fix(deps): update all core dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@babel/cli (source)	7.27.2 -> 7.28.0
@babel/core (source)	7.27.7 -> 7.28.0
@babel/node (source)	7.27.1 -> 7.28.0
@babel/preset-env (source)	7.27.2 -> 7.28.0
@babel/runtime (source)	7.27.6 -> 7.28.2
@types/debug (source)	4.1.7 -> 4.1.12
@types/lodash (source)	4.17.19 -> 4.17.20
debug	4.3.4 -> 4.4.1
eslint-config-prettier	8.10.0 -> 8.10.2
pnpm (source)	8.15.8+sha512.d1a029e1a447ad90bc96cd58b0fad486d2993d531856396f7babf2d83eb1823bb83c5a3d0fc18f675b2d10321d49eb161fece36fe8134aa5823ecd215feed392 -> 8.15.9

---

Release Notes

babel/babel (@​babel/cli)

v7.28.0

Compare Source

🚀 New Feature

• babel-node
  • #​17147 Support top level await in node repl (@​liuxingbaoyu)
• babel-types
  • #​17258 feat(matchesPattern): support super/private/meta (@​JLHwung)
• babel-compat-data, babel-preset-env
  • #​17355 Add explicit resource management to preset-env (@​JLHwung)
• babel-core, babel-parser
  • #​17390 Support sourceType: "commonjs" (@​JLHwung)
• babel-generator, babel-parser
  • #​17346 Materialize explicitResourceManagement parser plugin (@​JLHwung)
• babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-plugin-transform-object-rest-spread, babel-traverse, babel-types
  • #​17391 LVal coverage updates (Part 2) (@​JLHwung)
• babel-parser, babel-traverse, babel-types
  • #​17378 Accept bigints in t.bigIntLiteral factory (@​JLHwung)
• babel-generator, babel-plugin-proposal-destructuring-private, babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring, babel-plugin-transform-explicit-resource-management, babel-plugin-transform-react-display-name, babel-types
  • #​17277 Transform discard binding (@​JLHwung)
• babel-generator, babel-parser, babel-plugin-proposal-destructuring-private, babel-plugin-transform-block-scoping, babel-plugin-transform-object-rest-spread, babel-plugin-transform-typescript, babel-traverse, babel-types
  • #​17163 Parse discard binding (@​JLHwung)

🐛 Bug Fix

• babel-helper-globals, babel-plugin-transform-classes, babel-traverse
  • #​17297 Create babel-helper-globals (@​JLHwung)
• babel-types
  • #​17009 feature: TSTypeOperator: keyof (#​16799) (@​coderaiser)

🏠 Internal

• babel-compat-data, babel-plugin-proposal-decorators, babel-plugin-transform-async-generator-functions, babel-plugin-transform-json-modules, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs3
  • #​17403 Update babel-polyfill packages (@​nicolo-ribaudo)

debug-js/debug (debug)

v4.4.1

Compare Source

What's Changed

• fix(Issue-996): replace whitespaces in namespaces string with commas globally by @​pdahal-cx in https://github.com/debug-js/debug/pull/997
• fixes #​987 fallback to localStorage.DEBUG if debug is not defined by @​lzilioli in https://github.com/debug-js/debug/pull/988

New Contributors

• @​pdahal-cx made their first contribution in https://github.com/debug-js/debug/pull/997
• @​lzilioli made their first contribution in https://github.com/debug-js/debug/pull/988

Full Changelog: debug-js/debug@4.4.0...4.4.1

v4.4.0

Compare Source

Fixes (hopefully) the inefficient regex warnings in .enable().

Minor version as this is invariably going to break certain users who misuse the .enable() API and expected it to work with regexes, which was never supported nor documented. That's on you, sorry - that functionality won't be added back.

Full Changelog: debug-js/debug@4.3.7...4.4.0

v4.3.7

Compare Source

What's Changed

• Upgrade ms to version 2.1.3 by @​realityking in https://github.com/debug-js/debug/pull/819

Full Changelog: debug-js/debug@4.3.6...4.3.7

v4.3.6

Compare Source

What's Changed

• Avoid using deprecated RegExp.$1 by @​bluwy in https://github.com/debug-js/debug/pull/969

New Contributors

• @​bluwy made their first contribution in https://github.com/debug-js/debug/pull/969

Full Changelog: debug-js/debug@4.3.5...4.3.6

v4.3.5

Compare Source

Patch

• cac39b1 Fix/debug depth (#​926)

Thank you @​calvintwr for the fix.

prettier/eslint-config-prettier (eslint-config-prettier)

v8.10.2

Compare Source

pnpm/pnpm (pnpm)

v8.15.9: pnpm 8.15.9

Compare Source

Patch Changes

• Deduplicate bin names to prevent race condition and corrupted bin scripts #​7833.

Platinum Sponsors

Gold Sponsors

Our Silver Sponsors

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	rmdir-sync@​1.0.1
	eslint-config-prettier@​8.10.0 ⏵ 8.10.2
	@​babel/​node@​7.27.1 ⏵ 7.28.0	+1		+1
	@​babel/​cli@​7.27.2 ⏵ 7.28.0
	@​babel/​preset-env@​7.27.2 ⏵ 7.28.0			+1
	@​types/​debug@​4.1.7 ⏵ 4.1.12			-2
	rimraf@​3.0.2
	@​babel/​runtime@​7.27.6 ⏵ 7.28.2				+3
	@​babel/​core@​7.27.7 ⏵ 7.28.0
	@​types/​lodash@​4.17.19 ⏵ 4.17.20			+1	-2

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click for details)
Warn		[email protected] has a Critical CVE. CVE: GHSA-h755-8qp9-cq85 protobufjs Prototype Pollution vulnerability (CRITICAL) Affected versions: >= 7.0.0 < 7.2.5; >= 6.10.0 < 6.11.4 Patched version: 6.11.4 From: pnpm-lock.yaml → npm/@google-cloud/[email protected] → npm/[email protected] ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected]. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report