[MelvinBot]

Details

Bumps transitive @babel/plugin-transform-modules-systemjs 7.22.5 → 7.29.8 to fix GHSA-fv7c-fp4j-7gwp (high).

Lockfile-only. Generated with npm audit fix --package-lock-only, which also moves the rest of the Babel 7 toolchain (@babel/core 7.29.7, @babel/traverse, helpers) and other non-breaking transitive deps. That clears 31 of the 37 npm audit findings. The remaining 6 need [email protected] (breaking), so I left them alone.

Usage: dev-only. @babel/preset-env pulls in the plugin, and npm run build uses it to compile src → dist before publishing. This repo doesn't emit SystemJS modules, and consumers don't get this lockfile.

dist diff vs main: only newer inlined Babel helpers and exports.X = ... assignment style. Same behavior.

Change Log

Entries that touch @babel/plugin-transform-modules-systemjs (full 7.x changelog):

• 7.29.8: support __proto__ as an export name (babel/babel#18044)
• 7.29.4: improve module string name support, security fix (babel/babel#17974)
• 7.22.6 – 7.29.3: dependency bumps that follow @babel/helper-module-transforms / @babel/traverse

Related Issues

https://github.com/Expensify/Expensify/issues/695891

Manual Tests

1. npm ci && npm run build. The build succeeds.
2. npm run ts && npx eslint src. Both pass.
3. npm ls @babel/plugin-transform-modules-systemjs. It shows 7.29.8.
4. Optional: link the built package into a consumer and check that the map renders on web and native.

Linked PRs

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}

[luacmartins]

@MelvinBot resolve conflicts

[luacmartins]

It seems like we'll archive this repo https://expensify.slack.com/archives/C03TQ48KC/p1793034901158699, so no need for this PR.