Bump the npm-version-updates group across 1 directory with 11 updates by dependabot[bot] · Pull Request #467 · ONSdigital/eq-questionnaire-validator

dependabot · 2026-08-20T12:15:57Z

Bumps the npm-version-updates group with 11 updates in the / directory:

Package	From	To
axios	`1.18.1`	`1.19.0`
@babel/cli	`7.29.7`	`8.0.4`
@babel/core	`7.29.7`	`8.0.1`
@babel/preset-env	`7.29.7`	`8.0.2`
@babel/register	`7.29.7`	`8.0.1`
@eslint/json	`2.0.0`	`2.0.1`
eslint-plugin-chai-friendly	`1.2.0`	`1.2.1`
eslint-plugin-security	`4.0.0`	`4.0.1`
globals	`17.6.0`	`17.11.0`
jsonc-eslint-parser	`3.1.0`	`3.3.0`
prettier	`3.8.3`	`3.9.6`

Updates axios from 1.18.1 to 1.19.0

Release notes

Sourced from axios's releases.

v1.19.0 - July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)

Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)

HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)

Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)

Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)

Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)

URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11024, #11038)

Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)

Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)

Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)

Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

🔧 Maintenance & Chores

Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)

Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)

Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)

Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)

Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)

Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

@afonsojramos (#11028)

@MahinAnowar (#11006)

@yassertawfik4 (#11024)

@AnandSundar (#11029)

@lin-hongkuan (#11035)

@Wali007-lab (#11054)

@magicdawn (#11043)

@andrewkernel (#11053)

@Sagargupta16 (#11059)

@Rpaudel379 (#11078)

... (truncated)

Changelog

Sourced from axios's changelog.

v1.19.0 — July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)

Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)

HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)

Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)

Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)

Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)

URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11008, #11038)

Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)

Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)

Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)

Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

🔧 Maintenance & Chores

Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)

Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)

Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)

Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)

Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)

Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

@afonsojramos (#11028)

@MahinAnowar (#11006)

@yassertawfik4 (#11024)

@AnandSundar (#11029)

@lin-hongkuan (#11035)

@Wali007-lab (#11054)

@magicdawn (#11043)

@andrewkernel (#11053)

@Sagargupta16 (#11059)

... (truncated)

Commits

311fcc5 chore(release): prepare release 1.19.0 (#11095)
cb4fd74 chore(deps): bump axios from 1.16.1 to 1.18.1 in /docs (#11088)
004c93a chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 in the github-action...
122edde chore(deps-dev): bump the development_dependencies group with 3 updates (#11089)
c44f8d0 ci: use bundled npm for v1 publish (#11083)
878bb29 fix(sandbox): resolve TypeError on constant variable path assignment (#11073)
a092bae fix(core): synchronous interceptors swallow errors and proceed with request (...
3041b8f feat(HttpStatusCode): add missing 520 status code (#11067)
58b16c8 refactor(helpers): extract duplicated setFormDataHeaders into a shared helper...
3077e62 feat(types): Allow the Params property to be typed, instead of any (#11081)
Additional commits viewable in compare view

Updates @babel/cli from 7.29.7 to 8.0.4

Release notes

Sourced from @babel/cli's releases.

v8.0.4 (2026-07-09)

👓 Spec Compliance

babel-parser, babel-plugin-transform-typescript

#18120 fix(parser): disallow declare module M {} (@JLHwung)

babel-generator, babel-parser, babel-plugin-transform-typescript

#18100 fix(parser): forbid let x! and let x! = (@JLHwung)

🐛 Bug Fix

babel-traverse

#18122 fix: replaceWith in Visitor#exit should not stop traversal (@liuxingbaoyu)

🏠 Internal

babel-helper-validator-identifier

#18084 refactor: Shrink validator identifier size (@JLHwung)

Committers: 4

Babel Bot (@babel-bot)

Huáng Jùnliàng (@JLHwung)

Nicolò Ribaudo (@nicolo-ribaudo)

@liuxingbaoyu

v8.0.3 (2026-06-27)

🐛 Bug Fix

babel-core, babel-plugin-syntax-typescript

#18089 fix: Remove isTSX from babel-plugin-syntax-typescript types (@liuxingbaoyu)

babel-standalone

#18086 fix: Use runtime: 'classic' in the browser for React (@liuxingbaoyu)

Committers: 2

Nicolò Ribaudo (@nicolo-ribaudo)

@liuxingbaoyu

v8.0.2 (2026-06-18)

🐛 Bug Fix

Other

#18083 Use the @babel/core version when asserting version in @babel/standalone (@nicolo-ribaudo)

babel-helper-validator-identifier

#18075 fix(identifier): avoid double escaping slash (@JLHwung)

🏠 Internal

babel-plugin-proposal-decorators, babel-plugin-transform-regenerator, babel-preset-env

#18081 Update @babel/preset-modules and polyfill packages (@nicolo-ribaudo)

Committers: 2

Huáng Jùnliàng (@JLHwung)

Nicolò Ribaudo (@nicolo-ribaudo)

... (truncated)

Changelog

Sourced from @babel/cli's changelog.

v8.0.4 (2026-07-09)

👓 Spec Compliance

babel-parser, babel-plugin-transform-typescript

#18120 fix(parser): disallow declare module M {} (@JLHwung)

babel-generator, babel-parser, babel-plugin-transform-typescript

#18100 fix(parser): forbid let x! and let x! = (@JLHwung)

🐛 Bug Fix

babel-traverse

#18122 fix: replaceWith in Visitor#exit should not stop traversal (@liuxingbaoyu)

🏠 Internal

babel-helper-validator-identifier

#18084 refactor: Shrink validator identifier size (@JLHwung)

v8.0.3 (2026-06-27)

🐛 Bug Fix

babel-core, babel-plugin-syntax-typescript

#18089 fix: Remove isTSX from babel-plugin-syntax-typescript types (@liuxingbaoyu)

babel-standalone

#18086 fix: Use runtime: 'classic' in the browser for React (@liuxingbaoyu)

v8.0.2 (2026-06-18)

🐛 Bug Fix

Other

#18083 Use the @babel/core version when asserting version in @babel/standalone (@nicolo-ribaudo)

babel-helper-validator-identifier

#18075 fix(identifier): avoid double escaping slash (@JLHwung)

🏠 Internal

babel-plugin-proposal-decorators, babel-plugin-transform-regenerator, babel-preset-env

#18081 Update @babel/preset-modules and polyfill packages (@nicolo-ribaudo)

v8.0.1 (2026-06-17)

💥 Breaking Change

babel-core, babel-plugin-transform-object-rest-spread, babel-plugin-transform-runtime, babel-preset-env, babel-standalone

#18079 Actually remove preset-env's useBuiltIns (@nicolo-ribaudo)

v8.0.0 (2026-06-16)

👓 Spec Compliance

babel-core

#18039 perf: Only extract source map comments at the end of the file (@liuxingbaoyu)

💥 Breaking Change

babel-cli, babel-node, babel-plugin-proposal-decorators, babel-plugin-transform-classes, babel-plugin-transform-function-name, babel-plugin-transform-modules-commonjs, babel-plugin-transform-object-rest-spread, babel-plugin-transform-parameters, babel-plugin-transform-react-constant-elements, babel-plugin-transform-regenerator, babel-preset-env, babel-register

#18069 Fallback to assuming ESM support with modules: auto (@nicolo-ribaudo)

babel-plugin-transform-runtime, babel-runtime-corejs3, babel-runtime

#18036 Remove corejs exports for @babe/runtime-corejs3 (@liuxingbaoyu)

babel-parser

... (truncated)

Commits

8ed5db1 v8.0.4
b8e669f chore: bump chokidar to 5.0.0 (#18112)
b4be199 v8.0.1
cd96c47 chore(pkg): set @babel/core peer deps to ^8.0.0 (#18076)
7dc825a v8.0.0
004f4b4 Fallback to assuming ESM support with modules: auto (#18069)
73bceef v8.0.0-rc.6
c6d71f3 Enable strictFunctionTypes (#17946)
0e16971 Do not emit source map names for identical names (#18005)
3d34928 Use Yarn catalog for source map dependencies (#18004)
Additional commits viewable in compare view

Updates @babel/core from 7.29.7 to 8.0.1

Release notes

Sourced from @babel/core's releases.

v8.0.1 (2026-06-17)

This release includes a breaking change that was in the Babel 8 migration guide's Getting ready section and in the release post, but the actual removal of the feature from the codebase was accidentally not complete.

💥 Breaking Change

babel-core, babel-plugin-transform-object-rest-spread, babel-plugin-transform-runtime, babel-preset-env, babel-standalone

#18079 Actually remove preset-env's useBuiltIns (@nicolo-ribaudo)

Committers: 2

Huáng Jùnliàng (@JLHwung)

Nicolò Ribaudo (@nicolo-ribaudo)

v8.0.0 (2026-06-16)

NOTE: The changelog below is relative to v8.0.0-rc.6. You can find a summary of all the breaking changes shipped in the Babel 8 release line in the migration guide for users and migration guide for plugin developers.

Read the release blog post at http://babeljs.io/blog/2026/06/16/8.0.0!

👓 Spec Compliance

babel-core

#18039 perf: Only extract source map comments at the end of the file (@liuxingbaoyu)

💥 Breaking Change

babel-cli, babel-node, babel-plugin-proposal-decorators, babel-plugin-transform-classes, babel-plugin-transform-function-name, babel-plugin-transform-modules-commonjs, babel-plugin-transform-object-rest-spread, babel-plugin-transform-parameters, babel-plugin-transform-react-constant-elements, babel-plugin-transform-regenerator, babel-preset-env, babel-register

#18069 Fallback to assuming ESM support with modules: auto (@nicolo-ribaudo)

babel-plugin-transform-runtime, babel-runtime-corejs3, babel-runtime

#18036 Remove corejs exports for @babe/runtime-corejs3 (@liuxingbaoyu)

babel-parser

#18034 Remove locations: "packed" (@liuxingbaoyu)

🐛 Bug Fix

babel-generator

#18046 fix(generator): improve new callee parens check (@JLHwung)

babel-plugin-transform-modules-systemjs

#18032 fix(systemjs): support proto as an export name (@JLHwung)

📝 Documentation

#18070 Add EOL date for Babel 7 (end of June 2027) to SECURITY.md (@nicolo-ribaudo)

🏠 Internal

#18018 ci: enforce yarn integrity (@JLHwung)

🏃‍♀️ Performance

babel-core

#18039 perf: Only extract source map comments at the end of the file (@liuxingbaoyu)

Committers: 6

Babel Bot (@babel-bot)

Huáng Jùnliàng (@JLHwung)

James Garbutt (@43081j)

... (truncated)

Changelog

Sourced from @babel/core's changelog.

v8.0.1 (2026-06-17)

💥 Breaking Change

babel-core, babel-plugin-transform-object-rest-spread, babel-plugin-transform-runtime, babel-preset-env, babel-standalone

#18079 Actually remove preset-env's useBuiltIns (@nicolo-ribaudo)

v8.0.0 (2026-06-16)

👓 Spec Compliance

babel-core

#18039 perf: Only extract source map comments at the end of the file (@liuxingbaoyu)

💥 Breaking Change

babel-cli, babel-node, babel-plugin-proposal-decorators, babel-plugin-transform-classes, babel-plugin-transform-function-name, babel-plugin-transform-modules-commonjs, babel-plugin-transform-object-rest-spread, babel-plugin-transform-parameters, babel-plugin-transform-react-constant-elements, babel-plugin-transform-regenerator, babel-preset-env, babel-register

#18069 Fallback to assuming ESM support with modules: auto (@nicolo-ribaudo)

babel-plugin-transform-runtime, babel-runtime-corejs3, babel-runtime

#18036 Remove corejs exports for @babe/runtime-corejs3 (@liuxingbaoyu)

babel-parser

#18034 Remove locations: "packed" (@liuxingbaoyu)

🐛 Bug Fix

babel-generator

#18046 fix(generator): improve new callee parens check (@JLHwung)

babel-plugin-transform-modules-systemjs

#18032 fix(systemjs): support proto as an export name (@JLHwung)

📝 Documentation

#18070 Add EOL date for Babel 7 (end of June 2027) to SECURITY.md (@nicolo-ribaudo)

🏠 Internal

#18018 ci: enforce yarn integrity (@JLHwung)

🏃‍♀️ Performance

babel-core

#18039 perf: Only extract source map comments at the end of the file (@liuxingbaoyu)

v8.0.0-rc.6 (2026-05-25)

🐛 Bug Fix

babel-generator

#18011 Catchup source map position in preserveFormat (@nicolo-ribaudo)

babel-core

#17999 fix: improve inputSourceMap URL handling (@JLHwung)

babel-core, babel-generator

#17992 Preserve original identifier names from input sourcemaps (@Andarist)

🏠 Internal

babel-core

#17970 Always use native Node.js TS support for config files (@nicolo-ribaudo)

babel-compat-data, babel-register

#17993 chore: use bundled dts for register and eslint-* (@JLHwung)

babel-helper-transform-fixture-test-runner, babel-node

... (truncated)

Commits

b4be199 v8.0.1
b68b1cb Actually remove preset-env's useBuiltIns (#18079)
de007ea Avoid trailing zeroes in Babel 9 generated version (#18078)
7dc825a v8.0.0
b71c35a perf: Only extract source map comments at the end of the file (#18039)
e74b70d chore: Remove unused file (#18033)
ae57969 chore: consolidate upwards traversal to empathic (#18030)
827d003 Change jest snapshotFormat (#18029)
34cf24e Update deps (#18023)
73bceef v8.0.0-rc.6
Additional commits viewable in compare view

Updates @babel/preset-env from 7.29.7 to 8.0.2

Release notes

Sourced from @babel/preset-env's releases.

v8.0.2 (2026-06-18)

🐛 Bug Fix

Other

#18083 Use the @babel/core version when asserting version in @babel/standalone (@nicolo-ribaudo)

babel-helper-validator-identifier

#18075 fix(identifier): avoid double escaping slash (@JLHwung)

🏠 Internal

babel-plugin-proposal-decorators, babel-plugin-transform-regenerator, babel-preset-env

#18081 Update @babel/preset-modules and polyfill packages (@nicolo-ribaudo)

Committers: 2

Huáng Jùnliàng (@JLHwung)

Nicolò Ribaudo (@nicolo-ribaudo)

v8.0.1 (2026-06-17)

This release includes a breaking change that was in the Babel 8 migration guide's Getting ready section and in the release post, but the actual removal of the feature from the codebase was accidentally not complete.

💥 Breaking Change

babel-core, babel-plugin-transform-object-rest-spread, babel-plugin-transform-runtime, babel-preset-env, babel-standalone

#18079 Actually remove preset-env's useBuiltIns (@nicolo-ribaudo)

Committers: 2

Huáng Jùnliàng (@JLHwung)

Nicolò Ribaudo (@nicolo-ribaudo)

v8.0.0 (2026-06-16)

NOTE: The changelog below is relative to v8.0.0-rc.6. You can find a summary of all the breaking changes shipped in the Babel 8 release line in the migration guide for users and migration guide for plugin developers.

Read the release blog post at http://babeljs.io/blog/2026/06/16/8.0.0!

👓 Spec Compliance

babel-core

#18039 perf: Only extract source map comments at the end of the file (@liuxingbaoyu)

💥 Breaking Change

babel-cli, babel-node, babel-plugin-proposal-decorators, babel-plugin-transform-classes, babel-plugin-transform-function-name, babel-plugin-transform-modules-commonjs, babel-plugin-transform-object-rest-spread, babel-plugin-transform-parameters, babel-plugin-transform-react-constant-elements, babel-plugin-transform-regenerator, babel-preset-env, babel-register

#18069 Fallback to assuming ESM support with modules: auto (@nicolo-ribaudo)

babel-plugin-transform-runtime, babel-runtime-corejs3, babel-runtime

#18036 Remove corejs exports for @babe/runtime-corejs3 (@liuxingbaoyu)

babel-parser

#18034 Remove locations: "packed" (@liuxingbaoyu)

🐛 Bug Fix

babel-generator

#18046 fix(generator): improve new callee parens check (@JLHwung)

babel-plugin-transform-modules-systemjs

... (truncated)

Changelog

Sourced from @babel/preset-env's changelog.

v8.0.2 (2026-06-18)

🐛 Bug Fix

Other

#18083 Use the @babel/core version when asserting version in @babel/standalone (@nicolo-ribaudo)

babel-helper-validator-identifier

#18075 fix(identifier): avoid double escaping slash (@JLHwung)

🏠 Internal

babel-plugin-proposal-decorators, babel-plugin-transform-regenerator, babel-preset-env

#18081 Update @babel/preset-modules and polyfill packages (@nicolo-ribaudo)

v8.0.1 (2026-06-17)

💥 Breaking Change

babel-core, babel-plugin-transform-object-rest-spread, babel-plugin-transform-runtime, babel-preset-env, babel-standalone

#18079 Actually remove preset-env's useBuiltIns (@nicolo-ribaudo)

v8.0.0 (2026-06-16)

👓 Spec Compliance

babel-core

#18039 perf: Only extract source map comments at the end of the file (@liuxingbaoyu)

💥 Breaking Change

babel-cli, babel-node, babel-plugin-proposal-decorators, babel-plugin-transform-classes, babel-plugin-transform-function-name, babel-plugin-transform-modules-commonjs, babel-plugin-transform-object-rest-spread, babel-plugin-transform-parameters, babel-plugin-transform-react-constant-elements, babel-plugin-transform-regenerator, babel-preset-env, babel-register

#18069 Fallback to assuming ESM support with modules: auto (@nicolo-ribaudo)

babel-plugin-transform-runtime, babel-runtime-corejs3, babel-runtime

#18036 Remove corejs exports for @babe/runtime-corejs3 (@liuxingbaoyu)

babel-parser

#18034 Remove locations: "packed" (@liuxingbaoyu)

🐛 Bug Fix

babel-generator

#18046 fix(generator): improve new callee parens check (@JLHwung)

babel-plugin-transform-modules-systemjs

#18032 fix(systemjs): support proto as an export name (@JLHwung)

📝 Documentation

#18070 Add EOL date for Babel 7 (end of June 2027) to SECURITY.md (@nicolo-ribaudo)

🏠 Internal

#18018 ci: enforce yarn integrity (@JLHwung)

🏃‍♀️ Performance

babel-core

#18039 perf: Only extract source map comments at the end of the file (@liuxingbaoyu)

v8.0.0-rc.6 (2026-05-25)

🐛 Bug Fix

babel-generator

#18011 Catchup source map position in preserveFormat (@nicolo-ribaudo)

... (truncated)

Commits

73940a0 v8.0.2
59a63a6 Update @babel/preset-modules and polyfill packages (#18081)
b4be199 v8.0.1
b68b1cb Actually remove preset-env's useBuiltIns (#18079)
cd96c47 chore(pkg): set @babel/core peer deps to ^8.0.0 (#18076)
7dc825a v8.0.0
004f4b4 Fallback to assuming ESM support with modules: auto (#18069)
73bceef v8.0.0-rc.6
c6d71f3 Enable strictFunctionTypes (#17946)
dc91f90 v8.0.0-rc.5
Additional commits viewable in compare view

Updates @babel/register from 7.29.7 to 8.0.1

Release notes

Sourced from @babel/register's releases.

v8.0.1 (2026-06-17)

This release includes a breaking change that was in the Babel 8 migration guide's Getting ready section and in the release post, but the actual removal of the feature from the codebase was accidentally not complete.

💥 Breaking Change

babel-core, babel-plugin-transform-object-rest-spread, babel-plugin-transform-runtime, babel-preset-env, babel-standalone

#18079 Actually remove preset-env's useBuiltIns (@nicolo-ribaudo)

Committers: 2

Huáng Jùnliàng (@JLHwung)

Nicolò Ribaudo (@nicolo-ribaudo)

v8.0.0 (2026-06-16)

NOTE: The changelog below is relative to v8.0.0-rc.6. You can find a summary of all the breaking changes shipped in the Babel 8 release line in the migration guide for users and migration guide for plugin developers.

Read the release blog post at http://babeljs.io/blog/2026/06/16/8.0.0!

👓 Spec Compliance

babel-core

#18039 perf: Only extract source map comments at the end of the file (@liuxingbaoyu)

💥 Breaking Change

babel-cli, babel-node, babel-plugin-proposal-decorators, babel-plugin-transform-classes, babel-plugin-transform-function-name, babel-plugin-transform-modules-commonjs, babel-plugin-transform-object-rest-spread, babel-plugin-transform-parameters, babel-plugin-transform-react-constant-elements, babel-plugin-transform-regenerator, babel-preset-env, babel-register

#18069 Fallback to assuming ESM support with modules: auto (@nicolo-ribaudo)

babel-plugin-transform-runtime, babel-runtime-corejs3, babel-runtime

#18036 Remove corejs exports for @babe/runtime-corejs3 (@liuxingbaoyu)

babel-parser

#18034 Remove locations: "packed" (@liuxingbaoyu)

🐛 Bug Fix

babel-generator

#18046 fix(generator): improve new callee parens check (@JLHwung)

babel-plugin-transform-modules-systemjs

#18032 fix(systemjs): support proto as an export name (@JLHwung)

📝 Documentation

#18070 Add EOL date for Babel 7 (end of June 2027) to SECURITY.md (@nicolo-ribaudo)

🏠 Internal

#18018 ci: enforce yarn integrity (@JLHwung)

🏃‍♀️ Performance

babel-core

#18039 perf: Only extract source map comments at the end of the file (@liuxingbaoyu)

Committers: 6

Babel Bot (@babel-bot)

Huáng Jùnliàng (@JLHwung)

James Garbutt (@43081j)

... (truncated)

Changelog

Sourced from @babel/register's changelog.

v8.0.1 (2026-06-17)

💥 Breaking Change

babel-core, babel-plugin-transform-object-rest-spread, babel-plugin-transform-runtime, babel-preset-env, babel-standalone

#18079 Actually remove preset-env's useBuiltIns (@nicolo-ribaudo)

v8.0.0 (2026-06-16)

👓 Spec Compliance

babel-core

#18039 perf: Only extract source map comments at the end of the file (@liuxingbaoyu)

💥 Breaking Change

babel-cli, babel-node, babel-plugin-proposal-decorators, babel-plugin-transform-classes, babel-plugin-transform-function-name, babel-plugin-transform-modules-commonjs, babel-plugin-transform-object-rest-spread, babel-plugin-transform-parameters, babel-plugin-transform-react-constant-elements, babel-plugin-transform-regenerato... Description has been truncated

Bumps the npm-version-updates group with 11 updates in the / directory: | Package | From | To | | --- | --- | --- | | [axios](https://github.com/axios/axios) | `1.18.1` | `1.19.0` | | [@babel/cli](https://github.com/babel/babel/tree/HEAD/packages/babel-cli) | `7.29.7` | `8.0.4` | | [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) | `7.29.7` | `8.0.1` | | [@babel/preset-env](https://github.com/babel/babel/tree/HEAD/packages/babel-preset-env) | `7.29.7` | `8.0.2` | | [@babel/register](https://github.com/babel/babel/tree/HEAD/packages/babel-register) | `7.29.7` | `8.0.1` | | [@eslint/json](https://github.com/eslint/json) | `2.0.0` | `2.0.1` | | [eslint-plugin-chai-friendly](https://github.com/ihordiachenko/eslint-plugin-chai-friendly) | `1.2.0` | `1.2.1` | | [eslint-plugin-security](https://github.com/eslint-community/eslint-plugin-security) | `4.0.0` | `4.0.1` | | [globals](https://github.com/sindresorhus/globals) | `17.6.0` | `17.11.0` | | [jsonc-eslint-parser](https://github.com/ota-meshi/jsonc-eslint-parser) | `3.1.0` | `3.3.0` | | [prettier](https://github.com/prettier/prettier) | `3.8.3` | `3.9.6` | Updates `axios` from 1.18.1 to 1.19.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.18.1...v1.19.0) Updates `@babel/cli` from 7.29.7 to 8.0.4 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v8.0.4/packages/babel-cli) Updates `@babel/core` from 7.29.7 to 8.0.1 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v8.0.1/packages/babel-core) Updates `@babel/preset-env` from 7.29.7 to 8.0.2 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v8.0.2/packages/babel-preset-env) Updates `@babel/register` from 7.29.7 to 8.0.1 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v8.0.1/packages/babel-register) Updates `@eslint/json` from 2.0.0 to 2.0.1 - [Release notes](https://github.com/eslint/json/releases) - [Changelog](https://github.com/eslint/json/blob/main/CHANGELOG.md) - [Commits](eslint/json@json-v2.0.0...json-v2.0.1) Updates `eslint-plugin-chai-friendly` from 1.2.0 to 1.2.1 - [Release notes](https://github.com/ihordiachenko/eslint-plugin-chai-friendly/releases) - [Commits](ihordiachenko/eslint-plugin-chai-friendly@v1.2.0...v1.2.1) Updates `eslint-plugin-security` from 4.0.0 to 4.0.1 - [Release notes](https://github.com/eslint-community/eslint-plugin-security/releases) - [Changelog](https://github.com/eslint-community/eslint-plugin-security/blob/main/CHANGELOG.md) - [Commits](eslint-community/eslint-plugin-security@eslint-plugin-security-v4.0.0...eslint-plugin-security-v4.0.1) Updates `globals` from 17.6.0 to 17.11.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](sindresorhus/globals@v17.6.0...v17.11.0) Updates `jsonc-eslint-parser` from 3.1.0 to 3.3.0 - [Release notes](https://github.com/ota-meshi/jsonc-eslint-parser/releases) - [Changelog](https://github.com/ota-meshi/jsonc-eslint-parser/blob/master/CHANGELOG.md) - [Commits](ota-meshi/jsonc-eslint-parser@v3.1.0...v3.3.0) Updates `prettier` from 3.8.3 to 3.9.6 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.8.3...3.9.6) --- updated-dependencies: - dependency-name: axios dependency-version: 1.19.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-version-updates - dependency-name: "@babel/cli" dependency-version: 8.0.4 dependency-type: direct:development update-type: version-update:semver-major dependency-group: npm-version-updates - dependency-name: "@babel/core" dependency-version: 8.0.1 dependency-type: direct:development update-type: version-update:semver-major dependency-group: npm-version-updates - dependency-name: "@babel/preset-env" dependency-version: 8.0.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: npm-version-updates - dependency-name: "@babel/register" dependency-version: 8.0.1 dependency-type: direct:development update-type: version-update:semver-major dependency-group: npm-version-updates - dependency-name: "@eslint/json" dependency-version: 2.0.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-version-updates - dependency-name: eslint-plugin-chai-friendly dependency-version: 1.2.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-version-updates - dependency-name: eslint-plugin-security dependency-version: 4.0.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-version-updates - dependency-name: globals dependency-version: 17.11.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-version-updates - dependency-name: jsonc-eslint-parser dependency-version: 3.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-version-updates - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-version-updates ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-09-01T12:25:40Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file node labels Aug 20, 2026

dependabot Bot requested a review from a team as a code owner August 20, 2026 12:15

dependabot Bot added dependencies Pull requests that update a dependency file node labels Aug 20, 2026

dependabot Bot closed this Sep 1, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/npm-version-updates-d1f78819ed branch September 1, 2026 12:25

Navigation Menu

Uh oh!

Bump the npm-version-updates group across 1 directory with 11 updates - #467

Bump the npm-version-updates group across 1 directory with 11 updates#467
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-version-updates-d1f78819ed

dependabot Bot commented on behalf of github Aug 20, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Sep 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.19.0 - July 22, 2026

🔒 Security Fixes

🚀 New Features

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

v1.19.0 — July 22, 2026

🔒 Security Fixes

🚀 New Features

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

v8.0.4 (2026-07-09)

👓 Spec Compliance

🐛 Bug Fix

🏠 Internal

Committers: 4

v8.0.3 (2026-06-27)

🐛 Bug Fix

Committers: 2

v8.0.2 (2026-06-18)

🐛 Bug Fix

🏠 Internal

Committers: 2

v8.0.4 (2026-07-09)

👓 Spec Compliance

🐛 Bug Fix

🏠 Internal

v8.0.3 (2026-06-27)

🐛 Bug Fix

v8.0.2 (2026-06-18)

🐛 Bug Fix

🏠 Internal

v8.0.1 (2026-06-17)

💥 Breaking Change

v8.0.0 (2026-06-16)

👓 Spec Compliance

💥 Breaking Change

v8.0.1 (2026-06-17)

💥 Breaking Change

Committers: 2

v8.0.0 (2026-06-16)

👓 Spec Compliance

💥 Breaking Change

🐛 Bug Fix

📝 Documentation

🏠 Internal

🏃‍♀️ Performance

Committers: 6

v8.0.1 (2026-06-17)

💥 Breaking Change

v8.0.0 (2026-06-16)

👓 Spec Compliance

💥 Breaking Change

🐛 Bug Fix

📝 Documentation

🏠 Internal

🏃‍♀️ Performance

v8.0.0-rc.6 (2026-05-25)

🐛 Bug Fix

🏠 Internal

v8.0.2 (2026-06-18)

🐛 Bug Fix

🏠 Internal

Committers: 2

v8.0.1 (2026-06-17)

💥 Breaking Change

Committers: 2

v8.0.0 (2026-06-16)

👓 Spec Compliance

💥 Breaking Change

🐛 Bug Fix

v8.0.2 (2026-06-18)

🐛 Bug Fix

🏠 Internal

v8.0.1 (2026-06-17)

dependabot Bot commented on behalf of github Aug 20, 2026 •

edited

Loading