[OpenNMS/opennms] 06c5a9: NMS-20250: Drop unused babel-preset-es2015-nostric...

  Branch: refs/heads/jira/NMS-20250-dependabot-coreweb-security-issues-august-2026-smoke
  Home:   https://github.com/OpenNMS/opennms
  Commit: 06c5a9d9f24b8952b92190a791f06883da40ecf5
      https://github.com/OpenNMS/opennms/commit/06c5a9d9f24b8952b92190a791f06883da40ecf5
  Author: Scott Theleman <[email protected]>
  Date:   2026-08-24 (Mon, 24 Aug 2026)

  Changed paths:
    M core/web-assets/package.json
    M core/web-assets/pnpm-lock.yaml

  Log Message:
  -----------
  NMS-20250: Drop unused babel-preset-es2015-nostrict devDependency

This preset was the only thing pulling the legacy Babel 6 package
[email protected] into the tree. That package is affected by
CVE-2023-45133 (arbitrary code execution when compiling crafted code,
CVSS 9.3) and has no patched release -- the advisory's fix versions
apply to @babel/traverse 7.23.2+, not to the Babel 6 line.

The preset was referenced nowhere:

  - .babelrc uses only @babel/preset-env and @babel/preset-typescript
  - webpack.config.js invokes babel-loader with no inline presets, so
    it reads .babelrc
  - jest transforms via ts-jest, not babel
  - no script passes it explicitly

@babel/core is already ^7.29.7 and @babel/traverse resolves to
7.29.0/7.29.7, both well past the 7.23.2 fix, so removing the Babel 6
preset resolves the alert outright rather than merely dismissing it.

Removes 52 packages from the lockfile. Verified with pnpm run webpack
(exit 0), pnpm run lint (0 errors) and pnpm test (21 suites, 174 tests
passing).



To unsubscribe from these emails, change your notification settings at https://github.com/OpenNMS/opennms/settings/notifications


_______________________________________________
Please read the OpenNMS Mailing List FAQ:
http://www.opennms.org/wiki/index.php?page=MailingListFaq
opennms-cvs mailing list

To *unsubscribe* or change your subscription options, see the bottom of this page:
https://lists.sourceforge.net/lists/listinfo/opennms-cvs