Bump the minor-and-patch group across 3 directories with 68 updates

[dependabot]

Bumps the minor-and-patch group with 68 updates in the / directory:

Package	From	To
@babel/core	7.25.8	7.29.0
@babel/eslint-parser	7.25.8	7.28.6
@babel/plugin-proposal-optional-chaining	7.18.9	7.21.0
@babel/preset-env	7.25.8	7.29.0
@babel/preset-react	7.26.3	7.28.5
@babel/preset-typescript	7.25.7	7.28.5
@testing-library/dom	10.4.0	10.4.1
@testing-library/jest-dom	6.6.3	6.9.1
@typescript-eslint/eslint-plugin	8.20.0	8.56.0
@typescript-eslint/parser	8.20.0	8.56.0
@vercel/ncc	0.38.3	0.38.4
eslint-config-prettier	10.0.1	10.1.8
eslint-plugin-import	2.31.0	2.32.0
eslint-plugin-prettier	5.2.3	5.5.5
eslint-plugin-react	7.37.4	7.37.5
eslint-webpack-plugin	5.0.0	5.0.2
got	14.4.5	14.6.6
jest-localstorage-mock	2.4.3	2.4.26
prettier	3.5.1	3.8.1
pretty-quick	4.0.0	4.2.2
ts-loader	9.5.1	9.5.4
typescript	5.7.3	5.9.3
webpack	5.97.1	5.105.2
webpack-dev-server	5.2.1	5.2.3
@lavamoat/allow-scripts	3.3.1	3.4.3
@lavamoat/preinstall-always-fail	2.1.0	2.1.1
jest-fixed-jsdom	0.0.9	0.0.11
@blockaid/client	0.31.0	0.65.0
bignumber.js	9.3.0	9.3.1
@docusaurus/core	3.6.3	3.9.2
@docusaurus/preset-classic	3.6.3	3.9.2
react	19.0.3	19.2.4
@types/react	19.0.12	19.2.14
react-dom	19.0.3	19.2.4
@types/react-dom	19.0.3	19.2.3
react-is	19.0.3	19.2.4
styled-components	6.1.14	6.3.11
@ledgerhq/hw-app-str	7.2.0	7.4.0
@ledgerhq/hw-transport-webhid	6.30.6	6.31.0
@reduxjs/toolkit	2.5.0	2.11.2
@stellar/design-system	3.2.7	3.2.8
@tailwindcss/postcss	4.1.18	4.2.0
@testing-library/react	16.3.0	16.3.2
@types/chrome	0.0.287	0.1.37
@types/webextension-polyfill	0.12.0	0.12.5
concurrently	9.1.2	9.2.1
copy-webpack-plugin	13.0.0	13.0.1
css-loader	7.1.2	7.1.4
dotenv-webpack	8.1.0	8.1.1
formik	2.4.6	2.4.9
html-webpack-plugin	5.6.3	5.6.6
i18next	25.0.1	25.8.13
i18next-browser-languagedetector	8.0.5	8.2.1
lodash	4.17.21	4.17.23
@types/lodash	4.17.16	4.17.23
mini-css-extract-plugin	2.9.2	2.10.0
react-router-dom	7.5.1	7.13.0
sass	1.86.3	1.97.3
sass-loader	16.0.5	16.0.7
semver	7.7.1	7.7.4
@types/semver	7.5.8	7.7.1
ses	1.12.0	1.14.0
tailwindcss	4.1.18	4.2.0
yup	1.6.1	1.7.1
@playwright/test	1.49.0	1.58.2
postcss-loader	8.2.0	8.2.1
terser-webpack-plugin	5.3.14	5.3.16
url	0.11.1	0.11.4

Bumps the minor-and-patch group with 5 updates in the /@shared/api directory:

Package	From	To
prettier	3.5.3	3.8.1
typescript	5.8.3	5.9.3
@lavamoat/allow-scripts	3.3.2	3.4.3
@blockaid/client	0.31.0	0.65.0
bignumber.js	9.3.0	9.3.1

Bumps the minor-and-patch group with 39 updates in the /extension directory:

Package	From	To
prettier	3.5.3	3.8.1
pretty-quick	4.1.1	4.2.2
@lavamoat/allow-scripts	3.3.2	3.4.3
bignumber.js	9.3.0	9.3.1
react	19.0.3	19.2.4
@types/react	19.0.12	19.2.14
react-dom	19.0.3	19.2.4
@types/react-dom	19.1.2	19.2.3
@ledgerhq/hw-app-str	7.2.0	7.4.0
@ledgerhq/hw-transport-webhid	6.30.6	6.31.0
@reduxjs/toolkit	2.5.0	2.11.2
@stellar/design-system	3.2.7	3.2.8
@tailwindcss/postcss	4.1.18	4.2.0
@testing-library/react	16.3.0	16.3.2
@types/chrome	0.0.287	0.1.37
@types/webextension-polyfill	0.12.0	0.12.5
concurrently	9.1.2	9.2.1
copy-webpack-plugin	13.0.0	13.0.1
css-loader	7.1.2	7.1.4
dotenv-webpack	8.1.0	8.1.1
formik	2.4.6	2.4.9
html-webpack-plugin	5.6.3	5.6.6
i18next	25.0.1	25.8.13
i18next-browser-languagedetector	8.0.5	8.2.1
lodash	4.17.21	4.17.23
@types/lodash	4.17.16	4.17.23
mini-css-extract-plugin	2.9.2	2.10.0
react-router-dom	7.5.1	7.13.0
sass	1.86.3	1.97.3
sass-loader	16.0.5	16.0.7
semver	7.7.1	7.7.4
@types/semver	7.5.8	7.7.1
ses	1.12.0	1.14.0
tailwindcss	4.1.18	4.2.0
yup	1.6.1	1.7.1
@playwright/test	1.49.0	1.58.2
postcss-loader	8.2.0	8.2.1
terser-webpack-plugin	5.3.14	5.3.16
url	0.11.1	0.11.4

Updates @babel/core from 7.25.8 to 7.29.0

Release notes

Sourced from @​babel/core's releases.

v7.29.0 (2026-01-31)

Thanks @​simbahax for your first PR!

🚀 New Feature

• babel-types
  • #17750 [7.x backport] Add attributes import declaration builder (@​JLHwung)
• babel-standalone
  • #17663 [7.x backport] feat(standalone): export async transform (@​JLHwung)
  • #17725 [7.x backport] feat: read standalone targets from data-targets (@​JLHwung)

🐛 Bug Fix

• babel-parser
  • #17765 fix(parser): correctly parse type assertions in extends clause (@​nicolo-ribaudo)
  • #17723 [7.x backport] fix(parser): improve super type argument parsing (@​JLHwung)
• babel-traverse
  • #17708 fix(traverse): provide a hub when traversing a File or Program and no parentPath is given (@​simbahax)
• babel-plugin-transform-block-scoping, babel-traverse
  • #17737 [7.x backport] fix: Rename switch discriminant references when body creates shadowing variable (@​magic-akari)

🏃‍♀️ Performance

• babel-generator, babel-runtime-corejs3
  • #17642 [Babel 7] Improve generator performance (@​liuxingbaoyu)

Committers: 6

• David (@​simbahax)
• Huáng Jùnliàng (@​JLHwung)
• Nicolò Ribaudo (@​nicolo-ribaudo)
• @​liuxingbaoyu
• @​magic-akari

v7.28.6 (2026-01-12)

Thanks @​kadhirash and @​kolvian for your first PRs!

🐛 Bug Fix

• babel-cli, babel-code-frame, babel-core, babel-helper-check-duplicate-nodes, babel-helper-fixtures, babel-helper-plugin-utils, babel-node, babel-plugin-transform-flow-comments, babel-plugin-transform-modules-commonjs, babel-plugin-transform-property-mutators, babel-preset-env, babel-traverse, babel-types
  • #17589 Improve Unicode handling in code-frame tokenizer (@​JLHwung)
• babel-plugin-transform-regenerator
  • #17556 fix: transform-regenerator correctly handles scope (@​liuxingbaoyu)
• babel-plugin-transform-react-jsx
  • #17538 fix: Keep jsx comments (@​liuxingbaoyu)

💅 Polish

• babel-core, babel-standalone
  • #17606 Polish(standalone): improve message on invalid preset/plugin (@​JLHwung)

🏠 Internal

• babel-plugin-bugfix-v8-static-class-fields-redefine-readonly, babel-plugin-proposal-decorators, babel-plugin-proposal-import-attributes-to-assertions, babel-plugin-proposal-import-wasm-source, babel-plugin-syntax-async-do-expressions, babel-plugin-syntax-decorators, babel-plugin-syntax-destructuring-private, babel-plugin-syntax-do-expressions, babel-plugin-syntax-explicit-resource-management, babel-plugin-syntax-export-default-from, babel-plugin-syntax-flow, babel-plugin-syntax-function-bind, babel-plugin-syntax-function-sent, babel-plugin-syntax-import-assertions, babel-plugin-syntax-import-attributes, babel-plugin-syntax-import-defer, babel-plugin-syntax-import-source, babel-plugin-syntax-jsx, babel-plugin-syntax-module-blocks, babel-plugin-syntax-optional-chaining-assign, babel-plugin-syntax-partial-application, babel-plugin-syntax-pipeline-operator, babel-plugin-syntax-throw-expressions, babel-plugin-syntax-typescript, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-class-properties, babel-plugin-transform-class-static-block, babel-plugin-transform-dotall-regex, babel-plugin-transform-duplicate-named-capturing-groups-regex, babel-plugin-transform-explicit-resource-management, babel-plugin-transform-exponentiation-operator, babel-plugin-transform-json-strings, babel-plugin-transform-logical-assignment-operators, babel-plugin-transform-nullish-coalescing-operator, babel-plugin-transform-numeric-separator, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-catch-binding, babel-plugin-transform-optional-chaining, babel-plugin-transform-private-methods, babel-plugin-transform-private-property-in-object, babel-plugin-transform-regexp-modifiers, babel-plugin-transform-unicode-property-regex, babel-plugin-transform-unicode-sets-regex
  • #17580 Allow Babel 8 in compatible Babel 7 plugins (@​nicolo-ribaudo)

... (truncated)

Commits

• aa8394e v7.29.0
• ad0d03f [7.x backport] feat: Allow specifying startLine in code frame (#17739)
• d7f4008 v7.28.6
• e130225 Polish(standalone): improve message on invalid preset/plugin (#17606)
• 99dcba5 chore: enable some ts-eslint rules (#17592)
• c92c491 Improve Unicode handling in code-frame tokenizer (#17589)
• d725e39 Add BABEL_7_TO_8_DANGEROUSLY_DISABLE_VERSION_CHECK (#17569)
• c1b55f6 Use eslint.config.mts (#17573)
• 61647ae v7.28.5
• 42cb285 Improve @babel/core types (#17404)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​babel/core since your current version.

Updates @babel/eslint-parser from 7.25.8 to 7.28.6

Release notes

Sourced from @​babel/eslint-parser's releases.

v7.28.6 (2026-01-12)

Thanks @​kadhirash and @​kolvian for your first PRs!

🐛 Bug Fix

• babel-cli, babel-code-frame, babel-core, babel-helper-check-duplicate-nodes, babel-helper-fixtures, babel-helper-plugin-utils, babel-node, babel-plugin-transform-flow-comments, babel-plugin-transform-modules-commonjs, babel-plugin-transform-property-mutators, babel-preset-env, babel-traverse, babel-types
  • #17589 Improve Unicode handling in code-frame tokenizer (@​JLHwung)
• babel-plugin-transform-regenerator
  • #17556 fix: transform-regenerator correctly handles scope (@​liuxingbaoyu)
• babel-plugin-transform-react-jsx
  • #17538 fix: Keep jsx comments (@​liuxingbaoyu)

💅 Polish

• babel-core, babel-standalone
  • #17606 Polish(standalone): improve message on invalid preset/plugin (@​JLHwung)

🏠 Internal

• babel-plugin-bugfix-v8-static-class-fields-redefine-readonly, babel-plugin-proposal-decorators, babel-plugin-proposal-import-attributes-to-assertions, babel-plugin-proposal-import-wasm-source, babel-plugin-syntax-async-do-expressions, babel-plugin-syntax-decorators, babel-plugin-syntax-destructuring-private, babel-plugin-syntax-do-expressions, babel-plugin-syntax-explicit-resource-management, babel-plugin-syntax-export-default-from, babel-plugin-syntax-flow, babel-plugin-syntax-function-bind, babel-plugin-syntax-function-sent, babel-plugin-syntax-import-assertions, babel-plugin-syntax-import-attributes, babel-plugin-syntax-import-defer, babel-plugin-syntax-import-source, babel-plugin-syntax-jsx, babel-plugin-syntax-module-blocks, babel-plugin-syntax-optional-chaining-assign, babel-plugin-syntax-partial-application, babel-plugin-syntax-pipeline-operator, babel-plugin-syntax-throw-expressions, babel-plugin-syntax-typescript, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-class-properties, babel-plugin-transform-class-static-block, babel-plugin-transform-dotall-regex, babel-plugin-transform-duplicate-named-capturing-groups-regex, babel-plugin-transform-explicit-resource-management, babel-plugin-transform-exponentiation-operator, babel-plugin-transform-json-strings, babel-plugin-transform-logical-assignment-operators, babel-plugin-transform-nullish-coalescing-operator, babel-plugin-transform-numeric-separator, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-catch-binding, babel-plugin-transform-optional-chaining, babel-plugin-transform-private-methods, babel-plugin-transform-private-property-in-object, babel-plugin-transform-regexp-modifiers, babel-plugin-transform-unicode-property-regex, babel-plugin-transform-unicode-sets-regex
  • #17580 Allow Babel 8 in compatible Babel 7 plugins (@​nicolo-ribaudo)

🏃‍♀️ Performance

• babel-plugin-transform-react-jsx
  • #17555 perf: Use lighter traversal for jsx __source,__self (@​liuxingbaoyu)

Committers: 7

• Babel Bot (@​babel-bot)
• Eliot Pontarelli (@​kolvian)
• Huáng Jùnliàng (@​JLHwung)
• Kadhirash Sivakumar (@​kadhirash)
• Nicolò Ribaudo (@​nicolo-ribaudo)
• @​liuxingbaoyu
• coderaiser (@​coderaiser)

v7.28.5 (2025-10-23)

Thank you @​CO0Ki3, @​Olexandr88, and @​youthfulhps for your first PRs!

👓 Spec Compliance

• babel-parser
  • #17446 Allow Runtime Errors for Function Call Assignment Targets (@​liuxingbaoyu)
• babel-helper-validator-identifier
  • #17501 fix: update identifier to unicode 17 (@​fisker)

🐛 Bug Fix

• babel-plugin-proposal-destructuring-private
  • #17534 Allow mixing private destructuring and rest (@​CO0Ki3)
• babel-parser
  • #17521 Improve @babel/parser error typing (@​JLHwung)
  • #17491 fix: improve ts-only declaration parsing (@​JLHwung)
• babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring

... (truncated)

Commits

• d7f4008 v7.28.6
• beea88c [babel 8] Rename TSImportType.argument to .source (#17610)
• 61647ae v7.28.5
• 42cb285 Improve @babel/core types (#17404)
• e7031b7 [Babel 8] Treat allowSuperOutsideMethod as top-level only (#17505)
• 35055e3 v7.28.4
• f04083a [Babel 8] Align TSMappedType AST (#17479)
• 432a7ff fix(parser/typescript): parse import("./a", {with:{},}) (#17465)
• e77e3b0 move eslint-{parser,plugin} docs to the website (#17448)
• ccc5fae v7.28.0
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​babel/eslint-parser since your current version.

Updates @babel/plugin-proposal-optional-chaining from 7.18.9 to 7.21.0

Commits

• de7d75a v7.21.0
• 34136c5 docs: fix typos (#15432)
• d414940 v7.20.7
• 362451b chore: Enable eslint rule no-unnecessary-type-assertion (#15260)
• 67cb9f1 fix: Correctly generate (a ?? b) as T (#15258)
• d45d59a Improve comments generation (#14979)
• See full diff in compare view

Updates @babel/preset-env from 7.25.8 to 7.29.0

Release notes

Sourced from @​babel/preset-env's releases.

v7.29.0 (2026-01-31)

Thanks @​simbahax for your first PR!

🚀 New Feature

• babel-types
  • #17750 [7.x backport] Add attributes import declaration builder (@​JLHwung)
• babel-standalone
  • #17663 [7.x backport] feat(standalone): export async transform (@​JLHwung)
  • #17725 [7.x backport] feat: read standalone targets from data-targets (@​JLHwung)

🐛 Bug Fix

• babel-parser
  • #17765 fix(parser): correctly parse type assertions in extends clause (@​nicolo-ribaudo)
  • #17723 [7.x backport] fix(parser): improve super type argument parsing (@​JLHwung)
• babel-traverse
  • #17708 fix(traverse): provide a hub when traversing a File or Program and no parentPath is given (@​simbahax)
• babel-plugin-transform-block-scoping, babel-traverse
  • #17737 [7.x backport] fix: Rename switch discriminant references when body creates shadowing variable (@​magic-akari)

🏃‍♀️ Performance

• babel-generator, babel-runtime-corejs3
  • #17642 [Babel 7] Improve generator performance (@​liuxingbaoyu)

Committers: 6

• David (@​simbahax)
• Huáng Jùnliàng (@​JLHwung)
• Nicolò Ribaudo (@​nicolo-ribaudo)
• @​liuxingbaoyu
• @​magic-akari

v7.28.6 (2026-01-12)

Thanks @​kadhirash and @​kolvian for your first PRs!

🐛 Bug Fix

• babel-cli, babel-code-frame, babel-core, babel-helper-check-duplicate-nodes, babel-helper-fixtures, babel-helper-plugin-utils, babel-node, babel-plugin-transform-flow-comments, babel-plugin-transform-modules-commonjs, babel-plugin-transform-property-mutators, babel-preset-env, babel-traverse, babel-types
  • #17589 Improve Unicode handling in code-frame tokenizer (@​JLHwung)
• babel-plugin-transform-regenerator
  • #17556 fix: transform-regenerator correctly handles scope (@​liuxingbaoyu)
• babel-plugin-transform-react-jsx
  • #17538 fix: Keep jsx comments (@​liuxingbaoyu)

💅 Polish

• babel-core, babel-standalone
  • #17606 Polish(standalone): improve message on invalid preset/plugin (@​JLHwung)

🏠 Internal

• babel-plugin-bugfix-v8-static-class-fields-redefine-readonly, babel-plugin-proposal-decorators, babel-plugin-proposal-import-attributes-to-assertions, babel-plugin-proposal-import-wasm-source, babel-plugin-syntax-async-do-expressions, babel-plugin-syntax-decorators, babel-plugin-syntax-destructuring-private, babel-plugin-syntax-do-expressions, babel-plugin-syntax-explicit-resource-management, babel-plugin-syntax-export-default-from, babel-plugin-syntax-flow, babel-plugin-syntax-function-bind, babel-plugin-syntax-function-sent, babel-plugin-syntax-import-assertions, babel-plugin-syntax-import-attributes, babel-plugin-syntax-import-defer, babel-plugin-syntax-import-source, babel-plugin-syntax-jsx, babel-plugin-syntax-module-blocks, babel-plugin-syntax-optional-chaining-assign, babel-plugin-syntax-partial-application, babel-plugin-syntax-pipeline-operator, babel-plugin-syntax-throw-expressions, babel-plugin-syntax-typescript, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-class-properties, babel-plugin-transform-class-static-block, babel-plugin-transform-dotall-regex, babel-plugin-transform-duplicate-named-capturing-groups-regex, babel-plugin-transform-explicit-resource-management, babel-plugin-transform-exponentiation-operator, babel-plugin-transform-json-strings, babel-plugin-transform-logical-assignment-operators, babel-plugin-transform-nullish-coalescing-operator, babel-plugin-transform-numeric-separator, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-catch-binding, babel-plugin-transform-optional-chaining, babel-plugin-transform-private-methods, babel-plugin-transform-private-property-in-object, babel-plugin-transform-regexp-modifiers, babel-plugin-transform-unicode-property-regex, babel-plugin-transform-unicode-sets-regex
  • #17580 Allow Babel 8 in compatible Babel 7 plugins (@​nicolo-ribaudo)

... (truncated)

Commits

• aa8394e v7.29.0
• 0053db6 Update polyfill packages (#17727)
• f3a2226 [babel 7] Delete Babel 8 fixtures (#17729)
• d7f4008 v7.28.6
• 99dcba5 chore: enable some ts-eslint rules (#17592)
• c92c491 Improve Unicode handling in code-frame tokenizer (#17589)
• 61647ae v7.28.5
• 42cb285 Improve @babel/core types (#17404)
• ae363ae chore: Fix typo in variable name (#17535)
• 1edfcaa Update compat data (#17487)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​babel/preset-env since your current version.

Updates @babel/preset-react from 7.26.3 to 7.28.5

Release notes

Sourced from @​babel/preset-react's releases.

v7.28.5 (2025-10-23)

Thank you @​CO0Ki3, @​Olexandr88, and @​youthfulhps for your first PRs!

👓 Spec Compliance

• babel-parser
  • #17446 Allow Runtime Errors for Function Call Assignment Targets (@​liuxingbaoyu)
• babel-helper-validator-identifier
  • #17501 fix: update identifier to unicode 17 (@​fisker)

🐛 Bug Fix

• babel-plugin-proposal-destructuring-private
  • #17534 Allow mixing private destructuring and rest (@​CO0Ki3)
• babel-parser
  • #17521 Improve @babel/parser error typing (@​JLHwung)
  • #17491 fix: improve ts-only declaration parsing (@​JLHwung)
• babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring
  • #17519 fix: rest correctly returns plain array (@​liuxingbaoyu)
• babel-helper-create-class-features-plugin, babel-helper-member-expression-to-functions, babel-plugin-transform-block-scoping, babel-plugin-transform-optional-chaining, babel-traverse, babel-types
  • #17503 Fix JSXIdentifier handling in isReferencedIdentifier (@​JLHwung)
• babel-traverse
  • #17504 fix: ensure scope.push register in anonymous fn (@​JLHwung)

🏠 Internal

• babel-types
  • #17494 Type checking babel-types scripts (@​JLHwung)

🏃‍♀️ Performance

• babel-core
  • #17490 Faster finding of locations in buildCodeFrameError (@​liuxingbaoyu)

Committers: 8

• Babel Bot (@​babel-bot)
• Byeongho Yoo (@​youthfulhps)
• Huáng Jùnliàng (@​JLHwung)
• Hyeon Dokko (@​CO0Ki3)
• Nicolò Ribaudo (@​nicolo-ribaudo)
• @​Olexandr88
• @​liuxingbaoyu
• fisker Cheung (@​fisker)

v7.28.4 (2025-09-05)

Thanks @​gwillen and @​mrginglymus for your first PRs!

🏠 Internal

• babel-core, babel-helper-check-duplicate-nodes, babel-traverse, babel-types
  • #17493 Update Jest to v30.1.1 (@​JLHwung)
• babel-plugin-transform-regenerator
  • #17455 chore: Clean up transform-regenerator (@​liuxingbaoyu)

... (truncated)

Changelog

Sourced from @​babel/preset-react's changelog.

Changelog

Tags:

• 💥 [Breaking Change]
• 👓 [Spec Compliance]
• 🚀 [New Feature]
• 🐛 [Bug Fix]
• 📝 [Documentation]
• 🏠 [Internal]
• 💅 [Polish]

Note: Gaps between patch versions are faulty, broken or test releases.

This file contains the changelog starting from v8.0.0-alpha.0.

• See CHANGELOG - v7.15.0 to v7.28.5 for v7.15.0 to v7.28.5 changes (the last common release between the v8 and v7 release lines was v7.28.5).
• See CHANGELOG - v7.0.0 to v7.14.9 for v7.0.0 to v7.14.9 changes.
• See CHANGELOG - v7 prereleases for v7.0.0-alpha.1 to v7.0.0-rc.4 changes.
• See CHANGELOG - v4, CHANGELOG - v5, and CHANGELOG - v6 for v4.x-v6.x changes.
• See CHANGELOG - 6to5 for the pre-4.0.0 version changelog.
• See Babylon's CHANGELOG for the Babylon pre-7.0.0-beta.29 version changelog.
• See babel-eslint's releases for the changelog before @babel/eslint-parser 7.8.0.
• See eslint-plugin-babel's releases for the changelog before @babel/eslint-plugin 7.8.0.

v8.0.0-rc.2 (2026-02-15)

💥 Breaking Change

• Other
  • #17766 Remove unused code for old ESLint versions (@​liuxingbaoyu)
• babel-code-frame
  • #17772 Remove deprecated default export from @babel/code-frame (@​fisker)

🐛 Bug Fix

• babel-helpers, babel-plugin-transform-async-generator-functions, babel-runtime-corejs3
  • #17797 fix: Properly handle await in finally (@​liuxingbaoyu)
• babel-parser
  • #17796 Support ESLint 10 (@​JLHwung)
• babel-preset-env
  • #17787 Fix: preset-env include/exclude should accept bugfix plugins (@​JLHwung)
• babel-generator
  • #17781 fix: preserve trailing comma in optional call args (@​JLHwung)
  • #17774 Fix undefined indentation when exactly 64 indents (@​YoussefHenna)
• babel-standalone
  • #17770 fix: ensure targets.esmodules is validated (@​JLHwung)

💅 Polish

• babel-core

... (truncated)

Commits

• 61647ae v7.28.5
• 42cb285 Improve @babel/core types (#17404)
• eebd3a0 v7.27.1
• fdc0fb5 [Babel 8] Bump nodejs requirements to ^20.19.0 || >= 22.12.0 (#17204)
• cd24cc0 chore: Update TS 5.7 (#17053)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​babel/preset-react since your current version.

Updates @babel/preset-typescript from 7.25.7 to 7.28.5

Release notes

Sourced from @​babel/preset-typescript's releases.

v7.28.5 (2025-10-23)

Thank you @​CO0Ki3, @​Olexandr88, and @​youthfulhps for your first PRs!

👓 Spec Compliance

• babel-parser
  • #17446 Allow Runtime Errors for Function Call Assignment Targets (@​liuxingbaoyu)
• babel-helper-validator-identifier
  • #17501 fix: update identifier to unicode 17 (@​fisker)

🐛 Bug Fix

• babel-plugin-proposal-destructuring-private
  • #17534 Allow mixing private destructuring and rest (@​CO0Ki3)
• babel-parser
  • #17521 Improve @babel/parser error typing (@​JLHwung)
  • #17491 fix: improve ts-only declaration parsing (@​JLHwung)
• babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring
  • #17519 fix: rest correctly returns plain array (@​liuxingbaoyu)
• babel-helper-create-class-features-plugin, babel-helper-member-expression-to-functions, babel-plugin-transform-block-scoping, babel-plugin-transform-optional-chaining, babel-traverse, babel-types
  • #17503 Fix JSXIdentifier handling in isReferencedIdentifier (@​JLHwung)
• babel-traverse
  • #17504 fix: ensure scope.push register in anonymous fn (@​JLHwung)

🏠 Internal

• babel-types
  • #17494 Type checking babel-types scripts (@​JLHwung)

🏃‍♀️ Performance

• babel-core
  • #17490 Faster finding of locations in buildCodeFrameError (@​liuxingbaoyu)

Committers: 8

• Babel Bot (@​babel-bot)
• Byeongho Yoo (@​youthfulhps)
• Huáng Jùnliàng (@​JLHwung)
• Hyeon Dokko (@​CO0Ki3)
• Nicolò Ribaudo (@​nicolo-ribaudo)
• @​Olexandr88
• @​liuxingbaoyu
• fisker Cheung (@​fisker)

v7.28.4 (2025-09-05)

Thanks @​gwillen and @​mrginglymus for your first PRs!

🏠 Internal

• babel-core, babel-helper-check-duplicate-nodes, babel-traverse, babel-types
  • #17493 Update Jest to v30.1.1 (@​JLHwung)
• babel-plugin-transform-regenerator
  • #17455 chore: Clean up transform-regenerator (@​liuxingbaoyu)

... (truncated)

Changelog

Sourced from @​babel/preset-typescript's changelog.

Changelog

Tags:

• 💥 [Breaking Change]
• 👓 [Spec Compliance]
• 🚀 [New Feature]
• 🐛 [Bug Fix]
• 📝 [Documentation]
• 🏠 [Internal]
• 💅 [Polish]

Note: Gaps between patch versions are faulty, broken or test releases.

This file contains the changelog starting from v8.0.0-alpha.0.

• See CHANGELOG - v7.15.0 to v7.28.5 for v7.15.0 to v7.28.5 changes (the last common release between the v8 and v7 release lines was v7.28.5).
• See CHANGELOG - v7.0.0 to v7.14.9 for v7.0.0 to v7.14.9 changes.
• See CHANGELOG - v7 prereleases for v7.0.0-alpha.1 to v7.0.0-rc.4 changes.
• See CHANGELOG - v4, CHANGELOG - v5, and CHANGELOG - v6 for v4.x-v6.x changes.
• See CHANGELOG - 6to5 for the pre-4.0.0 version changelog.
• See Babylon's CHANGELOG for the Babylon pre-7.0.0-beta.29 version changelog.
• See babel-eslint's releases for the changelog before @babel/eslint-parser 7.8.0.
• See eslint-plugin-babel's releases for the changelog before @babel/eslint-plugin 7.8.0.

v8.0.0-rc.2 (2026-02-15)

💥 Breaking Change

• Other
  • #17766 Remove unused code for old ESLint versions (@​liuxingbaoyu)
• babel-code-frame
  • #17772 Remove deprecated default export from @babel/code-frame (@​fisker)

🐛 Bug Fix

• babel-helpers, babel-plugin-transform-async-generator-functions, babel-runtime-corejs3
  • #17797 fix: Properly handle await in finally (@​liuxingbaoyu)
• babel-parser
  • #17796 Support ESLint 10 (@​JLHwung)
• babel-preset-env
  • #17787 Fix: preset-env include/exclude should accept bugfix plugins (@​JLHwung)
• babel-generator
  • #17781 fix: preserve trailing comma in optional call args (@​JLHwung)
  • #17774 Fix undefined indentation when exactly 64 indents (@​YoussefHenna)
• babel-standalone
  • #17770 fix: ensure targets.esmodules is validated (@​JLHwung)

💅 Polish

• babel-core

... (truncated)

Commits

• 61647ae v7.28.5
• 42cb285 Improve @babel/core types (Description has been truncated

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​lavamoat/​preinstall-always-fail@​2.1.0 ⏵ 2.1.1
	npm/​@​babel/​plugin-proposal-optional-chaining@​7.18.9 ⏵ 7.21.0
	npm/​react-router-dom@​7.5.1 ⏵ 7.13.0				+1
	npm/​@​docusaurus/​preset-classic@​3.6.3 ⏵ 3.9.2	+1		+1	+4
	npm/​@​typescript-eslint/​parser@​8.20.0 ⏵ 8.56.0	+1
	npm/​@​babel/​preset-react@​7.26.3 ⏵ 7.28.5
	npm/​@​types/​chrome@​0.0.287 ⏵ 0.1.37	-7		+1	+2
	npm/​@​babel/​preset-typescript@​7.25.7 ⏵ 7.28.5
	npm/​@​types/​semver@​7.5.8 ⏵ 7.7.1	+1		+1
	npm/​@​docusaurus/​core@​3.6.3 ⏵ 3.9.2			+1	+4
	npm/​@​types/​react-dom@​19.1.2 ⏵ 19.2.3			+1
	npm/​lodash@​4.17.23
	npm/​@​babel/​preset-env@​7.25.8 ⏵ 7.29.0
	npm/​@​babel/​eslint-parser@​7.25.8 ⏵ 7.28.6			-23	+1
	npm/​@​types/​react@​19.0.12 ⏵ 19.2.14
	npm/​@​types/​webextension-polyfill@​0.12.0 ⏵ 0.12.5			+1	+4
	npm/​@​babel/​core@​7.25.8 ⏵ 7.29.0				+2
	npm/​@​types/​lodash@​4.17.16 ⏵ 4.17.23	+1		+1
	npm/​@​typescript-eslint/​eslint-plugin@​8.20.0 ⏵ 8.56.0	+1		+1
	npm/​jest-localstorage-mock@​2.4.3 ⏵ 2.4.26				+3
	npm/​@​stellar/​design-system@​3.2.7 ⏵ 3.2.8				+1
	npm/​dotenv-webpack@​8.1.0 ⏵ 8.1.1
	npm/​formik@​2.4.6 ⏵ 2.4.9	+1		+1
	npm/​yup@​1.6.1 ⏵ 1.7.1
	npm/​@​vercel/​ncc@​0.38.3 ⏵ 0.38.4
	npm/​eslint-plugin-react@​7.37.4 ⏵ 7.37.5	+1
	npm/​url@​0.11.1 ⏵ 0.11.4	+1		+1
	npm/​jest-fixed-jsdom@​0.0.9 ⏵ 0.0.11	+1		+1	+3
	npm/​concurrently@​9.1.2 ⏵ 9.2.1	+1		+1
	npm/​eslint-plugin-import@​2.31.0 ⏵ 2.32.0	+1
	npm/​ts-loader@​9.5.1 ⏵ 9.5.4
	npm/​tailwindcss@​4.1.18 ⏵ 4.2.0	+1		+1
See 35 more rows in the dashboard

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		License policy violation: npm @csstools/postcss-alpha-function under MIT-0 Location: Package overview From: ? → npm/@docusaurus/core@3.9.2 → npm/@csstools/postcss-alpha-function@1.0.1 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@csstools/postcss-alpha-function@1.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @csstools/postcss-color-function-display-p3-linear under MIT-0 Location: Package overview From: ? → npm/@docusaurus/core@3.9.2 → npm/@csstools/postcss-color-function-display-p3-linear@1.0.1 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@csstools/postcss-color-function-display-p3-linear@1.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @csstools/postcss-color-function under MIT-0 Location: Package overview From: ? → npm/@docusaurus/core@3.9.2 → npm/@csstools/postcss-color-function@4.0.12 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@csstools/postcss-color-function@4.0.12. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @csstools/postcss-color-mix-function under MIT-0 Location: Package overview From: ? → npm/@docusaurus/core@3.9.2 → npm/@csstools/postcss-color-mix-function@3.0.12 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@csstools/postcss-color-mix-function@3.0.12. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @csstools/postcss-color-mix-variadic-function-arguments under MIT-0 Location: Package overview From: ? → npm/@docusaurus/core@3.9.2 → npm/@csstools/postcss-color-mix-variadic-function-arguments@1.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@csstools/postcss-color-mix-variadic-function-arguments@1.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @csstools/postcss-content-alt-text under MIT-0 Location: Package overview From: ? → npm/@docusaurus/core@3.9.2 → npm/@csstools/postcss-content-alt-text@2.0.8 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@csstools/postcss-content-alt-text@2.0.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @csstools/postcss-contrast-color-function under MIT-0 Location: Package overview From: ? → npm/@docusaurus/core@3.9.2 → npm/@csstools/postcss-contrast-color-function@2.0.12 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@csstools/postcss-contrast-color-function@2.0.12. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @csstools/postcss-gradients-interpolation-method under MIT-0 Location: Package overview From: ? → npm/@docusaurus/core@3.9.2 → npm/@csstools/postcss-gradients-interpolation-method@5.0.12 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@csstools/postcss-gradients-interpolation-method@5.0.12. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @csstools/postcss-hwb-function under MIT-0 Location: Package overview From: ? → npm/@docusaurus/core@3.9.2 → npm/@csstools/postcss-hwb-function@4.0.12 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@csstools/postcss-hwb-function@4.0.12. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @csstools/postcss-ic-unit under MIT-0 Location: Package overview From: ? → npm/@docusaurus/core@3.9.2 → npm/@csstools/postcss-ic-unit@4.0.4 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@csstools/postcss-ic-unit@4.0.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @csstools/postcss-light-dark-function under MIT-0 Location: Package overview From: ? → npm/@docusaurus/core@3.9.2 → npm/@csstools/postcss-light-dark-function@2.0.11 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@csstools/postcss-light-dark-function@2.0.11. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @csstools/postcss-normalize-display-values under MIT-0 Location: Package overview From: ? → npm/@docusaurus/core@3.9.2 → npm/@csstools/postcss-normalize-display-values@4.0.1 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@csstools/postcss-normalize-display-values@4.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @csstools/postcss-oklab-function under MIT-0 Location: Package overview From: ? → npm/@docusaurus/core@3.9.2 → npm/@csstools/postcss-oklab-function@4.0.12 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@csstools/postcss-oklab-function@4.0.12. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @csstools/postcss-position-area-property under MIT-0 Location: Package overview From: ? → npm/@docusaurus/core@3.9.2 → npm/@csstools/postcss-position-area-property@1.0.0 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@csstools/postcss-position-area-property@1.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @csstools/postcss-progressive-custom-properties under MIT-0 Location: Package overview From: ? → npm/@docusaurus/core@3.9.2 → npm/@csstools/postcss-progressive-custom-properties@4.2.1 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@csstools/postcss-progressive-custom-properties@4.2.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @csstools/postcss-property-rule-prelude-list under MIT-0 Location: Package overview From: ? → npm/@docusaurus/core@3.9.2 → npm/@csstools/postcss-property-rule-prelude-list@1.0.0 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@csstools/postcss-property-rule-prelude-list@1.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @csstools/postcss-relative-color-syntax under MIT-0 Location: Package overview From: ? → npm/@docusaurus/core@3.9.2 → npm/@csstools/postcss-relative-color-syntax@3.0.12 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@csstools/postcss-relative-color-syntax@3.0.12. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @csstools/postcss-syntax-descriptor-syntax-production under MIT-0 Location: Package overview From: ? → npm/@docusaurus/core@3.9.2 → npm/@csstools/postcss-syntax-descriptor-syntax-production@1.0.1 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@csstools/postcss-syntax-descriptor-syntax-production@1.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @csstools/postcss-system-ui-font-family under MIT-0 Location: Package overview From: ? → npm/@docusaurus/core@3.9.2 → npm/@csstools/postcss-system-ui-font-family@1.0.0 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@csstools/postcss-system-ui-font-family@1.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @tailwindcss/oxide-wasm32-wasi under 0BSD AND MIT Location: Package overview From: ? → npm/@tailwindcss/postcss@4.2.0 → npm/@tailwindcss/oxide-wasm32-wasi@4.2.0 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tailwindcss/oxide-wasm32-wasi@4.2.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm asn1js under BSD-3-Clause Location: Package overview From: ? → npm/webpack-dev-server@5.2.3 → npm/asn1js@3.0.7 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/asn1js@3.0.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm bytestreamjs under BSD-3-Clause Location: Package overview From: ? → npm/webpack-dev-server@5.2.3 → npm/bytestreamjs@2.0.1 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/bytestreamjs@2.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm caniuse-lite under CC-BY-4.0 License: CC-BY-4.0 - the applicable license policy does not allow this license (4) (npm metadata) License: CC-BY-4.0 - the applicable license policy does not allow this license (4) (package/LICENSE) License: CC-BY-4.0 - the applicable license policy does not allow this license (4) (package/package.json) From: ? → npm/@babel/preset-env@7.29.0 → npm/caniuse-lite@1.0.30001770 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/caniuse-lite@1.0.30001770. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm cssdb under MIT-0 Location: Package overview From: ? → npm/@docusaurus/core@3.9.2 → npm/cssdb@8.8.0 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/cssdb@8.8.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm jest-localstorage-mock under BSD-3-Clause Location: Package overview From: package.json → npm/jest-localstorage-mock@2.4.26 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/jest-localstorage-mock@2.4.26. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm lightningcss-android-arm64 under MPL-2.0 Location: Package overview From: ? → npm/@tailwindcss/postcss@4.2.0 → npm/lightningcss-android-arm64@1.31.1 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lightningcss-android-arm64@1.31.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm lightningcss-darwin-arm64 under MPL-2.0 Location: Package overview From: ? → npm/@tailwindcss/postcss@4.2.0 → npm/lightningcss-darwin-arm64@1.31.1 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lightningcss-darwin-arm64@1.31.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
See 22 more rows in the dashboard

View full report