dependabot npm(deps-dev): [security] bump @babel/traverse from 7.22.5 to 7.23.3

Bumps @babel/traverse from 7.22.5 to 7.23.3. This update includes a security fix.

Vulnerabilities fixed

Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code

Impact

Using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the path.evaluate()or path.evaluateTruthy() internal Babel methods.

Known affected plugins are:

• @babel/plugin-transform-runtime
• @babel/preset-env when using its useBuiltIns option
• Any "polyfill provider" plugin that depends on @babel/helper-define-polyfill-provider, such as babel-plugin-polyfill-corejs3, babel-plugin-polyfill-corejs2, babel-plugin-polyfill-es-shims, babel-plugin-polyfill-regenerator

No other plugins under the @babel/ namespace are impacted, but third-party plugins might be.

Users that only compile trusted code are not impacted.

Patches

The vulnerability has been fixed in @babel/traverse@7.23.2.

Babel 6 does not receive security fixes anymore (see Babel's security policy), hence there is no patch planned for babel-traverse@6.

Workarounds

... (truncated)

Patched versions: 7.23.2 Affected versions: < 7.23.2

Release notes

Sourced from @​babel/traverse's releases.

v7.23.3 (2023-11-09)

🐛 Bug Fix

• babel-plugin-transform-typescript
  • #16071 Strip type-only TS namespaces (@​colinaaa)
• babel-generator
  • #16078 Fix indentation when generating comments with concise: true (@​liuxingbaoyu)
• babel-compat-data, babel-plugin-bugfix-v8-static-class-fields-redefine-readonly, babel-preset-env
  • #14295 Add a bugfix plugin for https://crbug.com/v8/12421 (@​nicolo-ribaudo)
• babel-plugin-transform-object-super
  • #15948 fix: super.x in a loop (@​liuxingbaoyu)
• babel-helper-module-transforms, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-umd
  • #16015 fix: handle __proto__ exports name in CJS/AMD/UMD (@​magic-akari)

📝 Documentation

• #16044 docs: Update links in @​babel/eslint-parser README (@​aryehb)

🏠 Internal

• babel-core, babel-preset-env
  • #15988 Refactor handling of modules plugins in preset-env (@​nicolo-ribaudo)

:running_woman: Performance

• babel-generator
  • #16061 perf: Improve @babel/generator performance (@​liuxingbaoyu)
• babel-traverse
  • #16060 Avoid dynamic dispatch when calling wrapCheck (@​yepitschunked)

🔬 Output optimization

• babel-plugin-transform-computed-properties
  • #6652 Optimize computed properties output (byte-wise) (@​Andarist)

Committers: 9

• Babel Bot (@​babel-bot)
• Colin (@​colinaaa)
• Huáng Jùnliàng (@​JLHwung)
• Mateusz Burzyński (@​Andarist)
• Nicolò Ribaudo (@​nicolo-ribaudo)
• @​aryehb
• @​liuxingbaoyu
• @​magic-akari
• @​yepitschunked

v7.23.2 (2023-10-11)

NOTE: This release also re-publishes @babel/core, even if it does not appear in the linked release commit.

Thanks @​jimmydief for your first PR!

🐛 Bug Fix

• babel-traverse

... (truncated)

Changelog

Sourced from @​babel/traverse's changelog.

v7.23.3 (2023-11-09)

🐛 Bug Fix

• babel-plugin-transform-typescript
  • #16071 Strip type-only TS namespaces (@​colinaaa)
• babel-generator
  • #16078 Fix indentation when generating comments with concise: true (@​liuxingbaoyu)
• babel-compat-data, babel-plugin-bugfix-v8-static-class-fields-redefine-readonly, babel-preset-env
  • #14295 Add a bugfix plugin for https://crbug.com/v8/12421 (@​nicolo-ribaudo)
• babel-plugin-transform-object-super
  • #15948 fix: super.x in a loop (@​liuxingbaoyu)
• babel-helper-module-transforms, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-umd
  • #16015 fix: handle __proto__ exports name in CJS/AMD/UMD (@​magic-akari)

📝 Documentation

• #16044 docs: Update links in @​babel/eslint-parser README (@​aryehb)

🏠 Internal

• babel-core, babel-preset-env
  • #15988 Refactor handling of modules plugins in preset-env (@​nicolo-ribaudo)

:running_woman: Performance

• babel-generator
  • #16061 perf: Improve @babel/generator performance (@​liuxingbaoyu)
• babel-traverse
  • #16060 Avoid dynamic dispatch when calling wrapCheck (@​yepitschunked)

🔬 Output optimization

• babel-plugin-transform-computed-properties
  • #6652 Optimize computed properties output (byte-wise) (@​Andarist)

v7.23.2 (2023-10-11)

🐛 Bug Fix

• babel-traverse
  • #16033 Only evaluate own String/Number/Math methods (@​nicolo-ribaudo)
• babel-preset-typescript
  • #16022 Rewrite .tsx extension when using rewriteImportExtensions (@​jimmydief)
• babel-helpers
  • #16017 Fix: fallback to typeof when toString is applied to incompatible object (@​JLHwung)
• babel-helpers, babel-plugin-transform-modules-commonjs, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • #16025 Avoid override mistake in namespace imports (@​nicolo-ribaudo)

v7.23.0 (2023-09-25)

🚀 New Feature

• babel-plugin-proposal-import-wasm-source, babel-plugin-syntax-import-source, babel-plugin-transform-dynamic-import
  • #15870 Support transforming import source for wasm (@​nicolo-ribaudo)
• babel-helper-module-transforms, babel-helpers, babel-plugin-proposal-import-defer, babel-plugin-syntax-import-defer, babel-plugin-transform-modules-commonjs, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime, babel-standalone
  • #15878 Implement import defer proposal transform support (@​nicolo-ribaudo)
• babel-generator, babel-parser, babel-types
  • #15845 Implement import defer parsing support (@​nicolo-ribaudo)

... (truncated)

Commits

• 1bce5c9 v7.23.3
• 4fb4fa6 Avoid dynamic dispatch when calling wrapCheck (#16060)
• 6d9725c [babel 8] Inline toSequenceExpression into @babel/traverse (#16057)
• b4b9942 v7.23.2
• b13376b Only evaluate own String/Number/Math methods (#16033)
• ca58ec1 v7.23.0
• 0f333da Add createImportExpressions parser option (#15682)
• 3744545 Fix linting
• c7e6806 Add t.buildUndefinedNode (#15893)
• 38ee8b4 Expand evaluation of global built-ins in @babel/traverse (#15797)
• Additional commits viewable in compare view