-
-
Notifications
You must be signed in to change notification settings - Fork 5.8k
Description
Bug Report
Current Behavior
Currently @babel/helper-function-name package requires following packages:
"@babel/helper-get-function-arity": "^7.0.0",
"@babel/template": "^7.1.0",
"@babel/types": "^7.0.0"
In these packages, @babel/types is not updated to latest version which in turn is dependent on lodash. lodash version less than 4.17.12 has security vulnerability for Prototype Pollution.
Input Code
- REPL or Repo link if applicable:
var your => (code) => here;Expected behavior/code
All the references of @babel/types in this package and its required packages must be latest version which required latest version of lodash ( > 4.17.12)
Babel Configuration (.babelrc, package.json, cli command)
{
"your": { "config": "here" }
}Environment
- Babel version(s): [e.g. v6.0.0, v7.0.0-beta.34]
- Node/npm version: [e.g. Node 8/npm 5]
- OS: [e.g. OSX 10.13.4, Windows 10]
- Monorepo: [e.g. yes/no/Lerna]
- How you are using Babel: [e.g.
cli,register,loader]
Possible Solution
Update required @babel/types to latest version. Also update its references in following packages:
babel/helper-function-name
@babel/helper-get-function-arity
@babel/template": "^7.1.0
Additional context/Screenshots
Add any other context about the problem here. If applicable, add screenshots to help explain.