Bump @babel/plugin-transform-modules-systemjs from 7.28.5 to 7.29.4 - #102
Conversation
dependabot
Bot
added
dependencies
There was a problem hiding this comment.
Archived legacy automated review — inactive
Preserved verbatim for history. This is not an active recommendation.
3PP Grackle (automated dependency triage -- Frontend DX)
Approving via 3PP Grackle's merge-safe automation.
CI is fully green, the PR is mergeable, and the only outstanding gate was review approval. The merge action still enforces the mergeSafeRepos safelist before any merge attempt.
See docs/production-deploy-classification.md for the safelist rationale.
skill-sig: 26cfcbaf
Archived legacy automated review — inactive
Grackle review -- no-CI minor bump of @babel/plugin-transform-modules-systemjs VerificationFindingsLOW #1 -- Transitive @babel/ packages bumped alongside target* VERIFIED: The lockfile adds new resolution entries for @babel/traverse@7.29.0, @babel/parser@7.29.3, @babel/generator@7.29.1, @babel/types@7.29.0, @babel/template@7.28.6, @babel/code-frame@7.29.0, @babel/helper-module-imports@7.28.6, @babel/helper-module-transforms@7.28.6, @babel/helper-plugin-utils@7.28.6. These are all direct dependencies of the target package and resolve within their declared semver ranges. No packages were removed. All resolved URLs point to registry.yarnpkg.com with sha512 integrity hashes. yarn.lock:730-740 for the target entry. Verified location: LOW #2 -- PR title says security fix but upstream release is labeled bug fix only HYPOTHESIS: The upstream v7.29.4 release notes describe a bug fix ("improve module string name support"), not a security advisory. The user's invocation states this is a security fix, but no CVE/GHSA is cited. Dependabot may have flagged this as security-relevant due to a transitive advisory in one of the bumped sub-deps. Refutation: check GitHub security advisories for @babel/traverse or @babel/parser at the old versions. Verified location: What's solid
Priority stack for the authorNo blocking issues. The only action item is confirming the security motivation -- if a specific CVE drove this bump, add it to the PR description for audit trail; otherwise this is safe to merge as a routine transitive update. Recommendation: GO skill-sig: 26cfcbaf · 3pp-skill-sig: ad61853a |
Bumps [@babel/plugin-transform-modules-systemjs](https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs) from 7.28.5 to 7.29.4. - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.4/packages/babel-plugin-transform-modules-systemjs) --- updated-dependencies: - dependency-name: "@babel/plugin-transform-modules-systemjs" dependency-version: 7.29.4 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
0ef7682 to
ab1f7bf
Compare
Archived legacy automated review — inactive
Grackle review -- minor bump @babel/plugin-transform-modules-systemjs 7.28.5 -> 7.29.4 VerificationFindingsLOW #1 -- Large transitive lockfile churn VERIFIED: 411 insertions / 285 deletions in yarn.lock due to Babel monorepo co-dependencies (@ampproject/remapping, @jridgewell/, other @babel/ packages). All are expected transitive bumps within the Babel ecosystem. No packages outside this family were added or removed. Verified location: LOW #2 -- Upstream change is a bug fix only VERIFIED: v7.29.4 release notes (babel/babel) contain exactly one commit -- a backported bug fix for module string name support in systemjs (PR #17974). No breaking changes, no deprecations, no new APIs. The fix improves correctness of existing behavior. Verified location: What's solid
Priority stack for the authorNo action required. The lockfile churn is cosmetic (Babel monorepo transitives); the upgrade itself is a single bug-fix with no breaking surface. Recommendation: GO skill-sig: 26cfcbaf · 3pp-skill-sig: ad61853a |
1 participant
Bumps @babel/plugin-transform-modules-systemjs from 7.28.5 to 7.29.4.
Release notes
Sourced from @babel/plugin-transform-modules-systemjs's releases.
... (truncated)
Commits
a458f66v7.29.432ebd5a[7.x backport]fix(systemjs): improve module string name support (#17974)aa8394ev7.29.00053db6Update polyfill packages (#17727)You can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.