Bump the npm-dependencies-security group across 6 directories with 15 updates

[dependabot]

Bumps the npm-dependencies-security group with 8 updates in the /@plotly/dash-generator-test-component-nested directory:

Package	From	To
@babel/core	7.19.6	7.29.7
@babel/plugin-transform-modules-systemjs	7.19.6	7.29.8
brace-expansion	1.1.11	1.1.21
browserslist	4.24.4	4.29.3
minimatch	3.1.2	3.1.5
picomatch	2.3.1	2.3.2
serialize-javascript	6.0.2	removed
shell-quote	1.7.3	1.12.0
@babel/core	7.19.6	7.29.7
@babel/plugin-transform-modules-systemjs	7.19.6	7.29.8
brace-expansion	1.1.11	1.1.21
browserslist	4.24.4	4.29.3
minimatch	3.1.2	3.1.5
picomatch	2.3.1	2.3.2
shell-quote	1.7.3	1.12.0
@babel/core	7.19.6	7.29.7
@babel/plugin-transform-modules-systemjs	7.19.6	7.29.8
brace-expansion	1.1.11	1.1.21
browserslist	4.24.4	4.29.3
minimatch	3.1.2	3.1.5
picomatch	2.3.1	2.3.2
shell-quote	1.7.3	1.12.0
brace-expansion	1.1.11	1.1.21
minimatch	3.1.2	3.1.5
@babel/core	7.19.6	7.29.7
@babel/plugin-transform-modules-systemjs	7.19.6	7.29.8
brace-expansion	1.1.11	1.1.21
browserslist	4.24.4	4.29.3
minimatch	3.1.2	3.1.5
picomatch	2.3.1	2.3.2
shell-quote	1.7.3	1.12.0
brace-expansion	1.1.11	1.1.21
minimatch	3.1.2	3.1.5

Bumps the npm-dependencies-security group with 8 updates in the /@plotly/dash-generator-test-component-standard directory:

Package	From	To
@babel/core	7.19.6	7.29.7
@babel/plugin-transform-modules-systemjs	7.19.6	7.29.8
brace-expansion	1.1.11	1.1.21
browserslist	4.24.4	4.29.3
minimatch	3.1.2	3.1.5
picomatch	2.3.1	2.3.2
serialize-javascript	6.0.2	removed
shell-quote	1.7.3	1.12.0
@babel/core	7.19.6	7.29.7
@babel/plugin-transform-modules-systemjs	7.19.6	7.29.8
brace-expansion	1.1.11	1.1.21
browserslist	4.24.4	4.29.3
minimatch	3.1.2	3.1.5
picomatch	2.3.1	2.3.2
shell-quote	1.7.3	1.12.0
@babel/core	7.19.6	7.29.7
@babel/plugin-transform-modules-systemjs	7.19.6	7.29.8
brace-expansion	1.1.11	1.1.21
browserslist	4.24.4	4.29.3
minimatch	3.1.2	3.1.5
picomatch	2.3.1	2.3.2
shell-quote	1.7.3	1.12.0
brace-expansion	1.1.11	1.1.21
minimatch	3.1.2	3.1.5
@babel/core	7.19.6	7.29.7
@babel/plugin-transform-modules-systemjs	7.19.6	7.29.8
brace-expansion	1.1.11	1.1.21
browserslist	4.24.4	4.29.3
minimatch	3.1.2	3.1.5
picomatch	2.3.1	2.3.2
shell-quote	1.7.3	1.12.0
brace-expansion	1.1.11	1.1.21
minimatch	3.1.2	3.1.5

Bumps the npm-dependencies-security group with 10 updates in the /@plotly/dash-generator-test-component-typescript directory:

Package	From	To
@babel/core	7.18.6	7.29.7
@babel/plugin-transform-modules-systemjs	7.19.6	7.29.8
brace-expansion	1.1.11	1.1.21
browserslist	4.28.1	4.29.3
minimatch	3.1.2	3.1.5
picomatch	2.3.1	2.3.2
serialize-javascript	6.0.2	removed
shell-quote	1.7.3	1.12.0
@babel/core	7.18.6	7.29.7
@babel/plugin-transform-modules-systemjs	7.19.6	7.29.8
brace-expansion	1.1.11	1.1.21
browserslist	4.28.1	4.29.3
minimatch	3.1.2	3.1.5
picomatch	2.3.1	2.3.2
shell-quote	1.7.3	1.12.0
@babel/core	7.18.6	7.29.7
@babel/plugin-transform-modules-systemjs	7.19.6	7.29.8
baseline-browser-mapping	2.9.19	2.11.27
brace-expansion	1.1.11	1.1.21
browserslist	4.28.1	4.29.3
js-yaml	3.14.2	3.15.2
minimatch	3.1.2	3.1.5
picomatch	2.3.1	2.3.2
shell-quote	1.7.3	1.12.0
brace-expansion	1.1.11	1.1.21
minimatch	3.1.2	3.1.5
@babel/core	7.18.6	7.29.7
@babel/plugin-transform-modules-systemjs	7.19.6	7.29.8
brace-expansion	1.1.11	1.1.21
browserslist	4.28.1	4.29.3
minimatch	3.1.2	3.1.5
picomatch	2.3.1	2.3.2
shell-quote	1.7.3	1.12.0
brace-expansion	1.1.11	1.1.21
js-yaml	3.14.2	3.15.2
minimatch	3.1.2	3.1.5

Bumps the npm-dependencies-security group with 6 updates in the /@plotly/dash-jupyterlab directory:

Package	From	To
brace-expansion	1.1.11	1.1.21
minimatch	3.0.4	3.1.5
brace-expansion	1.1.11	1.1.21
minimatch	3.0.4	3.1.5
brace-expansion	1.1.11	1.1.21
minimatch	3.0.4	3.1.5
brace-expansion	1.1.11	1.1.21
lodash	4.17.23	4.18.1
minimatch	3.0.4	3.1.5
nanoid	3.3.7	3.3.20
postcss	8.4.47	8.5.29
ws	8.18.0	8.22.0
brace-expansion	1.1.11	1.1.21
minimatch	3.0.4	3.1.5
brace-expansion	1.1.11	1.1.21
minimatch	3.0.4	3.1.5

Bumps the npm-dependencies-security group with 8 updates in the /@plotly/dash-test-components directory:

Package	From	To
@babel/core	7.19.6	7.29.7
@babel/plugin-transform-modules-systemjs	7.19.6	7.29.8
brace-expansion	1.1.11	1.1.21
browserslist	4.24.4	4.29.3
minimatch	3.1.2	3.1.5
picomatch	2.3.1	2.3.2
serialize-javascript	6.0.2	removed
shell-quote	1.7.3	1.12.0
@babel/core	7.19.6	7.29.7
@babel/plugin-transform-modules-systemjs	7.19.6	7.29.8
brace-expansion	1.1.11	1.1.21
browserslist	4.24.4	4.29.3
minimatch	3.1.2	3.1.5
picomatch	2.3.1	2.3.2
shell-quote	1.7.3	1.12.0
@babel/core	7.19.6	7.29.7
@babel/plugin-transform-modules-systemjs	7.19.6	7.29.8
brace-expansion	1.1.11	1.1.21
browserslist	4.24.4	4.29.3
minimatch	3.1.2	3.1.5
picomatch	2.3.1	2.3.2
shell-quote	1.7.3	1.12.0
brace-expansion	1.1.11	1.1.21
minimatch	3.1.2	3.1.5
@babel/core	7.19.6	7.29.7
@babel/plugin-transform-modules-systemjs	7.19.6	7.29.8
brace-expansion	1.1.11	1.1.21
browserslist	4.24.4	4.29.3
minimatch	3.1.2	3.1.5
picomatch	2.3.1	2.3.2
shell-quote	1.7.3	1.12.0
brace-expansion	1.1.11	1.1.21
minimatch	3.1.2	3.1.5

Bumps the npm-dependencies-security group with 4 updates in the /@plotly/eslint-config-dash directory: brace-expansion, minimatch, js-yaml and flatted.

Updates @babel/core from 7.19.6 to 7.29.7

Release notes

Sourced from @​babel/core's releases.

v7.29.7 (2026-05-25)

Re-release all packages with npm provenance attestations

v7.29.6 (2026-05-25)

🐛 Bug Fix

• babel-generator
  • #18014 Catchup source map position in preserveFormat (@​nicolo-ribaudo)
• babel-core
  • #18001 [7.x packport]Improve input source map handling (@​JLHwung)
• babel-core, babel-generator
  • #17998 Preserve original identifier names from input sourcemaps (#17992) (@​Andarist)

Committers: 3

• Huáng Jùnliàng (@​JLHwung)
• Mateusz Burzyński (@​Andarist)
• Nicolò Ribaudo (@​nicolo-ribaudo)

v7.29.5 (2026-05-05)

🏠 Internal

• babel-preset-env
  • Update @babel/* dependencies

v7.29.4 (2026-05-05)

🐛 Bug Fix

• babel-plugin-transform-modules-systemjs
  • #17974 [7.x backport]fix(systemjs): improve module string name support (@​JLHwung)

Committers: 1

• Huáng Jùnliàng (@​JLHwung)

v7.29.3 (2026-04-30)

👓 Spec Compliance

• babel-parser
  • #17923 Support flow extends bound (@​JLHwung)

🐛 Bug Fix

• babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
  • #17931 fix(decorators): replace super within all removed static elements (@​JLHwung)
• babel-register
  • #17915 Fix thread synchronization issues in @babel/register (@​liuxingbaoyu)
• babel-compat-data, babel-plugin-bugfix-safari-rest-destructuring-rhs-array, babel-preset-env
  • #17788 Add bugfix plugin for Safari array rest destructuring bug (@​JLHwung)

💅 Polish

• babel-parser

... (truncated)

Commits

• 4fba754 v7.29.7
• 04ea6b2 v7.29.6
• 99f498a [7.x packport]Improve input source map handling (#18001)
• feba0a3 Preserve original identifier names from input sourcemaps (#17992) (#17998)
• aa8394e v7.29.0
• ad0d03f [7.x backport] feat: Allow specifying startLine in code frame (#17739)
• d7f4008 v7.28.6
• e130225 Polish(standalone): improve message on invalid preset/plugin (#17606)
• 99dcba5 chore: enable some ts-eslint rules (#17592)
• c92c491 Improve Unicode handling in code-frame tokenizer (#17589)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​babel/core since your current version.

Updates @babel/plugin-transform-modules-systemjs from 7.19.6 to 7.29.8

Release notes

Sourced from @​babel/plugin-transform-modules-systemjs's releases.

v7.29.8 (2026-07-31)

👓 Spec Compliance

• babel-generator, babel-parser, babel-plugin-transform-spread, babel-traverse, babel-types
  • #17871 Disallow super call after new (@​JLHwung)

🐛 Bug Fix

• babel-generator
  • #18046 fix(generator): improve new callee parens check (@​JLHwung)
• babel-node, babel-plugin-transform-modules-systemjs
  • #18044 fix(systemjs): support __proto__ as an export name (@​JLHwung)

Committers: 2

• Huáng Jùnliàng (@​JLHwung)
• Nicolò Ribaudo (@​nicolo-ribaudo)

v7.29.7 (2026-05-25)

Re-release all packages with npm provenance attestations

v7.29.6 (2026-05-25)

🐛 Bug Fix

• babel-generator
  • #18014 Catchup source map position in preserveFormat (@​nicolo-ribaudo)
• babel-core
  • #18001 [7.x packport]Improve input source map handling (@​JLHwung)
• babel-core, babel-generator
  • #17998 Preserve original identifier names from input sourcemaps (#17992) (@​Andarist)

Committers: 3

• Huáng Jùnliàng (@​JLHwung)
• Mateusz Burzyński (@​Andarist)
• Nicolò Ribaudo (@​nicolo-ribaudo)

v7.29.5 (2026-05-05)

🏠 Internal

• babel-preset-env
  • Update @babel/* dependencies

v7.29.4 (2026-05-05)

🐛 Bug Fix

• babel-plugin-transform-modules-systemjs
  • #17974 [7.x backport]fix(systemjs): improve module string name support (@​JLHwung)

Committers: 1

• Huáng Jùnliàng (@​JLHwung)

... (truncated)

Commits

• 5de11ca v7.29.8
• f08d434 fix(systemjs): support proto as an export name (#18044)
• 4fba754 v7.29.7
• a458f66 v7.29.4
• 32ebd5a [7.x backport]fix(systemjs): improve module string name support (#17974)
• aa8394e v7.29.0
• 0053db6 Update polyfill packages (#17727)
• 61647ae v7.28.5
• a177d55 [Babel 8] Use t.traverseFast to replace some path.traverse (#17518)
• eebd3a0 v7.27.1
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​babel/plugin-transform-modules-systemjs since your current version.

Updates brace-expansion from 1.1.11 to 1.1.21

Release notes

Sourced from brace-expansion's releases.

v1.1.15

• Backport v5.0.6 change to v1 (#111) 0b09384

---

juliangruber/brace-expansion@v1.1.14...v1.1.15

v1.1.12

• pkg: publish on tag 1.x c460dbd
• fmt ccb8ac6
• Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8

---

juliangruber/brace-expansion@v1.1.11...v1.1.12

Commits

• 8e81e18 1.1.21
• ffdfa3e Merge commit from fork
• c6513ad 1.1.20
• 1efee7c Merge commit from fork
• a34340a 1.1.19
• 0bcbfc0 Merge commit from fork
• 758fcd6 1.1.18
• 27fbeed Merge commit from fork
• 5c57cc2 1.1.17
• d757f1d npm ignore .claude
• Additional commits viewable in compare view

Updates browserslist from 4.24.4 to 4.29.3

Release notes

Sourced from browserslist's releases.

4.29.3

• Updated Firefox ESR.

4.29.2

• Fixed ignoring null usage in cover X in Y query (by @​wahidrizka).

4.29.1

• Fixed config name loading protection on Windows (by @​oss-security-shop).
• Fixed case-insensitive negation queries (by @​jakezwang).
• Fixed percentage and supports queries case-insensitive (by @​wahidrizka).
• Fixed old Node.js tests (by @​aaron-belenky).
• Reduced code (by @​charmander).

4.29.0

• Added query continuations across lines and array entries (by @​fzlzjerry).

4.28.9

• Improve or parsing performance (by @​NotAFlightRisk).

4.28.8

• Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

• Improved parsing performance.
• Fixed unbounded memory growth (by @​alanturing881).
• Fixed prototype write issue (by @​alanturing881).

4.28.6

• Fixed Electron version queries (by @​spokodev).

4.28.5

• Fixed > and >= queries (by @​spokodev).

4.28.4

• Fixed SyntaxError regression of 4.28.3.

4.28.3

• Fixed baseline query case-insensitivity (by @​swwind).

4.28.2

• Fix prototype pollution (by @​chluo1997).

4.28.1

• Removed Baseline warning since we have it own warning.

4.27.0

• Added BROWSERSLIST_TRACE_WARNING environment variable.

4.26.3

• Fixed throwOnMissing with extends query (by @​alexander-akait).

... (truncated)

Changelog

Sourced from browserslist's changelog.

4.29.3

• Updated Firefox ESR.

4.29.2

• Fixed ignoring null usage in cover X in Y query (by @​wahidrizka).

4.29.1

• Fixed config name loading protection on Windows (by @​oss-security-shop).
• Fixed case-insensitive negation queries (by @​jakezwang).
• Fixed percentage and supports queries case-insensitive (by @​wahidrizka).
• Fixed old Node.js tests (by @​aaron-belenky).
• Reduced code (by @​charmander).

4.29.0

• Added query continuations across lines and array entries (by @​fzlzjerry).

4.28.9

• Improved or parsing performance (by @​NotAFlightRisk).

4.28.8

• Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

• Improved parsing performance.
• Fixed unbounded memory growth (by @​alanturing881).
• Fixed prototype write issue (by @​alanturing881).

4.28.6

• Fixed Electron version queries (by @​spokodev).

4.28.5

• Fixed > and >= queries (by @​spokodev).

4.28.4

• Fixed SyntaxError regression of 4.28.3.

4.28.3

• Fixed baseline query case-insensitivity (by @​swwind).

... (truncated)

Commits

• b4809dd Release 4.29.3 version
• 9d844f8 Update Firefox ESR
• 0033f34 Update dependencies
• 906d329 Release 4.29.2 version
• ff8c83f Update dependencies
• 067f4a1 Merge pull request #952 from wahidrizka/fix-cover-null-usage
• f760921 Do not add versions without usage data to cover queries
• 5be63f5 Merge pull request #953 from wahidrizka/docs-android-latest-version
• 1e5356f Note that Android version queries return only the latest version
• 5b7e941 Add missed changes to ChangeLog
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for browserslist since your current version.

Updates minimatch from 3.1.2 to 3.1.5

Commits

• 7bba978 3.1.5
• bd25942 docs: add warning about ReDoS
• 1a9c27c fix partial matching of globstar patterns
• 1a2e084 3.1.4
• ae24656 update lockfile
• b100374 limit recursion for **, improve perf considerably
• 26ffeaa lockfile update
• 9eca892 lock node version to 14
• 00c323b 3.1.3
• 30486b2 update CI matrix and actions
• Additional commits viewable in compare view

Updates picomatch from 2.3.1 to 2.3.2

Release notes

Sourced from picomatch's releases.

2.3.2

This is a security release fixing several security relevant issues.

What's Changed

• fix: exception when glob pattern contains constructor by @​Jason3S in micromatch/picomatch#144
• Fix for CVE-2026-33671
• Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@2.3.1...2.3.2

Changelog

Sourced from picomatch's changelog.

2.3.2 (2026-03-23)

Fixed

• Avoided an exception when a glob pattern contains constructor (#144, 3f4f10e).

Security

• Backported the extglob-quantifier ReDoS fix from 4.0.4. Risky repeated extglobs are now safely rewritten or treated as literals by default; positive numeric maxExtglobRecursion values allow limited nesting, while false disables the safeguard (CVE-2026-33671, eec17ae).
• Prevented inherited object properties from being interpreted as POSIX character classes (CVE-2026-33672, fc1f6b6).

Commits

• 81cba8d Publish 2.3.2
• fc1f6b6 Merge commit from fork
• eec17ae Merge commit from fork
• 78f8ca4 Merge pull request #156 from micromatch/backport-144
• 3f4f10e Merge pull request #144 from Jason3S/jdent-object-properties
• See full diff in compare view

Removes serialize-javascript

Updates shell-quote from 1.7.3 to 1.12.0

Changelog

Sourced from shell-quote's changelog.

v1.12.0 - 2026-10-02

Fixed

• [New] parse: support here-documents (<<) [#31](https://github.com/ljharb/shell-quote/issues/31)

Commits

• [New] parse: support tab-stripping here-documents (<<-) dbfac37
• [New] parse: support output process substitution (>() 2053315
• [New] parse: support the case test-next terminator (;;&) 7d688b9
• [New] parse: support the case fall-through terminator (;&) f27010e
• [New] parse: support redirecting output despite noclobber (>|) b78d19c
• [New] parse: support opening a file for reading and writing (<>) 21cc333
• [New] parse: support redirecting stdout and stderr (&>) 6ad6cd2
• [New] parse: support appending stdout and stderr (&>>) 90cde9c
• [Dev Deps] update @ljharb/eslint-config 3a7b4ae

v1.11.0 - 2026-09-29

Fixed

• [Refactor] quote: drop a replace that can never match in the single-quote branch [#15](https://github.com/ljharb/shell-quote/issues/15)
• [New] parse: support bash ANSI-C quoting ($'...') [#32](https://github.com/ljharb/shell-quote/issues/32)

Commits

• [Fix] quote: reject line terminators in tokens after a comment 6002b2e
• [Fix] parse: preserve text after special shell parameters 81b08a5
• [Fix] parse: an escaped backslash does not escape the character after it d708019
• [Fix] quote: preserve ! in arguments that also contain ' ad39927
• [Fix] parse: treat $_name as a variable name, not $_ followed by text 28f88cd
• [Fix] quote: preserve empty glob patterns 35c9b97
• [Fix] quote: escape ~ in glob patterns to prevent shell tilde-expansion 239d49c
• [Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, evalmd b1e406e
• [meta] npmignore some files ebfc308
• [actions] add permissions 3429b0d
• [actions] set least-privilege cache-mode 36f2394
• [Dev Deps] update eslint 6de9a41

v1.10.0 - 2026-07-10

Merged

• [New] parse: add opt-in splitUnquoted option for shell field-splitting of unquoted expansions [#1](https://github.com/ljharb/shell-quote/issues/1)

Commits

• [Fix] parse: match nested ${...} braces so nested parameter expansion is consumed as one substitution c0842c8
• [Tests] parse: pin single-quote literalness and unmatched-quote handling a0d03e3

... (truncated)

Commits

• 6ecb8aa v1.12.0
• 3a7b4ae [Dev Deps] update @ljharb/eslint-config
• 7d688b9 [New] parse: support the case test-next terminator (;;&)
• f27010e [New] parse: support the case fall-through terminator (;&)
• 90cde9c [New] parse: support appending stdout and stderr (&>>)
• 6ad6cd2 [New] parse: support redirecting stdout and stderr (&>)
• 2053315 [New] parse: support output process substitution (>()
• b78d19c [New] parse: support redirecting output despite noclobber (>|)
• 21cc333 [New] parse: support opening a file for reading and writing (\<>)
• dbfac37 [New] parse: support tab-stripping here-documents (<<-)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ljharb, a new releaser for shell-quote since your current version.

Install script changes

This version adds prepublish script that runs during installation. Review the package contents before updating.

Updates @babel/core from 7.19.6 to 7.29.7

Release notes

Sourced from @​babel/core's releases.

v7.29.7 (2026-05-25)

Re-release all packages with npm provenance attestations

v7.29.6 (2026-05-25)

🐛 Bug Fix

• babel-generator
  • #18014 Catchup source map position in preserveFormat (@​nicolo-ribaudo)
• babel-core
  • #18001 [7.x packport]Improve input source map handling (@​JLHwung)
• babel-core, babel-generator
  • #17998 Preserve original identifier names from input sourcemaps (#17992) (@​Andarist)

Committers: 3

• Huáng Jùnliàng (@​JLHwung)
• Mateusz Burzyński (@​Andarist)
• Nicolò Ribaudo (@​nicolo-ribaudo)

v7.29.5 (2026-05-05)

🏠 Internal

• babel-preset-env
  • Update @babel/* dependencies

v7.29.4 (2026-05-05)

🐛 Bug Fix

• babel-plugin-transform-modules-systemjs
  • #17974 [7.x backport]fix(systemjs): improve module string name support (@​JLHwung)

Committers: 1

• Huáng Jùnliàng (@​JLHwung)

v7.29.3 (2026-04-30)

👓 Spec Compliance

• babel-parser
  • #17923 Support flow extends bound (@​JLHwung)

🐛 Bug Fix

• babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
  • #17931 fix(decorators): replace super within all removed static elements (@​JLHwung)
• babel-register
  • #17915 Fix thread synchronization issues in @babel/register (@​liuxingbaoyu)
• babel-compat-data, babel-plugin-bugfix-safari-rest-destructuring-rhs-array, babel-preset-env
  • #17788 Add bugfix plugin for Safari array rest destructuring bug (@​JLHwung)

💅 Polish

• babel-parser

... (truncated)

Commits

• 4fba754 v7.29.7
• 04ea6b2 v7.29.6
• 99f498a [7.x packport]Improve input source map handling (#18001)
• feba0a3 Preserve original identifier names from input sourcemaps (#17992) (#17998)
• aa8394e v7.29.0
• ad0d03f [7.x backport] feat: Allow specifying startLine in code frame (#17739)
• d7f4008 v7.28.6
• e130225 Polish(standalone): improve message on invalid preset/plugin (#17606)
• 99dcba5 chore: enable some ts-eslint rules (#17592)
• c92c491 Improve Unicode handling in code-frame tokenizer (#17589)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​babel/core since your current version.

Updates @babel/plugin-transform-modules-systemjs from 7.19.6 to 7.29.8

Release notes

Sourced from @​babel/plugin-transform-modules-systemjs's releases.

v7.29.8 (2026-07-31)

👓 Spec Compliance

• babel-generator, babel-parser, babel-plugin-transform-spread, babel-traverse, babel-types
  • #17871 Disallow super call after new (@​JLHwung)

🐛 Bug Fix

• babel-generator
  • #18046 fix(generator): improve new callee parens check (@​JLHwung)
• babel-node, babel-plugin-transform-modules-systemjs
  • #18044 fix(systemjs): support __proto__ as an export name (@​JLHwung)

Committers: 2

• Huáng Jùnliàng (@​JLHwung)
• Nicolò Ribaudo (@​nicolo-ribaudo)

v7.29.7 (2026-05-25)

Re-release all packages with npm provenance attestations

v7.29.6 (2026-05-25)

🐛 Bug Fix

• babel-generator
  • #18014 Catchup source map position in preserveFormat (@​nicolo-ribaudo)
• babel-core
  • #18001 [7.x packport]Improve input source map handling (@​JLHwung)
• babel-core, babel-generator
  • #17998 Preserve original identifier names from input sourcemaps (#17992) (@​Andarist)

Committers: 3

• Huáng Jùnliàng (@​JLHwung)
• Mateusz Burzyński (@​Andarist)
• Nicolò Ribaudo (@​nicolo-ribaudo)

v7.29.5 (2026-05-05)

🏠 Internal

• babel-preset-env
  • Update @babel/* dependencies

v7.29.4 (2026-05-05)

🐛 Bug Fix

• babel-plugin-transform-modules-systemjs
  • #17974 [7.x backport]fix(systemjs): improve module string name support (@​JLHwung)

Committers: 1

• Huáng Jùnliàng (@​JLHwung)

... (truncated)

Commits

• 5de11ca v7.29.8
• f08d434 fix(systemjs): support proto as an export name (#18044)
• 4fba754 v7.29.7
• a458f66 v7.29.4
• 32ebd5a [7.x backport]fix(systemjs): improve module string name support (#17974)
• aa8394e v7.29.0
• 0053db6 Update polyfill packages (#17727)
• 61647ae v7.28.5
• a177d55 [Babel 8] Use t.traverseFast to replace some path.traverse (#17518)
• eebd3a0 v7.27.1
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​babel/plugin-transform-modules-systemjs since your current version.

Updates brace-expansion from 1.1.11 to 1.1.21

Release notes

Sourced from b...

Description has been truncated

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Dash performance benchmarks

❌ perf regression

	scenario	metric	p90 (ms)	median	growth	baseline p90	note
❌	full_children_replace	replace_ms	10563.5	2235.2	34.2x	4697.1	p90 10563.5ms > warn 6000ms; 2.1x baseline (norm)
✅	callback_chain	chain_ms	543.8	505.0	0.9x	499.1
✅	callback_chain	graph_ms	2.5	2.5	1.0x	2.4
✅	callback_fanout	fanout_ms	91.5	87.5	0.93x	92.5
✅	deep_nesting	render_ms	69.4	66.8	1.3x	56.8
✅	initial_render_large	render_ms	689.0	676.0	1.0x	694.4
✅	initial_render_small	render_ms	104.2	101.6	1.13x	104.0
✅	patch_append_nested	append_ms	168.5	119.4	2.46x	192.3
✅	patch_append_toplevel	append_ms	165.3	117.8	2.32x	140.2
✅	patch_scalar_update_large	update_ms	177.7	162.9	0.94x	202.9
✅	wildcard_all_resolve	wildcard_ms	309.9	304.8	0.98x	313.6
✅	wildcard_all_resolve	graph_ms	1.5	1.5	1.0x	1.3

growth = late-third / early-third per-op time; ~1 is flat, a large value means the per-op cost scales with accumulated state.

machine scale vs baseline: 1.06x - divided out of the baseline ratios so they compare like for like (the absolute warn/fail ceilings are left un-scaled); calibrated on initial_render_small.