Refresh vulnerable Babel dependencies

[bgentry]

Dependabot cannot resolve the low-severity @babel/core advisory even
though its parent ranges accept the patched release. A lockfile-only targeted
refresh updates the synchronized Babel suite to 7.29.7 and includes the
corresponding Browserslist data refresh required by npm's resolver.

This also adds a security-floor override for the transitive development-only
@babel/runtime. GitHub auto-dismissed that separate advisory, but npm still
reported the vulnerable 7.24.5 helper; the override resolves reviewed 7.29.7
and removes its obsolete regenerator-runtime dependency.

The actual registry artifacts, source fixes, provenance, package graph, and
lockfile churn were reviewed before project execution. The resulting lockfile
has no known npm advisories, lifecycle-hook additions, native packages,
non-registry sources, or integrity anomalies.

[bgentry]

🤖 Codex review: Security and compatibility review looks good to me.

Reviewed head: 9d0b6d4f0d3d0f49fe97aa10197e59debd6a6441

Security and supply-chain scope

• Compared the vulnerable and patched published artifacts/source for
  @babel/core (7.28.5 → 7.29.7) and @babel/runtime (7.24.5 → 7.29.7),
  including the earliest fixed releases for GHSA-4x5r-pxfx-6jf8 and
  GHSA-968p-4wvh-cqc8. The reviewed registry SHA-512 values and available
  SLSA subjects match the packed artifacts and upstream source tags.
• Verified the core fix constrains sourceMappingURL reads to the source
  package/root boundary and includes upstream traversal tests. The runtime
  fix replaces the inefficient named-capture replacement helper; the fixed
  implementation is identical in the security-floor and selected releases.
• Reviewed the synchronized Babel 7.29.7 suite and actual Browserslist/data
  churn artifact-by-artifact. Maintainers, repositories, licenses, engines,
  publishers, and expected runtime surfaces remain consistent.
• Structurally checked the final lockfile: 4 added, 25 changed, and 1 removed;
  no lifecycle-hook additions, native/WASM packages, non-registry sources,
  non-SHA-512 integrity, same-version checksum rewrites, or unexpected bin
  changes. npm audit reports zero known vulnerabilities.

Notable transitive surfaces

• The only added bin is baseline-browser-mapping, a reviewed local
  data-query CLI with no network, process spawning, filesystem writes,
  telemetry, dynamic evaluation, or credential access.
• update-browserslist-db retains its existing explicitly invoked CLI/API
  that can run package managers and update lockfiles. It is not an install
  hook and is not executed by normal Browserslist library/build resolution;
  the reviewed update only extends explicit database-update behavior.
• @babel/runtime remains development-only through Testing Library, and the
  override records the patched ^7.26.10 security floor while currently
  resolving reviewed 7.29.7. The obsolete regenerator-runtime dependency is
  removed as expected.

Compatibility and validation

• All current Storybook, TanStack Router, React Hooks ESLint, react-docgen,
  dead-code-elimination, and Testing Library paths deduplicate to the patched
  Babel releases without peer or engine incompatibility.
• Self-verification passed: lifecycle-disabled and normal clean installs,
  installed dependency-tree checks, 205 tests, lint, production build,
  Storybook build, and npm audit.
• An explicit malicious-source regression confirmed that
  //# sourceMappingURL=../../outside.map cannot import a canary source map
  outside the input package boundary.

Residual risk and verdict

These packages execute only in River UI's trusted-source development/build
tooling today; neither advisory is currently reachable from application
input. The refreshed compiler/browser-data surface is larger than a one-entry
lock change, but the exact artifacts and behavior above were reviewed. I
found no blocking security or compatibility issue in this remediation.