[MelvinBot]

Details

Bumps transitive @babel/traverse 7.22.8 → 7.23.2 (lockfile only) to fix GHSA-67hx-6x53-jw92 (critical: arbitrary code execution when compiling crafted code). Its required deps moved too: @babel/generator, @babel/types, @babel/parser → 7.23.0; @babel/helper-function-name 7.23.0; @babel/template 7.22.15; @babel/code-frame 7.22.13 (adds a nested chalk@2); @babel/highlight, @babel/helper-validator-identifier, @babel/helper-environment-visitor → 7.22.20.

Usage: build-time only. @babel/core (via @babel/cli and the presets in babel.config.json) uses it to compile src/ to dist/ in npm run build. Not shipped to consumers.

Change Log

@babel/traverse changes from 7.22.9 to 7.23.2:

• 7.23.2: Only evaluate own String/Number/Math methods (#16033), which fixes the alert.
• 7.23.0: Added createImportExpressions support (#15682) and t.buildUndefinedNode (#15893). Expanded evaluation of global built-ins (#15797).
• 7.22.16: Changed tests only (#15936).
• 7.22.14, 7.22.11: Changed tests and lint only.
• 7.22.10: Improved path.isX types (#15661) and moved to typescript-eslint@v6 (#15716).

Related Issues

$ https://github.com/Expensify/Expensify/issues/695901

Manual Tests

1. npm ci succeeds.
2. npm run build succeeds and outputs dist/.
3. npx eslint src, npx prettier . --check, and npm run ts pass.
4. npm ls @babel/traverse shows only 7.23.2, and npm ls --all reports no invalid or missing deps.

All four passed locally.

Linked PRs

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}

[blimpich]

@MelvinBot can you please sign the CLA as per #57 (comment)?

[chiragsalian]

Archiving this repository so closing out this PR