Skip to content

Update @babel/helper-function-name package to use latest version of lodash #10554

@anushreemjoshi

Description

@anushreemjoshi

Bug Report

Current Behavior
Currently @babel/helper-function-name package requires following packages:

    "@babel/helper-get-function-arity": "^7.0.0",
    "@babel/template": "^7.1.0",
    "@babel/types": "^7.0.0"

In these packages, @babel/types is not updated to latest version which in turn is dependent on lodash. lodash version less than 4.17.12 has security vulnerability for Prototype Pollution.

Input Code

  • REPL or Repo link if applicable:
var your => (code) => here;

Expected behavior/code
All the references of @babel/types in this package and its required packages must be latest version which required latest version of lodash ( > 4.17.12)

Babel Configuration (.babelrc, package.json, cli command)

{
  "your": { "config": "here" }
}

Environment

  • Babel version(s): [e.g. v6.0.0, v7.0.0-beta.34]
  • Node/npm version: [e.g. Node 8/npm 5]
  • OS: [e.g. OSX 10.13.4, Windows 10]
  • Monorepo: [e.g. yes/no/Lerna]
  • How you are using Babel: [e.g. cli, register, loader]

Possible Solution
Update required @babel/types to latest version. Also update its references in following packages:

babel/helper-function-name
@babel/helper-get-function-arity
@babel/template": "^7.1.0

Additional context/Screenshots
Add any other context about the problem here. If applicable, add screenshots to help explain.

Metadata

Metadata

Assignees

No one assigned

    Labels

    i: needs triageoutdatedA closed issue/PR that is archived due to age. Recommended to make a new issue

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions