This PR contains the following updates:

| Package | Change | Age | Confidence |
|---|---|---|---|
| @babel/core (source) | 7.29.0 → 7.29.6 | | |

---

@​babel/core: Arbitrary File Read via sourceMappingURL Comment

CVE-2026-49356 / GHSA-4x5r-pxfx-6jf8

More information

#### Details
##### Impact

Using `@babel/core` to compile maliciously crafted code can allow ab attacker to read any source map from the system that is running Babel, if these conditions are _all_ true:
- the attacker controls the input source code
- the attacker can read the output source code
- the attacker knows the path of the source map file that they want to read

**Users that only compile trusted code are not impacted.**

##### Patches

The vulnerability has been fixed in `@babel/[email protected]` and `@babel/[email protected]`.

##### Workarounds

Callers can mitigate the issue without upgrading by setting [`inputSourceMap: false`](https://babeljs.io/docs/options#inputsourcemap) in their Babel options.

Callers can also manually extract the `#sourceMappingURL` comment from the input source code, validate whether the source map that it links to is allowed to be read, and if it is pass an object to `inputSourceMap` (passing `false` when it's not).

##### Credits

Thanks Teodor-Cristian Radoi for reporting the vulnerability.

#### Severity
- CVSS Score: 3.2 / 10 (Low)
- Vector String: `CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N`

#### References
- [https://github.com/babel/babel/security/advisories/GHSA-4x5r-pxfx-6jf8](https://redirect.github.com/babel/babel/security/advisories/GHSA-4x5r-pxfx-6jf8)
- [https://babeljs.io/docs/options#inputsourcemap](https://babeljs.io/docs/options#inputsourcemap)
- [https://nvd.nist.gov/vuln/detail/CVE-2026-49356](https://nvd.nist.gov/vuln/detail/CVE-2026-49356)
- [https://github.com/advisories/GHSA-4x5r-pxfx-6jf8](https://redirect.github.com/advisories/GHSA-4x5r-pxfx-6jf8)

This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-4x5r-pxfx-6jf8) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).

---

Release Notes

babel/babel (@​babel/core)

### [`v7.29.6`](https://redirect.github.com/babel/babel/releases/tag/v7.29.6)

[Compare Source](https://redirect.github.com/babel/babel/compare/v7.29.0...v7.29.6)

#### v7.29.6 (2026-05-25)

##### :bug: Bug Fix

- `babel-generator`
- [#​18014](https://redirect.github.com/babel/babel/pull/18014) Catchup source map position in preserveFormat ([@​nicolo-ribaudo](https://redirect.github.com/nicolo-ribaudo))
- `babel-core`
- [#​18001](https://redirect.github.com/babel/babel/pull/18001) \[7.x packport]Improve input source map handling ([@​JLHwung](https://redirect.github.com/JLHwung))
- `babel-core`, `babel-generator`
- [#​17998](https://redirect.github.com/babel/babel/pull/17998) Preserve original identifier names from input sourcemaps ([#​17992](https://redirect.github.com/babel/babel/issues/17992)) ([@​Andarist](https://redirect.github.com/Andarist))

##### Committers: 3

- Huáng Jùnliàng ([@​JLHwung](https://redirect.github.com/JLHwung))
- Mateusz Burzyński ([@​Andarist](https://redirect.github.com/Andarist))
- Nicolò Ribaudo ([@​nicolo-ribaudo](https://redirect.github.com/nicolo-ribaudo))

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  
  
  • At any time (no schedule defined)
  
  
  
  


• Automerge
  
  
  • At any time (no schedule defined)
  
  
  
  

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC45Ni4zIiwidXBkYXRlZEluVmVyIjoiNDQuOTYuMyIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19-->