fix(deps): update all core dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@babel/core (source)	7.26.7 -> 7.26.10
@babel/plugin-transform-runtime (source)	7.25.9 -> 7.26.10
@babel/preset-env (source)	7.26.7 -> 7.26.9
@babel/runtime (source)	7.26.7 -> 7.26.10
@types/lodash (source)	4.17.14 -> 4.17.16
snyk	1.1295.2 -> 1.1296.0
typedoc (source)	^0.27.0 -> ^0.28.0

---

Release Notes

babel/babel (@​babel/core)

v7.26.10

Compare Source

👓 Spec Compliance

• babel-parser
  • #​17159 Disallow decorator in array pattern (@​JLHwung)

🐛 Bug Fix

• babel-parser, babel-template
  • #​17164 Fix: always initialize ExportDeclaration attributes (@​JLHwung)
• babel-core
  • #​17142 fix: "Map maximum size exceeded" in deepClone (@​liuxingbaoyu)
• babel-parser, babel-plugin-transform-typescript
  • #​17154 Update typescript parser tests (@​JLHwung)
• babel-traverse
  • #​17151 fix: Should not evaluate vars in child scope (@​liuxingbaoyu)
• babel-generator
  • #​17153 fix: Correctly generate abstract override (@​liuxingbaoyu)
• babel-parser
  • #​17107 Fix source type detection when parsing TypeScript (@​JLHwung)

💅 Polish

• babel-standalone
  • #​17158 Avoid warnings when re-bundling @​babel/standalone with webpack (@​liuxingbaoyu)

🏠 Internal

• babel-parser
  • #​17160 Left-value parsing cleanup (@​JLHwung)

v7.26.9

Compare Source

🐛 Bug Fix

• babel-types
  • #​17103 fix: Definition for TSPropertySignature.kind (@​liuxingbaoyu)
• babel-generator, babel-types
  • #​17062 Print TypeScript optional/definite in ClassPrivateProperty (@​jamiebuilds-signal)

🏠 Internal

• babel-types
  • #​17130 Use .ts files with explicit reexports to solve name conflicts (@​nicolo-ribaudo)
• babel-core
  • #​17127 Do not depend on @types/gensync in Babel 7 (@​nicolo-ribaudo)

v7.26.8

Compare Source

v7.26.8 (2025-02-08)

🏠 Internal

• babel-preset-env
  • #​17097 Update dependency babel-plugin-polyfill-corejs3 to ^0.11.0

snyk/snyk (snyk)

v1.1296.0

Compare Source

The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation

News

• general: Improved error logging and handling

Features

• container: add support for --exclude-node-modules option (4756f27)
• container: adds kaniko support (bfb69c8)
• general: display a unique interactionID alongside each error (960a71c)
• test: python support for local wheel files specifiers (42675eb)
• test: dep-graph json file output (90f24ec)
• test: print legacy tree with json file output (b256937)
• test: display all applicable maven unmanaged identities (ebf6ba1)
• code: enable v1 fingerprints in code sarif output (00644af)
• test: Add 'pkgIdProvenance' labels to dependency graph nodes when the package identity has been changed from what has been discovered in the manifest files (4d529b3)
• test: added Python support for sys_platform (1aa1565)
• language-server AI fix explain (26d118f)
• language-server enable calling mcp commands via ls commands (6f80a03)
• language-server add scan source to metrics (6f80a03)
• language-server add mcp server, refactoring (6f80a03)
• language-server added a new code action and code lens for showDocument (8e7ab06)
• language-server add Option for Pre-Scan command, fix auth race (64920ac)
• language-server add ideStyle variable to static html (0a05e66)
• language-server intiial commit of shared html for scan summary panel (0a05e66)
• language-server send scan summary and scan base & working directory concurrently (1908a08)
• language-server store folder config outside of git repo, add reference folder (50d0770)
• language-server send initial summary panel notification (50d0770)
• language-server add a new $/snyk.scanSummary notificiation (fc80c9c)
• language-server support maven pom hierarchies for highlighting & fixes (e5924fc)
• language-server Sending a user event when fixing inside the editor (e5924fc)
• language-server Sending IDE+extension versions to autofix (a18975a)

Bug Fixes

• container: add container test doc info for --exclude-node-modules (2faf2d1)
• test: fix dotnet UTF-16LE support for target framework (e90075a)
• test: reduce false positives when scanning improved dotnet projects (c21625a)
• test: use --strict-out-of-sync when set to false with pnpm for top level dependencies (8d5b71a)
• test: fix OutOfSync errors in pnpm for download urls (b6e4ea0)
• test: fix OutOfSync errors in pnpm git protocol dependencies (5c8dc34)
• code: Don't write sarif files when no results are found (5a15113)
• code: Support single file test for golang native implementation (d7881f1)
• sbom: mavenAggregateProject with Dverbose or sbom (e88cf71)
• iac: Updates the user messages for snyk iac test --report for IaC V2 (1c9b3b3)
• language-server check folder trust before opening/changing/saving file (26d118f)
• language-server new issue summary totals (6f80a03)
• language-server add correct lesson url for license issues (6f80a03)
• language-server issues with non-UTF-8 encoded files in Snyk Code (8e7ab06)
• language-server ignore first dataflow element for oss fingerprint (64920ac)
• language-server use workdir folderConfig for ref Scan (64920ac)
• language-server test bundle add size property (0a05e66)
• language-server normalize path for file filter and reduce memory footprint (0a05e66)
• language-server add ideScript to Summary html (0a05e66)
• language-server add css variables and headers (0a05e66)
• language-server panic in range_finder (50d0770)
• language-server fix issue metadata used for hashing (fc80c9c)
• language-server use diff without enricher for delta (b213b58)
• language-server move issue view option filtering to the LS to not display ignored diagnostics in editor (b213b58)
• language-server add api version query to explain API URL (b213b58)

v1.1295.4

Compare Source

The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation

Bug Fixes

• security: Upgrades dependencies to address CVE-2023-37788

v1.1295.3

Compare Source

The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation

Bug Fixes

• security: Upgrades dependencies to address CVE-2025-21614
• language-server: Improved memory usage when executing code scans on large projects
• language-server: Fix incorrect filtering of files when executing code scans which could fail the analysis
• language-server: Fix random unexpected logouts when using OAuth2 authentication

TypeStrong/TypeDoc (typedoc)

v0.28.0

Compare Source

Breaking Changes

• TypeDoc now expects all input globs paths to be specified with / path separators, #​2825.
• TypeDoc's --entryPointStrategy merge mode now requires JSON from at least version 0.28.0.
• Removed jp translations from lang, to migrate switch to ja.
• File name references in intentionallyNotExported now use a package name/package relative path instead of an absolute path for matching.
• The source-order sort ordering now considers package names / package relative paths instead of using the absolute paths to a file.
• TypeDoc will only check for a project README file next to the discovered package.json file if --readme is not set
  this change improves handling of monorepo setups where some packages have readme files and others do not, #​2875.
• Function-like variable exports will now only be automatically converted as function types if
  they are initialized with a function expression. TypeDoc can be instructed to convert them as functions
  with the @function tag, #​2881.
• Object literal type alias types will now be converted in a way which causes them to be rendered more similarly
  to how interfaces are rendered, #​2817.

API Breaking Changes

• ProjectReflection.getReflectionFromSymbol and ProjectReflection.getSymbolFromReflection have been moved to Context
• Path and PathArray parameter types now always contain normalized paths.
• Introduced a Router which is used for URL creation. Reflection.url,
  Reflection.anchor, and Reflection.hasOwnDocument have been removed.
• Deserializer.reviveProject(s) no longer accepts an option to add project documents.
• Deserializer.reviveProjects now requires an alwaysCreateEntryPointModule option.
• Comment.serializeDisplayParts no longer requires a serializer argument.
• ReflectionSymbolId.fileName is now optional, TypeDoc now stores a combination of a package name and package relative path instead.
  The fileName property will be present when initially created, but is not serialized.
• Removed DeclarationReflection.relevanceBoost attribute which was added for plugins, but never used.
• i18n proxy is no longer passed to many functions, instead, reference i18n exported from the module directly.
• ReflectionKind.singularString and ReflectionKind.pluralString now returns translated strings.
  The methods on Internationalization to do this previously have been removed.
• The HTML output structure for the search box has changed to support the new modal.
• DefaultThemeRenderContext's typeDeclaration and typeDetailsIfUseful
  methods now require both a reflection and a type in order to support
  @expandType

Features

• Add support for TypeScript 5.8.x
• The search modal in the HTML output has been rewritten to provide better mobile support
• Added a --router option which can be used to modify TypeDoc's output folder
  structure. This can be extended with plugins, #​2111.
• Introduced the @primaryExport modifier tag to provide more fine grained
  control over export conversion order, #​2856
• Introduced packagesRequiringDocumentation option for validation.notDocumented, TypeDoc will expect comments to be present for symbols in the specified packages.
• TypeDoc now exports a typedoc/browser entrypoint for parsing and using serialized JSON files, #​2528.
• Type packageOptions as Partial<TypeDocOptions>, #​2878.
• TypeDoc will now warn if an option which should only be set at the root level is set in packageOptions, #​2878.
• Introduced @function tag to force TypeDoc to convert variable declarations with a type annotation as functions, #​2881.
• Exposed a TypeDoc global object in the HTML theme which can be used to prevent TypeDoc from using localStorage, #​2872.
• Introduced @preventInline and @inlineType tags for further control extending the @inline tag, #​2862.
• Introduced @preventExpand and @expandType tags for further control extending the @expand tag, #​2862.
• API: Introduced DefaultThemeRenderContext.reflectionIcon for more granular control over displayed reflection icons.

Bug Fixes

• TypeDoc will now only create references for symbols re-exported from modules.
• Variable-functions will now prefer placing the comment on the signature if there is only one signature present, #​2824.
• User filter settings will no longer sometimes cause the search to have fewer visible results than expected.
• Fixed handling of expando functions which were also merged with a namespace, #​2876.
• Fixed rendering of function types within arrays and union types, #​2892.
• Fixed an issue where if the theme JS didn't load, the page wouldn't be shown, #​2894.

Thanks!

• @​crimx
• @​jsmith2-coveo
• @​phoneticallySAARTHaK
• @​XeroAlpha

v0.27.9

Compare Source

This will be the last v0.27.x release, see #​2868 for discussion on the 0.28 beta.

Features

• Added support for TypeScript 5.8

v0.27.8

Compare Source

Features

• The visibilityFilter option now supports individual signatures, #​2846.
• The favicon option may now be given a link starting with https?:// instead of a path, #​2851.
• TypeDoc now supports specifying # as the link in externalSymbolLinkMappings to indicate the type should not be linked to, #​2853.

Bug Fixes

• Fixed an issue where unrecognized languages would incorrectly be listed in the list of languages with translations, #​2852.
• Unresolved external type references will no longer incorrectly linked to undefined, #​2854.

Thanks!

• @​pjeby
• @​XeroAlpha

v0.27.7

Compare Source

Features

• @includeCode and @inline can now inject parts of files using region
  names or line numbers, #​2816.
• Introduced ja translation options, deprecated jp in favor of ja, #​2843.
• Improved TypeDoc's --watch option to support watching files not caught by
  TypeScript's watch mode, #​2675.
• The @inline tag now works in more places for generic types.
• Visibility filters now consider individual signatures, #​2846.

Bug Fixes

• Fixed an issue where TypeDoc would incorrectly ignore type arguments in references, #​2823.
• Improved narrator support for labeling icons, #​2832.
• Fixed an issue with @class incorrectly handling mapped types, #​2842.
• TypeDoc will now consider symbols to be external only if all of their declarations are external
  so that declaration merged members with global symbols can be documented, #​2844.
• Fixed an issue where TypeDoc would constantly rebuild, #​2844.
• Fixed an issue where the dropdown arrow in the index group would not respect the state of the dropdown, #​2845.

Thanks!

• @​pjeby
• @​shawninder
• @​tats-u
• @​XeroAlpha

v0.27.6

Compare Source

Features

• Added ignoredHighlightLanguages option to specify languages which will be
  allowed in code blocks but not highlighted, #​2819.

Bug Fixes

• @include and @includeCode now work in the readme file, #​2814.
• TypeDoc will now avoid making references to references, #​2811.
• Fixed output specific option specification, #​2818.
• Improved type reference conversion to avoid including defaulted type arguments, #​2820.
• Fixed parsing of declaration references which include a module and a local reference, #​2810.
• Improved link resolution logic to prioritize type alias properties with the
  same symbol over type literal properties within function parameters.

v0.27.5

Compare Source

Bug Fixes

• Possibly Breaking: TypeDoc will no longer render anchors within the page for
  deeply nested properties. This only affects links to properties of
  properties of types, which did not have a clickable link exposed so are
  unlikely to have been linked to. Furthermore, these links were not always
  created by TypeDoc, only being created if all parent properties contained
  comments, #​2808.
• TypeDoc will now warn if a property which does not have a URL within the
  rendered document and the parent property/page will be linked to instead,
  #​2808. These warnings can be disabled with the validation.rewrittenLink
  option.
• Fix restoration of groups/categories including documents, #​2801.
• Fixed missed relative paths within markdown link references in documents.
• Improved handling of incomplete inline code blocks within markdown.
• Direct https:// links under the hostedBaseUrl option's URL will no
  longer be treated as external, #​2809.

Thanks!

• @​SacDeNoeuds

v0.27.4

Compare Source

Features

• API: Introduced new Converter.EVENT_CREATE_PROJECT event which fires when a project is created by the converter, #​2800.

Bug Fixes

• Switch from gzip to deflate for compressing assets to make output consistent across different operating systems, #​2796.
• @include and @includeCode now work for comments on the entry point for projects with a single entry point, #​2800.
• Cascaded modifier tags will no longer be copied into type literals, #​2802.
• @summary now works to describe functions within modules, #​2803.
• Corrected navigation showing module link as current when not on module page, #​2805.

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

New, updated, and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/@babel/core@7.26.7 ➜ 7.26.10	Transitive: environment, filesystem	+41	17.5 MB
npm/@babel/plugin-transform-runtime@7.25.9 ➜ 7.26.10	Transitive: environment, filesystem	+46	17.7 MB	nicolo-ribaudo
npm/@babel/preset-env@7.26.7 ➜ 7.26.9	Transitive: environment, filesystem, unsafe	+130	24.6 MB	existentialism, hzoo, jlhwung, ...1 more
npm/@babel/runtime@7.26.7 ➜ 7.26.10	None	+1	276 kB	nicolo-ribaudo
npm/@types/lodash@4.17.14 ➜ 4.17.16	None	0	868 kB	types

View full report↗︎