Skip to content

[Aikido] Fix security issue in @babel/traverse via minor version upgrade from 7.10.4 to 7.29.0 in docs - #58

Open
aikido-autofix[bot] wants to merge 1 commit into
masterfrom
fix/aikido-security-update-packages-34645945-dr3l
Open

aikido-autofix[bot] wants to merge 1 commit into
masterfrom
fix/aikido-security-update-packages-34645945-dr3l

Conversation

@aikido-autofix

Copy link
Copy Markdown

Upgrade @babel/traverse to fix remote code execution vulnerability in compilation when processing malicious input with path evaluation methods.

⚠️ Breaking changes analysis not available for: @babel/traverse

✅ 1 CVE resolved by this upgrade

This PR will resolve the following CVEs:

Issue Severity           Description
AIKIDO-2025-10745
MEDIUM
[@babel/traverse] A vulnerability allows remote code execution during compilation when processing malicious input with certain plugins that use internal evaluation methods. This affects plugins like @babel/plugin-transform-runtime and @babel/preset-env with useBuiltIns option.
🤖 Remediation details

Fix AIKIDO-2025-10745: upgrade @babel/traverse to patched version

Short summary

This PR remediates a medium-severity vulnerability in @babel/traverse (affected range [7.0.0, 7.23.0]). The package is a transitive dependency resolved in docs/.awesome/package-lock.json; no package.json manifest required editing. The lockfile was refreshed so the single hoisted instance of @babel/traverse resolves to a patched version.

@babel/traverse

@babel/traverse was resolved at 7.10.4 in the lockfile, which falls within the vulnerable range. It is a transitive dependency pulled in by several parents (including @babel/core and gatsby), all of which declare it with a ^7.10.x range that is semver-compatible with the patched floor of 7.23.2. Because no parent pinned an exact vulnerable version, running npm update @babel/traverse --package-lock-only from docs/.awesome/ was sufficient to advance the resolved version to 7.29.0 without any manifest edits or overrides.

Version changes

Package From To Why updated
@babel/traverse 7.10.4 7.29.0 Direct CVE fix — lockfile-only refresh; semver-compatible with all declaring parents

@github-actions

Copy link
Copy Markdown

Package lock diff

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

0 participants