Update packages to the latest versions

Oct 13, 2025 by talynt.org 34 views

Introduction

In this article, we will discuss a vulnerability in the @babel/runtime package, specifically in versions less than 7.26.10. This vulnerability was discovered through an npm audit report, which highlights the importance of regular security audits and updates in our projects. We will walk through the steps to reproduce the issue, provide a step-by-step guide to fix it, and discuss the implications of this vulnerability.

Description

When using npm audit fix in a project that utilizes the @wordpress/scripts package, a moderate severity vulnerability is reported in the @babel/runtime package. The vulnerability is related to inefficient regular expression complexity in generated code with .replace when transpiling named capturing groups. This issue is tracked on GitHub at https://github.com/advisories/GHSA-968p-4wvh-cqc8.

Step-by-Step Reproduction Instructions

To reproduce this issue, follow these steps:

Update packages to the latest versions: Run ncu -u to update all packages to the latest versions.
Install dependencies: Run npm install to install the dependencies.
Run npm audit fix: Run npm audit fix in a project that uses the @wordpress/scripts package.

Screenshots, Screen Recording, Code Snippet

Unfortunately, there are no screenshots, screen recordings, or code snippets available to demonstrate this issue.

Environment Info

No specific environment information is provided for this issue.

Precautions and Pre-requisites

Before attempting to fix this issue, please confirm that you have:

Searched existing issues in the repository: [Yes]
Tested with all plugins deactivated except Gutenberg: [Yes]
Used the correct theme type for testing: [Not specified]

Fixing the Vulnerability

To fix this vulnerability, you can run the following command:

npm audit fix --force

This command will install the latest version of @babel/runtime (7.26.10 or higher) and update any dependent packages. However, please note that this may introduce breaking changes in your project.

Implications and Recommendations

The vulnerability in @babel/runtime versions less than 7.26.10 highlights the importance of regular security audits and updates in our projects. To prevent similar issues in the future:

Regularly update your packages to the latest versions using ncu -u and npm install.
Run npm audit fix regularly to identify and fix vulnerabilities.
Use a secure and up-to-date version of @babel/runtime (7.26.10 or higher) in your projects.

By following these best practices, you can ensure the security and stability of your projects and prevent potential vulnerabilities like this one.

Conclusion

Introduction

In our previous article, we discussed a vulnerability in the @babel/runtime package, specifically in versions less than 7.26.10. This vulnerability was discovered through an npm audit report, which highlights the importance of regular security audits and updates in our projects. In this Q&A article, we will address some common questions related to this vulnerability and provide additional information to help you understand and fix the issue.

Q: What is the vulnerability in @babel/runtime versions <7.26.10?

A: The vulnerability in @babel/runtime versions less than 7.26.10 is related to inefficient regular expression complexity in generated code with .replace when transpiling named capturing groups. This issue is tracked on GitHub at https://github.com/advisories/GHSA-968p-4wvh-cqc8.

Q: How do I know if my project is affected by this vulnerability?

A: If you are using @babel/runtime versions less than 7.26.10 in your project, you may be affected by this vulnerability. You can check your project's package.json file to see if you are using an affected version. You can also run npm audit to identify any vulnerabilities in your project.

Q: How do I fix the vulnerability in my project?

A: To fix the vulnerability, you can update @babel/runtime to version 7.26.10 or higher. You can do this by running the following command:

npm install @babel/runtime@7.26.10

Alternatively, you can run npm audit fix --force to install the latest version of @babel/runtime and update any dependent packages.

Q: Will updating @babel/runtime break my project?

A: Updating @babel/runtime may introduce breaking changes in your project, especially if you are using a custom configuration or plugins. Before updating, make sure to test your project thoroughly to ensure that it works as expected.

Q: Can I ignore this vulnerability?

A: No, it is not recommended to ignore this vulnerability. While it may not be a critical issue, it is still a moderate severity vulnerability that can potentially affect your project's security and stability.

Q: How can I prevent similar vulnerabilities in the future?

A: To prevent similar vulnerabilities in the future, make sure to:

Regularly update your packages to the latest versions using ncu -u and npm install.
Run npm audit regularly to identify any vulnerabilities in your project.
Use a secure and up-to-date version of @babel/runtime (7.26.10 or higher) in your projects.

Q: Where can I find more information about this vulnerability?

A: You can find more information about this vulnerability on GitHub at https://github.com/advisories/GHSA-968p-4wvh-cqc8. You can also check the official @babel/runtime documentation for more information on how to use the package securely.

Conclusion

In conclusion, the vulnerability in @babel/runtime versions less than 7.26.10 is a moderate severity issue that can be fixed by updating to the latest version of the package. Regular security audits and updates are essential to prevent similar issues in the future. By following the steps outlined in this article, you can ensure the security and stability of your projects and prevent potential vulnerabilities like this one.