[Snyk] Upgrade: , , , core-js, webpack

[AKJUS]

Snyk has created this PR to upgrade multiple dependencies.

👯‍♂ The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name	Versions	Released on

@babel/preset-env
from 7.25.3 to 7.25.4 | 1 version ahead of your current version | 22 days ago
on 2024-08-22
@jetbrains/logos
from 1.4.27 to 1.4.34 | 7 versions ahead of your current version | 2 years ago
on 2022-05-31
@types/node
from 16.18.104 to 16.18.105 | 1 version ahead of your current version | a month ago
on 2024-08-09
core-js
from 3.37.1 to 3.38.1 | 2 versions ahead of your current version | 23 days ago
on 2024-08-20
webpack
from 5.93.0 to 5.94.0 | 1 version ahead of your current version | 21 days ago
on 2024-08-22

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Cross-site Scripting (XSS) SNYK-JS-WEBPACK-7840298	688	Proof of Concept

Release notes

Package name: @babel/preset-env

• 7.25.4 - 2024-08-22
  

  v7.25.4 (2024-08-22)

  🐛 Bug Fix

  • babel-traverse
    • #16756 fix: Skip computed key when renaming (@ liuxingbaoyu)
  • babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
    • #16755 fix: Decorator 2018-09 may throw an exception (@ liuxingbaoyu)
  • babel-types
    • #16710 Visit AST fields nodes according to their syntactical order (@ nicolo-ribaudo)
  • babel-generator
    • #16709 Print semicolon after TS export namespace as A (@ nicolo-ribaudo)

  💅 Polish

  • babel-generator, babel-plugin-proposal-decorators, babel-plugin-proposal-destructuring-private, babel-plugin-proposal-pipeline-operator, babel-plugin-transform-class-properties, babel-plugin-transform-destructuring, babel-plugin-transform-optional-chaining, babel-plugin-transform-private-methods, babel-plugin-transform-private-property-in-object, babel-plugin-transform-typescript, babel-runtime-corejs2, babel-runtime, babel-traverse
    • #16722 Avoid unnecessary parens around sequence expressions (@ nicolo-ribaudo)
  • babel-generator, babel-plugin-transform-class-properties
    • #16714 Avoid unnecessary parens around exported arrow functions (@ nicolo-ribaudo)
  • babel-generator, babel-plugin-proposal-decorators, babel-plugin-proposal-destructuring-private, babel-plugin-transform-object-rest-spread
    • #16712 Avoid printing unnecessary parens around object destructuring (@ nicolo-ribaudo)

  🔬 Output optimization

  • babel-generator
    • #16740 Avoid extra spaces between comments/regexps in compact mode (@ nicolo-ribaudo)

  Committers: 4

  • Babel Bot (@ babel-bot)
  • Huáng Jùnliàng (@ JLHwung)
  • Nicolò Ribaudo (@ nicolo-ribaudo)
  • @ liuxingbaoyu
• 7.25.3 - 2024-07-31
  

  v7.25.3 (2024-07-31)

  🐛 Bug Fix

  • babel-plugin-bugfix-firefox-class-in-computed-class-key, babel-traverse
    • #16699 Avoid validating visitors produced by traverse.visitors.merge (@ nicolo-ribaudo)

  🏠 Internal

  • babel-parser
    • #16688 Add @ babel/types as a dependency of @ babel/parser (@ nicolo-ribaudo)

  Committers: 2

  • Huáng Jùnliàng (@ JLHwung)
  • Nicolò Ribaudo (@ nicolo-ribaudo)

from @babel/preset-env GitHub release notes

Package name: @jetbrains/logos

• 1.4.34 - 2022-05-31
  

  "chore(release): 1.4.34"

• 1.4.33 - 2022-05-05
  

  "chore(release): 1.4.33"

• 1.4.32 - 2022-04-29
  

  "chore(release): 1.4.32"

• 1.4.31 - 2022-04-29
  

  "chore(release): 1.4.31"

• 1.4.30 - 2022-04-25
  

  "chore(release): 1.4.30"

• 1.4.29 - 2022-04-18
  

  "chore(release): 1.4.29"

• 1.4.28 - 2022-04-11
  

  "chore(release): 1.4.28"

• 1.4.27 - 2021-11-16
  

  "chore(release): 1.4.27"

from @jetbrains/logos GitHub release notes

Package name: @types/node

• 16.18.105 - 2024-08-09
• 16.18.104 - 2024-07-23

from @types/node GitHub release notes

Package name: core-js

• 3.38.1 - 2024-08-20
  
  • Changes v3.38.0...v3.38.1
  • Fixed some cases of URLSearchParams percent decoding, #1357, #1361, thanks @ slowcheetah
  • Some stylistic changes and minor optimizations
  • Compat data improvements:
    • Iterator helpers proposal methods marked as shipped from FF131
    • Math.f16round and DataView.prototype.{ getFloat16, setFloat16 } marked as shipped from Bun 1.1.23
    • RegExp.escape marked as shipped from Bun 1.1.22
    • Promise.try marked as shipped from Bun 1.1.22
    • Uint8Array to / from base64 and hex proposal methods marked as shipped from Bun 1.1.22
    • Added Hermes 0.13 compat data, similar to React Native 0.75 Hermes
    • Added Opera Android 84 compat data mapping
• 3.38.0 - 2024-08-04
  
  • Changes v3.37.1...v3.38.0
  • RegExp.escape proposal:
    • Built-ins:
      • RegExp.escape
    • Moved to stage 3, June 2024 and July 2024 TC39 meetings
    • Updated the way of escaping, regex-escaping/77
    • Throw an error on non-strings, regex-escaping/58
    • Added /actual/ namespace entries, unconditional forced replacement changed to feature detection
  • Promise.try proposal:
    • Built-ins:
      • Promise.try
    • Moved to stage 3, June 2024 TC39 meeting
    • Added /actual/ namespace entries, unconditional forced replacement changed to feature detection
  • Uint8Array to / from base64 and hex stage 3 proposal:
    • Built-ins:
      • Uint8Array.fromBase64
      • Uint8Array.fromHex
      • Uint8Array.prototype.setFromBase64
      • Uint8Array.prototype.setFromHex
      • Uint8Array.prototype.toBase64
      • Uint8Array.prototype.toHex
    • Added Uint8Array.prototype.{ setFromBase64, setFromHex } methods
    • Added Uint8Array.fromBase64 and Uint8Array.prototype.setFromBase64 lastChunkHandling option, proposal-arraybuffer-base64/33
    • Added Uint8Array.prototype.toBase64 omitPadding option, proposal-arraybuffer-base64/60
    • Added throwing a TypeError on arrays backed by detached buffers
    • Unconditional forced replacement changed to feature detection
  • Fixed RegExp named capture groups polyfill in combination with non-capturing groups, #1352, thanks @ Ulop
  • Improved some cases of environment detection
  • Uses process.getBuiltinModule for getting built-in NodeJS modules where it's available
  • Uses https instead of http in URL constructor feature detection to avoid extra notifications from some overly vigilant security scanners, #1345
  • Some minor optimizations
  • Updated browserslist in core-js-compat dependencies that fixes an upstream issue with incorrect interpretation of some browserslist queries, #1344, browserslist/829, browserslist/836
  • Compat data improvements:
    • Added Safari 18.0 compat data:
      • Fixed Object.groupBy and Map.groupBy to work for non-objects
      • Fixed throwing a RangeError if Set methods are called on an object with negative size property
      • Fixed Set.prototype.symmetricDifference to call this.has in each iteration
      • Fixed Array.fromAsync to not call the Array constructor twice
      • Added URL.parse
    • Math.f16round and DataView.prototype.{ getFloat16, setFloat16 } marked as shipped from FF129
    • Symbol.asyncDispose added and marked as supported from V8 ~ Chromium 127
    • Promise.try added and marked as supported from V8 ~ Chromium 128
    • Added Deno 1.44 and 1.45 compat data mapping
    • self descriptor is broken in Deno 1.45.3 (again)
    • Added Electron 32 and 33 compat data mapping
    • Added Opera Android 83 compat data mapping
    • Added Samsung Internet 27 compat data mapping
    • Added Oculus Quest Browser 34 compat data mapping
• 3.37.1 - 2024-05-14
  
  • Changes v3.37.0...v3.37.1
  • Fixed URL.parse feature detection for some specific cases
  • Compat data improvements:
    • Set methods proposal added and marked as supported from FF 127
    • Symbol.dispose added and marked as supported from V8 ~ Chromium 125
    • Math.f16round and DataView.prototype.{ getFloat16, setFloat16 } added and marked as supported from Deno 1.43
    • URL.parse added and marked as supported from Chromium 126
    • URL.parse added and marked as supported from NodeJS 22.0
    • URL.parse added and marked as supported from Deno 1.43
    • Added Rhino 1.7.15 compat data, many features marked as supported
    • Added NodeJS 22.0 compat data mapping
    • Added Deno 1.43 compat data mapping
    • Added Electron 31 compat data mapping
    • Updated Opera Android 82 compat data mapping
    • Added Samsung Internet 26 compat data mapping
    • Added Oculus Quest Browser 33 compat data mapping

from core-js GitHub release notes

Package name: webpack

• 5.94.0 - 2024-08-22
  

  Bug Fixes

  • Added runtime condition for harmony reexport checked
  • Handle properly data/http/https protocols in source maps
  • Make bigint optimistic when browserslist not found
  • Move @ types/eslint-scope to dev deps
  • Related in asset stats is now always an array when no related found
  • Handle ASI for export declarations
  • Mangle destruction incorrect with export named default properly
  • Fixed unexpected asi generation with sequence expression
  • Fixed a lot of types

  New Features

  • Added new external type "module-import"
  • Support webpackIgnore for new URL() construction
  • [CSS] @ import pathinfo support

  Security

  • Fixed DOM clobbering in auto public path
• 5.93.0 - 2024-07-11
  

  Bug Fixes

  • Generate correct relative path to runtime chunks
  • Makes DefinePlugin quieter under default log level
  • Fixed mangle destructuring default in namespace import
  • Fixed consumption of eager shared modules for module federation
  • Strip slash for pretty regexp
  • Calculate correct contenthash for CSS generator options

  New Features

  • Added the binary generator option for asset modules to explicitly keep source maps produced by loaders
  • Added the modern-module library value for tree shakable output
  • Added the overrideStrict option to override strict or non-strict mode for javascript modules

from webpack GitHub release notes

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.
• Max score is 1000. Note that the real score may have changed since the PR was raised.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs