[Security] Bump @babel/helpers from 7.25.6 to 7.27.3

Bumps @babel/helpers from 7.25.6 to 7.27.3. This update includes a security fix.

Vulnerabilities fixed

Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups

Impact

When using Babel to compile regular expression named capturing groups, Babel will generate a polyfill for the .replace method that has quadratic complexity on some specific replacement pattern strings (i.e. the second argument passed to .replace).

Your generated code is vulnerable if all the following conditions are true:

• You use Babel to compile regular expression named capturing groups
• You use the .replace method on a regular expression that contains named capturing groups
• Your code uses untrusted strings as the second argument of .replace

If you are using @babel/preset-env with the targets option, the transform that injects the vulnerable code is automatically enabled if:

• you use duplicated named capturing groups, and target any browser older than Chrome/Edge 126, Opera 112, Firefox 129, Safari 17.4, or Node.js 23
• you use any named capturing groups, and target any browser older than Chrome 64, Opera 71, Edge 79, Firefox 78, Safari 11.1, or Node.js 10

You can verify what transforms @babel/preset-env is using by enabling the debug option.

Patches

This problem has been fixed in @babel/helpers and @babel/runtime 7.26.10 and 8.0.0-alpha.17, please upgrade. It's likely that you do not directly depend on @babel/helpers, and instead you depend on @babel/core (which itself depends on @babel/helpers). Upgrading to @babel/core 7.26.10 is not required, but it guarantees that you are on a new enough @babel/helpers version.

... (truncated)

Patched versions: 7.26.10 Affected versions: < 7.26.10

Release notes

Sourced from @​babel/helpers's releases.

v7.27.3 (2025-05-27)

Bug Fix

• babel-generator
  • #17324 Improve multiline comments handling in yield/await expression (@​JLHwung)
• babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3
  • #17328 Correctly set .displayName on GeneratorFunction (@​nicolo-ribaudo)
• babel-plugin-proposal-explicit-resource-management
  • #17319 fix: handle shadowed binding in for using of body (@​JLHwung)
  • #17317 fix: support named evaluation for using declaration (@​JLHwung)
• babel-plugin-proposal-decorators, babel-types
  • #17321 fix(converter): Remove abstract modifiers in class declaration to expression conversion (@​magic-akari)
• babel-helper-module-transforms, babel-plugin-proposal-explicit-resource-management, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-umd
  • #17257 Preserve class id when transforming using declarations with exported class (@​JLHwung)
• babel-parser
  • #17312 fix(parser): properly handle optional markers in generator class methods (@​magic-akari)
  • #17307 fix(parser): Terminate modifier parsing at newline (@​magic-akari)
• babel-generator, babel-parser
  • #17308 Improve import phase parsing (@​JLHwung)

Committers: 7

• Babel Bot (@​babel-bot)
• Huáng Jùnliàng (@​JLHwung)
• Nicolò Ribaudo (@​nicolo-ribaudo)
• Vik R (@​vikr01)
• @​liuxingbaoyu
• @​magic-akari
• fisker Cheung (@​fisker)

v7.27.2 (2025-05-06)

Bug Fix

• babel-parser
  • #17289 fix: @babel/parser/bin/index.js contains node: protocol require (@​liuxingbaoyu)
  • #17291 fix: Private class method not found when TS and estree (@​liuxingbaoyu)
• babel-plugin-transform-object-rest-spread
  • #17281 Fix: improve object rest handling in array pattern (@​JLHwung)
• babel-plugin-transform-modules-commonjs, babel-template
  • #17284 fix(babel-template): Properly handle empty string replacements (@​magic-akari)

:running_woman: Performance

• babel-cli
  • #17285 Enable Node compile cache for @babel/cli (@​JLHwung)

Committers: 5

• Babel Bot (@​babel-bot)
• Huáng Jùnliàng (@​JLHwung)
• Nicolò Ribaudo (@​nicolo-ribaudo)
• @​liuxingbaoyu
• @​magic-akari

... (truncated)

Changelog

Sourced from @​babel/helpers's changelog.

v7.27.3 (2025-05-27)

Bug Fix

• babel-generator
  • #17324 Improve multiline comments handling in yield/await expression (@​JLHwung)
• babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3
  • #17328 Correctly set .displayName on GeneratorFunction (@​nicolo-ribaudo)
• babel-plugin-proposal-explicit-resource-management
  • #17319 fix: handle shadowed binding in for using of body (@​JLHwung)
  • #17317 fix: support named evaluation for using declaration (@​JLHwung)
• babel-plugin-proposal-decorators, babel-types
  • #17321 fix(converter): Remove abstract modifiers in class declaration to expression conversion (@​magic-akari)
• babel-helper-module-transforms, babel-plugin-proposal-explicit-resource-management, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-umd
  • #17257 Preserve class id when transforming using declarations with exported class (@​JLHwung)
• babel-parser
  • #17312 fix(parser): properly handle optional markers in generator class methods (@​magic-akari)
  • #17307 fix(parser): Terminate modifier parsing at newline (@​magic-akari)
• babel-generator, babel-parser
  • #17308 Improve import phase parsing (@​JLHwung)

v7.27.2 (2025-05-06)

Bug Fix

• babel-parser
  • #17289 fix: @babel/parser/bin/index.js contains node: protocol require (@​liuxingbaoyu)
  • #17291 fix: Private class method not found when TS and estree (@​liuxingbaoyu)
• babel-plugin-transform-object-rest-spread
  • #17281 Fix: improve object rest handling in array pattern (@​JLHwung)
• babel-plugin-transform-modules-commonjs, babel-template
  • #17284 fix(babel-template): Properly handle empty string replacements (@​magic-akari)

:running_woman: Performance

• babel-cli
  • #17285 Enable Node compile cache for @babel/cli (@​JLHwung)

v7.27.1 (2025-04-30)

Spec Compliance

• babel-parser
  • #17254 Allow using of as lexical declaration within for (@​JLHwung)
  • #17230 Disallow get/set in TSPropertySignature (@​JLHwung)
• babel-parser, babel-types
  • #17193 Stricter TSImportType options parsing (@​JLHwung)

Bug Fix

• babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-traverse
  • #17137 fix: do expressions should allow early exit (@​kermanx)
• babel-helper-wrap-function, babel-plugin-transform-async-to-generator
  • #17251 Fix: propagate argument evaluation errors through async promise chain (@​magic-akari)
• babel-helper-remap-async-to-generator, babel-plugin-transform-async-to-generator
  • #17231 fix apply()/call() annotated as pure (@​Lacsw)
• babel-helper-fixtures, babel-parser

... (truncated)

Commits

• da5e371 v7.27.3
• 35152d8 Correctly set .displayName on GeneratorFunction (#17328)
• 4b76a5f Enable dot-notation rule (#17301)
• eebd3a0 v7.27.1
• b1f9184 Reduce interopRequireWildcard size (#16538)
• 9c351e5 Use class and add type definitions for regenerator (#17220)
• 0f95b74 Reduce regeneratorRuntime size (#17213)
• 317e332 Enforce node protocol import (#17207)
• 14ef1e9 Babel 8 cleanup (#17211)
• 97105cb Re-convert regeneratorRuntime to helper format (#17205)
• Additional commits viewable in compare view