ACT-3656: fix @babel/core GHSA-4x5r-pxfx-6jf8

[robertvangor]

Corresponding ticket and security links

• ACT-3656
• Dependabot alert #60
• GHSA-4x5r-pxfx-6jf8

What has been done?

• Raises the direct @babel/core floor from ^7.20.12 to ^7.29.6.
• Regenerates the npm lockfile; the installed graph resolves @babel/core@7.29.7 and its coherent Babel internals.
• Keeps the change limited to this Babel advisory.

Why was this done?

Versions through 7.29.0 can read an outside source map when compiling attacker-controlled input containing a crafted sourceMappingURL. The package is development-only, but upgrading removes the unsafe build-tool behavior and closes Dependabot alert #60.

How to test the changes

1. npm ci
2. npm ls @babel/core --all — only 7.29.7 is installed.
3. Run the disposable source-map sentinel check:
   • 7.29.0: relative-parent and absolute-outside maps both exposed the sentinel.
   • 7.29.7: neither path exposed the sentinel.
4. npm run lint
5. npm test -- --runInBand — 6 suites and 158 tests pass.
6. npm run test:coverage — 99.39% statement/line coverage, 82.48% branch coverage, 100% function coverage.
7. npm pack --dry-run — package contents generated successfully.

Rollout and risk

This is a development-only package update. No environment deployment is required or performed. Rollback is a revert of this PR. Four unrelated pre-existing npm audit findings remain and are outside this single-advisory scope.

[robertvangor]

Vulnerability validation

• Scope: @babel/core GHSA-4x5r-pxfx-6jf8 development-tooling remediation
• PR head: 4a0473fc44ec13143af7b1b2e7d079ee52371dc8
• Tested head: 4a0473fc44ec13143af7b1b2e7d079ee52371dc8
• Tested at: 2026-07-18T18:02:06+02:00

Remediation proof

• GHSA-4x5r-pxfx-6jf8 / CVE-2026-49356 (low (CVSS 3.2)): main resolves direct dev dependency @babel/core@7.29.0, affected <=7.29.0 -> this head resolves only @babel/core@7.29.7, above the 7.29.6 patched threshold. baseline npm audit reported the advisory and npm ls showed 7.29.0; exact-head npm ci/npm ls showed only 7.29.7 and targeted audit no longer reported it. Harmless relative-parent and absolute source-map sentinels were read by 7.29.0 and rejected by 7.29.7; an in-root control map remained accepted.

Changelog and compatibility review

• @babel/core and coherent Babel 7.29.x lock graph 7.29.0 -> 7.29.7 (direct floor ^7.20.12 -> ^7.29.6): 7.29.6 contains the input-source-map boundary fix; 7.29.7 is the provenance re-release. Reviewed core, generator, parser, and compat-data notes through 7.29.7: no breaking migration, engine, peer, ESM/CJS, types, platform, or license change. The reachable build is trusted CommonJS targeting Node 20 with sourceMaps, preserveFormat, Flow, useBuiltIns, and corejs unset; parser/generator/compat-data behavioral changes are not reached.
• @babel/core advisory <=7.29.0 -> 7.29.7: Attack requires attacker-controlled compiled input, readable output, and a known source-map path. The SDK uses Babel only as a direct development dependency and does not ship it in the package artifact.

Test evidence

• PASS [REQUIRED] - baseline and exact head / immutable install, ancestry, and targeted audit: main 2ce315e: @babel/core@7.29.0 and GHSA-4x5r-pxfx-6jf8 present; exact head: npm ci, npm ls @babel/core --all, and audit showed only 7.29.7 and no target advisory. Install left tracked files clean.

• PASS [REQUIRED] - local security regression / sourceMappingURL boundary probe: Disposable baseline @babel/core@7.29.0 applied harmless relative-parent and absolute external maps; exact head 7.29.7 discarded both while applying the in-root map.

• PASS [REQUIRED] - local / lint, coverage, docs, and package: Exact head npm ci; npm run lint; npm run test:coverage -- --runInBand (6 suites, 158 tests, 99.39% statements/lines); npm run readme; npm pack --dry-run all passed.

• PASS [REQUIRED] - CI / supported Node matrix: GitHub Node.js CI passed on Node 20.x, 22.x, and 24.x; policy and both Socket checks also passed on this exact head.

• PASS [REQUIRED] - cumulative local validation / explicit composition with PR ACT-3722: update js-yaml to 3.15.0 #112: Local merge 3b3266a088a538b0cb91b3028dddc4c667e3059b contains this exact head and PR ACT-3722: update js-yaml to 3.15.0 #112 as ancestors. npm ci, lint, coverage (158 tests), docs, pack, audit, and serial Node 20.20.2/22.22.3/24.14.0 lint+test lanes passed; composed audit removes both target advisories.

• PASS [REQUIRED] - consumer fixture / packed artifact CommonJS and ESM loading: A disposable consumer installed the exact packed tarball and verified CommonJS require and ESM dynamic import expose helpers, middleware, and sso. Extracted dist, docs, and README payload files were byte-identical to main; no TypeScript declarations exist on either baseline or candidate.

• Deployment: NOT-APPLICABLE (library): plugins-sdk-nodejs is an npm package with no Staffbase dev deployment path; package/consumer validation is the repository-matrix alternative.

• Environment validation: PASS (consumer-fixture, disposable local npm consumer): Exact packed candidate installed cleanly with no consumer audit findings and passed CommonJS and ESM import smoke checks.

• Observability: NOT-APPLICABLE: No service or tenant deployment exists for this package-only repository.; soak: not required; development-only tooling update

• Cleanup: PASS: All local tarballs, consumer fixtures, source-map sentinels, baseline fixtures, PR-fetch clone, and cumulative clone were moved to Trash after verification.

Remaining gaps

• No dev deployment, browser, Grafana, or soak applies to this package-only, development-only dependency remediation.
• The remote PR remains a draft and review-required; validation does not change that GitHub state.

Scores and recommendation

• Importance: 3/10 - Low-severity arbitrary local source-map disclosure in a direct development compiler; the repository builds trusted source and does not ship Babel runtime code.
• Tested residual risk: 2/10 - Exact-head and cumulative remediation proof, focused boundary regression, full local lanes, green Node 20/22/24 CI, supported-node cumulative lanes, and packed-consumer checks are clean; only non-applicable deployment surfaces remain.
• Recommendation: Ready for review and merge; keep the PR isolated to this advisory.