more (@​liuxingbaoyu)
• babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-classes, babel-plugin-transform-destructuring, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs3
  • #​17334 Use shorter method names for regenerator context (@​nicolo-ribaudo)
  • #​17268 Reduce regenerator helper size (@​liuxingbaoyu)
• babel-core, babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-classes, babel-plugin-transform-destructuring, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime, babel-standalone
  • #​17238 Split regeneratorRuntime into multiple helpers (@​nicolo-ribaudo)

v7.27.3

Compare Source

🐛 Bug Fix

• babel-generator
  • #​17324 Improve multiline comments handling in yield/await expression (@​JLHwung)
• babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3
  • #​17328 Correctly set .displayName on GeneratorFunction (@​nicolo-ribaudo)
• babel-plugin-proposal-explicit-resource-management
  • #​17319 fix: handle shadowed binding in for using of body (@​JLHwung)
  • #​17317 fix: support named evaluation for using declaration (@​JLHwung)
• babel-plugin-proposal-decorators, babel-types
  • #​17321 fix(converter): Remove abstract modifiers in class declaration to expression conversion (@​magic-akari)
• babel-helper-module-transforms, babel-plugin-proposal-explicit-resource-management, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-umd
  • #​17257 Preserve class id when transforming using declarations with exported class (@​JLHwung)
• babel-parser
  • #​17312 fix(parser): properly handle optional markers in generator class methods (@​magic-akari)
  • #​17307 fix(parser): Terminate modifier parsing at newline (@​magic-akari)
• babel-generator, babel-parser
  • #​17308 Improve import phase parsing (@​JLHwung)

v7.27.1

Compare Source

👓 Spec Compliance

• babel-parser
  • #​17254 Allow using of as lexical declaration within for (@​JLHwung)
  • #​17230 Disallow get/set in TSPropertySignature (@​JLHwung)
• babel-parser, babel-types
  • #​17193 Stricter TSImportType options parsing (@​JLHwung)

🐛 Bug Fix

• babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-traverse
  • #​17137 fix: do expressions should allow early exit (@​kermanx)
• babel-helper-wrap-function, babel-plugin-transform-async-to-generator
  • #​17251 Fix: propagate argument evaluation errors through async promise chain (@​magic-akari)
• babel-helper-remap-async-to-generator, babel-plugin-transform-async-to-generator
  • #​17231 fix apply()/call() annotated as pure (@​Lacsw)
• babel-helper-fixtures, babel-parser
  • #​17233 Create ChainExpression within TSInstantiationExpression (@​JLHwung)
• babel-generator, babel-parser
  • #​17226 Fill optional AST properties when both estree and typescript parser plugin are enabled (Part 2) (@​JLHwung)
• babel-parser
  • #​17224 Fill optional AST properties when both estree and typescript parser plugin are enabled (Part 1) (@​JLHwung)
  • #​17080 Fix start of TSParameterProperty (@​JLHwung)
• babel-compat-data, babel-preset-env
  • #​17228 Update firefox bugfix compat data (@​JLHwung)
• babel-traverse
  • #​17156 fix: Objects and arrays with multiple references should not be evaluated (@​liuxingbaoyu)
• babel-generator
  • #​17216 Fix: support const type parameter in generator (@​JLHwung)

💅 Polish

• babel-plugin-bugfix-v8-spread-parameters-in-optional-chaining, babel-plugin-proposal-decorators, babel-plugin-transform-arrow-functions, babel-plugin-transform-class-properties, babel-plugin-transform-destructuring, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-chaining, babel-plugin-transform-parameters, babel-traverse
  • #​17221 Reduce generated names size for the 10th-11th (@​nicolo-ribaudo)

🏠 Internal

• babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • #​17263 Remove unused regenerator-runtime dep in @babel/runtime (@​nicolo-ribaudo)
• babel-compat-data, babel-preset-env
  • #​17256 Tune plugin compat data (@​JLHwung)
• babel-compat-data, babel-standalone
  • #​17236 migrate babel-compat-data build script to mjs (@​JLHwung)
• Other
  • #​17232 Bump typescript-eslint to 8.29.1 (@​JLHwung)
  • #​17219 test: add basic typescript-eslint integration tests (@​JLHwung)
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
• babel-register
  • #​16844 Migrate @babel/register to cts (@​liuxingbaoyu)
• babel-cli, babel-compat-data, babel-core, babel-generator, babel-helper-compilation-targets, babel-helper-fixtures, babel-helper-module-imports, babel-helper-module-transforms, babel-helper-plugin-test-runner, babel-helper-transform-fixture-test-runner, babel-helpers, babel-node, babel-parser, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-systemjs, babel-plugin-transform-modules-umd, babel-plugin-transform-react-display-name, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-plugin-transform-typeof-symbol, babel-plugin-transform-typescript, babel-preset-env, babel-register, babel-standalone, babel-types
  • #​17207 Enforce node protocol import (@​JLHwung)
• babel-plugin-transform-regenerator
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
• babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
• babel-helpers, babel-plugin-transform-regenerator
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
• babel-helpers
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)

🔬 Output optimization

• babel-helpers, babel-plugin-transform-modules-commonjs, babel-runtime-corejs3
  • #​16538 Reduce interopRequireWildcard size (@​liuxingbaoyu)
• babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3
  • #​17213 Reduce regeneratorRuntime size (@​liuxingbaoyu)

v7.26.10

Compare Source

👓 Spec Compliance

• babel-parser
  • #​17159 Disallow decorator in array pattern (@​JLHwung)

🐛 Bug Fix

• babel-parser, babel-template
  • #​17164 Fix: always initialize ExportDeclaration attributes (@​JLHwung)
• babel-core
  • #​17142 fix: "Map maximum size exceeded" in deepClone (@​liuxingbaoyu)
• babel-parser, babel-plugin-transform-typescript
  • #​17154 Update typescript parser tests (@​JLHwung)
• babel-traverse
  • #​17151 fix: Should not evaluate vars in child scope (@​liuxingbaoyu)
• babel-generator
  • #​17153 fix: Correctly generate abstract override (@​liuxingbaoyu)
• babel-parser
  • #​17107 Fix source type detection when parsing TypeScript (@​JLHwung)
• babel-helpers, babel-runtime, babel-runtime-corejs2, babel-runtime-corejs3
  • #​17173 Fix processing of replacement pattern with named capture groups (@​mmmsssttt404)

💅 Polish

• babel-standalone
  • #​17158 Avoid warnings when re-bundling @​babel/standalone with webpack (@​liuxingbaoyu)

🏠 Internal

• babel-parser
  • #​17160 Left-value parsing cleanup (@​JLHwung)

v7.26.9

Compare Source

🐛 Bug Fix

• babel-types
  • #​17103 fix: Definition for TSPropertySignature.kind (@​liuxingbaoyu)
• babel-generator, babel-types
  • #​17062 Print TypeScript optional/definite in ClassPrivateProperty (@​jamiebuilds-signal)

🏠 Internal

• babel-types
  • #​17130 Use .ts files with explicit reexports to solve name conflicts (@​nicolo-ribaudo)
• babel-core
  • #​17127 Do not depend on @types/gensync in Babel 7 (@​nicolo-ribaudo)

v7.26.8

Compare Source

v7.26.8 (2025-02-08)

🏠 Internal

• babel-preset-env
  • #​17097 Update dependency babel-plugin-polyfill-corejs3 to ^0.11.0

v7.26.7

Compare Source

🐛 Bug Fix

• babel-helpers, babel-preset-env, babel-runtime-corejs3
  • #​17086 Make "object without properties" helpers ES6-compatible (@​tquetano-netflix)
• babel-plugin-transform-typeof-symbol
  • #​17085 fix: Correctly handle typeof in arrow functions (@​liuxingbaoyu)
• babel-parser
  • #​17079 Respect ranges option in estree method value (@​JLHwung)
• babel-core
  • #​17052 Do not try to parse .ts configs as JSON if natively supported (@​nicolo-ribaudo)
• babel-plugin-transform-typescript
  • #​17050 fix: correctly resolve references to non-constant enum members (@​branchseer)
• babel-plugin-transform-typescript, babel-traverse, babel-types
  • #​17025 fix: Remove type-only import x = y.z (@​liuxingbaoyu)

v7.26.0

Compare Source

🚀 New Feature

• babel-core, babel-generator, babel-parser, babel-plugin-syntax-import-assertions, babel-plugin-syntax-import-attributes, babel-preset-env, babel-standalone, babel-types
  • #​16850 Enable import attributes parsing by default (@​nicolo-ribaudo)
• babel-core
  • #​16862 feat: support async plugin's pre/post (@​timofei-iatsenko)
• babel-compat-data, babel-plugin-proposal-regexp-modifiers, babel-plugin-transform-regexp-modifiers, babel-preset-env, babel-standalone
  • #​16692 Add transform-regexp-modifiers to preset-env (@​JLHwung)
• babel-parser
  • #​16849 feat: add startIndex parser option (@​DylanPiercey)
• babel-generator, babel-parser, babel-plugin-syntax-flow
  • #​16841 Always enable parsing of Flow enums (@​nicolo-ribaudo)
• babel-helpers, babel-preset-typescript, babel-runtime-corejs3
  • #​16794 Support import() in rewriteImportExtensions (@​liuxingbaoyu)
• babel-generator, babel-parser
  • #​16708 Add experimental format-preserving mode to @babel/generator (@​nicolo-ribaudo)

🐛 Bug Fix

• babel-core
  • #​16928 Workaround Node.js bug for parallel loading of TLA modules (@​nicolo-ribaudo)
  • #​16926 Fix loading of modules with TLA in Node.js 23 (@​nicolo-ribaudo)

💅 Polish

• babel-plugin-proposal-json-modules, babel-plugin-transform-json-modules, babel-standalone
  • #​16924 Rename proposal-json-modules to transform-json-modules (@​nicolo-ribaudo)

🏠 Internal

• babel-code-frame, babel-highlight
  • #​16896 Inline @babel/highlight in @babel/code-frame (@​nicolo-ribaudo)
• babel-generator, babel-parser, babel-types
  • #​16732 Add kind to TSModuleDeclaration (@​liuxingbaoyu)

🏃‍♀️ Performance

• babel-helper-module-transforms, babel-plugin-transform-modules-commonjs
  • #​16882 perf: Improve module transforms (@​liuxingbaoyu)

v7.25.9

Compare Source

🐛 Bug Fix

• babel-parser, babel-template, babel-types
  • #​16905 fix: Keep type annotations in syntacticPlaceholders mode (@​liuxingbaoyu)
• babel-helper-compilation-targets, babel-preset-env
  • #​16907 fix: support BROWSERSLIST{,_CONFIG} env (@​JLHwung)
• Other
  • #​16884 Analyze ClassAccessorProperty to prevent the no-undef rule (@​victorenator)

🏠 Internal

• babel-helper-transform-fixture-test-runner
  • #​16914 remove test options flaky (@​JLHwung)

🏃‍♀️ Performance

• babel-parser, babel-types
  • #​16918 perf: Make VISITOR_KEYS etc. faster to access (@​liuxingbaoyu)

v7.25.8

Compare Source

🐛 Bug Fix

• babel-core
  • #​16888 Restore public API of resolvePlugin/resolvePreset (@​nicolo-ribaudo)

🏠 Internal

• babel-parser, babel-plugin-proposal-async-do-expressions, babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-plugin-proposal-explicit-resource-management, babel-plugin-proposal-export-default-from, babel-plugin-proposal-function-bind, babel-plugin-proposal-function-sent, babel-plugin-proposal-import-defer, babel-plugin-proposal-partial-application, babel-plugin-proposal-throw-expressions, babel-plugin-transform-async-generator-functions, babel-plugin-transform-class-static-block, babel-plugin-transform-dynamic-import, babel-plugin-transform-export-namespace-from, babel-plugin-transform-json-strings, babel-plugin-transform-logical-assignment-operators, babel-plugin-transform-nullish-coalescing-operator, babel-plugin-transform-numeric-separator, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-catch-binding, babel-plugin-transform-optional-chaining, babel-plugin-transform-private-property-in-object, babel-preset-env
  • #​16824 Inline one-line syntax plugins (@​nicolo-ribaudo)

v7.25.7

Compare Source

🐛 Bug Fix

• babel-helper-validator-identifier
  • #​16825 fix: update identifier to unicode 16 (@​JLHwung)
• babel-traverse
  • #​16814 fix: issue with node path keys updated on unrelated paths (@​DylanPiercey)
• babel-plugin-transform-classes
  • #​16797 Use an inclusion rather than exclusion list for super() check (@​nicolo-ribaudo)
• babel-generator
  • #​16788 Fix printing of TS infer in compact mode (@​nicolo-ribaudo)
  • #​16785 Print TS type annotations for destructuring in assignment pattern (@​nicolo-ribaudo)
  • #​16778 Respect [no LineTerminator here] after nodes (@​nicolo-ribaudo)

💅 Polish

• babel-types
  • #​16852 Add deprecated JSDOC for fields (@​liuxingbaoyu)

🏠 Internal

• babel-core
  • #​16820 Allow sync loading of ESM when --experimental-require-module (@​nicolo-ribaudo)
• babel-helper-compilation-targets, babel-helper-plugin-utils, babel-preset-env
  • #​16858 Add browserslist config to external dependency (@​JLHwung)
• babel-plugin-proposal-destructuring-private, babel-plugin-syntax-decimal, babel-plugin-syntax-import-reflection, babel-standalone
  • #​16809 Archive syntax-import-reflection and syntax-decimal (@​nicolo-ribaudo)
• babel-generator
  • #​16779 Simplify logic for [no LineTerminator here] before nodes (@​nicolo-ribaudo)

🏃‍♀️ Performance

• babel-plugin-transform-typescript
  • #​16875 perf: Avoid extra cloning of namespaces (@​liuxingbaoyu)
• babel-types
  • #​16842 perf: Improve @​babel/types builders (@​liuxingbaoyu)
  • #​16828 Only access BABEL_TYPES_8_BREAKING at startup (@​nicolo-ribaudo)

v7.25.2

Compare Source

🐛 Bug Fix

• babel-core, babel-traverse
  • #​16695 Ensure that requeueComputedKeyAndDecorators is available (@​nicolo-ribaudo)

v7.24.9

Compare Source

🐛 Bug Fix

• babel-core, babel-standalone
  • #​16639 Avoid require() call in @babel/standalone bundle (@​nicolo-ribaudo)
• babel-types
  • #​16638 fix: provide legacy typings for TS < 4.1 (@​JLHwung)

💅 Polish

• babel-generator, babel-plugin-transform-optional-chaining
  • #​16617 Avoid extra parens in TS as/satisfies (@​nicolo-ribaudo)

🏠 Internal

• babel-helper-module-transforms
  • #​16629 Lazy top-level initializations for module transforms (@​guybedford)

v7.24.8

Compare Source

👓 Spec Compliance

• babel-parser
  • #​16567 Do not use strict mode in TS declare (@​liuxingbaoyu)

🐛 Bug Fix

• babel-generator
  • #​16630 Correctly print parens around in in for heads (@​nicolo-ribaudo)
  • #​16626 Fix printing of comments in await using (@​nicolo-ribaudo)
  • #​16591 fix typescript code generation for yield expression inside type expre… (@​SreeXD)
• babel-parser
  • #​16613 Disallow destructuring assignment in using declarations (@​H0onnn)
  • #​16490 fix: do not add .value: undefined to regexp literals (@​liuxingbaoyu)
• babel-types
  • #​16615 Remove boolean props from ObjectTypeInternalSlot visitor keys (@​nicolo-ribaudo)
• babel-plugin-transform-typescript
  • #​16566 fix: Correctly handle export import x = (@​liuxingbaoyu)

💅 Polish

• babel-generator
  • #​16625 Avoid unnecessary parens around async in for await (@​nicolo-ribaudo)
• babel-traverse
  • #​16619 Avoid checking Scope.globals multiple times (@​liuxingbaoyu)

v7.24.7

Compare Source

🐛 Bug Fix

• babel-node
  • #​16554 Allow extra flags in babel-node (@​nicolo-ribaudo)
• babel-traverse
  • #​16522 fix: incorrect constantViolations with destructuring (@​liuxingbaoyu)
• babel-helper-transform-fixture-test-runner, babel-plugin-proposal-explicit-resource-management
  • #​16524 fix: Transform using in switch correctly (@​liuxingbaoyu)

🏠 Internal

• babel-helpers, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • #​16525 Delete unused array helpers (@​blakewilson)

v7.24.6

Compare Source

🐛 Bug Fix

• babel-helper-create-class-features-plugin, babel-plugin-transform-class-properties
  • #​16514 Fix source maps for private member expressions (@​nicolo-ribaudo)
• babel-core, babel-generator, babel-plugin-transform-modules-commonjs
  • #​16515 Fix source maps for template literals (@​nicolo-ribaudo)
• babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
  • #​16485 Support undecorated static accessor in anonymous classes (@​JLHwung)
  • #​16484 Fix decorator bare yield await (@​JLHwung)
• babel-helpers, babel-plugin-proposal-decorators, babel-runtime-corejs3
  • #​16483 Fix: throw TypeError if addInitializer is called after finished (@​JLHwung)
• babel-parser, babel-plugin-transform-typescript
  • #​16476 fix: Correctly parse cls.fn<C> = x (@​liuxingbaoyu)

🏠 Internal

• babel-core, babel-helpers, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • #​16501 Generate helper metadata at build time (@​nicolo-ribaudo)
• babel-helpers
  • #​16499 Add tsconfig.json for @babel/helpers/src/helpers (@​nicolo-ribaudo)
• babel-cli, babel-helpers, babel-plugin-external-helpers, babel-plugin-proposal-decorators, babel-plugin-transform-class-properties, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-systemjs, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • #​16495 Move all runtime helpers to individual files (@​nicolo-ribaudo)
• babel-parser, babel-traverse
  • #​16482 Statically generate boilerplate for bitfield accessors (@​nicolo-ribaudo)
• Other
  • #​16466 Migrate import assertions syntax (@​JLHwung)

v7.24.5

Compare Source

🐛 Bug Fix

• babel-plugin-transform-classes, babel-traverse
  • #​16377 fix: TypeScript annotation affects output (@​liuxingbaoyu)
• babel-helpers, babel-plugin-proposal-explicit-resource-management, babel-runtime-corejs3
  • #​16440 Fix suppressed error order (@​sossost)
  • #​16408 Await nullish async disposable (@​JLHwung)

💅 Polish

• babel-parser
  • #​16407 Recover from exported using declaration (@​JLHwung)

🏠 Internal

• Other
  • #​16414 Relax ESLint peerDependency constraint to allow v9 (@​liuxingbaoyu)
• babel-parser
  • #​16425 Improve @babel/parser AST types (@​nicolo-ribaudo)
  • #​16417 Always pass type argument to .startNode (@​nicolo-ribaudo)
• babel-helper-create-class-features-plugin, babel-helper-member-expression-to-functions, babel-helper-module-transforms, babel-helper-split-export-declaration, babel-helper-wrap-function, babel-helpers, babel-plugin-bugfix-firefox-class-in-computed-class-key, babel-plugin-proposal-explicit-resource-management, babel-plugin-transform-block-scoping, babel-plugin-transform-destructuring, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-chaining, babel-plugin-transform-parameters, babel-plugin-transform-private-property-in-object, babel-plugin-transform-react-jsx-self, babel-plugin-transform-typeof-symbol, babel-plugin-transform-typescript, babel-traverse
  • [#​16439](https://redirect.github.com

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@babel/core (source)	7.12.3 → 7.29.6

---

@​babel/core: Arbitrary File Read via sourceMappingURL Comment

CVE-2026-49356 / GHSA-4x5r-pxfx-6jf8

More information

Details

Impact

Using @babel/core to compile maliciously crafted code can allow ab attacker to read any source map from the system that is running Babel, if these conditions are all true:

• the attacker controls the input source code
• the attacker can read the output source code
• the attacker knows the path of the source map file that they want to read

Users that only compile trusted code are not impacted.

Patches

The vulnerability has been fixed in @babel/core@7.29.6 and @babel/core@8.0.0-rc.6.

Workarounds

Callers can mitigate the issue without upgrading by setting inputSourceMap: false in their Babel options.

Callers can also manually extract the #sourceMappingURL comment from the input source code, validate whether the source map that it links to is allowed to be read, and if it is pass an object to inputSourceMap (passing false when it's not).

Credits

Thanks Teodor-Cristian Radoi for reporting the vulnerability.

Severity

• CVSS Score: 3.2 / 10 (Low)
• Vector String: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

References

• https://github.com/babel/babel/security/advisories/GHSA-4x5r-pxfx-6jf8
• https://babeljs.io/docs/options#inputsourcemap
• https://nvd.nist.gov/vuln/detail/CVE-2026-49356
• https://github.com/advisories/GHSA-4x5r-pxfx-6jf8

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

babel/babel (@​babel/core)

v7.29.6

Compare Source

v7.29.6 (2026-05-25)

🐛 Bug Fix

• babel-generator
  • #​18014 Catchup source map position in preserveFormat (@​nicolo-ribaudo)
• babel-core
  • #​18001 [7.x packport]Improve input source map handling (@​JLHwung)
• babel-core, babel-generator
  • #​17998 Preserve original identifier names from input sourcemaps (#​17992) (@​Andarist)

Committers: 3

• Huáng Jùnliàng (@​JLHwung)
• Mateusz Burzyński (@​Andarist)
• Nicolò Ribaudo (@​nicolo-ribaudo)

v7.29.0

Compare Source

v7.29.0 (2026-01-31)

Thanks @​simbahax for your first PR!

🚀 New Feature

• babel-types
  • #​17750 [7.x backport] Add attributes import declaration builder (@​JLHwung)
• babel-standalone
  • #​17663 [7.x backport] feat(standalone): export async transform (@​JLHwung)
  • #​17725 [7.x backport] feat: read standalone targets from data-targets (@​JLHwung)

🐛 Bug Fix

• babel-parser
  • #​17765 fix(parser): correctly parse type assertions in extends clause (@​nicolo-ribaudo)
  • #​17723 [7.x backport] fix(parser): improve super type argument parsing (@​JLHwung)
• babel-traverse
  • #​17708 fix(traverse): provide a hub when traversing a File or Program and no parentPath is given (@​simbahax)
• babel-plugin-transform-block-scoping, babel-traverse
  • #​17737 [7.x backport] fix: Rename switch discriminant references when body creates shadowing variable (@​magic-akari)

🏃‍♀️ Performance

• babel-generator, babel-runtime-corejs3
  • #​17642 [Babel 7] Improve generator performance (@​liuxingbaoyu)

Committers: 6

• David (@​simbahax)
• Huáng Jùnliàng (@​JLHwung)
• Nicolò Ribaudo (@​nicolo-ribaudo)
• @​liuxingbaoyu
• @​magic-akari

v7.28.6

Compare Source

v7.28.5

Compare Source

👓 Spec Compliance

• babel-parser
  • #​17446 Allow Runtime Errors for Function Call Assignment Targets (@​liuxingbaoyu)
• babel-helper-validator-identifier
  • #​17501 fix: update identifier to unicode 17 (@​fisker)

🐛 Bug Fix

• babel-plugin-proposal-destructuring-private
  • #​17534 Allow mixing private destructuring and rest (@​CO0Ki3)
• babel-parser
  • #​17521 Improve @babel/parser error typing (@​JLHwung)
  • #​17491 fix: improve ts-only declaration parsing (@​JLHwung)
• babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring
  • #​17519 fix: rest correctly returns plain array (@​liuxingbaoyu)
• babel-helper-create-class-features-plugin, babel-helper-member-expression-to-functions, babel-plugin-transform-block-scoping, babel-plugin-transform-optional-chaining, babel-traverse, babel-types
  • #​17503 Fix JSXIdentifier handling in isReferencedIdentifier (@​JLHwung)
• babel-traverse
  • #​17504 fix: ensure scope.push register in anonymous fn (@​JLHwung)

🏠 Internal

• babel-types
  • #​17494 Type checking babel-types scripts (@​JLHwung)

🏃‍♀️ Performance

• babel-core
  • #​17490 Faster finding of locations in buildCodeFrameError (@​liuxingbaoyu)

v7.28.4

Compare Source

🏠 Internal

• babel-core, babel-helper-check-duplicate-nodes, babel-traverse, babel-types
  • #​17493 Update Jest to v30.1.1 (@​JLHwung)
• babel-plugin-transform-regenerator
  • #​17455 chore: Clean up transform-regenerator (@​liuxingbaoyu)
• babel-core
  • #​17474 Switch to @​jridgewell/remapping (@​mrginglymus)

v7.28.3

Compare Source

👓 Spec Compliance

• babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators, babel-plugin-transform-class-static-block, babel-preset-env
  • #​17443 [static blocks] Do not inject new static fields after static code (@​nicolo-ribaudo)

🐛 Bug Fix

• babel-parser
  • #​17465 fix(parser/typescript): parse import("./a", {with:{},}) (@​easrng)
  • #​17478 fix(parser): stop subscript parsing on async arrow (@​JLHwung)

💅 Polish

• babel-plugin-transform-regenerator, babel-plugin-transform-runtime
  • #​17363 Do not save last yield in call in temp var (@​nicolo-ribaudo)

📝 Documentation

• #​17448 move eslint-{parser,plugin} docs to the website (@​JLHwung)

🏠 Internal

• #​17454 Enable type checking for scripts and babel-worker.cjs (@​JLHwung)

🔬 Output optimization

• babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions
  • #​17444 Optimize do expression output (@​JLHwung)

v7.28.0

Compare Source

🚀 New Feature

• babel-node
  • #​17147 Support top level await in node repl (@​liuxingbaoyu)
• babel-types
  • #​17258 feat(matchesPattern): support super/private/meta (@​JLHwung)
• babel-compat-data, babel-preset-env
  • #​17355 Add explicit resource management to preset-env (@​JLHwung)
• babel-core, babel-parser
  • #​17390 Support sourceType: "commonjs" (@​JLHwung)
• babel-generator, babel-parser
  • #​17346 Materialize explicitResourceManagement parser plugin (@​JLHwung)
• babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-plugin-transform-object-rest-spread, babel-traverse, babel-types
  • #​17391 LVal coverage updates (Part 2) (@​JLHwung)
• babel-parser, babel-traverse, babel-types
  • #​17378 Accept bigints in t.bigIntLiteral factory (@​JLHwung)
• babel-generator, babel-plugin-proposal-destructuring-private, babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring, babel-plugin-transform-explicit-resource-management, babel-plugin-transform-react-display-name, babel-types
  • #​17277 Transform discard binding (@​JLHwung)
• babel-generator, babel-parser, babel-plugin-proposal-destructuring-private, babel-plugin-transform-block-scoping, babel-plugin-transform-object-rest-spread, babel-plugin-transform-typescript, babel-traverse, babel-types
  • #​17163 Parse discard binding (@​JLHwung)

🐛 Bug Fix

• babel-helper-globals, babel-plugin-transform-classes, babel-traverse
  • #​17297 Create babel-helper-globals (@​JLHwung)
• babel-types
  • #​17009 feature: TSTypeOperator: keyof (#​16799) (@​coderaiser)

🏠 Internal

• babel-compat-data, babel-plugin-proposal-decorators, babel-plugin-transform-async-generator-functions, babel-plugin-transform-json-modules, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs3
  • #​17403 Update babel-polyfill packages (@​nicolo-ribaudo)

v7.27.7

Compare Source

👓 Spec Compliance

• babel-parser, babel-plugin-transform-classes
  • #​17203 Interepret parser allow* options as top level only (@​JLHwung)
• babel-parser
  • #​17371 fix: disable using in ambient context (@​JLHwung)

🐛 Bug Fix

• babel-core
  • #​17392 Improve TS babel config loading (@​JLHwung)
• babel-types
  • #​17376 fix: support negative bigint in valueToNode (@​JLHwung)
• babel-plugin-transform-parameters
  • #​17352 fix: Params of async function* should throw synchronously (@​liuxingbaoyu)

🏠 Internal

• babel-plugin-transform-destructuring, babel-plugin-transform-object-rest-spread
  • #​17389 Use NodePath#splitExportDeclaration in destructuring transforms (@​JLHwung)

v7.27.4

Compare Source

👓 Spec Compliance

• babel-parser, babel-plugin-proposal-explicit-resource-management
  • #​17323 Disallow using in bare case statement (@​JLHwung)

💅 Polish

• babel-parser
  • #​17311 Improve parseExpression error messages (@​JLHwung)

🔬 Output optimization

• babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-classes, babel-plugin-transform-destructuring, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • #​17287 Reduce regenerator size more (@​liuxingbaoyu)
• babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-classes, babel-plugin-transform-destructuring, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs3
  • #​17334 Use shorter method names for regenerator context (@​nicolo-ribaudo)
  • #​17268 Reduce regenerator helper size (@​liuxingbaoyu)
• babel-core, babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-classes, babel-plugin-transform-destructuring, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime, babel-standalone
  • #​17238 Split regeneratorRuntime into multiple helpers (@​nicolo-ribaudo)

v7.27.3

Compare Source

🐛 Bug Fix

• babel-generator
  • #​17324 Improve multiline comments handling in yield/await expression (@​JLHwung)
• babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3
  • #​17328 Correctly set .displayName on GeneratorFunction (@​nicolo-ribaudo)
• babel-plugin-proposal-explicit-resource-management
  • #​17319 fix: handle shadowed binding in for using of body (@​JLHwung)
  • #​17317 fix: support named evaluation for using declaration (@​JLHwung)
• babel-plugin-proposal-decorators, babel-types
  • #​17321 fix(converter): Remove abstract modifiers in class declaration to expression conversion (@​magic-akari)
• babel-helper-module-transforms, babel-plugin-proposal-explicit-resource-management, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-umd
  • #​17257 Preserve class id when transforming using declarations with exported class (@​JLHwung)
• babel-parser
  • #​17312 fix(parser): properly handle optional markers in generator class methods (@​magic-akari)
  • #​17307 fix(parser): Terminate modifier parsing at newline (@​magic-akari)
• babel-generator, babel-parser
  • #​17308 Improve import phase parsing (@​JLHwung)

v7.27.1

Compare Source

👓 Spec Compliance

• babel-parser
  • #​17254 Allow using of as lexical declaration within for (@​JLHwung)
  • #​17230 Disallow get/set in TSPropertySignature (@​JLHwung)
• babel-parser, babel-types
  • #​17193 Stricter TSImportType options parsing (@​JLHwung)

🐛 Bug Fix

• babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-traverse
  • #​17137 fix: do expressions should allow early exit (@​kermanx)
• babel-helper-wrap-function, babel-plugin-transform-async-to-generator
  • #​17251 Fix: propagate argument evaluation errors through async promise chain (@​magic-akari)
• babel-helper-remap-async-to-generator, babel-plugin-transform-async-to-generator
  • #​17231 fix apply()/call() annotated as pure (@​Lacsw)
• babel-helper-fixtures, babel-parser
  • #​17233 Create ChainExpression within TSInstantiationExpression (@​JLHwung)
• babel-generator, babel-parser
  • #​17226 Fill optional AST properties when both estree and typescript parser plugin are enabled (Part 2) (@​JLHwung)
• babel-parser
  • #​17224 Fill optional AST properties when both estree and typescript parser plugin are enabled (Part 1) (@​JLHwung)
  • #​17080 Fix start of TSParameterProperty (@​JLHwung)
• babel-compat-data, babel-preset-env
  • #​17228 Update firefox bugfix compat data (@​JLHwung)
• babel-traverse
  • #​17156 fix: Objects and arrays with multiple references should not be evaluated (@​liuxingbaoyu)
• babel-generator
  • #​17216 Fix: support const type parameter in generator (@​JLHwung)

💅 Polish

• babel-plugin-bugfix-v8-spread-parameters-in-optional-chaining, babel-plugin-proposal-decorators, babel-plugin-transform-arrow-functions, babel-plugin-transform-class-properties, babel-plugin-transform-destructuring, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-chaining, babel-plugin-transform-parameters, babel-traverse
  • #​17221 Reduce generated names size for the 10th-11th (@​nicolo-ribaudo)

🏠 Internal

• babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • #​17263 Remove unused regenerator-runtime dep in @babel/runtime (@​nicolo-ribaudo)
• babel-compat-data, babel-preset-env
  • #​17256 Tune plugin compat data (@​JLHwung)
• babel-compat-data, babel-standalone
  • #​17236 migrate babel-compat-data build script to mjs (@​JLHwung)
• Other
  • #​17232 Bump typescript-eslint to 8.29.1 (@​JLHwung)
  • #​17219 test: add basic typescript-eslint integration tests (@​JLHwung)
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
• babel-register
  • #​16844 Migrate @babel/register to cts (@​liuxingbaoyu)
• babel-cli, babel-compat-data, babel-core, babel-generator, babel-helper-compilation-targets, babel-helper-fixtures, babel-helper-module-imports, babel-helper-module-transforms, babel-helper-plugin-test-runner, babel-helper-transform-fixture-test-runner, babel-helpers, babel-node, babel-parser, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-systemjs, babel-plugin-transform-modules-umd, babel-plugin-transform-react-display-name, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-plugin-transform-typeof-symbol, babel-plugin-transform-typescript, babel-preset-env, babel-register, babel-standalone, babel-types
  • #​17207 Enforce node protocol import (@​JLHwung)
• babel-plugin-transform-regenerator
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
• babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
• babel-helpers, babel-plugin-transform-regenerator
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
• babel-helpers
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)

🔬 Output optimization

• babel-helpers, babel-plugin-transform-modules-commonjs, babel-runtime-corejs3
  • #​16538 Reduce interopRequireWildcard size (@​liuxingbaoyu)
• babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3
  • #​17213 Reduce regeneratorRuntime size (@​liuxingbaoyu)

v7.26.10

Compare Source

👓 Spec Compliance

• babel-parser
  • #​17159 Disallow decorator in array pattern (@​JLHwung)

🐛 Bug Fix

• babel-parser, babel-template
  • #​17164 Fix: always initialize ExportDeclaration attributes (@​JLHwung)
• babel-core
  • #​17142 fix: "Map maximum size exceeded" in deepClone (@​liuxingbaoyu)
• babel-parser, babel-plugin-transform-typescript
  • #​17154 Update typescript parser tests (@​JLHwung)
• babel-traverse
  • #​17151 fix: Should not evaluate vars in child scope (@​liuxingbaoyu)
• babel-generator
  • #​17153 fix: Correctly generate abstract override (@​liuxingbaoyu)
• babel-parser
  • #​17107 Fix source type detection when parsing TypeScript (@​JLHwung)
• babel-helpers, babel-runtime, babel-runtime-corejs2, babel-runtime-corejs3
  • #​17173 Fix processing of replacement pattern with named capture groups (@​mmmsssttt404)

💅 Polish

• babel-standalone
  • #​17158 Avoid warnings when re-bundling @​babel/standalone with webpack (@​liuxingbaoyu)

🏠 Internal

• babel-parser
  • #​17160 Left-value parsing cleanup (@​JLHwung)

v7.26.9

Compare Source

🐛 Bug Fix

• babel-types
  • #​17103 fix: Definition for TSPropertySignature.kind (@​liuxingbaoyu)
• babel-generator, babel-types
  • #​17062 Print TypeScript optional/definite in ClassPrivateProperty (@​jamiebuilds-signal)

🏠 Internal

• babel-types
  • #​17130 Use .ts files with explicit reexports to solve name conflicts (@​nicolo-ribaudo)
• babel-core
  • #​17127 Do not depend on @types/gensync in Babel 7 (@​nicolo-ribaudo)

v7.26.8

Compare Source

v7.26.8 (2025-02-08)

🏠 Internal

• babel-preset-env
  • #​17097 Update dependency babel-plugin-polyfill-corejs3 to ^0.11.0

v7.26.7

Compare Source

🐛 Bug Fix

• babel-helpers, babel-preset-env, babel-runtime-corejs3
  • #​17086 Make "object without properties" helpers ES6-compatible (@​tquetano-netflix)
• babel-plugin-transform-typeof-symbol
  • #​17085 fix: Correctly handle typeof in arrow functions (@​liuxingbaoyu)
• babel-parser
  • #​17079 Respect ranges option in estree method value (@​JLHwung)
• babel-core
  • #​17052 Do not try to parse .ts configs as JSON if natively supported (@​nicolo-ribaudo)
• babel-plugin-transform-typescript
  • #​17050 fix: correctly resolve references to non-constant enum members (@​branchseer)
• babel-plugin-transform-typescript, babel-traverse, babel-types
  • #​17025 fix: Remove type-only import x = y.z (@​liuxingbaoyu)

v7.26.0

Compare Source

🚀 New Feature

• babel-core, babel-generator, babel-parser, babel-plugin-syntax-import-assertions, babel-plugin-syntax-import-attributes, babel-preset-env, babel-standalone, babel-types
  • #​16850 Enable import attributes parsing by default (@​nicolo-ribaudo)
• babel-core
  • #​16862 feat: support async plugin's pre/post (@​timofei-iatsenko)
• babel-compat-data, babel-plugin-proposal-regexp-modifiers, babel-plugin-transform-regexp-modifiers, babel-preset-env, babel-standalone
  • #​16692 Add transform-regexp-modifiers to preset-env (@​JLHwung)
• babel-parser
  • #​16849 feat: add startIndex parser option (@​DylanPiercey)
• babel-generator, babel-parser, babel-plugin-syntax-flow
  • #​16841 Always enable parsing of Flow enums (@​nicolo-ribaudo)
• babel-helpers, babel-preset-typescript, babel-runtime-corejs3
  • #​16794 Support import() in rewriteImportExtensions (@​liuxingbaoyu)
• babel-generator, babel-parser
  • #​16708 Add experimental format-preserving mode to @babel/generator (@​nicolo-ribaudo)

🐛 Bug Fix

• babel-core
  • #​16928 Workaround Node.js bug for parallel loading of TLA modules (@​nicolo-ribaudo)
  • #​16926 Fix loading of modules with TLA in Node.js 23 (@​nicolo-ribaudo)

💅 Polish

• babel-plugin-proposal-json-modules, babel-plugin-transform-json-modules, babel-standalone
  • #​16924 Rename proposal-json-modules to transform-json-modules (@​nicolo-ribaudo)

🏠 Internal

• babel-code-frame, babel-highlight
  • #​16896 Inline @babel/highlight in @babel/code-frame (@​nicolo-ribaudo)
• babel-generator, babel-parser, babel-types
  • #​16732 Add kind to TSModuleDeclaration (@​liuxingbaoyu)

🏃‍♀️ Performance

• babel-helper-module-transforms, babel-plugin-transform-modules-commonjs
  • #​16882 perf: Improve module transforms (@​liuxingbaoyu)

v7.25.9

Compare Source

🐛 Bug Fix

• babel-parser, babel-template, babel-types
  • #​16905 fix: Keep type annotations in syntacticPlaceholders mode (@​liuxingbaoyu)
• babel-helper-compilation-targets, babel-preset-env
  • #​16907 fix: support BROWSERSLIST{,_CONFIG} env (@​JLHwung)
• Other
  • #​16884 Analyze ClassAccessorProperty to prevent the no-undef rule (@​victorenator)

🏠 Internal

• babel-helper-transform-fixture-test-runner
  • #​16914 remove test options flaky (@​JLHwung)

🏃‍♀️ Performance

• babel-parser, babel-types
  • #​16918 perf: Make VISITOR_KEYS etc. faster to access (@​liuxingbaoyu)

v7.25.8

Compare Source

🐛 Bug Fix

• babel-core
  • #​16888 Restore public API of resolvePlugin/resolvePreset (@​nicolo-ribaudo)

🏠 Internal

• babel-parser, babel-plugin-proposal-async-do-expressions, babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-plugin-proposal-explicit-resource-management, babel-plugin-proposal-export-default-from, babel-plugin-proposal-function-bind, babel-plugin-proposal-function-sent, babel-plugin-proposal-import-defer, babel-plugin-proposal-partial-application, babel-plugin-proposal-throw-expressions, babel-plugin-transform-async-generator-functions, babel-plugin-transform-class-static-block, babel-plugin-transform-dynamic-import, babel-plugin-transform-export-namespace-from, babel-plugin-transform-json-strings, babel-plugin-transform-logical-assignment-operators, babel-plugin-transform-nullish-coalescing-operator, babel-plugin-transform-numeric-separator, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-catch-binding, babel-plugin-transform-optional-chaining, babel-plugin-transform-private-property-in-object, babel-preset-env
  • #​16824 Inline one-line syntax plugins (@​nicolo-ribaudo)

v7.25.7

Compare Source

🐛 Bug Fix

• babel-helper-validator-identifier
  • #​16825 fix: update identifier to unicode 16 (@​JLHwung)
• babel-traverse
  • #​16814 fix: issue with node path keys updated on unrelated paths (@​DylanPiercey)
• babel-plugin-transform-classes
  • #​16797 Use an inclusion rather than exclusion list for super() check (@​nicolo-ribaudo)
• babel-generator
  • #​16788 Fix printing of TS infer in compact mode (@​nicolo-ribaudo)
  • #​16785 Print TS type annotations for destructuring in assignment pattern (@​nicolo-ribaudo)
  • #​16778 Respect [no LineTerminator here] after nodes (@​nicolo-ribaudo)

💅 Polish

• babel-types
  • #​16852 Add deprecated JSDOC for fields (@​liuxingbaoyu)

🏠 Internal

• babel-core
  • #​16820 Allow sync loading of ESM when --experimental-require-module (@​nicolo-ribaudo)
• babel-helper-compilation-targets, babel-helper-plugin-utils, babel-preset-env
  • #​16858 Add browserslist config to external dependency (@​JLHwung)
• babel-plugin-proposal-destructuring-private, babel-plugin-syntax-decimal, babel-plugin-syntax-import-reflection, babel-standalone
  • #​16809 Archive syntax-import-reflection and syntax-decimal (@​nicolo-ribaudo)
• babel-generator
  • #​16779 Simplify logic for [no LineTerminator here] before nodes (@​nicolo-ribaudo)

🏃‍♀️ Performance

• babel-plugin-transform-typescript
  • #​16875 perf: Avoid extra cloning of namespaces (@​liuxingbaoyu)
• babel-types
  • #​16842 perf: Improve @​babel/types builders (@​liuxingbaoyu)
  • #​16828 Only access BABEL_TYPES_8_BREAKING at startup (@​nicolo-ribaudo)

v7.25.2

Compare Source

🐛 Bug Fix

• babel-core, babel-traverse
  • #​16695 Ensure that requeueComputedKeyAndDecorators is available (@​nicolo-ribaudo)

v7.24.9

Compare Source

🐛 Bug Fix

• babel-core, babel-standalone
  • #​16639 Avoid require() call in @babel/standalone bundle (@​nicolo-ribaudo)
• babel-types
  • #​16638 fix: provide legacy typings for TS < 4.1 (@​JLHwung)

💅 Polish

• babel-generator, babel-plugin-transform-optional-chaining
  • #​16617 Avoid extra parens in TS as/satisfies (@​nicolo-ribaudo)

🏠 Internal

• babel-helper-module-transforms
  • #​16629 Lazy top-level initializations for module transforms (@​guybedford)

v7.24.8

Compare Source

👓 Spec Compliance

• babel-parser
  • #​16567 Do not use strict mode in TS declare (@​liuxingbaoyu)

🐛 Bug Fix

• babel-generator
  • #​16630 Correctly print parens around in in for heads (@​nicolo-ribaudo)
  • #​16626 Fix printing of comments in await using (@​nicolo-ribaudo)
  • #​16591 fix typescript code generation for yield expression inside type expre… (@​SreeXD)
• babel-parser
  • #​16613 Disallow destructuring assignment in using declarations (@​H0onnn)
  • #​16490 fix: do not add .value: undefined to regexp literals (@​liuxingbaoyu)
• babel-types
  • #​16615 Remove boolean props from ObjectTypeInternalSlot visitor keys (@​nicolo-ribaudo)
• babel-plugin-transform-typescript
  • #​16566 fix: Correctly handle export import x = (@​liuxingbaoyu)

💅 Polish

• babel-generator
  • #​16625 Avoid unnecessary parens around async in for await (@​nicolo-ribaudo)
• babel-traverse
  • #​16619 Avoid checking Scope.globals multiple times (@​liuxingbaoyu)

v7.24.7

Compare Source

🐛 Bug Fix

• babel-node
  • #​16554 Allow extra flags in babel-node (@​nicolo-ribaudo)
• babel-traverse
  • #​16522 fix: incorrect constantViolations with destructuring (@​liuxingbaoyu)
• babel-helper-transform-fixture-test-runner, babel-plugin-proposal-explicit-resource-management
  • #​16524 fix: Transform using in switch correctly (@​liuxingbaoyu)

🏠 Internal

• babel-helpers, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • #​16525 Delete unused array helpers (@​blakewilson)

v7.24.6

Compare Source

🐛 Bug Fix

• babel-helper-create-class-features-plugin, babel-plugin-transform-class-properties
  • #​16514 Fix source maps for private member expressions (@​nicolo-ribaudo)
• babel-core, babel-generator, babel-plugin-transform-modules-commonjs
  • #​16515 Fix source maps for template literals (@​nicolo-ribaudo)
• babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
  • #​16485 Support undecorated static accessor in anonymous classes (@​JLHwung)
  • #​16484 Fix decorator bare yield await (@​JLHwung)
• babel-helpers, babel-plugin-proposal-decorators, babel-runtime-corejs3
  • #​16483 Fix: throw TypeError if addInitializer is called after finished (@​JLHwung)
• babel-parser, babel-plugin-transform-typescript
  • #​16476 fix: Correctly parse cls.fn<C> = x (@​liuxingbaoyu)

🏠 Internal

• babel-core, babel-helpers, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • #​16501 Generate helper metadata at build time (@​nicolo-ribaudo)
• babel-helpers
  • #​16499 Add tsconfig.json for @babel/helpers/src/helpers (@​nicolo-ribaudo)
• babel-cli, babel-helpers, babel-plugin-external-helpers, babel-plugin-proposal-decorators, babel-plugin-transform-class-properties, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-systemjs, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • #​16495 Move all runtime helpers to individual files (@​nicolo-ribaudo)
• babel-parser, babel-traverse
  • #​16482 Statically generate boilerplate for bitfield accessors (@​nicolo-ribaudo)
• Other
  • #​16466 Migrate import assertions syntax (@​JLHwung)

v7.24.5

Compare Source

🐛 Bug Fix

• babel-plugin-transform-classes, babel-traverse
  • #​16377 fix: TypeScript annotation affects output (@​liuxingbaoyu)
• babel-helpers, babel-plugin-proposal-explicit-resource-management, babel-runtime-corejs3
  • #​16440 Fix suppressed error order (@​sossost)
  • #​16408 Await nullish async disposable (@​JLHwung)

💅 Polish

• babel-parser
  • #​16407 Recover from exported using declaration (@​JLHwung)

🏠 Internal

• Other
  • #​16414 Relax ESLint peerDependency constraint to allow v9 (@​liuxingbaoyu)
• babel-parser
  • #​16425 Improve @babel/parser AST types (@​nicolo-ribaudo)
  • #​16417 Always pass type argument to .startNode (@​nicolo-ribaudo)
• babel-helper-create-class-features-plugin, babel-helper-member-expression-to-functions, babel-helper-module-transforms, babel-helper-split-export-declaration, babel-helper-wrap-function, babel-helpers, babel-plugin-bugfix-firefox-class-in-computed-class-key, babel-plugin-proposal-explicit-resource-management, babel-plugin-transform-block-scoping, babel-plugin-transform-destructuring, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-chaining, babel-plugin-transform-parameters, babel-plugin-transform-private-property-in-object, babel-plugin-transform-react-jsx-self, babel-plugin-transform-typeof-symbol, babel-plugin-transform-typescript, babel-traverse
  • [#​16439](https://redirect.github.com

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@babel/core (source)	7.12.3 → 7.29.6

---

@​babel/core: Arbitrary File Read via sourceMappingURL Comment

CVE-2026-49356 / GHSA-4x5r-pxfx-6jf8

More information

Details

Impact

Using @babel/core to compile maliciously crafted code can allow ab attacker to read any source map from the system that is running Babel, if these conditions are all true:

• the attacker controls the input source code
• the attacker can read the output source code
• the attacker knows the path of the source map file that they want to read

Users that only compile trusted code are not impacted.

Patches

The vulnerability has been fixed in @babel/core@7.29.6 and @babel/core@8.0.0-rc.6.

Workarounds

Callers can mitigate the issue without upgrading by setting inputSourceMap: false in their Babel options.

Callers can also manually extract the #sourceMappingURL comment from the input source code, validate whether the source map that it links to is allowed to be read, and if it is pass an object to inputSourceMap (passing false when it's not).

Credits

Thanks Teodor-Cristian Radoi for reporting the vulnerability.

Severity

• CVSS Score: 3.2 / 10 (Low)
• Vector String: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

References

• https://github.com/babel/babel/security/advisories/GHSA-4x5r-pxfx-6jf8
• https://babeljs.io/docs/options#inputsourcemap
• https://nvd.nist.gov/vuln/detail/CVE-2026-49356
• https://github.com/advisories/GHSA-4x5r-pxfx-6jf8

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

babel/babel (@​babel/core)

v7.29.6

Compare Source

v7.29.6 (2026-05-25)

🐛 Bug Fix

• babel-generator
  • #​18014 Catchup source map position in preserveFormat (@​nicolo-ribaudo)
• babel-core
  • #​18001 [7.x packport]Improve input source map handling (@​JLHwung)
• babel-core, babel-generator
  • #​17998 Preserve original identifier names from input sourcemaps (#​17992) (@​Andarist)

Committers: 3

• Huáng Jùnliàng (@​JLHwung)
• Mateusz Burzyński (@​Andarist)
• Nicolò Ribaudo (@​nicolo-ribaudo)

v7.29.0

Compare Source

v7.29.0 (2026-01-31)

Thanks @​simbahax for your first PR!

🚀 New Feature

• babel-types
  • #​17750 [7.x backport] Add attributes import declaration builder (@​JLHwung)
• babel-standalone
  • #​17663 [7.x backport] feat(standalone): export async transform (@​JLHwung)
  • #​17725 [7.x backport] feat: read standalone targets from data-targets (@​JLHwung)

🐛 Bug Fix

• babel-parser
  • #​17765 fix(parser): correctly parse type assertions in extends clause (@​nicolo-ribaudo)
  • #​17723 [7.x backport] fix(parser): improve super type argument parsing (@​JLHwung)
• babel-traverse
  • #​17708 fix(traverse): provide a hub when traversing a File or Program and no parentPath is given (@​simbahax)
• babel-plugin-transform-block-scoping, babel-traverse
  • #​17737 [7.x backport] fix: Rename switch discriminant references when body creates shadowing variable (@​magic-akari)

🏃‍♀️ Performance

• babel-generator, babel-runtime-corejs3
  • #​17642 [Babel 7] Improve generator performance (@​liuxingbaoyu)

Committers: 6

• David (@​simbahax)
• Huáng Jùnliàng (@​JLHwung)
• Nicolò Ribaudo (@​nicolo-ribaudo)
• @​liuxingbaoyu
• @​magic-akari

v7.28.6

Compare Source

v7.28.5

Compare Source

👓 Spec Compliance

• babel-parser
  • #​17446 Allow Runtime Errors for Function Call Assignment Targets (@​liuxingbaoyu)
• babel-helper-validator-identifier
  • #​17501 fix: update identifier to unicode 17 (@​fisker)

🐛 Bug Fix

• babel-plugin-proposal-destructuring-private
  • #​17534 Allow mixing private destructuring and rest (@​CO0Ki3)
• babel-parser
  • #​17521 Improve @babel/parser error typing (@​JLHwung)
  • #​17491 fix: improve ts-only declaration parsing (@​JLHwung)
• babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring
  • #​17519 fix: rest correctly returns plain array (@​liuxingbaoyu)
• babel-helper-create-class-features-plugin, babel-helper-member-expression-to-functions, babel-plugin-transform-block-scoping, babel-plugin-transform-optional-chaining, babel-traverse, babel-types
  • #​17503 Fix JSXIdentifier handling in isReferencedIdentifier (@​JLHwung)
• babel-traverse
  • #​17504 fix: ensure scope.push register in anonymous fn (@​JLHwung)

🏠 Internal

• babel-types
  • #​17494 Type checking babel-types scripts (@​JLHwung)

🏃‍♀️ Performance

• babel-core
  • #​17490 Faster finding of locations in buildCodeFrameError (@​liuxingbaoyu)

v7.28.4

Compare Source

🏠 Internal

• babel-core, babel-helper-check-duplicate-nodes, babel-traverse, babel-types
  • #​17493 Update Jest to v30.1.1 (@​JLHwung)
• babel-plugin-transform-regenerator
  • #​17455 chore: Clean up transform-regenerator (@​liuxingbaoyu)
• babel-core
  • #​17474 Switch to @​jridgewell/remapping (@​mrginglymus)

v7.28.3

Compare Source

👓 Spec Compliance

• babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators, babel-plugin-transform-class-static-block, babel-preset-env
  • #​17443 [static blocks] Do not inject new static fields after static code (@​nicolo-ribaudo)

🐛 Bug Fix

• babel-parser
  • #​17465 fix(parser/typescript): parse import("./a", {with:{},}) (@​easrng)
  • #​17478 fix(parser): stop subscript parsing on async arrow (@​JLHwung)

💅 Polish

• babel-plugin-transform-regenerator, babel-plugin-transform-runtime
  • #​17363 Do not save last yield in call in temp var (@​nicolo-ribaudo)

📝 Documentation

• #​17448 move eslint-{parser,plugin} docs to the website (@​JLHwung)

🏠 Internal

• #​17454 Enable type checking for scripts and babel-worker.cjs (@​JLHwung)

🔬 Output optimization

• babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions
  • #​17444 Optimize do expression output (@​JLHwung)

v7.28.0

Compare Source

🚀 New Feature

• babel-node
  • #​17147 Support top level await in node repl (@​liuxingbaoyu)
• babel-types
  • #​17258 feat(matchesPattern): support super/private/meta (@​JLHwung)
• babel-compat-data, babel-preset-env
  • #​17355 Add explicit resource management to preset-env (@​JLHwung)
• babel-core, babel-parser
  • #​17390 Support sourceType: "commonjs" (@​JLHwung)
• babel-generator, babel-parser
  • #​17346 Materialize explicitResourceManagement parser plugin (@​JLHwung)
• babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-plugin-transform-object-rest-spread, babel-traverse, babel-types
  • #​17391 LVal coverage updates (Part 2) (@​JLHwung)
• babel-parser, babel-traverse, babel-types
  • #​17378 Accept bigints in t.bigIntLiteral factory (@​JLHwung)
• babel-generator, babel-plugin-proposal-destructuring-private, babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring, babel-plugin-transform-explicit-resource-management, babel-plugin-transform-react-display-name, babel-types
  • #​17277 Transform discard binding (@​JLHwung)
• babel-generator, babel-parser, babel-plugin-proposal-destructuring-private, babel-plugin-transform-block-scoping, babel-plugin-transform-object-rest-spread, babel-plugin-transform-typescript, babel-traverse, babel-types
  • #​17163 Parse discard binding (@​JLHwung)

🐛 Bug Fix

• babel-helper-globals, babel-plugin-transform-classes, babel-traverse
  • #​17297 Create babel-helper-globals (@​JLHwung)
• babel-types
  • #​17009 feature: TSTypeOperator: keyof (#​16799) (@​coderaiser)

🏠 Internal

• babel-compat-data, babel-plugin-proposal-decorators, babel-plugin-transform-async-generator-functions, babel-plugin-transform-json-modules, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs3
  • #​17403 Update babel-polyfill packages (@​nicolo-ribaudo)

v7.27.7

Compare Source

👓 Spec Compliance

• babel-parser, babel-plugin-transform-classes
  • #​17203 Interepret parser allow* options as top level only (@​JLHwung)
• babel-parser
  • #​17371 fix: disable using in ambient context (@​JLHwung)

🐛 Bug Fix

• babel-core
  • #​17392 Improve TS babel config loading (@​JLHwung)
• babel-types
  • #​17376 fix: support negative bigint in valueToNode (@​JLHwung)
• babel-plugin-transform-parameters
  • #​17352 fix: Params of async function* should throw synchronously (@​liuxingbaoyu)

🏠 Internal

• babel-plugin-transform-destructuring, babel-plugin-transform-object-rest-spread
  • #​17389 Use NodePath#splitExportDeclaration in destructuring transforms (@​JLHwung)

v7.27.4

Compare Source

👓 Spec Compliance

• babel-parser, babel-plugin-proposal-explicit-resource-management
  • #​17323 Disallow using in bare case statement (@​JLHwung)

💅 Polish

• babel-parser
  • #​17311 Improve parseExpression error messages (@​JLHwung)

🔬 Output optimization

• babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-classes, babel-plugin-transform-destructuring, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • #​17287 Reduce regenerator size more (@​liuxingbaoyu)
• babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-classes, babel-plugin-transform-destructuring, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs3
  • #​17334 Use shorter method names for regenerator context (@​nicolo-ribaudo)
  • #​17268 Reduce regenerator helper size (@​liuxingbaoyu)
• babel-core, babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-classes, babel-plugin-transform-destructuring, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime, babel-standalone
  • #​17238 Split regeneratorRuntime into multiple helpers (@​nicolo-ribaudo)

v7.27.3

Compare Source

🐛 Bug Fix

• babel-generator
  • #​17324 Improve multiline comments handling in yield/await expression (@​JLHwung)
• babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3
  • #​17328 Correctly set .displayName on GeneratorFunction (@​nicolo-ribaudo)
• babel-plugin-proposal-explicit-resource-management
  • #​17319 fix: handle shadowed binding in for using of body (@​JLHwung)
  • #​17317 fix: support named evaluation for using declaration (@​JLHwung)
• babel-plugin-proposal-decorators, babel-types
  • #​17321 fix(converter): Remove abstract modifiers in class declaration to expression conversion (@​magic-akari)
• babel-helper-module-transforms, babel-plugin-proposal-explicit-resource-management, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-umd
  • #​17257 Preserve class id when transforming using declarations with exported class (@​JLHwung)
• babel-parser
  • #​17312 fix(parser): properly handle optional markers in generator class methods (@​magic-akari)
  • #​17307 fix(parser): Terminate modifier parsing at newline (@​magic-akari)
• babel-generator, babel-parser
  • #​17308 Improve import phase parsing (@​JLHwung)

v7.27.1

Compare Source

👓 Spec Compliance

• babel-parser
  • #​17254 Allow using of as lexical declaration within for (@​JLHwung)
  • #​17230 Disallow get/set in TSPropertySignature (@​JLHwung)
• babel-parser, babel-types
  • #​17193 Stricter TSImportType options parsing (@​JLHwung)

🐛 Bug Fix

• babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-traverse
  • #​17137 fix: do expressions should allow early exit (@​kermanx)
• babel-helper-wrap-function, babel-plugin-transform-async-to-generator
  • #​17251 Fix: propagate argument evaluation errors through async promise chain (@​magic-akari)
• babel-helper-remap-async-to-generator, babel-plugin-transform-async-to-generator
  • #​17231 fix apply()/call() annotated as pure (@​Lacsw)
• babel-helper-fixtures, babel-parser
  • #​17233 Create ChainExpression within TSInstantiationExpression (@​JLHwung)
• babel-generator, babel-parser
  • #​17226 Fill optional AST properties when both estree and typescript parser plugin are enabled (Part 2) (@​JLHwung)
• babel-parser
  • #​17224 Fill optional AST properties when both estree and typescript parser plugin are enabled (Part 1) (@​JLHwung)
  • #​17080 Fix start of TSParameterProperty (@​JLHwung)
• babel-compat-data, babel-preset-env
  • #​17228 Update firefox bugfix compat data (@​JLHwung)
• babel-traverse
  • #​17156 fix: Objects and arrays with multiple references should not be evaluated (@​liuxingbaoyu)
• babel-generator
  • #​17216 Fix: support const type parameter in generator (@​JLHwung)

💅 Polish

• babel-plugin-bugfix-v8-spread-parameters-in-optional-chaining, babel-plugin-proposal-decorators, babel-plugin-transform-arrow-functions, babel-plugin-transform-class-properties, babel-plugin-transform-destructuring, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-chaining, babel-plugin-transform-parameters, babel-traverse
  • #​17221 Reduce generated names size for the 10th-11th (@​nicolo-ribaudo)

🏠 Internal

• babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • #​17263 Remove unused regenerator-runtime dep in @babel/runtime (@​nicolo-ribaudo)
• babel-compat-data, babel-preset-env
  • #​17256 Tune plugin compat data (@​JLHwung)
• babel-compat-data, babel-standalone
  • #​17236 migrate babel-compat-data build script to mjs (@​JLHwung)
• Other
  • #​17232 Bump typescript-eslint to 8.29.1 (@​JLHwung)
  • #​17219 test: add basic typescript-eslint integration tests (@​JLHwung)
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
• babel-register
  • #​16844 Migrate @babel/register to cts (@​liuxingbaoyu)
• babel-cli, babel-compat-data, babel-core, babel-generator, babel-helper-compilation-targets, babel-helper-fixtures, babel-helper-module-imports, babel-helper-module-transforms, babel-helper-plugin-test-runner, babel-helper-transform-fixture-test-runner, babel-helpers, babel-node, babel-parser, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-systemjs, babel-plugin-transform-modules-umd, babel-plugin-transform-react-display-name, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-plugin-transform-typeof-symbol, babel-plugin-transform-typescript, babel-preset-env, babel-register, babel-standalone, babel-types
  • #​17207 Enforce node protocol import (@​JLHwung)
• babel-plugin-transform-regenerator
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
• babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
• babel-helpers, babel-plugin-transform-regenerator
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
• babel-helpers
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)

🔬 Output optimization

• babel-helpers, babel-plugin-transform-modules-commonjs, babel-runtime-corejs3
  • #​16538 Reduce interopRequireWildcard size (@​liuxingbaoyu)
• babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3
  • #​17213 Reduce regeneratorRuntime size (@​liuxingbaoyu)

v7.26.10

Compare Source

👓 Spec Compliance

• babel-parser
  • #​17159 Disallow decorator in array pattern (@​JLHwung)

🐛 Bug Fix

• babel-parser, babel-template
  • #​17164 Fix: always initialize ExportDeclaration attributes (@​JLHwung)
• babel-core
  • #​17142 fix: "Map maximum size exceeded" in deepClone (@​liuxingbaoyu)
• babel-parser, babel-plugin-transform-typescript
  • #​17154 Update typescript parser tests (@​JLHwung)
• babel-traverse
  • #​17151 fix: Should not evaluate vars in child scope (@​liuxingbaoyu)
• babel-generator
  • #​17153 fix: Correctly generate abstract override (@​liuxingbaoyu)
• babel-parser
  • #​17107 Fix source type detection when parsing TypeScript (@​JLHwung)
• babel-helpers, babel-runtime, babel-runtime-corejs2, babel-runtime-corejs3
  • #​17173 Fix processing of replacement pattern with named capture groups (@​mmmsssttt404)

💅 Polish

• babel-standalone
  • #​17158 Avoid warnings when re-bundling @​babel/standalone with webpack (@​liuxingbaoyu)

🏠 Internal

• babel-parser
  • #​17160 Left-value parsing cleanup (@​JLHwung)

v7.26.9

Compare Source

🐛 Bug Fix

• babel-types
  • #​17103 fix: Definition for TSPropertySignature.kind (@​liuxingbaoyu)
• babel-generator, babel-types
  • #​17062 Print TypeScript optional/definite in ClassPrivateProperty (@​jamiebuilds-signal)

🏠 Internal

• babel-types
  • #​17130 Use .ts files with explicit reexports to solve name conflicts (@​nicolo-ribaudo)
• babel-core
  • #​17127 Do not depend on @types/gensync in Babel 7 (@​nicolo-ribaudo)

v7.26.8

Compare Source

v7.26.8 (2025-02-08)

🏠 Internal

• babel-preset-env
  • #​17097 Update dependency babel-plugin-polyfill-corejs3 to ^0.11.0

v7.26.7

Compare Source

🐛 Bug Fix

• babel-helpers, babel-preset-env, babel-runtime-corejs3
  • #​17086 Make "object without properties" helpers ES6-compatible (@​tquetano-netflix)
• babel-plugin-transform-typeof-symbol
  • #​17085 fix: Correctly handle typeof in arrow functions (@​liuxingbaoyu)
• babel-parser
  • #​17079 Respect ranges option in estree method value (@​JLHwung)
• babel-core
  • #​17052 Do not try to parse .ts configs as JSON if natively supported (@​nicolo-ribaudo)
• babel-plugin-transform-typescript
  • #​17050 fix: correctly resolve references to non-constant enum members (@​branchseer)
• babel-plugin-transform-typescript, babel-traverse, babel-types
  • #​17025 fix: Remove type-only import x = y.z (@​liuxingbaoyu)

v7.26.0

Compare Source

🚀 New Feature

• babel-core, babel-generator, babel-parser, babel-plugin-syntax-import-assertions, babel-plugin-syntax-import-attributes, babel-preset-env, babel-standalone, babel-types
  • #​16850 Enable import attributes parsing by default (@​nicolo-ribaudo)
• babel-core
  • #​16862 feat: support async plugin's pre/post (@​timofei-iatsenko)
• babel-compat-data, babel-plugin-proposal-regexp-modifiers, babel-plugin-transform-regexp-modifiers, babel-preset-env, babel-standalone
  • #​16692 Add transform-regexp-modifiers to preset-env (@​JLHwung)
• babel-parser
  • #​16849 feat: add startIndex parser option (@​DylanPiercey)
• babel-generator, babel-parser, babel-plugin-syntax-flow
  • #​16841 Always enable parsing of Flow enums (@​nicolo-ribaudo)
• babel-helpers, babel-preset-typescript, babel-runtime-corejs3
  • #​16794 Support import() in rewriteImportExtensions (@​liuxingbaoyu)
• babel-generator, babel-parser
  • #​16708 Add experimental format-preserving mode to @babel/generator (@​nicolo-ribaudo)

🐛 Bug Fix

• babel-core
  • #​16928 Workaround Node.js bug for parallel loading of TLA modules (@​nicolo-ribaudo)
  • #​16926 Fix loading of modules with TLA in Node.js 23 (@​nicolo-ribaudo)

💅 Polish

• babel-plugin-proposal-json-modules, babel-plugin-transform-json-modules, babel-standalone
  • #​16924 Rename proposal-json-modules to transform-json-modules (@​nicolo-ribaudo)

🏠 Internal

• babel-code-frame, babel-highlight
  • #​16896 Inline @babel/highlight in @babel/code-frame (@​nicolo-ribaudo)
• babel-generator, babel-parser, babel-types
  • #​16732 Add kind to TSModuleDeclaration (@​liuxingbaoyu)

🏃‍♀️ Performance

• babel-helper-module-transforms, babel-plugin-transform-modules-commonjs
  • #​16882 perf: Improve module transforms (@​liuxingbaoyu)

v7.25.9

Compare Source

🐛 Bug Fix

• babel-parser, babel-template, babel-types
  • #​16905 fix: Keep type annotations in syntacticPlaceholders mode (@​liuxingbaoyu)
• babel-helper-compilation-targets, babel-preset-env
  • #​16907 fix: support BROWSERSLIST{,_CONFIG} env (@​JLHwung)
• Other
  • #​16884 Analyze ClassAccessorProperty to prevent the no-undef rule (@​victorenator)

🏠 Internal

• babel-helper-transform-fixture-test-runner
  • #​16914 remove test options flaky (@​JLHwung)

🏃‍♀️ Performance

• babel-parser, babel-types
  • #​16918 perf: Make VISITOR_KEYS etc. faster to access (@​liuxingbaoyu)

v7.25.8

Compare Source

🐛 Bug Fix

• babel-core
  • #​16888 Restore public API of resolvePlugin/resolvePreset (@​nicolo-ribaudo)

🏠 Internal

• babel-parser, babel-plugin-proposal-async-do-expressions, babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-plugin-proposal-explicit-resource-management, babel-plugin-proposal-export-default-from, babel-plugin-proposal-function-bind, babel-plugin-proposal-function-sent, babel-plugin-proposal-import-defer, babel-plugin-proposal-partial-application, babel-plugin-proposal-throw-expressions, babel-plugin-transform-async-generator-functions, babel-plugin-transform-class-static-block, babel-plugin-transform-dynamic-import, babel-plugin-transform-export-namespace-from, babel-plugin-transform-json-strings, babel-plugin-transform-logical-assignment-operators, babel-plugin-transform-nullish-coalescing-operator, babel-plugin-transform-numeric-separator, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-catch-binding, babel-plugin-transform-optional-chaining, babel-plugin-transform-private-property-in-object, babel-preset-env
  • #​16824 Inline one-line syntax plugins (@​nicolo-ribaudo)

v7.25.7

Compare Source

🐛 Bug Fix

• babel-helper-validator-identifier
  • #​16825 fix: update identifier to unicode 16 (@​JLHwung)
• babel-traverse
  • #​16814 fix: issue with node path keys updated on unrelated paths (@​DylanPiercey)
• babel-plugin-transform-classes
  • #​16797 Use an inclusion rather than exclusion list for super() check (@​nicolo-ribaudo)
• babel-generator
  • #​16788 Fix printing of TS infer in compact mode (@​nicolo-ribaudo)
  • #​16785 Print TS type annotations for destructuring in assignment pattern (@​nicolo-ribaudo)
  • #​16778 Respect [no LineTerminator here] after nodes (@​nicolo-ribaudo)

💅 Polish

• babel-types
  • #​16852 Add deprecated JSDOC for fields (@​liuxingbaoyu)

🏠 Internal

• babel-core
  • #​16820 Allow sync loading of ESM when --experimental-require-module (@​nicolo-ribaudo)
• babel-helper-compilation-targets, babel-helper-plugin-utils, babel-preset-env
  • #​16858 Add browserslist config to external dependency (@​JLHwung)
• babel-plugin-proposal-destructuring-private, babel-plugin-syntax-decimal, babel-plugin-syntax-import-reflection, babel-standalone
  • #​16809 Archive syntax-import-reflection and syntax-decimal (@​nicolo-ribaudo)
• babel-generator
  • #​16779 Simplify logic for [no LineTerminator here] before nodes (@​nicolo-ribaudo)

🏃‍♀️ Performance

• babel-plugin-transform-typescript
  • #​16875 perf: Avoid extra cloning of namespaces (@​liuxingbaoyu)
• babel-types
  • #​16842 perf: Improve @​babel/types builders (@​liuxingbaoyu)
  • #​16828 Only access BABEL_TYPES_8_BREAKING at startup (@​nicolo-ribaudo)

v7.25.2

Compare Source

🐛 Bug Fix

• babel-core, babel-traverse
  • #​16695 Ensure that requeueComputedKeyAndDecorators is available (@​nicolo-ribaudo)

v7.24.9

Compare Source

🐛 Bug Fix

• babel-core, babel-standalone
  • #​16639 Avoid require() call in @babel/standalone bundle (@​nicolo-ribaudo)
• babel-types
  • #​16638 fix: provide legacy typings for TS < 4.1 (@​JLHwung)

💅 Polish

• babel-generator, babel-plugin-transform-optional-chaining
  • #​16617 Avoid extra parens in TS as/satisfies (@​nicolo-ribaudo)

🏠 Internal

• babel-helper-module-transforms
  • #​16629 Lazy top-level initializations for module transforms (@​guybedford)

v7.24.8

Compare Source

👓 Spec Compliance

• babel-parser
  • #​16567 Do not use strict mode in TS declare (@​liuxingbaoyu)

🐛 Bug Fix

• babel-generator
  • #​16630 Correctly print parens around in in for heads (@​nicolo-ribaudo)
  • #​16626 Fix printing of comments in await using (@​nicolo-ribaudo)
  • #​16591 fix typescript code generation for yield expression inside type expre… (@​SreeXD)
• babel-parser
  • #​16613 Disallow destructuring assignment in using declarations (@​H0onnn)
  • #​16490 fix: do not add .value: undefined to regexp literals (@​liuxingbaoyu)
• babel-types
  • #​16615 Remove boolean props from ObjectTypeInternalSlot visitor keys (@​nicolo-ribaudo)
• babel-plugin-transform-typescript
  • #​16566 fix: Correctly handle export import x = (@​liuxingbaoyu)

💅 Polish

• babel-generator
  • #​16625 Avoid unnecessary parens around async in for await (@​nicolo-ribaudo)
• babel-traverse
  • #​16619 Avoid checking Scope.globals multiple times (@​liuxingbaoyu)

v7.24.7

Compare Source

🐛 Bug Fix

• babel-node
  • #​16554 Allow extra flags in babel-node (@​nicolo-ribaudo)
• babel-traverse
  • #​16522 fix: incorrect constantViolations with destructuring (@​liuxingbaoyu)
• babel-helper-transform-fixture-test-runner, babel-plugin-proposal-explicit-resource-management
  • #​16524 fix: Transform using in switch correctly (@​liuxingbaoyu)

🏠 Internal

• babel-helpers, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • #​16525 Delete unused array helpers (@​blakewilson)

v7.24.6

Compare Source

🐛 Bug Fix

• babel-helper-create-class-features-plugin, babel-plugin-transform-class-properties
  • #​16514 Fix source maps for private member expressions (@​nicolo-ribaudo)
• babel-core, babel-generator, babel-plugin-transform-modules-commonjs
  • #​16515 Fix source maps for template literals (@​nicolo-ribaudo)
• babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
  • #​16485 Support undecorated static accessor in anonymous classes (@​JLHwung)
  • #​16484 Fix decorator bare yield await (@​JLHwung)
• babel-helpers, babel-plugin-proposal-decorators, babel-runtime-corejs3
  • #​16483 Fix: throw TypeError if addInitializer is called after finished (@​JLHwung)
• babel-parser, babel-plugin-transform-typescript
  • #​16476 fix: Correctly parse cls.fn<C> = x (@​liuxingbaoyu)

🏠 Internal

• babel-core, babel-helpers, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • #​16501 Generate helper metadata at build time (@​nicolo-ribaudo)
• babel-helpers
  • #​16499 Add tsconfig.json for @babel/helpers/src/helpers (@​nicolo-ribaudo)
• babel-cli, babel-helpers, babel-plugin-external-helpers, babel-plugin-proposal-decorators, babel-plugin-transform-class-properties, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-systemjs, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • #​16495 Move all runtime helpers to individual files (@​nicolo-ribaudo)
• babel-parser, babel-traverse
  • #​16482 Statically generate boilerplate for bitfield accessors (@​nicolo-ribaudo)
• Other
  • #​16466 Migrate import assertions syntax (@​JLHwung)

v7.24.5

Compare Source

🐛 Bug Fix

• babel-plugin-transform-classes, babel-traverse
  • #​16377 fix: TypeScript annotation affects output (@​liuxingbaoyu)
• babel-helpers, babel-plugin-proposal-explicit-resource-management, babel-runtime-corejs3
  • #​16440 Fix suppressed error order (@​sossost)
  • #​16408 Await nullish async disposable (@​JLHwung)

💅 Polish

• babel-parser
  • #​16407 Recover from exported using declaration (@​JLHwung)

🏠 Internal

• Other
  • #​16414 Relax ESLint peerDependency constraint to allow v9 (@​liuxingbaoyu)
• babel-parser
  • #​16425 Improve @babel/parser AST types (@​nicolo-ribaudo)
  • #​16417 Always pass type argument to .startNode (@​nicolo-ribaudo)
• babel-helper-create-class-features-plugin, babel-helper-member-expression-to-functions, babel-helper-module-transforms, babel-helper-split-export-declaration, babel-helper-wrap-function, babel-helpers, babel-plugin-bugfix-firefox-class-in-computed-class-key, babel-plugin-proposal-explicit-resource-management, babel-plugin-transform-block-scoping, babel-plugin-transform-destructuring, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-chaining, babel-plugin-transform-parameters, babel-plugin-transform-private-property-in-object, babel-plugin-transform-react-jsx-self, babel-plugin-transform-typeof-symbol, babel-plugin-transform-typescript, babel-traverse
  • [#​16439](https://redirect.github.com

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@babel/core (source)	7.12.3 → 7.29.6

---

@​babel/core: Arbitrary File Read via sourceMappingURL Comment

CVE-2026-49356 / GHSA-4x5r-pxfx-6jf8

More information

Details

Impact

Using @babel/core to compile maliciously crafted code can allow ab attacker to read any source map from the system that is running Babel, if these conditions are all true:

• the attacker controls the input source code
• the attacker can read the output source code
• the attacker knows the path of the source map file that they want to read

Users that only compile trusted code are not impacted.

Patches

The vulnerability has been fixed in @babel/core@7.29.6 and @babel/core@8.0.0-rc.6.

Workarounds

Callers can mitigate the issue without upgrading by setting inputSourceMap: false in their Babel options.

Callers can also manually extract the #sourceMappingURL comment from the input source code, validate whether the source map that it links to is allowed to be read, and if it is pass an object to inputSourceMap (passing false when it's not).

Credits

Thanks Teodor-Cristian Radoi for reporting the vulnerability.

Severity

• CVSS Score: 3.2 / 10 (Low)
• Vector String: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

References

• https://github.com/babel/babel/security/advisories/GHSA-4x5r-pxfx-6jf8
• https://babeljs.io/docs/options#inputsourcemap
• https://nvd.nist.gov/vuln/detail/CVE-2026-49356
• https://github.com/advisories/GHSA-4x5r-pxfx-6jf8

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

babel/babel (@​babel/core)

v7.29.6

Compare Source

v7.29.6 (2026-05-25)

🐛 Bug Fix

• babel-generator
  • #​18014 Catchup source map position in preserveFormat (@​nicolo-ribaudo)
• babel-core
  • #​18001 [7.x packport]Improve input source map handling (@​JLHwung)
• babel-core, babel-generator
  • #​17998 Preserve original identifier names from input sourcemaps (#​17992) (@​Andarist)

Committers: 3

• Huáng Jùnliàng (@​JLHwung)
• Mateusz Burzyński (@​Andarist)
• Nicolò Ribaudo (@​nicolo-ribaudo)

v7.29.0

Compare Source

v7.29.0 (2026-01-31)

Thanks @​simbahax for your first PR!

🚀 New Feature

• babel-types
  • #​17750 [7.x backport] Add attributes import declaration builder (@​JLHwung)
• babel-standalone
  • #​17663 [7.x backport] feat(standalone): export async transform (@​JLHwung)
  • #​17725 [7.x backport] feat: read standalone targets from data-targets (@​JLHwung)

🐛 Bug Fix

• babel-parser
  • #​17765 fix(parser): correctly parse type assertions in extends clause (@​nicolo-ribaudo)
  • #​17723 [7.x backport] fix(parser): improve super type argument parsing (@​JLHwung)
• babel-traverse
  • #​17708 fix(traverse): provide a hub when traversing a File or Program and no parentPath is given (@​simbahax)
• babel-plugin-transform-block-scoping, babel-traverse
  • #​17737 [7.x backport] fix: Rename switch discriminant references when body creates shadowing variable (@​magic-akari)

🏃‍♀️ Performance

• babel-generator, babel-runtime-corejs3
  • #​17642 [Babel 7] Improve generator performance (@​liuxingbaoyu)

Committers: 6

• David (@​simbahax)
• Huáng Jùnliàng (@​JLHwung)
• Nicolò Ribaudo (@​nicolo-ribaudo)
• @​liuxingbaoyu
• @​magic-akari

v7.28.6

Compare Source

v7.28.5

Compare Source

👓 Spec Compliance

• babel-parser
  • #​17446 Allow Runtime Errors for Function Call Assignment Targets (@​liuxingbaoyu)
• babel-helper-validator-identifier
  • #​17501 fix: update identifier to unicode 17 (@​fisker)

🐛 Bug Fix

• babel-plugin-proposal-destructuring-private
  • #​17534 Allow mixing private destructuring and rest (@​CO0Ki3)
• babel-parser
  • #​17521 Improve @babel/parser error typing (@​JLHwung)
  • #​17491 fix: improve ts-only declaration parsing (@​JLHwung)
• babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring
  • #​17519 fix: rest correctly returns plain array (@​liuxingbaoyu)
• babel-helper-create-class-features-plugin, babel-helper-member-expression-to-functions, babel-plugin-transform-block-scoping, babel-plugin-transform-optional-chaining, babel-traverse, babel-types
  • #​17503 Fix JSXIdentifier handling in isReferencedIdentifier (@​JLHwung)
• babel-traverse
  • #​17504 fix: ensure scope.push register in anonymous fn (@​JLHwung)

🏠 Internal

• babel-types
  • #​17494 Type checking babel-types scripts (@​JLHwung)

🏃‍♀️ Performance

• babel-core
  • #​17490 Faster finding of locations in buildCodeFrameError (@​liuxingbaoyu)

v7.28.4

Compare Source

🏠 Internal

• babel-core, babel-helper-check-duplicate-nodes, babel-traverse, babel-types
  • #​17493 Update Jest to v30.1.1 (@​JLHwung)
• babel-plugin-transform-regenerator
  • #​17455 chore: Clean up transform-regenerator (@​liuxingbaoyu)
• babel-core
  • #​17474 Switch to @​jridgewell/remapping (@​mrginglymus)

v7.28.3

Compare Source

👓 Spec Compliance

• babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators, babel-plugin-transform-class-static-block, babel-preset-env
  • #​17443 [static blocks] Do not inject new static fields after static code (@​nicolo-ribaudo)

🐛 Bug Fix

• babel-parser
  • #​17465 fix(parser/typescript): parse import("./a", {with:{},}) (@​easrng)
  • #​17478 fix(parser): stop subscript parsing on async arrow (@​JLHwung)

💅 Polish

• babel-plugin-transform-regenerator, babel-plugin-transform-runtime
  • #​17363 Do not save last yield in call in temp var (@​nicolo-ribaudo)

📝 Documentation

• #​17448 move eslint-{parser,plugin} docs to the website (@​JLHwung)

🏠 Internal

• #​17454 Enable type checking for scripts and babel-worker.cjs (@​JLHwung)

🔬 Output optimization

• babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions
  • #​17444 Optimize do expression output (@​JLHwung)

v7.28.0

Compare Source

🚀 New Feature

• babel-node
  • #​17147 Support top level await in node repl (@​liuxingbaoyu)
• babel-types
  • #​17258 feat(matchesPattern): support super/private/meta (@​JLHwung)
• babel-compat-data, babel-preset-env
  • #​17355 Add explicit resource management to preset-env (@​JLHwung)
• babel-core, babel-parser
  • #​17390 Support sourceType: "commonjs" (@​JLHwung)
• babel-generator, babel-parser
  • #​17346 Materialize explicitResourceManagement parser plugin (@​JLHwung)
• babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-plugin-transform-object-rest-spread, babel-traverse, babel-types
  • #​17391 LVal coverage updates (Part 2) (@​JLHwung)
• babel-parser, babel-traverse, babel-types
  • #​17378 Accept bigints in t.bigIntLiteral factory (@​JLHwung)
• babel-generator, babel-plugin-proposal-destructuring-private, babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring, babel-plugin-transform-explicit-resource-management, babel-plugin-transform-react-display-name, babel-types
  • #​17277 Transform discard binding (@​JLHwung)
• babel-generator, babel-parser, babel-plugin-proposal-destructuring-private, babel-plugin-transform-block-scoping, babel-plugin-transform-object-rest-spread, babel-plugin-transform-typescript, babel-traverse, babel-types
  • #​17163 Parse discard binding (@​JLHwung)

🐛 Bug Fix

• babel-helper-globals, babel-plugin-transform-classes, babel-traverse
  • #​17297 Create babel-helper-globals (@​JLHwung)
• babel-types
  • #​17009 feature: TSTypeOperator: keyof (#​16799) (@​coderaiser)

🏠 Internal

• babel-compat-data, babel-plugin-proposal-decorators, babel-plugin-transform-async-generator-functions, babel-plugin-transform-json-modules, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs3
  • #​17403 Update babel-polyfill packages (@​nicolo-ribaudo)

v7.27.7

Compare Source

👓 Spec Compliance

• babel-parser, babel-plugin-transform-classes
  • #​17203 Interepret parser allow* options as top level only (@​JLHwung)
• babel-parser
  • #​17371 fix: disable using in ambient context (@​JLHwung)

🐛 Bug Fix

• babel-core
  • #​17392 Improve TS babel config loading (@​JLHwung)
• babel-types
  • #​17376 fix: support negative bigint in valueToNode (@​JLHwung)
• babel-plugin-transform-parameters
  • #​17352 fix: Params of async function* should throw synchronously (@​liuxingbaoyu)

🏠 Internal

• babel-plugin-transform-destructuring, babel-plugin-transform-object-rest-spread
  • #​17389 Use NodePath#splitExportDeclaration in destructuring transforms (@​JLHwung)

v7.27.4

Compare Source

👓 Spec Compliance

• babel-parser, babel-plugin-proposal-explicit-resource-management
  • #​17323 Disallow using in bare case statement (@​JLHwung)

💅 Polish

• babel-parser
  • #​17311 Improve parseExpression error messages (@​JLHwung)

🔬 Output optimization

• babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-classes, babel-plugin-transform-destructuring, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • #​17287 Reduce regenerator size more (@​liuxingbaoyu)
• babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-classes, babel-plugin-transform-destructuring, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs3
  • #​17334 Use shorter method names for regenerator context (@​nicolo-ribaudo)
  • #​17268 Reduce regenerator helper size (@​liuxingbaoyu)
• babel-core, babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-classes, babel-plugin-transform-destructuring, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime, babel-standalone
  • #​17238 Split regeneratorRuntime into multiple helpers (@​nicolo-ribaudo)

v7.27.3

Compare Source

🐛 Bug Fix

• babel-generator
  • #​17324 Improve multiline comments handling in yield/await expression (@​JLHwung)
• babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3
  • #​17328 Correctly set .displayName on GeneratorFunction (@​nicolo-ribaudo)
• babel-plugin-proposal-explicit-resource-management
  • #​17319 fix: handle shadowed binding in for using of body (@​JLHwung)
  • #​17317 fix: support named evaluation for using declaration (@​JLHwung)
• babel-plugin-proposal-decorators, babel-types
  • #​17321 fix(converter): Remove abstract modifiers in class declaration to expression conversion (@​magic-akari)
• babel-helper-module-transforms, babel-plugin-proposal-explicit-resource-management, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-umd
  • #​17257 Preserve class id when transforming using declarations with exported class (@​JLHwung)
• babel-parser
  • #​17312 fix(parser): properly handle optional markers in generator class methods (@​magic-akari)
  • #​17307 fix(parser): Terminate modifier parsing at newline (@​magic-akari)
• babel-generator, babel-parser
  • #​17308 Improve import phase parsing (@​JLHwung)

v7.27.1

Compare Source

👓 Spec Compliance

• babel-parser
  • #​17254 Allow using of as lexical declaration within for (@​JLHwung)
  • #​17230 Disallow get/set in TSPropertySignature (@​JLHwung)
• babel-parser, babel-types
  • #​17193 Stricter TSImportType options parsing (@​JLHwung)

🐛 Bug Fix

• babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-traverse
  • #​17137 fix: do expressions should allow early exit (@​kermanx)
• babel-helper-wrap-function, babel-plugin-transform-async-to-generator
  • #​17251 Fix: propagate argument evaluation errors through async promise chain (@​magic-akari)
• babel-helper-remap-async-to-generator, babel-plugin-transform-async-to-generator
  • #​17231 fix apply()/call() annotated as pure (@​Lacsw)
• babel-helper-fixtures, babel-parser
  • #​17233 Create ChainExpression within TSInstantiationExpression (@​JLHwung)
• babel-generator, babel-parser
  • #​17226 Fill optional AST properties when both estree and typescript parser plugin are enabled (Part 2) (@​JLHwung)
• babel-parser
  • #​17224 Fill optional AST properties when both estree and typescript parser plugin are enabled (Part 1) (@​JLHwung)
  • #​17080 Fix start of TSParameterProperty (@​JLHwung)
• babel-compat-data, babel-preset-env
  • #​17228 Update firefox bugfix compat data (@​JLHwung)
• babel-traverse
  • #​17156 fix: Objects and arrays with multiple references should not be evaluated (@​liuxingbaoyu)
• babel-generator
  • #​17216 Fix: support const type parameter in generator (@​JLHwung)

💅 Polish

• babel-plugin-bugfix-v8-spread-parameters-in-optional-chaining, babel-plugin-proposal-decorators, babel-plugin-transform-arrow-functions, babel-plugin-transform-class-properties, babel-plugin-transform-destructuring, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-chaining, babel-plugin-transform-parameters, babel-traverse
  • #​17221 Reduce generated names size for the 10th-11th (@​nicolo-ribaudo)

🏠 Internal

• babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • #​17263 Remove unused regenerator-runtime dep in @babel/runtime (@​nicolo-ribaudo)
• babel-compat-data, babel-preset-env
  • #​17256 Tune plugin compat data (@​JLHwung)
• babel-compat-data, babel-standalone
  • #​17236 migrate babel-compat-data build script to mjs (@​JLHwung)
• Other
  • #​17232 Bump typescript-eslint to 8.29.1 (@​JLHwung)
  • #​17219 test: add basic typescript-eslint integration tests (@​JLHwung)
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
• babel-register
  • #​16844 Migrate @babel/register to cts (@​liuxingbaoyu)
• babel-cli, babel-compat-data, babel-core, babel-generator, babel-helper-compilation-targets, babel-helper-fixtures, babel-helper-module-imports, babel-helper-module-transforms, babel-helper-plugin-test-runner, babel-helper-transform-fixture-test-runner, babel-helpers, babel-node, babel-parser, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-systemjs, babel-plugin-transform-modules-umd, babel-plugin-transform-react-display-name, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-plugin-transform-typeof-symbol, babel-plugin-transform-typescript, babel-preset-env, babel-register, babel-standalone, babel-types
  • #​17207 Enforce node protocol import (@​JLHwung)
• babel-plugin-transform-regenerator
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
• babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
• babel-helpers, babel-plugin-transform-regenerator
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
• babel-helpers
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)

🔬 Output optimization

• babel-helpers, babel-plugin-transform-modules-commonjs, babel-runtime-corejs3
  • #​16538 Reduce interopRequireWildcard size (@​liuxingbaoyu)
• babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3
  • #​17213 Reduce regeneratorRuntime size (@​liuxingbaoyu)

v7.26.10

Compare Source

👓 Spec Compliance

• babel-parser
  • #​17159 Disallow decorator in array pattern (@​JLHwung)

🐛 Bug Fix

• babel-parser, babel-template
  • #​17164 Fix: always initialize ExportDeclaration attributes (@​JLHwung)
• babel-core
  • #​17142 fix: "Map maximum size exceeded" in deepClone (@​liuxingbaoyu)
• babel-parser, babel-plugin-transform-typescript
  • #​17154 Update typescript parser tests (@​JLHwung)
• babel-traverse
  • #​17151 fix: Should not evaluate vars in child scope (@​liuxingbaoyu)
• babel-generator
  • #​17153 fix: Correctly generate abstract override (@​liuxingbaoyu)
• babel-parser
  • #​17107 Fix source type detection when parsing TypeScript (@​JLHwung)
• babel-helpers, babel-runtime, babel-runtime-corejs2, babel-runtime-corejs3
  • #​17173 Fix processing of replacement pattern with named capture groups (@​mmmsssttt404)

💅 Polish

• babel-standalone
  • #​17158 Avoid warnings when re-bundling @​babel/standalone with webpack (@​liuxingbaoyu)

🏠 Internal

• babel-parser
  • #​17160 Left-value parsing cleanup (@​JLHwung)

v7.26.9

Compare Source

🐛 Bug Fix

• babel-types
  • #​17103 fix: Definition for TSPropertySignature.kind (@​liuxingbaoyu)
• babel-generator, babel-types
  • #​17062 Print TypeScript optional/definite in ClassPrivateProperty (@​jamiebuilds-signal)

🏠 Internal

• babel-types
  • #​17130 Use .ts files with explicit reexports to solve name conflicts (@​nicolo-ribaudo)
• babel-core
  • #​17127 Do not depend on @types/gensync in Babel 7 (@​nicolo-ribaudo)

v7.26.8

Compare Source

v7.26.8 (2025-02-08)

🏠 Internal

• babel-preset-env
  • #​17097 Update dependency babel-plugin-polyfill-corejs3 to ^0.11.0

v7.26.7

Compare Source

🐛 Bug Fix

• babel-helpers, babel-preset-env, babel-runtime-corejs3
  • #​17086 Make "object without properties" helpers ES6-compatible (@​tquetano-netflix)
• babel-plugin-transform-typeof-symbol
  • #​17085 fix: Correctly handle typeof in arrow functions (@​liuxingbaoyu)
• babel-parser
  • #​17079 Respect ranges option in estree method value (@​JLHwung)
• babel-core
  • #​17052 Do not try to parse .ts configs as JSON if natively supported (@​nicolo-ribaudo)
• babel-plugin-transform-typescript
  • #​17050 fix: correctly resolve references to non-constant enum members (@​branchseer)
• babel-plugin-transform-typescript, babel-traverse, babel-types
  • #​17025 fix: Remove type-only import x = y.z (@​liuxingbaoyu)

v7.26.0

Compare Source

🚀 New Feature

• babel-core, babel-generator, babel-parser, babel-plugin-syntax-import-assertions, babel-plugin-syntax-import-attributes, babel-preset-env, babel-standalone, babel-types
  • #​16850 Enable import attributes parsing by default (@​nicolo-ribaudo)
• babel-core
  • #​16862 feat: support async plugin's pre/post (@​timofei-iatsenko)
• babel-compat-data, babel-plugin-proposal-regexp-modifiers, babel-plugin-transform-regexp-modifiers, babel-preset-env, babel-standalone
  • #​16692 Add transform-regexp-modifiers to preset-env (@​JLHwung)
• babel-parser
  • #​16849 feat: add startIndex parser option (@​DylanPiercey)
• babel-generator, babel-parser, babel-plugin-syntax-flow
  • #​16841 Always enable parsing of Flow enums (@​nicolo-ribaudo)
• babel-helpers, babel-preset-typescript, babel-runtime-corejs3
  • #​16794 Support import() in rewriteImportExtensions (@​liuxingbaoyu)
• babel-generator, babel-parser
  • #​16708 Add experimental format-preserving mode to @babel/generator (@​nicolo-ribaudo)

🐛 Bug Fix

• babel-core
  • #​16928 Workaround Node.js bug for parallel loading of TLA modules (@​nicolo-ribaudo)
  • #​16926 Fix loading of modules with TLA in Node.js 23 (@​nicolo-ribaudo)

💅 Polish

• babel-plugin-proposal-json-modules, babel-plugin-transform-json-modules, babel-standalone
  • #​16924 Rename proposal-json-modules to transform-json-modules (@​nicolo-ribaudo)

🏠 Internal

• babel-code-frame, babel-highlight
  • #​16896 Inline @babel/highlight in @babel/code-frame (@​nicolo-ribaudo)
• babel-generator, babel-parser, babel-types
  • #​16732 Add kind to TSModuleDeclaration (@​liuxingbaoyu)

🏃‍♀️ Performance

• babel-helper-module-transforms, babel-plugin-transform-modules-commonjs
  • #​16882 perf: Improve module transforms (@​liuxingbaoyu)

v7.25.9

Compare Source

🐛 Bug Fix

• babel-parser, babel-template, babel-types
  • #​16905 fix: Keep type annotations in syntacticPlaceholders mode (@​liuxingbaoyu)
• babel-helper-compilation-targets, babel-preset-env
  • #​16907 fix: support BROWSERSLIST{,_CONFIG} env (@​JLHwung)
• Other
  • #​16884 Analyze ClassAccessorProperty to prevent the no-undef rule (@​victorenator)

🏠 Internal

• babel-helper-transform-fixture-test-runner
  • #​16914 remove test options flaky (@​JLHwung)

🏃‍♀️ Performance

• babel-parser, babel-types
  • #​16918 perf: Make VISITOR_KEYS etc. faster to access (@​liuxingbaoyu)

v7.25.8

Compare Source

🐛 Bug Fix

• babel-core
  • #​16888 Restore public API of resolvePlugin/resolvePreset (@​nicolo-ribaudo)

🏠 Internal

• babel-parser, babel-plugin-proposal-async-do-expressions, babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-plugin-proposal-explicit-resource-management, babel-plugin-proposal-export-default-from, babel-plugin-proposal-function-bind, babel-plugin-proposal-function-sent, babel-plugin-proposal-import-defer, babel-plugin-proposal-partial-application, babel-plugin-proposal-throw-expressions, babel-plugin-transform-async-generator-functions, babel-plugin-transform-class-static-block, babel-plugin-transform-dynamic-import, babel-plugin-transform-export-namespace-from, babel-plugin-transform-json-strings, babel-plugin-transform-logical-assignment-operators, babel-plugin-transform-nullish-coalescing-operator, babel-plugin-transform-numeric-separator, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-catch-binding, babel-plugin-transform-optional-chaining, babel-plugin-transform-private-property-in-object, babel-preset-env
  • #​16824 Inline one-line syntax plugins (@​nicolo-ribaudo)

v7.25.7

Compare Source

🐛 Bug Fix

• babel-helper-validator-identifier
  • #​16825 fix: update identifier to unicode 16 (@​JLHwung)
• babel-traverse
  • #​16814 fix: issue with node path keys updated on unrelated paths (@​DylanPiercey)
• babel-plugin-transform-classes
  • #​16797 Use an inclusion rather than exclusion list for super() check (@​nicolo-ribaudo)
• babel-generator
  • #​16788 Fix printing of TS infer in compact mode (@​nicolo-ribaudo)
  • #​16785 Print TS type annotations for destructuring in assignment pattern (@​nicolo-ribaudo)
  • #​16778 Respect [no LineTerminator here] after nodes (@​nicolo-ribaudo)

💅 Polish

• babel-types
  • #​16852 Add deprecated JSDOC for fields (@​liuxingbaoyu)

🏠 Internal

• babel-core
  • #​16820 Allow sync loading of ESM when --experimental-require-module (@​nicolo-ribaudo)
• babel-helper-compilation-targets, babel-helper-plugin-utils, babel-preset-env
  • #​16858 Add browserslist config to external dependency (@​JLHwung)
• babel-plugin-proposal-destructuring-private, babel-plugin-syntax-decimal, babel-plugin-syntax-import-reflection, babel-standalone
  • #​16809 Archive syntax-import-reflection and syntax-decimal (@​nicolo-ribaudo)
• babel-generator
  • #​16779 Simplify logic for [no LineTerminator here] before nodes (@​nicolo-ribaudo)

🏃‍♀️ Performance

• babel-plugin-transform-typescript
  • #​16875 perf: Avoid extra cloning of namespaces (@​liuxingbaoyu)
• babel-types
  • #​16842 perf: Improve @​babel/types builders (@​liuxingbaoyu)
  • #​16828 Only access BABEL_TYPES_8_BREAKING at startup (@​nicolo-ribaudo)

v7.25.2

Compare Source

🐛 Bug Fix

• babel-core, babel-traverse
  • #​16695 Ensure that requeueComputedKeyAndDecorators is available (@​nicolo-ribaudo)

v7.24.9

Compare Source

🐛 Bug Fix

• babel-core, babel-standalone
  • #​16639 Avoid require() call in @babel/standalone bundle (@​nicolo-ribaudo)
• babel-types
  • #​16638 fix: provide legacy typings for TS < 4.1 (@​JLHwung)

💅 Polish

• babel-generator, babel-plugin-transform-optional-chaining
  • #​16617 Avoid extra parens in TS as/satisfies (@​nicolo-ribaudo)

🏠 Internal

• babel-helper-module-transforms
  • #​16629 Lazy top-level initializations for module transforms (@​guybedford)

v7.24.8

Compare Source

👓 Spec Compliance

• babel-parser
  • #​16567 Do not use strict mode in TS declare (@​liuxingbaoyu)

🐛 Bug Fix

• babel-generator
  • #​16630 Correctly print parens around in in for heads (@​nicolo-ribaudo)
  • #​16626 Fix printing of comments in await using (@​nicolo-ribaudo)
  • #​16591 fix typescript code generation for yield expression inside type expre… (@​SreeXD)
• babel-parser
  • #​16613 Disallow destructuring assignment in using declarations (@​H0onnn)
  • #​16490 fix: do not add .value: undefined to regexp literals (@​liuxingbaoyu)
• babel-types
  • #​16615 Remove boolean props from ObjectTypeInternalSlot visitor keys (@​nicolo-ribaudo)
• babel-plugin-transform-typescript
  • #​16566 fix: Correctly handle export import x = (@​liuxingbaoyu)

💅 Polish

• babel-generator
  • #​16625 Avoid unnecessary parens around async in for await (@​nicolo-ribaudo)
• babel-traverse
  • #​16619 Avoid checking Scope.globals multiple times (@​liuxingbaoyu)

v7.24.7

Compare Source

🐛 Bug Fix

• babel-node
  • #​16554 Allow extra flags in babel-node (@​nicolo-ribaudo)
• babel-traverse
  • #​16522 fix: incorrect constantViolations with destructuring (@​liuxingbaoyu)
• babel-helper-transform-fixture-test-runner, babel-plugin-proposal-explicit-resource-management
  • #​16524 fix: Transform using in switch correctly (@​liuxingbaoyu)

🏠 Internal

• babel-helpers, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • #​16525 Delete unused array helpers (@​blakewilson)

v7.24.6

Compare Source

🐛 Bug Fix

• babel-helper-create-class-features-plugin, babel-plugin-transform-class-properties
  • #​16514 Fix source maps for private member expressions (@​nicolo-ribaudo)
• babel-core, babel-generator, babel-plugin-transform-modules-commonjs
  • #​16515 Fix source maps for template literals (@​nicolo-ribaudo)
• babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
  • #​16485 Support undecorated static accessor in anonymous classes (@​JLHwung)
  • #​16484 Fix decorator bare yield await (@​JLHwung)
• babel-helpers, babel-plugin-proposal-decorators, babel-runtime-corejs3
  • #​16483 Fix: throw TypeError if addInitializer is called after finished (@​JLHwung)
• babel-parser, babel-plugin-transform-typescript
  • #​16476 fix: Correctly parse cls.fn<C> = x (@​liuxingbaoyu)

🏠 Internal

• babel-core, babel-helpers, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • #​16501 Generate helper metadata at build time (@​nicolo-ribaudo)
• babel-helpers
  • #​16499 Add tsconfig.json for @babel/helpers/src/helpers (@​nicolo-ribaudo)
• babel-cli, babel-helpers, babel-plugin-external-helpers, babel-plugin-proposal-decorators, babel-plugin-transform-class-properties, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-systemjs, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • #​16495 Move all runtime helpers to individual files (@​nicolo-ribaudo)
• babel-parser, babel-traverse
  • #​16482 Statically generate boilerplate for bitfield accessors (@​nicolo-ribaudo)
• Other
  • #​16466 Migrate import assertions syntax (@​JLHwung)

v7.24.5

Compare Source

🐛 Bug Fix

• babel-plugin-transform-classes, babel-traverse
  • #​16377 fix: TypeScript annotation affects output (@​liuxingbaoyu)
• babel-helpers, babel-plugin-proposal-explicit-resource-management, babel-runtime-corejs3
  • #​16440 Fix suppressed error order (@​sossost)
  • #​16408 Await nullish async disposable (@​JLHwung)

💅 Polish

• babel-parser
  • #​16407 Recover from exported using declaration (@​JLHwung)

🏠 Internal

• Other
  • #​16414 Relax ESLint peerDependency constraint to allow v9 (@​liuxingbaoyu)
• babel-parser
  • #​16425 Improve @babel/parser AST types (@​nicolo-ribaudo)
  • #​16417 Always pass type argument to .startNode (@​nicolo-ribaudo)
• babel-helper-create-class-features-plugin, babel-helper-member-expression-to-functions, babel-helper-module-transforms, babel-helper-split-export-declaration, babel-helper-wrap-function, babel-helpers, babel-plugin-bugfix-firefox-class-in-computed-class-key, babel-plugin-proposal-explicit-resource-management, babel-plugin-transform-block-scoping, babel-plugin-transform-destructuring, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-chaining, babel-plugin-transform-parameters, babel-plugin-transform-private-property-in-object, babel-plugin-transform-react-jsx-self, babel-plugin-transform-typeof-symbol, babel-plugin-transform-typescript, babel-traverse
  • [#​16439](https://redirect.github.com

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@babel/core (source)	7.12.3 → 7.29.6

---

@​babel/core: Arbitrary File Read via sourceMappingURL Comment

CVE-2026-49356 / GHSA-4x5r-pxfx-6jf8

More information

Details

Impact

Using @babel/core to compile maliciously crafted code can allow ab attacker to read any source map from the system that is running Babel, if these conditions are all true:

• the attacker controls the input source code
• the attacker can read the output source code
• the attacker knows the path of the source map file that they want to read

Users that only compile trusted code are not impacted.

Patches

The vulnerability has been fixed in @babel/core@7.29.6 and @babel/core@8.0.0-rc.6.

Workarounds

Callers can mitigate the issue without upgrading by setting inputSourceMap: false in their Babel options.

Callers can also manually extract the #sourceMappingURL comment from the input source code, validate whether the source map that it links to is allowed to be read, and if it is pass an object to inputSourceMap (passing false when it's not).

Credits

Thanks Teodor-Cristian Radoi for reporting the vulnerability.

Severity

• CVSS Score: 3.2 / 10 (Low)
• Vector String: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

References

• https://github.com/babel/babel/security/advisories/GHSA-4x5r-pxfx-6jf8
• https://babeljs.io/docs/options#inputsourcemap
• https://nvd.nist.gov/vuln/detail/CVE-2026-49356
• https://github.com/advisories/GHSA-4x5r-pxfx-6jf8

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

babel/babel (@​babel/core)

v7.29.6

Compare Source

v7.29.6 (2026-05-25)

🐛 Bug Fix

• babel-generator
  • #​18014 Catchup source map position in preserveFormat (@​nicolo-ribaudo)
• babel-core
  • #​18001 [7.x packport]Improve input source map handling (@​JLHwung)
• babel-core, babel-generator
  • #​17998 Preserve original identifier names from input sourcemaps (#​17992) (@​Andarist)

Committers: 3

• Huáng Jùnliàng (@​JLHwung)
• Mateusz Burzyński (@​Andarist)
• Nicolò Ribaudo (@​nicolo-ribaudo)

v7.29.0

Compare Source

v7.29.0 (2026-01-31)

Thanks @​simbahax for your first PR!

🚀 New Feature

• babel-types
  • #​17750 [7.x backport] Add attributes import declaration builder (@​JLHwung)
• babel-standalone
  • #​17663 [7.x backport] feat(standalone): export async transform (@​JLHwung)
  • #​17725 [7.x backport] feat: read standalone targets from data-targets (@​JLHwung)

🐛 Bug Fix

• babel-parser
  • #​17765 fix(parser): correctly parse type assertions in extends clause (@​nicolo-ribaudo)
  • #​17723 [7.x backport] fix(parser): improve super type argument parsing (@​JLHwung)
• babel-traverse
  • #​17708 fix(traverse): provide a hub when traversing a File or Program and no parentPath is given (@​simbahax)
• babel-plugin-transform-block-scoping, babel-traverse
  • #​17737 [7.x backport] fix: Rename switch discriminant references when body creates shadowing variable (@​magic-akari)

🏃‍♀️ Performance

• babel-generator, babel-runtime-corejs3
  • #​17642 [Babel 7] Improve generator performance (@​liuxingbaoyu)

Committers: 6

• David (@​simbahax)
• Huáng Jùnliàng (@​JLHwung)
• Nicolò Ribaudo (@​nicolo-ribaudo)
• @​liuxingbaoyu
• @​magic-akari

v7.28.6

Compare Source

v7.28.5

Compare Source

👓 Spec Compliance

• babel-parser
  • #​17446 Allow Runtime Errors for Function Call Assignment Targets (@​liuxingbaoyu)
• babel-helper-validator-identifier
  • #​17501 fix: update identifier to unicode 17 (@​fisker)

🐛 Bug Fix

• babel-plugin-proposal-destructuring-private
  • #​17534 Allow mixing private destructuring and rest (@​CO0Ki3)
• babel-parser
  • #​17521 Improve @babel/parser error typing (@​JLHwung)
  • #​17491 fix: improve ts-only declaration parsing (@​JLHwung)
• babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring
  • #​17519 fix: rest correctly returns plain array (@​liuxingbaoyu)
• babel-helper-create-class-features-plugin, babel-helper-member-expression-to-functions, babel-plugin-transform-block-scoping, babel-plugin-transform-optional-chaining, babel-traverse, babel-types
  • #​17503 Fix JSXIdentifier handling in isReferencedIdentifier (@​JLHwung)
• babel-traverse
  • #​17504 fix: ensure scope.push register in anonymous fn (@​JLHwung)

🏠 Internal

• babel-types
  • #​17494 Type checking babel-types scripts (@​JLHwung)

🏃‍♀️ Performance

• babel-core
  • #​17490 Faster finding of locations in buildCodeFrameError (@​liuxingbaoyu)

v7.28.4

Compare Source

🏠 Internal

• babel-core, babel-helper-check-duplicate-nodes, babel-traverse, babel-types
  • #​17493 Update Jest to v30.1.1 (@​JLHwung)
• babel-plugin-transform-regenerator
  • #​17455 chore: Clean up transform-regenerator (@​liuxingbaoyu)
• babel-core
  • #​17474 Switch to @​jridgewell/remapping (@​mrginglymus)

v7.28.3

Compare Source

👓 Spec Compliance

• babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators, babel-plugin-transform-class-static-block, babel-preset-env
  • #​17443 [static blocks] Do not inject new static fields after static code (@​nicolo-ribaudo)

🐛 Bug Fix

• babel-parser
  • #​17465 fix(parser/typescript): parse import("./a", {with:{},}) (@​easrng)
  • #​17478 fix(parser): stop subscript parsing on async arrow (@​JLHwung)

💅 Polish

• babel-plugin-transform-regenerator, babel-plugin-transform-runtime
  • #​17363 Do not save last yield in call in temp var (@​nicolo-ribaudo)

📝 Documentation

• #​17448 move eslint-{parser,plugin} docs to the website (@​JLHwung)

🏠 Internal

• #​17454 Enable type checking for scripts and babel-worker.cjs (@​JLHwung)

🔬 Output optimization

• babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions
  • #​17444 Optimize do expression output (@​JLHwung)

v7.28.0

Compare Source

🚀 New Feature

• babel-node
  • #​17147 Support top level await in node repl (@​liuxingbaoyu)
• babel-types
  • #​17258 feat(matchesPattern): support super/private/meta (@​JLHwung)
• babel-compat-data, babel-preset-env
  • #​17355 Add explicit resource management to preset-env (@​JLHwung)
• babel-core, babel-parser
  • #​17390 Support sourceType: "commonjs" (@​JLHwung)
• babel-generator, babel-parser
  • #​17346 Materialize explicitResourceManagement parser plugin (@​JLHwung)
• babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-plugin-transform-object-rest-spread, babel-traverse, babel-types
  • #​17391 LVal coverage updates (Part 2) (@​JLHwung)
• babel-parser, babel-traverse, babel-types
  • #​17378 Accept bigints in t.bigIntLiteral factory (@​JLHwung)
• babel-generator, babel-plugin-proposal-destructuring-private, babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring, babel-plugin-transform-explicit-resource-management, babel-plugin-transform-react-display-name, babel-types
  • #​17277 Transform discard binding (@​JLHwung)
• babel-generator, babel-parser, babel-plugin-proposal-destructuring-private, babel-plugin-transform-block-scoping, babel-plugin-transform-object-rest-spread, babel-plugin-transform-typescript, babel-traverse, babel-types
  • #​17163 Parse discard binding (@​JLHwung)

🐛 Bug Fix

• babel-helper-globals, babel-plugin-transform-classes, babel-traverse
  • #​17297 Create babel-helper-globals (@​JLHwung)
• babel-types
  • #​17009 feature: TSTypeOperator: keyof (#​16799) (@​coderaiser)

🏠 Internal

• babel-compat-data, babel-plugin-proposal-decorators, babel-plugin-transform-async-generator-functions, babel-plugin-transform-json-modules, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs3
  • #​17403 Update babel-polyfill packages (@​nicolo-ribaudo)

v7.27.7

Compare Source

👓 Spec Compliance

• babel-parser, babel-plugin-transform-classes
  • #​17203 Interepret parser allow* options as top level only (@​JLHwung)
• babel-parser
  • #​17371 fix: disable using in ambient context (@​JLHwung)

🐛 Bug Fix

• babel-core
  • #​17392 Improve TS babel config loading (@​JLHwung)
• babel-types
  • #​17376 fix: support negative bigint in valueToNode (@​JLHwung)
• babel-plugin-transform-parameters
  • #​17352 fix: Params of async function* should throw synchronously (@​liuxingbaoyu)

🏠 Internal

• babel-plugin-transform-destructuring, babel-plugin-transform-object-rest-spread
  • #​17389 Use NodePath#splitExportDeclaration in destructuring transforms (@​JLHwung)

v7.27.4

Compare Source

👓 Spec Compliance

• babel-parser, babel-plugin-proposal-explicit-resource-management
  • #​17323 Disallow using in bare case statement (@​JLHwung)

💅 Polish

• babel-parser
  • #​17311 Improve parseExpression error messages (@​JLHwung)

🔬 Output optimization

• babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-classes, babel-plugin-transform-destructuring, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • #​17287 Reduce regenerator size more (@​liuxingbaoyu)
• babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-classes, babel-plugin-transform-destructuring, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs3
  • #​17334 Use shorter method names for regenerator context (@​nicolo-ribaudo)
  • #​17268 Reduce regenerator helper size (@​liuxingbaoyu)
• babel-core, babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-classes, babel-plugin-transform-destructuring, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime, babel-standalone
  • #​17238 Split regeneratorRuntime into multiple helpers (@​nicolo-ribaudo)

v7.27.3

Compare Source

🐛 Bug Fix

• babel-generator
  • #​17324 Improve multiline comments handling in yield/await expression (@​JLHwung)
• babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3
  • #​17328 Correctly set .displayName on GeneratorFunction (@​nicolo-ribaudo)
• babel-plugin-proposal-explicit-resource-management
  • #​17319 fix: handle shadowed binding in for using of body (@​JLHwung)
  • #​17317 fix: support named evaluation for using declaration (@​JLHwung)
• babel-plugin-proposal-decorators, babel-types
  • #​17321 fix(converter): Remove abstract modifiers in class declaration to expression conversion (@​magic-akari)
• babel-helper-module-transforms, babel-plugin-proposal-explicit-resource-management, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-umd
  • #​17257 Preserve class id when transforming using declarations with exported class (@​JLHwung)
• babel-parser
  • #​17312 fix(parser): properly handle optional markers in generator class methods (@​magic-akari)
  • #​17307 fix(parser): Terminate modifier parsing at newline (@​magic-akari)
• babel-generator, babel-parser
  • #​17308 Improve import phase parsing (@​JLHwung)

v7.27.1

Compare Source

👓 Spec Compliance

• babel-parser
  • #​17254 Allow using of as lexical declaration within for (@​JLHwung)
  • #​17230 Disallow get/set in TSPropertySignature (@​JLHwung)
• babel-parser, babel-types
  • #​17193 Stricter TSImportType options parsing (@​JLHwung)

🐛 Bug Fix

• babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-traverse
  • #​17137 fix: do expressions should allow early exit (@​kermanx)
• babel-helper-wrap-function, babel-plugin-transform-async-to-generator
  • #​17251 Fix: propagate argument evaluation errors through async promise chain (@​magic-akari)
• babel-helper-remap-async-to-generator, babel-plugin-transform-async-to-generator
  • #​17231 fix apply()/call() annotated as pure (@​Lacsw)
• babel-helper-fixtures, babel-parser
  • #​17233 Create ChainExpression within TSInstantiationExpression (@​JLHwung)
• babel-generator, babel-parser
  • #​17226 Fill optional AST properties when both estree and typescript parser plugin are enabled (Part 2) (@​JLHwung)
• babel-parser
  • #​17224 Fill optional AST properties when both estree and typescript parser plugin are enabled (Part 1) (@​JLHwung)
  • #​17080 Fix start of TSParameterProperty (@​JLHwung)
• babel-compat-data, babel-preset-env
  • #​17228 Update firefox bugfix compat data (@​JLHwung)
• babel-traverse
  • #​17156 fix: Objects and arrays with multiple references should not be evaluated (@​liuxingbaoyu)
• babel-generator
  • #​17216 Fix: support const type parameter in generator (@​JLHwung)

💅 Polish

• babel-plugin-bugfix-v8-spread-parameters-in-optional-chaining, babel-plugin-proposal-decorators, babel-plugin-transform-arrow-functions, babel-plugin-transform-class-properties, babel-plugin-transform-destructuring, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-chaining, babel-plugin-transform-parameters, babel-traverse
  • #​17221 Reduce generated names size for the 10th-11th (@​nicolo-ribaudo)

🏠 Internal

• babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • #​17263 Remove unused regenerator-runtime dep in @babel/runtime (@​nicolo-ribaudo)
• babel-compat-data, babel-preset-env
  • #​17256 Tune plugin compat data (@​JLHwung)
• babel-compat-data, babel-standalone
  • #​17236 migrate babel-compat-data build script to mjs (@​JLHwung)
• Other
  • #​17232 Bump typescript-eslint to 8.29.1 (@​JLHwung)
  • #​17219 test: add basic typescript-eslint integration tests (@​JLHwung)
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
• babel-register
  • #​16844 Migrate @babel/register to cts (@​liuxingbaoyu)
• babel-cli, babel-compat-data, babel-core, babel-generator, babel-helper-compilation-targets, babel-helper-fixtures, babel-helper-module-imports, babel-helper-module-transforms, babel-helper-plugin-test-runner, babel-helper-transform-fixture-test-runner, babel-helpers, babel-node, babel-parser, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-systemjs, babel-plugin-transform-modules-umd, babel-plugin-transform-react-display-name, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-plugin-transform-typeof-symbol, babel-plugin-transform-typescript, babel-preset-env, babel-register, babel-standalone, babel-types
  • #​17207 Enforce node protocol import (@​JLHwung)
• babel-plugin-transform-regenerator
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
• babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
• babel-helpers, babel-plugin-transform-regenerator
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
• babel-helpers
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)

🔬 Output optimization

• babel-helpers, babel-plugin-transform-modules-commonjs, babel-runtime-corejs3
  • #​16538 Reduce interopRequireWildcard size (@​liuxingbaoyu)
• babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3
  • #​17213 Reduce regeneratorRuntime size (@​liuxingbaoyu)

v7.26.10

Compare Source

👓 Spec Compliance

• babel-parser
  • #​17159 Disallow decorator in array pattern (@​JLHwung)

🐛 Bug Fix

• babel-parser, babel-template
  • #​17164 Fix: always initialize ExportDeclaration attributes (@​JLHwung)
• babel-core
  • #​17142 fix: "Map maximum size exceeded" in deepClone (@​liuxingbaoyu)
• babel-parser, babel-plugin-transform-typescript
  • #​17154 Update typescript parser tests (@​JLHwung)
• babel-traverse
  • #​17151 fix: Should not evaluate vars in child scope (@​liuxingbaoyu)
• babel-generator
  • #​17153 fix: Correctly generate abstract override (@​liuxingbaoyu)
• babel-parser
  • #​17107 Fix source type detection when parsing TypeScript (@​JLHwung)
• babel-helpers, babel-runtime, babel-runtime-corejs2, babel-runtime-corejs3
  • #​17173 Fix processing of replacement pattern with named capture groups (@​mmmsssttt404)

💅 Polish

• babel-standalone
  • #​17158 Avoid warnings when re-bundling @​babel/standalone with webpack (@​liuxingbaoyu)

🏠 Internal

• babel-parser
  • #​17160 Left-value parsing cleanup (@​JLHwung)

v7.26.9

Compare Source

🐛 Bug Fix

• babel-types
  • #​17103 fix: Definition for TSPropertySignature.kind (@​liuxingbaoyu)
• babel-generator, babel-types
  • #​17062 Print TypeScript optional/definite in ClassPrivateProperty (@​jamiebuilds-signal)

🏠 Internal

• babel-types
  • #​17130 Use .ts files with explicit reexports to solve name conflicts (@​nicolo-ribaudo)
• babel-core
  • #​17127 Do not depend on @types/gensync in Babel 7 (@​nicolo-ribaudo)

v7.26.8

Compare Source

v7.26.8 (2025-02-08)

🏠 Internal

• babel-preset-env
  • #​17097 Update dependency babel-plugin-polyfill-corejs3 to ^0.11.0

v7.26.7

Compare Source

🐛 Bug Fix

• babel-helpers, babel-preset-env, babel-runtime-corejs3
  • #​17086 Make "object without properties" helpers ES6-compatible (@​tquetano-netflix)
• babel-plugin-transform-typeof-symbol
  • #​17085 fix: Correctly handle typeof in arrow functions (@​liuxingbaoyu)
• babel-parser
  • #​17079 Respect ranges option in estree method value (@​JLHwung)
• babel-core
  • #​17052 Do not try to parse .ts configs as JSON if natively supported (@​nicolo-ribaudo)
• babel-plugin-transform-typescript
  • #​17050 fix: correctly resolve references to non-constant enum members (@​branchseer)
• babel-plugin-transform-typescript, babel-traverse, babel-types
  • #​17025 fix: Remove type-only import x = y.z (@​liuxingbaoyu)

v7.26.0

Compare Source

🚀 New Feature

• babel-core, babel-generator, babel-parser, babel-plugin-syntax-import-assertions, babel-plugin-syntax-import-attributes, babel-preset-env, babel-standalone, babel-types
  • #​16850 Enable import attributes parsing by default (@​nicolo-ribaudo)
• babel-core
  • #​16862 feat: support async plugin's pre/post (@​timofei-iatsenko)
• babel-compat-data, babel-plugin-proposal-regexp-modifiers, babel-plugin-transform-regexp-modifiers, babel-preset-env, babel-standalone
  • #​16692 Add transform-regexp-modifiers to preset-env (@​JLHwung)
• babel-parser
  • #​16849 feat: add startIndex parser option (@​DylanPiercey)
• babel-generator, babel-parser, babel-plugin-syntax-flow
  • #​16841 Always enable parsing of Flow enums (@​nicolo-ribaudo)
• babel-helpers, babel-preset-typescript, babel-runtime-corejs3
  • #​16794 Support import() in rewriteImportExtensions (@​liuxingbaoyu)
• babel-generator, babel-parser
  • #​16708 Add experimental format-preserving mode to @babel/generator (@​nicolo-ribaudo)

🐛 Bug Fix

• babel-core
  • #​16928 Workaround Node.js bug for parallel loading of TLA modules (@​nicolo-ribaudo)
  • #​16926 Fix loading of modules with TLA in Node.js 23 (@​nicolo-ribaudo)

💅 Polish

• babel-plugin-proposal-json-modules, babel-plugin-transform-json-modules, babel-standalone
  • #​16924 Rename proposal-json-modules to transform-json-modules (@​nicolo-ribaudo)

🏠 Internal

• babel-code-frame, babel-highlight
  • #​16896 Inline @babel/highlight in @babel/code-frame (@​nicolo-ribaudo)
• babel-generator, babel-parser, babel-types
  • #​16732 Add kind to TSModuleDeclaration (@​liuxingbaoyu)

🏃‍♀️ Performance

• babel-helper-module-transforms, babel-plugin-transform-modules-commonjs
  • #​16882 perf: Improve module transforms (@​liuxingbaoyu)

v7.25.9

Compare Source

🐛 Bug Fix

• babel-parser, babel-template, babel-types
  • #​16905 fix: Keep type annotations in syntacticPlaceholders mode (@​liuxingbaoyu)
• babel-helper-compilation-targets, babel-preset-env
  • #​16907 fix: support BROWSERSLIST{,_CONFIG} env (@​JLHwung)
• Other
  • #​16884 Analyze ClassAccessorProperty to prevent the no-undef rule (@​victorenator)

🏠 Internal

• babel-helper-transform-fixture-test-runner
  • #​16914 remove test options flaky (@​JLHwung)

🏃‍♀️ Performance

• babel-parser, babel-types
  • #​16918 perf: Make VISITOR_KEYS etc. faster to access (@​liuxingbaoyu)

v7.25.8

Compare Source

🐛 Bug Fix

• babel-core
  • #​16888 Restore public API of resolvePlugin/resolvePreset (@​nicolo-ribaudo)

🏠 Internal

• babel-parser, babel-plugin-proposal-async-do-expressions, babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-plugin-proposal-explicit-resource-management, babel-plugin-proposal-export-default-from, babel-plugin-proposal-function-bind, babel-plugin-proposal-function-sent, babel-plugin-proposal-import-defer, babel-plugin-proposal-partial-application, babel-plugin-proposal-throw-expressions, babel-plugin-transform-async-generator-functions, babel-plugin-transform-class-static-block, babel-plugin-transform-dynamic-import, babel-plugin-transform-export-namespace-from, babel-plugin-transform-json-strings, babel-plugin-transform-logical-assignment-operators, babel-plugin-transform-nullish-coalescing-operator, babel-plugin-transform-numeric-separator, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-catch-binding, babel-plugin-transform-optional-chaining, babel-plugin-transform-private-property-in-object, babel-preset-env
  • #​16824 Inline one-line syntax plugins (@​nicolo-ribaudo)

v7.25.7

Compare Source

🐛 Bug Fix

• babel-helper-validator-identifier
  • #​16825 fix: update identifier to unicode 16 (@​JLHwung)
• babel-traverse
  • #​16814 fix: issue with node path keys updated on unrelated paths (@​DylanPiercey)
• babel-plugin-transform-classes
  • #​16797 Use an inclusion rather than exclusion list for super() check (@​nicolo-ribaudo)
• babel-generator
  • #​16788 Fix printing of TS infer in compact mode (@​nicolo-ribaudo)
  • #​16785 Print TS type annotations for destructuring in assignment pattern (@​nicolo-ribaudo)
  • #​16778 Respect [no LineTerminator here] after nodes (@​nicolo-ribaudo)

💅 Polish

• babel-types
  • #​16852 Add deprecated JSDOC for fields (@​liuxingbaoyu)

🏠 Internal

• babel-core
  • #​16820 Allow sync loading of ESM when --experimental-require-module (@​nicolo-ribaudo)
• babel-helper-compilation-targets, babel-helper-plugin-utils, babel-preset-env
  • #​16858 Add browserslist config to external dependency (@​JLHwung)
• babel-plugin-proposal-destructuring-private, babel-plugin-syntax-decimal, babel-plugin-syntax-import-reflection, babel-standalone
  • #​16809 Archive syntax-import-reflection and syntax-decimal (@​nicolo-ribaudo)
• babel-generator
  • #​16779 Simplify logic for [no LineTerminator here] before nodes (@​nicolo-ribaudo)

🏃‍♀️ Performance

• babel-plugin-transform-typescript
  • #​16875 perf: Avoid extra cloning of namespaces (@​liuxingbaoyu)
• babel-types
  • #​16842 perf: Improve @​babel/types builders (@​liuxingbaoyu)
  • #​16828 Only access BABEL_TYPES_8_BREAKING at startup (@​nicolo-ribaudo)

v7.25.2

Compare Source

🐛 Bug Fix

• babel-core, babel-traverse
  • #​16695 Ensure that requeueComputedKeyAndDecorators is available (@​nicolo-ribaudo)

v7.24.9

Compare Source

🐛 Bug Fix

• babel-core, babel-standalone
  • #​16639 Avoid require() call in @babel/standalone bundle (@​nicolo-ribaudo)
• babel-types
  • #​16638 fix: provide legacy typings for TS < 4.1 (@​JLHwung)

💅 Polish

• babel-generator, babel-plugin-transform-optional-chaining
  • #​16617 Avoid extra parens in TS as/satisfies (@​nicolo-ribaudo)

🏠 Internal

• babel-helper-module-transforms
  • #​16629 Lazy top-level initializations for module transforms (@​guybedford)

v7.24.8

Compare Source

👓 Spec Compliance

• babel-parser
  • #​16567 Do not use strict mode in TS declare (@​liuxingbaoyu)

🐛 Bug Fix

• babel-generator
  • #​16630 Correctly print parens around in in for heads (@​nicolo-ribaudo)
  • #​16626 Fix printing of comments in await using (@​nicolo-ribaudo)
  • #​16591 fix typescript code generation for yield expression inside type expre… (@​SreeXD)
• babel-parser
  • #​16613 Disallow destructuring assignment in using declarations (@​H0onnn)
  • #​16490 fix: do not add .value: undefined to regexp literals (@​liuxingbaoyu)
• babel-types
  • #​16615 Remove boolean props from ObjectTypeInternalSlot visitor keys (@​nicolo-ribaudo)
• babel-plugin-transform-typescript
  • #​16566 fix: Correctly handle export import x = (@​liuxingbaoyu)

💅 Polish

• babel-generator
  • #​16625 Avoid unnecessary parens around async in for await (@​nicolo-ribaudo)
• babel-traverse
  • #​16619 Avoid checking Scope.globals multiple times (@​liuxingbaoyu)

v7.24.7

Compare Source

🐛 Bug Fix

• babel-node
  • #​16554 Allow extra flags in babel-node (@​nicolo-ribaudo)
• babel-traverse
  • #​16522 fix: incorrect constantViolations with destructuring (@​liuxingbaoyu)
• babel-helper-transform-fixture-test-runner, babel-plugin-proposal-explicit-resource-management
  • #​16524 fix: Transform using in switch correctly (@​liuxingbaoyu)

🏠 Internal

• babel-helpers, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • #​16525 Delete unused array helpers (@​blakewilson)

v7.24.6

Compare Source

🐛 Bug Fix

• babel-helper-create-class-features-plugin, babel-plugin-transform-class-properties
  • #​16514 Fix source maps for private member expressions (@​nicolo-ribaudo)
• babel-core, babel-generator, babel-plugin-transform-modules-commonjs
  • #​16515 Fix source maps for template literals (@​nicolo-ribaudo)
• babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
  • #​16485 Support undecorated static accessor in anonymous classes (@​JLHwung)
  • #​16484 Fix decorator bare yield await (@​JLHwung)
• babel-helpers, babel-plugin-proposal-decorators, babel-runtime-corejs3
  • #​16483 Fix: throw TypeError if addInitializer is called after finished (@​JLHwung)
• babel-parser, babel-plugin-transform-typescript
  • #​16476 fix: Correctly parse cls.fn<C> = x (@​liuxingbaoyu)

🏠 Internal

• babel-core, babel-helpers, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • #​16501 Generate helper metadata at build time (@​nicolo-ribaudo)
• babel-helpers
  • #​16499 Add tsconfig.json for @babel/helpers/src/helpers (@​nicolo-ribaudo)
• babel-cli, babel-helpers, babel-plugin-external-helpers, babel-plugin-proposal-decorators, babel-plugin-transform-class-properties, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-systemjs, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • #​16495 Move all runtime helpers to individual files (@​nicolo-ribaudo)
• babel-parser, babel-traverse
  • #​16482 Statically generate boilerplate for bitfield accessors (@​nicolo-ribaudo)
• Other
  • #​16466 Migrate import assertions syntax (@​JLHwung)

v7.24.5

Compare Source

🐛 Bug Fix

• babel-plugin-transform-classes, babel-traverse
  • #​16377 fix: TypeScript annotation affects output (@​liuxingbaoyu)
• babel-helpers, babel-plugin-proposal-explicit-resource-management, babel-runtime-corejs3
  • #​16440 Fix suppressed error order (@​sossost)
  • #​16408 Await nullish async disposable (@​JLHwung)

💅 Polish

• babel-parser
  • #​16407 Recover from exported using declaration (@​JLHwung)

🏠 Internal

• Other
  • #​16414 Relax ESLint peerDependency constraint to allow v9 (@​liuxingbaoyu)
• babel-parser
  • #​16425 Improve @babel/parser AST types (@​nicolo-ribaudo)
  • #​16417 Always pass type argument to .startNode (@​nicolo-ribaudo)
• babel-helper-create-class-features-plugin, babel-helper-member-expression-to-functions, babel-helper-module-transforms, babel-helper-split-export-declaration, babel-helper-wrap-function, babel-helpers, babel-plugin-bugfix-firefox-class-in-computed-class-key, babel-plugin-proposal-explicit-resource-management, babel-plugin-transform-block-scoping, babel-plugin-transform-destructuring, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-chaining, babel-plugin-transform-parameters, babel-plugin-transform-private-property-in-object, babel-plugin-transform-react-jsx-self, babel-plugin-transform-typeof-symbol, babel-plugin-transform-typescript, babel-traverse
  • [#​16439](https://redirect.github.com

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@babel/core (source)	7.12.3 → 7.29.6

---

@​babel/core: Arbitrary File Read via sourceMappingURL Comment

CVE-2026-49356 / GHSA-4x5r-pxfx-6jf8

More information

Details

Impact

Using @babel/core to compile maliciously crafted code can allow ab attacker to read any source map from the system that is running Babel, if these conditions are all true:

• the attacker controls the input source code
• the attacker can read the output source code
• the attacker knows the path of the source map file that they want to read

Users that only compile trusted code are not impacted.

Patches

The vulnerability has been fixed in @babel/core@7.29.6 and @babel/core@8.0.0-rc.6.

Workarounds

Callers can mitigate the issue without upgrading by setting inputSourceMap: false in their Babel options.

Callers can also manually extract the #sourceMappingURL comment from the input source code, validate whether the source map that it links to is allowed to be read, and if it is pass an object to inputSourceMap (passing false when it's not).

Credits

Thanks Teodor-Cristian Radoi for reporting the vulnerability.

Severity

• CVSS Score: 3.2 / 10 (Low)
• Vector String: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

References

• https://github.com/babel/babel/security/advisories/GHSA-4x5r-pxfx-6jf8
• https://babeljs.io/docs/options#inputsourcemap
• https://nvd.nist.gov/vuln/detail/CVE-2026-49356
• https://github.com/advisories/GHSA-4x5r-pxfx-6jf8

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

babel/babel (@​babel/core)

v7.29.6

Compare Source

v7.29.6 (2026-05-25)

🐛 Bug Fix

• babel-generator
  • #​18014 Catchup source map position in preserveFormat (@​nicolo-ribaudo)
• babel-core
  • #​18001 [7.x packport]Improve input source map handling (@​JLHwung)
• babel-core, babel-generator
  • #​17998 Preserve original identifier names from input sourcemaps (#​17992) (@​Andarist)

Committers: 3

• Huáng Jùnliàng (@​JLHwung)
• Mateusz Burzyński (@​Andarist)
• Nicolò Ribaudo (@​nicolo-ribaudo)

v7.29.0

Compare Source

v7.29.0 (2026-01-31)

Thanks @​simbahax for your first PR!

🚀 New Feature

• babel-types
  • #​17750 [7.x backport] Add attributes import declaration builder (@​JLHwung)
• babel-standalone
  • #​17663 [7.x backport] feat(standalone): export async transform (@​JLHwung)
  • #​17725 [7.x backport] feat: read standalone targets from data-targets (@​JLHwung)

🐛 Bug Fix

• babel-parser
  • #​17765 fix(parser): correctly parse type assertions in extends clause (@​nicolo-ribaudo)
  • #​17723 [7.x backport] fix(parser): improve super type argument parsing (@​JLHwung)
• babel-traverse
  • #​17708 fix(traverse): provide a hub when traversing a File or Program and no parentPath is given (@​simbahax)
• babel-plugin-transform-block-scoping, babel-traverse
  • #​17737 [7.x backport] fix: Rename switch discriminant references when body creates shadowing variable (@​magic-akari)

🏃‍♀️ Performance

• babel-generator, babel-runtime-corejs3
  • #​17642 [Babel 7] Improve generator performance (@​liuxingbaoyu)

Committers: 6

• David (@​simbahax)
• Huáng Jùnliàng (@​JLHwung)
• Nicolò Ribaudo (@​nicolo-ribaudo)
• @​liuxingbaoyu
• @​magic-akari

v7.28.6

Compare Source

v7.28.5

Compare Source

👓 Spec Compliance

• babel-parser
  • #​17446 Allow Runtime Errors for Function Call Assignment Targets (@​liuxingbaoyu)
• babel-helper-validator-identifier
  • #​17501 fix: update identifier to unicode 17 (@​fisker)

🐛 Bug Fix

• babel-plugin-proposal-destructuring-private
  • #​17534 Allow mixing private destructuring and rest (@​CO0Ki3)
• babel-parser
  • #​17521 Improve @babel/parser error typing (@​JLHwung)
  • #​17491 fix: improve ts-only declaration parsing (@​JLHwung)
• babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring
  • #​17519 fix: rest correctly returns plain array (@​liuxingbaoyu)
• babel-helper-create-class-features-plugin, babel-helper-member-expression-to-functions, babel-plugin-transform-block-scoping, babel-plugin-transform-optional-chaining, babel-traverse, babel-types
  • #​17503 Fix JSXIdentifier handling in isReferencedIdentifier (@​JLHwung)
• babel-traverse
  • #​17504 fix: ensure scope.push register in anonymous fn (@​JLHwung)

🏠 Internal

• babel-types
  • #​17494 Type checking babel-types scripts (@​JLHwung)

🏃‍♀️ Performance

• babel-core
  • #​17490 Faster finding of locations in buildCodeFrameError (@​liuxingbaoyu)

v7.28.4

Compare Source

🏠 Internal

• babel-core, babel-helper-check-duplicate-nodes, babel-traverse, babel-types
  • #​17493 Update Jest to v30.1.1 (@​JLHwung)
• babel-plugin-transform-regenerator
  • #​17455 chore: Clean up transform-regenerator (@​liuxingbaoyu)
• babel-core
  • #​17474 Switch to @​jridgewell/remapping (@​mrginglymus)

v7.28.3

Compare Source

👓 Spec Compliance

• babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators, babel-plugin-transform-class-static-block, babel-preset-env
  • #​17443 [static blocks] Do not inject new static fields after static code (@​nicolo-ribaudo)

🐛 Bug Fix

• babel-parser
  • #​17465 fix(parser/typescript): parse import("./a", {with:{},}) (@​easrng)
  • #​17478 fix(parser): stop subscript parsing on async arrow (@​JLHwung)

💅 Polish

• babel-plugin-transform-regenerator, babel-plugin-transform-runtime
  • #​17363 Do not save last yield in call in temp var (@​nicolo-ribaudo)

📝 Documentation

• #​17448 move eslint-{parser,plugin} docs to the website (@​JLHwung)

🏠 Internal

• #​17454 Enable type checking for scripts and babel-worker.cjs (@​JLHwung)

🔬 Output optimization

• babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions
  • #​17444 Optimize do expression output (@​JLHwung)

v7.28.0

Compare Source

🚀 New Feature

• babel-node
  • #​17147 Support top level await in node repl (@​liuxingbaoyu)
• babel-types
  • #​17258 feat(matchesPattern): support super/private/meta (@​JLHwung)
• babel-compat-data, babel-preset-env
  • #​17355 Add explicit resource management to preset-env (@​JLHwung)
• babel-core, babel-parser
  • #​17390 Support sourceType: "commonjs" (@​JLHwung)
• babel-generator, babel-parser
  • #​17346 Materialize explicitResourceManagement parser plugin (@​JLHwung)
• babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-plugin-transform-object-rest-spread, babel-traverse, babel-types
  • #​17391 LVal coverage updates (Part 2) (@​JLHwung)
• babel-parser, babel-traverse, babel-types
  • #​17378 Accept bigints in t.bigIntLiteral factory (@​JLHwung)
• babel-generator, babel-plugin-proposal-destructuring-private, babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring, babel-plugin-transform-explicit-resource-management, babel-plugin-transform-react-display-name, babel-types
  • #​17277 Transform discard binding (@​JLHwung)
• babel-generator, babel-parser, babel-plugin-proposal-destructuring-private, babel-plugin-transform-block-scoping, babel-plugin-transform-object-rest-spread, babel-plugin-transform-typescript, babel-traverse, babel-types
  • #​17163 Parse discard binding (@​JLHwung)

🐛 Bug Fix

• babel-helper-globals, babel-plugin-transform-classes, babel-traverse
  • #​17297 Create babel-helper-globals (@​JLHwung)
• babel-types
  • #​17009 feature: TSTypeOperator: keyof (#​16799) (@​coderaiser)

🏠 Internal

• babel-compat-data, babel-plugin-proposal-decorators, babel-plugin-transform-async-generator-functions, babel-plugin-transform-json-modules, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs3
  • #​17403 Update babel-polyfill packages (@​nicolo-ribaudo)

v7.27.7

Compare Source

👓 Spec Compliance

• babel-parser, babel-plugin-transform-classes
  • #​17203 Interepret parser allow* options as top level only (@​JLHwung)
• babel-parser
  • #​17371 fix: disable using in ambient context (@​JLHwung)

🐛 Bug Fix

• babel-core
  • #​17392 Improve TS babel config loading (@​JLHwung)
• babel-types
  • #​17376 fix: support negative bigint in valueToNode (@​JLHwung)
• babel-plugin-transform-parameters
  • #​17352 fix: Params of async function* should throw synchronously (@​liuxingbaoyu)

🏠 Internal

• babel-plugin-transform-destructuring, babel-plugin-transform-object-rest-spread
  • #​17389 Use NodePath#splitExportDeclaration in destructuring transforms (@​JLHwung)

v7.27.4

Compare Source

👓 Spec Compliance

• babel-parser, babel-plugin-proposal-explicit-resource-management
  • #​17323 Disallow using in bare case statement (@​JLHwung)

💅 Polish

• babel-parser
  • #​17311 Improve parseExpression error messages (@​JLHwung)

🔬 Output optimization

• babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-classes, babel-plugin-transform-destructuring, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • #​17287 Reduce regenerator size more (@​liuxingbaoyu)
• babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-classes, babel-plugin-transform-destructuring, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs3
  • #​17334 Use shorter method names for regenerator context (@​nicolo-ribaudo)
  • #​17268 Reduce regenerator helper size (@​liuxingbaoyu)
• babel-core, babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-classes, babel-plugin-transform-destructuring, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime, babel-standalone
  • #​17238 Split regeneratorRuntime into multiple helpers (@​nicolo-ribaudo)

v7.27.3

Compare Source

🐛 Bug Fix

• babel-generator
  • #​17324 Improve multiline comments handling in yield/await expression (@​JLHwung)
• babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3
  • #​17328 Correctly set .displayName on GeneratorFunction (@​nicolo-ribaudo)
• babel-plugin-proposal-explicit-resource-management
  • #​17319 fix: handle shadowed binding in for using of body (@​JLHwung)
  • #​17317 fix: support named evaluation for using declaration (@​JLHwung)
• babel-plugin-proposal-decorators, babel-types
  • #​17321 fix(converter): Remove abstract modifiers in class declaration to expression conversion (@​magic-akari)
• babel-helper-module-transforms, babel-plugin-proposal-explicit-resource-management, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-umd
  • #​17257 Preserve class id when transforming using declarations with exported class (@​JLHwung)
• babel-parser
  • #​17312 fix(parser): properly handle optional markers in generator class methods (@​magic-akari)
  • #​17307 fix(parser): Terminate modifier parsing at newline (@​magic-akari)
• babel-generator, babel-parser
  • #​17308 Improve import phase parsing (@​JLHwung)

v7.27.1

Compare Source

👓 Spec Compliance

• babel-parser
  • #​17254 Allow using of as lexical declaration within for (@​JLHwung)
  • #​17230 Disallow get/set in TSPropertySignature (@​JLHwung)
• babel-parser, babel-types
  • #​17193 Stricter TSImportType options parsing (@​JLHwung)

🐛 Bug Fix

• babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-traverse
  • #​17137 fix: do expressions should allow early exit (@​kermanx)
• babel-helper-wrap-function, babel-plugin-transform-async-to-generator
  • #​17251 Fix: propagate argument evaluation errors through async promise chain (@​magic-akari)
• babel-helper-remap-async-to-generator, babel-plugin-transform-async-to-generator
  • #​17231 fix apply()/call() annotated as pure (@​Lacsw)
• babel-helper-fixtures, babel-parser
  • #​17233 Create ChainExpression within TSInstantiationExpression (@​JLHwung)
• babel-generator, babel-parser
  • #​17226 Fill optional AST properties when both estree and typescript parser plugin are enabled (Part 2) (@​JLHwung)
• babel-parser
  • #​17224 Fill optional AST properties when both estree and typescript parser plugin are enabled (Part 1) (@​JLHwung)
  • #​17080 Fix start of TSParameterProperty (@​JLHwung)
• babel-compat-data, babel-preset-env
  • #​17228 Update firefox bugfix compat data (@​JLHwung)
• babel-traverse
  • #​17156 fix: Objects and arrays with multiple references should not be evaluated (@​liuxingbaoyu)
• babel-generator
  • #​17216 Fix: support const type parameter in generator (@​JLHwung)

💅 Polish

• babel-plugin-bugfix-v8-spread-parameters-in-optional-chaining, babel-plugin-proposal-decorators, babel-plugin-transform-arrow-functions, babel-plugin-transform-class-properties, babel-plugin-transform-destructuring, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-chaining, babel-plugin-transform-parameters, babel-traverse
  • #​17221 Reduce generated names size for the 10th-11th (@​nicolo-ribaudo)

🏠 Internal

• babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • #​17263 Remove unused regenerator-runtime dep in @babel/runtime (@​nicolo-ribaudo)
• babel-compat-data, babel-preset-env
  • #​17256 Tune plugin compat data (@​JLHwung)
• babel-compat-data, babel-standalone
  • #​17236 migrate babel-compat-data build script to mjs (@​JLHwung)
• Other
  • #​17232 Bump typescript-eslint to 8.29.1 (@​JLHwung)
  • #​17219 test: add basic typescript-eslint integration tests (@​JLHwung)
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
• babel-register
  • #​16844 Migrate @babel/register to cts (@​liuxingbaoyu)
• babel-cli, babel-compat-data, babel-core, babel-generator, babel-helper-compilation-targets, babel-helper-fixtures, babel-helper-module-imports, babel-helper-module-transforms, babel-helper-plugin-test-runner, babel-helper-transform-fixture-test-runner, babel-helpers, babel-node, babel-parser, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-systemjs, babel-plugin-transform-modules-umd, babel-plugin-transform-react-display-name, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-plugin-transform-typeof-symbol, babel-plugin-transform-typescript, babel-preset-env, babel-register, babel-standalone, babel-types
  • #​17207 Enforce node protocol import (@​JLHwung)
• babel-plugin-transform-regenerator
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
• babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
• babel-helpers, babel-plugin-transform-regenerator
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
• babel-helpers
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)

🔬 Output optimization

• babel-helpers, babel-plugin-transform-modules-commonjs, babel-runtime-corejs3
  • #​16538 Reduce interopRequireWildcard size (@​liuxingbaoyu)
• babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3
  • #​17213 Reduce regeneratorRuntime size (@​liuxingbaoyu)

v7.26.10

Compare Source

👓 Spec Compliance

• babel-parser
  • #​17159 Disallow decorator in array pattern (@​JLHwung)

🐛 Bug Fix

• babel-parser, babel-template
  • #​17164 Fix: always initialize ExportDeclaration attributes (@​JLHwung)
• babel-core
  • #​17142 fix: "Map maximum size exceeded" in deepClone (@​liuxingbaoyu)
• babel-parser, babel-plugin-transform-typescript
  • #​17154 Update typescript parser tests (@​JLHwung)
• babel-traverse
  • #​17151 fix: Should not evaluate vars in child scope (@​liuxingbaoyu)
• babel-generator
  • #​17153 fix: Correctly generate abstract override (@​liuxingbaoyu)
• babel-parser
  • #​17107 Fix source type detection when parsing TypeScript (@​JLHwung)
• babel-helpers, babel-runtime, babel-runtime-corejs2, babel-runtime-corejs3
  • #​17173 Fix processing of replacement pattern with named capture groups (@​mmmsssttt404)

💅 Polish

• babel-standalone
  • #​17158 Avoid warnings when re-bundling @​babel/standalone with webpack (@​liuxingbaoyu)

🏠 Internal

• babel-parser
  • #​17160 Left-value parsing cleanup (@​JLHwung)

v7.26.9

Compare Source

🐛 Bug Fix

• babel-types
  • #​17103 fix: Definition for TSPropertySignature.kind (@​liuxingbaoyu)
• babel-generator, babel-types
  • #​17062 Print TypeScript optional/definite in ClassPrivateProperty (@​jamiebuilds-signal)

🏠 Internal

• babel-types
  • #​17130 Use .ts files with explicit reexports to solve name conflicts (@​nicolo-ribaudo)
• babel-core
  • #​17127 Do not depend on @types/gensync in Babel 7 (@​nicolo-ribaudo)

v7.26.8

Compare Source

v7.26.8 (2025-02-08)

🏠 Internal

• babel-preset-env
  • #​17097 Update dependency babel-plugin-polyfill-corejs3 to ^0.11.0

v7.26.7

Compare Source

🐛 Bug Fix

• babel-helpers, babel-preset-env, babel-runtime-corejs3
  • #​17086 Make "object without properties" helpers ES6-compatible (@​tquetano-netflix)
• babel-plugin-transform-typeof-symbol
  • #​17085 fix: Correctly handle typeof in arrow functions (@​liuxingbaoyu)
• babel-parser
  • #​17079 Respect ranges option in estree method value (@​JLHwung)
• babel-core
  • #​17052 Do not try to parse .ts configs as JSON if natively supported (@​nicolo-ribaudo)
• babel-plugin-transform-typescript
  • #​17050 fix: correctly resolve references to non-constant enum members (@​branchseer)
• babel-plugin-transform-typescript, babel-traverse, babel-types
  • #​17025 fix: Remove type-only import x = y.z (@​liuxingbaoyu)

v7.26.0

Compare Source

🚀 New Feature

• babel-core, babel-generator, babel-parser, babel-plugin-syntax-import-assertions, babel-plugin-syntax-import-attributes, babel-preset-env, babel-standalone, babel-types
  • #​16850 Enable import attributes parsing by default (@​nicolo-ribaudo)
• babel-core
  • #​16862 feat: support async plugin's pre/post (@​timofei-iatsenko)
• babel-compat-data, babel-plugin-proposal-regexp-modifiers, babel-plugin-transform-regexp-modifiers, babel-preset-env, babel-standalone
  • #​16692 Add transform-regexp-modifiers to preset-env (@​JLHwung)
• babel-parser
  • #​16849 feat: add startIndex parser option (@​DylanPiercey)
• babel-generator, babel-parser, babel-plugin-syntax-flow
  • #​16841 Always enable parsing of Flow enums (@​nicolo-ribaudo)
• babel-helpers, babel-preset-typescript, babel-runtime-corejs3
  • #​16794 Support import() in rewriteImportExtensions (@​liuxingbaoyu)
• babel-generator, babel-parser
  • #​16708 Add experimental format-preserving mode to @babel/generator (@​nicolo-ribaudo)

🐛 Bug Fix

• babel-core
  • #​16928 Workaround Node.js bug for parallel loading of TLA modules (@​nicolo-ribaudo)
  • #​16926 Fix loading of modules with TLA in Node.js 23 (@​nicolo-ribaudo)

💅 Polish

• babel-plugin-proposal-json-modules, babel-plugin-transform-json-modules, babel-standalone
  • #​16924 Rename proposal-json-modules to transform-json-modules (@​nicolo-ribaudo)

🏠 Internal

• babel-code-frame, babel-highlight
  • #​16896 Inline @babel/highlight in @babel/code-frame (@​nicolo-ribaudo)
• babel-generator, babel-parser, babel-types
  • #​16732 Add kind to TSModuleDeclaration (@​liuxingbaoyu)

🏃‍♀️ Performance

• babel-helper-module-transforms, babel-plugin-transform-modules-commonjs
  • #​16882 perf: Improve module transforms (@​liuxingbaoyu)

v7.25.9

Compare Source

🐛 Bug Fix

• babel-parser, babel-template, babel-types
  • #​16905 fix: Keep type annotations in syntacticPlaceholders mode (@​liuxingbaoyu)
• babel-helper-compilation-targets, babel-preset-env
  • #​16907 fix: support BROWSERSLIST{,_CONFIG} env (@​JLHwung)
• Other
  • #​16884 Analyze ClassAccessorProperty to prevent the no-undef rule (@​victorenator)

🏠 Internal

• babel-helper-transform-fixture-test-runner
  • #​16914 remove test options flaky (@​JLHwung)

🏃‍♀️ Performance

• babel-parser, babel-types
  • #​16918 perf: Make VISITOR_KEYS etc. faster to access (@​liuxingbaoyu)

v7.25.8

Compare Source

🐛 Bug Fix

• babel-core
  • #​16888 Restore public API of resolvePlugin/resolvePreset (@​nicolo-ribaudo)

🏠 Internal

• babel-parser, babel-plugin-proposal-async-do-expressions, babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-plugin-proposal-explicit-resource-management, babel-plugin-proposal-export-default-from, babel-plugin-proposal-function-bind, babel-plugin-proposal-function-sent, babel-plugin-proposal-import-defer, babel-plugin-proposal-partial-application, babel-plugin-proposal-throw-expressions, babel-plugin-transform-async-generator-functions, babel-plugin-transform-class-static-block, babel-plugin-transform-dynamic-import, babel-plugin-transform-export-namespace-from, babel-plugin-transform-json-strings, babel-plugin-transform-logical-assignment-operators, babel-plugin-transform-nullish-coalescing-operator, babel-plugin-transform-numeric-separator, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-catch-binding, babel-plugin-transform-optional-chaining, babel-plugin-transform-private-property-in-object, babel-preset-env
  • #​16824 Inline one-line syntax plugins (@​nicolo-ribaudo)

v7.25.7

Compare Source

🐛 Bug Fix

• babel-helper-validator-identifier
  • #​16825 fix: update identifier to unicode 16 (@​JLHwung)
• babel-traverse
  • #​16814 fix: issue with node path keys updated on unrelated paths (@​DylanPiercey)
• babel-plugin-transform-classes
  • #​16797 Use an inclusion rather than exclusion list for super() check (@​nicolo-ribaudo)
• babel-generator
  • #​16788 Fix printing of TS infer in compact mode (@​nicolo-ribaudo)
  • #​16785 Print TS type annotations for destructuring in assignment pattern (@​nicolo-ribaudo)
  • #​16778 Respect [no LineTerminator here] after nodes (@​nicolo-ribaudo)

💅 Polish

• babel-types
  • #​16852 Add deprecated JSDOC for fields (@​liuxingbaoyu)

🏠 Internal

• babel-core
  • #​16820 Allow sync loading of ESM when --experimental-require-module (@​nicolo-ribaudo)
• babel-helper-compilation-targets, babel-helper-plugin-utils, babel-preset-env
  • #​16858 Add browserslist config to external dependency (@​JLHwung)
• babel-plugin-proposal-destructuring-private, babel-plugin-syntax-decimal, babel-plugin-syntax-import-reflection, babel-standalone
  • #​16809 Archive syntax-import-reflection and syntax-decimal (@​nicolo-ribaudo)
• babel-generator
  • #​16779 Simplify logic for [no LineTerminator here] before nodes (@​nicolo-ribaudo)

🏃‍♀️ Performance

• babel-plugin-transform-typescript
  • #​16875 perf: Avoid extra cloning of namespaces (@​liuxingbaoyu)
• babel-types
  • #​16842 perf: Improve @​babel/types builders (@​liuxingbaoyu)
  • #​16828 Only access BABEL_TYPES_8_BREAKING at startup (@​nicolo-ribaudo)

v7.25.2

Compare Source

🐛 Bug Fix

• babel-core, babel-traverse
  • #​16695 Ensure that requeueComputedKeyAndDecorators is available (@​nicolo-ribaudo)

v7.24.9

Compare Source

🐛 Bug Fix

• babel-core, babel-standalone
  • #​16639 Avoid require() call in @babel/standalone bundle (@​nicolo-ribaudo)
• babel-types
  • #​16638 fix: provide legacy typings for TS < 4.1 (@​JLHwung)

💅 Polish

• babel-generator, babel-plugin-transform-optional-chaining
  • #​16617 Avoid extra parens in TS as/satisfies (@​nicolo-ribaudo)

🏠 Internal

• babel-helper-module-transforms
  • #​16629 Lazy top-level initializations for module transforms (@​guybedford)

v7.24.8

Compare Source

👓 Spec Compliance

• babel-parser
  • #​16567 Do not use strict mode in TS declare (@​liuxingbaoyu)

🐛 Bug Fix

• babel-generator
  • #​16630 Correctly print parens around in in for heads (@​nicolo-ribaudo)
  • #​16626 Fix printing of comments in await using (@​nicolo-ribaudo)
  • #​16591 fix typescript code generation for yield expression inside type expre… (@​SreeXD)
• babel-parser
  • #​16613 Disallow destructuring assignment in using declarations (@​H0onnn)
  • #​16490 fix: do not add .value: undefined to regexp literals (@​liuxingbaoyu)
• babel-types
  • #​16615 Remove boolean props from ObjectTypeInternalSlot visitor keys (@​nicolo-ribaudo)
• babel-plugin-transform-typescript
  • #​16566 fix: Correctly handle export import x = (@​liuxingbaoyu)

💅 Polish

• babel-generator
  • #​16625 Avoid unnecessary parens around async in for await (@​nicolo-ribaudo)
• babel-traverse
  • #​16619 Avoid checking Scope.globals multiple times (@​liuxingbaoyu)

v7.24.7

Compare Source

🐛 Bug Fix

• babel-node
  • #​16554 Allow extra flags in babel-node (@​nicolo-ribaudo)
• babel-traverse
  • #​16522 fix: incorrect constantViolations with destructuring (@​liuxingbaoyu)
• babel-helper-transform-fixture-test-runner, babel-plugin-proposal-explicit-resource-management
  • #​16524 fix: Transform using in switch correctly (@​liuxingbaoyu)

🏠 Internal

• babel-helpers, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • #​16525 Delete unused array helpers (@​blakewilson)

v7.24.6

Compare Source

🐛 Bug Fix

• babel-helper-create-class-features-plugin, babel-plugin-transform-class-properties
  • #​16514 Fix source maps for private member expressions (@​nicolo-ribaudo)
• babel-core, babel-generator, babel-plugin-transform-modules-commonjs
  • #​16515 Fix source maps for template literals (@​nicolo-ribaudo)
• babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
  • #​16485 Support undecorated static accessor in anonymous classes (@​JLHwung)
  • #​16484 Fix decorator bare yield await (@​JLHwung)
• babel-helpers, babel-plugin-proposal-decorators, babel-runtime-corejs3
  • #​16483 Fix: throw TypeError if addInitializer is called after finished (@​JLHwung)
• babel-parser, babel-plugin-transform-typescript
  • #​16476 fix: Correctly parse cls.fn<C> = x (@​liuxingbaoyu)

🏠 Internal

• babel-core, babel-helpers, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • #​16501 Generate helper metadata at build time (@​nicolo-ribaudo)
• babel-helpers
  • #​16499 Add tsconfig.json for @babel/helpers/src/helpers (@​nicolo-ribaudo)
• babel-cli, babel-helpers, babel-plugin-external-helpers, babel-plugin-proposal-decorators, babel-plugin-transform-class-properties, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-systemjs, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • #​16495 Move all runtime helpers to individual files (@​nicolo-ribaudo)
• babel-parser, babel-traverse
  • #​16482 Statically generate boilerplate for bitfield accessors (@​nicolo-ribaudo)
• Other
  • #​16466 Migrate import assertions syntax (@​JLHwung)

v7.24.5

Compare Source

🐛 Bug Fix

• babel-plugin-transform-classes, babel-traverse
  • #​16377 fix: TypeScript annotation affects output (@​liuxingbaoyu)
• babel-helpers, babel-plugin-proposal-explicit-resource-management, babel-runtime-corejs3
  • #​16440 Fix suppressed error order (@​sossost)
  • #​16408 Await nullish async disposable (@​JLHwung)

💅 Polish

• babel-parser
  • #​16407 Recover from exported using declaration (@​JLHwung)

🏠 Internal

• Other
  • #​16414 Relax ESLint peerDependency constraint to allow v9 (@​liuxingbaoyu)
• babel-parser
  • #​16425 Improve @babel/parser AST types (@​nicolo-ribaudo)
  • #​16417 Always pass type argument to .startNode (@​nicolo-ribaudo)
• babel-helper-create-class-features-plugin, babel-helper-member-expression-to-functions, babel-helper-module-transforms, babel-helper-split-export-declaration, babel-helper-wrap-function, babel-helpers, babel-plugin-bugfix-firefox-class-in-computed-class-key, babel-plugin-proposal-explicit-resource-management, babel-plugin-transform-block-scoping, babel-plugin-transform-destructuring, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-chaining, babel-plugin-transform-parameters, babel-plugin-transform-private-property-in-object, babel-plugin-transform-react-jsx-self, babel-plugin-transform-typeof-symbol, babel-plugin-transform-typescript, babel-traverse
  • [#​16439](https://redirect.github.com

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@babel/core (source)	7.12.3 → 7.29.6

---

@​babel/core: Arbitrary File Read via sourceMappingURL Comment

CVE-2026-49356 / GHSA-4x5r-pxfx-6jf8

More information

Details

Impact

Using @babel/core to compile maliciously crafted code can allow ab attacker to read any source map from the system that is running Babel, if these conditions are all true:

• the attacker controls the input source code
• the attacker can read the output source code
• the attacker knows the path of the source map file that they want to read

Users that only compile trusted code are not impacted.

Patches

The vulnerability has been fixed in @babel/core@7.29.6 and @babel/core@8.0.0-rc.6.

Workarounds

Callers can mitigate the issue without upgrading by setting inputSourceMap: false in their Babel options.

Callers can also manually extract the #sourceMappingURL comment from the input source code, validate whether the source map that it links to is allowed to be read, and if it is pass an object to inputSourceMap (passing false when it's not).

Credits

Thanks Teodor-Cristian Radoi for reporting the vulnerability.

Severity

• CVSS Score: 3.2 / 10 (Low)
• Vector String: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

References

• https://github.com/babel/babel/security/advisories/GHSA-4x5r-pxfx-6jf8
• https://babeljs.io/docs/options#inputsourcemap
• https://nvd.nist.gov/vuln/detail/CVE-2026-49356
• https://github.com/advisories/GHSA-4x5r-pxfx-6jf8

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

babel/babel (@​babel/core)

v7.29.6

Compare Source

v7.29.6 (2026-05-25)

🐛 Bug Fix

• babel-generator
  • #​18014 Catchup source map position in preserveFormat (@​nicolo-ribaudo)
• babel-core
  • #​18001 [7.x packport]Improve input source map handling (@​JLHwung)
• babel-core, babel-generator
  • #​17998 Preserve original identifier names from input sourcemaps (#​17992) (@​Andarist)

Committers: 3

• Huáng Jùnliàng (@​JLHwung)
• Mateusz Burzyński (@​Andarist)
• Nicolò Ribaudo (@​nicolo-ribaudo)

v7.29.0

Compare Source

v7.29.0 (2026-01-31)

Thanks @​simbahax for your first PR!

🚀 New Feature

• babel-types
  • #​17750 [7.x backport] Add attributes import declaration builder (@​JLHwung)
• babel-standalone
  • #​17663 [7.x backport] feat(standalone): export async transform (@​JLHwung)
  • #​17725 [7.x backport] feat: read standalone targets from data-targets (@​JLHwung)

🐛 Bug Fix

• babel-parser
  • #​17765 fix(parser): correctly parse type assertions in extends clause (@​nicolo-ribaudo)
  • #​17723 [7.x backport] fix(parser): improve super type argument parsing (@​JLHwung)
• babel-traverse
  • #​17708 fix(traverse): provide a hub when traversing a File or Program and no parentPath is given (@​simbahax)
• babel-plugin-transform-block-scoping, babel-traverse
  • #​17737 [7.x backport] fix: Rename switch discriminant references when body creates shadowing variable (@​magic-akari)

🏃‍♀️ Performance

• babel-generator, babel-runtime-corejs3
  • #​17642 [Babel 7] Improve generator performance (@​liuxingbaoyu)

Committers: 6

• David (@​simbahax)
• Huáng Jùnliàng (@​JLHwung)
• Nicolò Ribaudo (@​nicolo-ribaudo)
• @​liuxingbaoyu
• @​magic-akari

v7.28.6

Compare Source

v7.28.5

Compare Source

👓 Spec Compliance

• babel-parser
  • #​17446 Allow Runtime Errors for Function Call Assignment Targets (@​liuxingbaoyu)
• babel-helper-validator-identifier
  • #​17501 fix: update identifier to unicode 17 (@​fisker)

🐛 Bug Fix

• babel-plugin-proposal-destructuring-private
  • #​17534 Allow mixing private destructuring and rest (@​CO0Ki3)
• babel-parser
  • #​17521 Improve @babel/parser error typing (@​JLHwung)
  • #​17491 fix: improve ts-only declaration parsing (@​JLHwung)
• babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring
  • #​17519 fix: rest correctly returns plain array (@​liuxingbaoyu)
• babel-helper-create-class-features-plugin, babel-helper-member-expression-to-functions, babel-plugin-transform-block-scoping, babel-plugin-transform-optional-chaining, babel-traverse, babel-types
  • #​17503 Fix JSXIdentifier handling in isReferencedIdentifier (@​JLHwung)
• babel-traverse
  • #​17504 fix: ensure scope.push register in anonymous fn (@​JLHwung)

🏠 Internal

• babel-types
  • #​17494 Type checking babel-types scripts (@​JLHwung)

🏃‍♀️ Performance

• babel-core
  • #​17490 Faster finding of locations in buildCodeFrameError (@​liuxingbaoyu)

v7.28.4

Compare Source

🏠 Internal

• babel-core, babel-helper-check-duplicate-nodes, babel-traverse, babel-types
  • #​17493 Update Jest to v30.1.1 (@​JLHwung)
• babel-plugin-transform-regenerator
  • #​17455 chore: Clean up transform-regenerator (@​liuxingbaoyu)
• babel-core
  • #​17474 Switch to @​jridgewell/remapping (@​mrginglymus)

v7.28.3

Compare Source

👓 Spec Compliance

• babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators, babel-plugin-transform-class-static-block, babel-preset-env
  • #​17443 [static blocks] Do not inject new static fields after static code (@​nicolo-ribaudo)

🐛 Bug Fix

• babel-parser
  • #​17465 fix(parser/typescript): parse import("./a", {with:{},}) (@​easrng)
  • #​17478 fix(parser): stop subscript parsing on async arrow (@​JLHwung)

💅 Polish

• babel-plugin-transform-regenerator, babel-plugin-transform-runtime
  • #​17363 Do not save last yield in call in temp var (@​nicolo-ribaudo)

📝 Documentation

• #​17448 move eslint-{parser,plugin} docs to the website (@​JLHwung)

🏠 Internal

• #​17454 Enable type checking for scripts and babel-worker.cjs (@​JLHwung)

🔬 Output optimization

• babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions
  • #​17444 Optimize do expression output (@​JLHwung)

v7.28.0

Compare Source

🚀 New Feature

• babel-node
  • #​17147 Support top level await in node repl (@​liuxingbaoyu)
• babel-types
  • #​17258 feat(matchesPattern): support super/private/meta (@​JLHwung)
• babel-compat-data, babel-preset-env
  • #​17355 Add explicit resource management to preset-env (@​JLHwung)
• babel-core, babel-parser
  • #​17390 Support sourceType: "commonjs" (@​JLHwung)
• babel-generator, babel-parser
  • #​17346 Materialize explicitResourceManagement parser plugin (@​JLHwung)
• babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-plugin-transform-object-rest-spread, babel-traverse, babel-types
  • #​17391 LVal coverage updates (Part 2) (@​JLHwung)
• babel-parser, babel-traverse, babel-types
  • #​17378 Accept bigints in t.bigIntLiteral factory (@​JLHwung)
• babel-generator, babel-plugin-proposal-destructuring-private, babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring, babel-plugin-transform-explicit-resource-management, babel-plugin-transform-react-display-name, babel-types
  • #​17277 Transform discard binding (@​JLHwung)
• babel-generator, babel-parser, babel-plugin-proposal-destructuring-private, babel-plugin-transform-block-scoping, babel-plugin-transform-object-rest-spread, babel-plugin-transform-typescript, babel-traverse, babel-types
  • #​17163 Parse discard binding (@​JLHwung)

🐛 Bug Fix

• babel-helper-globals, babel-plugin-transform-classes, babel-traverse
  • #​17297 Create babel-helper-globals (@​JLHwung)
• babel-types
  • #​17009 feature: TSTypeOperator: keyof (#​16799) (@​coderaiser)

🏠 Internal

• babel-compat-data, babel-plugin-proposal-decorators, babel-plugin-transform-async-generator-functions, babel-plugin-transform-json-modules, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs3
  • #​17403 Update babel-polyfill packages (@​nicolo-ribaudo)

v7.27.7

Compare Source

👓 Spec Compliance

• babel-parser, babel-plugin-transform-classes
  • #​17203 Interepret parser allow* options as top level only (@​JLHwung)
• babel-parser
  • #​17371 fix: disable using in ambient context (@​JLHwung)

🐛 Bug Fix

• babel-core
  • #​17392 Improve TS babel config loading (@​JLHwung)
• babel-types
  • #​17376 fix: support negative bigint in valueToNode (@​JLHwung)
• babel-plugin-transform-parameters
  • #​17352 fix: Params of async function* should throw synchronously (@​liuxingbaoyu)

🏠 Internal

• babel-plugin-transform-destructuring, babel-plugin-transform-object-rest-spread
  • #​17389 Use NodePath#splitExportDeclaration in destructuring transforms (@​JLHwung)

v7.27.4

Compare Source

👓 Spec Compliance

• babel-parser, babel-plugin-proposal-explicit-resource-management
  • #​17323 Disallow using in bare case statement (@​JLHwung)

💅 Polish

• babel-parser
  • #​17311 Improve parseExpression error messages (@​JLHwung)

🔬 Output optimization

• babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-classes, babel-plugin-transform-destructuring, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • #​17287 Reduce regenerator size more (@​liuxingbaoyu)
• babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-classes, babel-plugin-transform-destructuring, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs3
  • #​17334 Use shorter method names for regenerator context (@​nicolo-ribaudo)
  • #​17268 Reduce regenerator helper size (@​liuxingbaoyu)
• babel-core, babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-classes, babel-plugin-transform-destructuring, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime, babel-standalone
  • #​17238 Split regeneratorRuntime into multiple helpers (@​nicolo-ribaudo)

v7.27.3

Compare Source

🐛 Bug Fix

• babel-generator
  • #​17324 Improve multiline comments handling in yield/await expression (@​JLHwung)
• babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3
  • #​17328 Correctly set .displayName on GeneratorFunction (@​nicolo-ribaudo)
• babel-plugin-proposal-explicit-resource-management
  • #​17319 fix: handle shadowed binding in for using of body (@​JLHwung)
  • #​17317 fix: support named evaluation for using declaration (@​JLHwung)
• babel-plugin-proposal-decorators, babel-types
  • #​17321 fix(converter): Remove abstract modifiers in class declaration to expression conversion (@​magic-akari)
• babel-helper-module-transforms, babel-plugin-proposal-explicit-resource-management, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-umd
  • #​17257 Preserve class id when transforming using declarations with exported class (@​JLHwung)
• babel-parser
  • #​17312 fix(parser): properly handle optional markers in generator class methods (@​magic-akari)
  • #​17307 fix(parser): Terminate modifier parsing at newline (@​magic-akari)
• babel-generator, babel-parser
  • #​17308 Improve import phase parsing (@​JLHwung)

v7.27.1

Compare Source

👓 Spec Compliance

• babel-parser
  • #​17254 Allow using of as lexical declaration within for (@​JLHwung)
  • #​17230 Disallow get/set in TSPropertySignature (@​JLHwung)
• babel-parser, babel-types
  • #​17193 Stricter TSImportType options parsing (@​JLHwung)

🐛 Bug Fix

• babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-traverse
  • #​17137 fix: do expressions should allow early exit (@​kermanx)
• babel-helper-wrap-function, babel-plugin-transform-async-to-generator
  • #​17251 Fix: propagate argument evaluation errors through async promise chain (@​magic-akari)
• babel-helper-remap-async-to-generator, babel-plugin-transform-async-to-generator
  • #​17231 fix apply()/call() annotated as pure (@​Lacsw)
• babel-helper-fixtures, babel-parser
  • #​17233 Create ChainExpression within TSInstantiationExpression (@​JLHwung)
• babel-generator, babel-parser
  • #​17226 Fill optional AST properties when both estree and typescript parser plugin are enabled (Part 2) (@​JLHwung)
• babel-parser
  • #​17224 Fill optional AST properties when both estree and typescript parser plugin are enabled (Part 1) (@​JLHwung)
  • #​17080 Fix start of TSParameterProperty (@​JLHwung)
• babel-compat-data, babel-preset-env
  • #​17228 Update firefox bugfix compat data (@​JLHwung)
• babel-traverse
  • #​17156 fix: Objects and arrays with multiple references should not be evaluated (@​liuxingbaoyu)
• babel-generator
  • #​17216 Fix: support const type parameter in generator (@​JLHwung)

💅 Polish

• babel-plugin-bugfix-v8-spread-parameters-in-optional-chaining, babel-plugin-proposal-decorators, babel-plugin-transform-arrow-functions, babel-plugin-transform-class-properties, babel-plugin-transform-destructuring, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-chaining, babel-plugin-transform-parameters, babel-traverse
  • #​17221 Reduce generated names size for the 10th-11th (@​nicolo-ribaudo)

🏠 Internal

• babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • #​17263 Remove unused regenerator-runtime dep in @babel/runtime (@​nicolo-ribaudo)
• babel-compat-data, babel-preset-env
  • #​17256 Tune plugin compat data (@​JLHwung)
• babel-compat-data, babel-standalone
  • #​17236 migrate babel-compat-data build script to mjs (@​JLHwung)
• Other
  • #​17232 Bump typescript-eslint to 8.29.1 (@​JLHwung)
  • #​17219 test: add basic typescript-eslint integration tests (@​JLHwung)
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
• babel-register
  • #​16844 Migrate @babel/register to cts (@​liuxingbaoyu)
• babel-cli, babel-compat-data, babel-core, babel-generator, babel-helper-compilation-targets, babel-helper-fixtures, babel-helper-module-imports, babel-helper-module-transforms, babel-helper-plugin-test-runner, babel-helper-transform-fixture-test-runner, babel-helpers, babel-node, babel-parser, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-systemjs, babel-plugin-transform-modules-umd, babel-plugin-transform-react-display-name, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-plugin-transform-typeof-symbol, babel-plugin-transform-typescript, babel-preset-env, babel-register, babel-standalone, babel-types
  • #​17207 Enforce node protocol import (@​JLHwung)
• babel-plugin-transform-regenerator
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
• babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
• babel-helpers, babel-plugin-transform-regenerator
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)
• babel-helpers
  • #​17205 Inline regenerator in the relevant packages (@​nicolo-ribaudo)

🔬 Output optimization

• babel-helpers, babel-plugin-transform-modules-commonjs, babel-runtime-corejs3
  • #​16538 Reduce interopRequireWildcard size (@​liuxingbaoyu)
• babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3
  • #​17213 Reduce regeneratorRuntime size (@​liuxingbaoyu)

v7.26.10

Compare Source

👓 Spec Compliance

• babel-parser
  • #​17159 Disallow decorator in array pattern (@​JLHwung)

🐛 Bug Fix

• babel-parser, babel-template
  • #​17164 Fix: always initialize ExportDeclaration attributes (@​JLHwung)
• babel-core
  • #​17142 fix: "Map maximum size exceeded" in deepClone (@​liuxingbaoyu)
• babel-parser, babel-plugin-transform-typescript
  • #​17154 Update typescript parser tests (@​JLHwung)
• babel-traverse
  • #​17151 fix: Should not evaluate vars in child scope (@​liuxingbaoyu)
• babel-generator
  • #​17153 fix: Correctly generate abstract override (@​liuxingbaoyu)
• babel-parser
  • #​17107 Fix source type detection when parsing TypeScript (@​JLHwung)
• babel-helpers, babel-runtime, babel-runtime-corejs2, babel-runtime-corejs3
  • #​17173 Fix processing of replacement pattern with named capture groups (@​mmmsssttt404)

💅 Polish

• babel-standalone
  • #​17158 Avoid warnings when re-bundling @​babel/standalone with webpack (@​liuxingbaoyu)

🏠 Internal

• babel-parser
  • #​17160 Left-value parsing cleanup (@​JLHwung)

v7.26.9

Compare Source

🐛 Bug Fix

• babel-types
  • #​17103 fix: Definition for TSPropertySignature.kind (@​liuxingbaoyu)
• babel-generator, babel-types
  • #​17062 Print TypeScript optional/definite in ClassPrivateProperty (@​jamiebuilds-signal)

🏠 Internal

• babel-types
  • #​17130 Use .ts files with explicit reexports to solve name conflicts (@​nicolo-ribaudo)
• babel-core
  • #​17127 Do not depend on @types/gensync in Babel 7 (@​nicolo-ribaudo)

v7.26.8

Compare Source

v7.26.8 (2025-02-08)

🏠 Internal

• babel-preset-env
  • #​17097 Update dependency babel-plugin-polyfill-corejs3 to ^0.11.0

v7.26.7

Compare Source

🐛 Bug Fix

• babel-helpers, babel-preset-env, babel-runtime-corejs3
  • #​17086 Make "object without properties" helpers ES6-compatible (@​tquetano-netflix)
• babel-plugin-transform-typeof-symbol
  • #​17085 fix: Correctly handle typeof in arrow functions (@​liuxingbaoyu)
• babel-parser
  • #​17079 Respect ranges option in estree method value (@​JLHwung)
• babel-core
  • #​17052 Do not try to parse .ts configs as JSON if natively supported (@​nicolo-ribaudo)
• babel-plugin-transform-typescript
  • #​17050 fix: correctly resolve references to non-constant enum members (@​branchseer)
• babel-plugin-transform-typescript, babel-traverse, babel-types
  • #​17025 fix: Remove type-only import x = y.z (@​liuxingbaoyu)

v7.26.0

Compare Source

🚀 New Feature

• babel-core, babel-generator, babel-parser, babel-plugin-syntax-import-assertions, babel-plugin-syntax-import-attributes, babel-preset-env, babel-standalone, babel-types
  • #​16850 Enable import attributes parsing by default (@​nicolo-ribaudo)
• babel-core
  • #​16862 feat: support async plugin's pre/post (@​timofei-iatsenko)
• babel-compat-data, babel-plugin-proposal-regexp-modifiers, babel-plugin-transform-regexp-modifiers, babel-preset-env, babel-standalone
  • #​16692 Add transform-regexp-modifiers to preset-env (@​JLHwung)
• babel-parser
  • #​16849 feat: add startIndex parser option (@​DylanPiercey)
• babel-generator, babel-parser, babel-plugin-syntax-flow
  • #​16841 Always enable parsing of Flow enums (@​nicolo-ribaudo)
• babel-helpers, babel-preset-typescript, babel-runtime-corejs3
  • #​16794 Support import() in rewriteImportExtensions (@​liuxingbaoyu)
• babel-generator, babel-parser
  • #​16708 Add experimental format-preserving mode to @babel/generator (@​nicolo-ribaudo)

🐛 Bug Fix

• babel-core
  • #​16928 Workaround Node.js bug for parallel loading of TLA modules (@​nicolo-ribaudo)
  • #​16926 Fix loading of modules with TLA in Node.js 23 (@​nicolo-ribaudo)

💅 Polish

• babel-plugin-proposal-json-modules, babel-plugin-transform-json-modules, babel-standalone
  • #​16924 Rename proposal-json-modules to transform-json-modules (@​nicolo-ribaudo)

🏠 Internal

• babel-code-frame, babel-highlight
  • #​16896 Inline @babel/highlight in @babel/code-frame (@​nicolo-ribaudo)
• babel-generator, babel-parser, babel-types
  • #​16732 Add kind to TSModuleDeclaration (@​liuxingbaoyu)

🏃‍♀️ Performance

• babel-helper-module-transforms, babel-plugin-transform-modules-commonjs
  • #​16882 perf: Improve module transforms (@​liuxingbaoyu)

v7.25.9

Compare Source

🐛 Bug Fix

• babel-parser, babel-template, babel-types
  • #​16905 fix: Keep type annotations in syntacticPlaceholders mode (@​liuxingbaoyu)
• babel-helper-compilation-targets, babel-preset-env
  • #​16907 fix: support BROWSERSLIST{,_CONFIG} env (@​JLHwung)
• Other
  • #​16884 Analyze ClassAccessorProperty to prevent the no-undef rule (@​victorenator)

🏠 Internal

• babel-helper-transform-fixture-test-runner
  • #​16914 remove test options flaky (@​JLHwung)

🏃‍♀️ Performance

• babel-parser, babel-types
  • #​16918 perf: Make VISITOR_KEYS etc. faster to access (@​liuxingbaoyu)

v7.25.8

Compare Source

🐛 Bug Fix

• babel-core
  • #​16888 Restore public API of resolvePlugin/resolvePreset (@​nicolo-ribaudo)

🏠 Internal

• babel-parser, babel-plugin-proposal-async-do-expressions, babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-plugin-proposal-explicit-resource-management, babel-plugin-proposal-export-default-from, babel-plugin-proposal-function-bind, babel-plugin-proposal-function-sent, babel-plugin-proposal-import-defer, babel-plugin-proposal-partial-application, babel-plugin-proposal-throw-expressions, babel-plugin-transform-async-generator-functions, babel-plugin-transform-class-static-block, babel-plugin-transform-dynamic-import, babel-plugin-transform-export-namespace-from, babel-plugin-transform-json-strings, babel-plugin-transform-logical-assignment-operators, babel-plugin-transform-nullish-coalescing-operator, babel-plugin-transform-numeric-separator, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-catch-binding, babel-plugin-transform-optional-chaining, babel-plugin-transform-private-property-in-object, babel-preset-env
  • #​16824 Inline one-line syntax plugins (@​nicolo-ribaudo)

v7.25.7

Compare Source

🐛 Bug Fix

• babel-helper-validator-identifier
  • #​16825 fix: update identifier to unicode 16 (@​JLHwung)
• babel-traverse
  • #​16814 fix: issue with node path keys updated on unrelated paths (@​DylanPiercey)
• babel-plugin-transform-classes
  • #​16797 Use an inclusion rather than exclusion list for super() check (@​nicolo-ribaudo)
• babel-generator
  • #​16788 Fix printing of TS infer in compact mode (@​nicolo-ribaudo)
  • #​16785 Print TS type annotations for destructuring in assignment pattern (@​nicolo-ribaudo)
  • #​16778 Respect [no LineTerminator here] after nodes (@​nicolo-ribaudo)

💅 Polish

• babel-types
  • #​16852 Add deprecated JSDOC for fields (@​liuxingbaoyu)

🏠 Internal

• babel-core
  • #​16820 Allow sync loading of ESM when --experimental-require-module (@​nicolo-ribaudo)
• babel-helper-compilation-targets, babel-helper-plugin-utils, babel-preset-env
  • #​16858 Add browserslist config to external dependency (@​JLHwung)
• babel-plugin-proposal-destructuring-private, babel-plugin-syntax-decimal, babel-plugin-syntax-import-reflection, babel-standalone
  • #​16809 Archive syntax-import-reflection and syntax-decimal (@​nicolo-ribaudo)
• babel-generator
  • #​16779 Simplify logic for [no LineTerminator here] before nodes (@​nicolo-ribaudo)

🏃‍♀️ Performance

• babel-plugin-transform-typescript
  • #​16875 perf: Avoid extra cloning of namespaces (@​liuxingbaoyu)
• babel-types
  • #​16842 perf: Improve @​babel/types builders (@​liuxingbaoyu)
  • #​16828 Only access BABEL_TYPES_8_BREAKING at startup (@​nicolo-ribaudo)

v7.25.2

Compare Source

🐛 Bug Fix

• babel-core, babel-traverse
  • #​16695 Ensure that requeueComputedKeyAndDecorators is available (@​nicolo-ribaudo)

v7.24.9

Compare Source

🐛 Bug Fix

• babel-core, babel-standalone
  • #​16639 Avoid require() call in @babel/standalone bundle (@​nicolo-ribaudo)
• babel-types
  • #​16638 fix: provide legacy typings for TS < 4.1 (@​JLHwung)

💅 Polish

• babel-generator, babel-plugin-transform-optional-chaining
  • #​16617 Avoid extra parens in TS as/satisfies (@​nicolo-ribaudo)

🏠 Internal

• babel-helper-module-transforms
  • #​16629 Lazy top-level initializations for module transforms (@​guybedford)

v7.24.8

Compare Source

👓 Spec Compliance

• babel-parser
  • #​16567 Do not use strict mode in TS declare (@​liuxingbaoyu)

🐛 Bug Fix

• babel-generator
  • #​16630 Correctly print parens around in in for heads (@​nicolo-ribaudo)
  • #​16626 Fix printing of comments in await using (@​nicolo-ribaudo)
  • #​16591 fix typescript code generation for yield expression inside type expre… (@​SreeXD)
• babel-parser
  • #​16613 Disallow destructuring assignment in using declarations (@​H0onnn)
  • #​16490 fix: do not add .value: undefined to regexp literals (@​liuxingbaoyu)
• babel-types
  • #​16615 Remove boolean props from ObjectTypeInternalSlot visitor keys (@​nicolo-ribaudo)
• babel-plugin-transform-typescript
  • #​16566 fix: Correctly handle export import x = (@​liuxingbaoyu)

💅 Polish

• babel-generator
  • #​16625 Avoid unnecessary parens around async in for await (@​nicolo-ribaudo)
• babel-traverse
  • #​16619 Avoid checking Scope.globals multiple times (@​liuxingbaoyu)

v7.24.7

Compare Source

🐛 Bug Fix

• babel-node
  • #​16554 Allow extra flags in babel-node (@​nicolo-ribaudo)
• babel-traverse
  • #​16522 fix: incorrect constantViolations with destructuring (@​liuxingbaoyu)
• babel-helper-transform-fixture-test-runner, babel-plugin-proposal-explicit-resource-management
  • #​16524 fix: Transform using in switch correctly (@​liuxingbaoyu)

🏠 Internal

• babel-helpers, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • #​16525 Delete unused array helpers (@​blakewilson)

v7.24.6

Compare Source

🐛 Bug Fix

• babel-helper-create-class-features-plugin, babel-plugin-transform-class-properties
  • #​16514 Fix source maps for private member expressions (@​nicolo-ribaudo)
• babel-core, babel-generator, babel-plugin-transform-modules-commonjs
  • #​16515 Fix source maps for template literals (@​nicolo-ribaudo)
• babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
  • #​16485 Support undecorated static accessor in anonymous classes (@​JLHwung)
  • #​16484 Fix decorator bare yield await (@​JLHwung)
• babel-helpers, babel-plugin-proposal-decorators, babel-runtime-corejs3
  • #​16483 Fix: throw TypeError if addInitializer is called after finished (@​JLHwung)
• babel-parser, babel-plugin-transform-typescript
  • #​16476 fix: Correctly parse cls.fn<C> = x (@​liuxingbaoyu)

🏠 Internal

• babel-core, babel-helpers, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • #​16501 Generate helper metadata at build time (@​nicolo-ribaudo)
• babel-helpers
  • #​16499 Add tsconfig.json for @babel/helpers/src/helpers (@​nicolo-ribaudo)
• babel-cli, babel-helpers, babel-plugin-external-helpers, babel-plugin-proposal-decorators, babel-plugin-transform-class-properties, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-systemjs, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • #​16495 Move all runtime helpers to individual files (@​nicolo-ribaudo)
• babel-parser, babel-traverse
  • #​16482 Statically generate boilerplate for bitfield accessors (@​nicolo-ribaudo)
• Other
  • #​16466 Migrate import assertions syntax (@​JLHwung)

v7.24.5

Compare Source

🐛 Bug Fix

• babel-plugin-transform-classes, babel-traverse
  • #​16377 fix: TypeScript annotation affects output (@​liuxingbaoyu)
• babel-helpers, babel-plugin-proposal-explicit-resource-management, babel-runtime-corejs3
  • #​16440 Fix suppressed error order (@​sossost)
  • #​16408 Await nullish async disposable (@​JLHwung)

💅 Polish

• babel-parser
  • #​16407 Recover from exported using declaration (@​JLHwung)

🏠 Internal

• Other
  • #​16414 Relax ESLint peerDependency constraint to allow v9 (@​liuxingbaoyu)
• babel-parser
  • #​16425 Improve @babel/parser AST types (@​nicolo-ribaudo)
  • #​16417 Always pass type argument to .startNode (@​nicolo-ribaudo)
• babel-helper-create-class-features-plugin, babel-helper-member-expression-to-functions, babel-helper-module-transforms, babel-helper-split-export-declaration, babel-helper-wrap-function, babel-helpers, babel-plugin-bugfix-firefox-class-in-computed-class-key, babel-plugin-proposal-explicit-resource-management, babel-plugin-transform-block-scoping, babel-plugin-transform-destructuring, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-chaining, babel-plugin-transform-parameters, babel-plugin-transform-private-property-in-object, babel-plugin-transform-react-jsx-self, babel-plugin-transform-typeof-symbol, babel-plugin-transform-typescript, babel-traverse
  • [#​16439](https://redirect.github.com

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.