[Snyk] Security upgrade babel-loader from 8.4.1 to 10.0.0

[Eric-Guo]

Snyk has created this PR to fix 1 vulnerabilities in the yarn dependencies of this project.

Snyk changed the following file(s):

• package.json

Note for zero-installs users

If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the .yarn/cache/ directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to run yarn to update the contents of the ./yarn/cache directory.
If you are not using zero-install you can ignore this as your flow should likely be unchanged.

⚠️ Warning

Failed to update the yarn.lock, please update manually before merging.

Vulnerabilities that will be fixed with an upgrade:

	Issue
	Regular Expression Denial of Service (ReDoS) SNYK-JS-AJV-15274295

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9529db6584

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Regenerate pnpm lockfile for babel-loader upgrade

This version bump is incomplete because pnpm-lock.yaml still resolves babel-loader to 8.4.1 (pnpm-lock.yaml:60-62), so the intended security fix is not actually captured in the lock state. In the CI workflow, dependencies are installed with pnpm install --frozen-lockfile (.github/workflows/rubyonrails.yml:54), which requires the lockfile to match package.json; as committed, this can block installs and leaves the vulnerable dependency pinned until the lockfile is regenerated and committed.

Useful? React with 👍 / 👎.

[Copilot]

Pull request overview

This PR is an automated security upgrade generated by Snyk to address a high-severity Regular Expression Denial of Service (ReDoS) vulnerability in the ajv dependency (SNYK-JS-AJV-15274295) by upgrading babel-loader from version 8.4.1 to 10.0.0.

Changes:

• Updated babel-loader dependency version from ^8.4.1 to ^10.0.0 in package.json

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The package.json has been updated but the pnpm-lock.yaml file has not been updated to reflect this change. The lock file still references babel-loader@8.4.1 (visible in line 945 and as a dependency of shakapacker on line 5195 of pnpm-lock.yaml). Without updating the lock file by running 'pnpm install', the actual installed version will not match the package.json specification. The PR description mentions "Failed to update the yarn.lock", but this project uses pnpm (as specified by packageManager: "pnpm@10.29.3"), so pnpm-lock.yaml needs to be updated instead.

Suggested change

	"babel-loader": "^10.0.0",
	"babel-loader": "^8.4.1",

[Copilot]

The PR description mentions updating yarn.lock, but this project uses pnpm as its package manager (indicated by "packageManager": "pnpm@10.29.3" in package.json). The warning about "Failed to update the yarn.lock" is misleading since this project doesn't use yarn. The actual lock file that needs updating is pnpm-lock.yaml, not yarn.lock. This suggests the automated Snyk PR may have been configured for the wrong package manager.