Bump @babel/traverse from 7.16.10 to 7.23.2 in /research-hub-web by dependabot[bot] · Pull Request #410 · UoA-eResearch/hub-stack

dependabot · 2023-10-17T10:17:36Z

Bumps @babel/traverse from 7.16.10 to 7.23.2.

Release notes

Sourced from @babel/traverse's releases.

v7.23.2 (2023-10-11)

NOTE: This release also re-publishes @babel/core, even if it does not appear in the linked release commit.

Thanks @jimmydief for your first PR!

🐛 Bug Fix

babel-traverse

#16033 Only evaluate own String/Number/Math methods (@nicolo-ribaudo)

babel-preset-typescript

#16022 Rewrite .tsx extension when using rewriteImportExtensions (@jimmydief)

babel-helpers

#16017 Fix: fallback to typeof when toString is applied to incompatible object (@JLHwung)

babel-helpers, babel-plugin-transform-modules-commonjs, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime

#16025 Avoid override mistake in namespace imports (@nicolo-ribaudo)

Committers: 5

Babel Bot (@babel-bot)

Huáng Jùnliàng (@JLHwung)

James Diefenderfer (@jimmydief)

Nicolò Ribaudo (@nicolo-ribaudo)

@liuxingbaoyu

v7.23.1 (2023-09-25)

Re-publishing @babel/helpers due to a publishing error in 7.23.0.

v7.23.0 (2023-09-25)

Thanks @lorenzoferre and @RajShukla1 for your first PRs!

🚀 New Feature

babel-plugin-proposal-import-wasm-source, babel-plugin-syntax-import-source, babel-plugin-transform-dynamic-import

#15870 Support transforming import source for wasm (@nicolo-ribaudo)

babel-helper-module-transforms, babel-helpers, babel-plugin-proposal-import-defer, babel-plugin-syntax-import-defer, babel-plugin-transform-modules-commonjs, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime, babel-standalone

#15878 Implement import defer proposal transform support (@nicolo-ribaudo)

babel-generator, babel-parser, babel-types

#15845 Implement import defer parsing support (@nicolo-ribaudo)

#15829 Add parsing support for the "source phase imports" proposal (@nicolo-ribaudo)

babel-generator, babel-helper-module-transforms, babel-parser, babel-plugin-transform-dynamic-import, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-systemjs, babel-traverse, babel-types

#15682 Add createImportExpressions parser option (@JLHwung)

babel-standalone

#15671 Pass through nonce to the transformed script element (@JLHwung)

babel-helper-function-name, babel-helper-member-expression-to-functions, babel-helpers, babel-parser, babel-plugin-proposal-destructuring-private, babel-plugin-proposal-optional-chaining-assign, babel-plugin-syntax-optional-chaining-assign, babel-plugin-transform-destructuring, babel-plugin-transform-optional-chaining, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime, babel-standalone, babel-types

#15751 Add support for optional chain in assignments (@nicolo-ribaudo)

babel-helpers, babel-plugin-proposal-decorators

#15895 Implement the "decorator metadata" proposal (@nicolo-ribaudo)

babel-traverse, babel-types

#15893 Add t.buildUndefinedNode (@liuxingbaoyu)

babel-preset-typescript

... (truncated)

Changelog

Sourced from @babel/traverse's changelog.

v7.23.2 (2023-10-11)

🐛 Bug Fix

babel-traverse

#16033 Only evaluate own String/Number/Math methods (@nicolo-ribaudo)

babel-preset-typescript

#16022 Rewrite .tsx extension when using rewriteImportExtensions (@jimmydief)

babel-helpers

#16017 Fix: fallback to typeof when toString is applied to incompatible object (@JLHwung)

babel-helpers, babel-plugin-transform-modules-commonjs, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime

#16025 Avoid override mistake in namespace imports (@nicolo-ribaudo)

v7.23.0 (2023-09-25)

🚀 New Feature

babel-plugin-proposal-import-wasm-source, babel-plugin-syntax-import-source, babel-plugin-transform-dynamic-import

#15870 Support transforming import source for wasm (@nicolo-ribaudo)

babel-helper-module-transforms, babel-helpers, babel-plugin-proposal-import-defer, babel-plugin-syntax-import-defer, babel-plugin-transform-modules-commonjs, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime, babel-standalone

#15878 Implement import defer proposal transform support (@nicolo-ribaudo)

babel-generator, babel-parser, babel-types

#15845 Implement import defer parsing support (@nicolo-ribaudo)

#15829 Add parsing support for the "source phase imports" proposal (@nicolo-ribaudo)

babel-generator, babel-helper-module-transforms, babel-parser, babel-plugin-transform-dynamic-import, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-systemjs, babel-traverse, babel-types

#15682 Add createImportExpressions parser option (@JLHwung)

babel-standalone

#15671 Pass through nonce to the transformed script element (@JLHwung)

babel-helper-function-name, babel-helper-member-expression-to-functions, babel-helpers, babel-parser, babel-plugin-proposal-destructuring-private, babel-plugin-proposal-optional-chaining-assign, babel-plugin-syntax-optional-chaining-assign, babel-plugin-transform-destructuring, babel-plugin-transform-optional-chaining, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime, babel-standalone, babel-types

#15751 Add support for optional chain in assignments (@nicolo-ribaudo)

babel-helpers, babel-plugin-proposal-decorators

#15895 Implement the "decorator metadata" proposal (@nicolo-ribaudo)

babel-traverse, babel-types

#15893 Add t.buildUndefinedNode (@liuxingbaoyu)

babel-preset-typescript

#15913 Add rewriteImportExtensions option to TS preset (@nicolo-ribaudo)

babel-parser

#15896 Allow TS tuples to have both labeled and unlabeled elements (@yukukotani)

🐛 Bug Fix

babel-plugin-transform-block-scoping

#15962 fix: transform-block-scoping captures the variables of the method in the loop (@liuxingbaoyu)

💅 Polish

babel-traverse

#15797 Expand evaluation of global built-ins in @babel/traverse (@lorenzoferre)

babel-plugin-proposal-explicit-resource-management

#15985 Improve source maps for blocks with using declarations (@nicolo-ribaudo)

🔬 Output optimization

babel-core, babel-helper-module-transforms, babel-plugin-transform-async-to-generator, babel-plugin-transform-classes, babel-plugin-transform-dynamic-import, babel-plugin-transform-function-name, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-umd, babel-plugin-transform-parameters, babel-plugin-transform-react-constant-elements, babel-plugin-transform-react-inline-elements, babel-plugin-transform-runtime, babel-plugin-transform-typescript, babel-preset-env

#15984 Inline exports.XXX = update in simple variable declarations (@nicolo-ribaudo)

v7.22.20 (2023-09-16)

... (truncated)

Commits

b4b9942 v7.23.2
b13376b Only evaluate own String/Number/Math methods (#16033)
ca58ec1 v7.23.0
0f333da Add createImportExpressions parser option (#15682)
3744545 Fix linting
c7e6806 Add t.buildUndefinedNode (#15893)
38ee8b4 Expand evaluation of global built-ins in @babel/traverse (#15797)
9f3dfd9 v7.22.20
3ed28b2 Fully support || and && in pluginToggleBooleanFlag (#15961)
77b0d73 v7.22.19
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Expandable page part

Add capabilities navbar link

Change activities label to research stage

Bugfix/update csp

Fix failed start up due to Contentful type changes

dependabot · 2023-10-17T10:17:38Z

Dependabot tried to add @Trombach, @cakr322 and @eric-el-tan as reviewers to this PR, but received the following error from GitHub:

POST https://api.github.com/repos/UoA-eResearch/hub-stack/pulls/410/requested_reviewers: 422 - Reviews may only be requested from collaborators. One or more of the users or teams you specified is not a collaborator of the UoA-eResearch/hub-stack repository. // See: https://docs.github.com/rest/pulls/review-requests#request-reviewers-for-a-pull-request

…search-stage-url RSM-3036: stage: replace search with url

…rsion Update linting.yml

Feature/rsm 3250 search logic

Bumps [@babel/traverse](https://github.com/babel/babel/tree/HEAD/packages/babel-traverse) from 7.16.10 to 7.23.2. - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.23.2/packages/babel-traverse) --- updated-dependencies: - dependency-name: "@babel/traverse" dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

.github/workflows/linting.yml

+    name: Run linters
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out Git repository
+        uses: actions/checkout@v2
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v1
+        with:
+          node-version: 18
+
+      - name: Install Node.js dependencies
+        working-directory: ./research-hub-web
+        run: npm ci --force
+
+      - name: Install Angular CLI
+        run: npm install -g @angular/cli
+
+      - name: ng lint
+        working-directory: ./research-hub-web
+        run: ng lint


In general, the fix is to explicitly set permissions for the workflow (or for the individual job) so that GITHUB_TOKEN has only the minimal scopes required. For this linting job, it only needs to read the repository contents to check out the code; no writes to the repository or other resources appear necessary.

The best minimal change is to add a workflow-level permissions block just after the name: line and before on: in .github/workflows/linting.yml. This will apply to all jobs in this workflow, including run-linters, without changing any existing logic. The block should grant contents: read, which is sufficient for actions/checkout and for running local npm and ng lint commands. No new imports or additional methods are required, as this is purely a YAML configuration change.

Concretely, in .github/workflows/linting.yml, insert:

permissions: contents: read

between line 1 (name: Lint) and line 3 (on:), preserving indentation as shown.

.github/workflows/sentry.yml

+    name: Create Sentry Release
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out Git repository
+        uses: actions/checkout@v2
+      - name: Get Branch
+        id: var
+        run: echo ::set-output name=branch::${GITHUB_REF#refs/*/}
+      - name: Output Branch
+        run: echo ${{ steps.var.outputs.branch }}
+      - name: Notify Sentry
+        # https://github.com/getsentry/action-release
+        uses: getsentry/action-release@v1.1.6
+        env:
+          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+          SENTRY_ORG: university-of-auckland-7o
+          SENTRY_PROJECT: research-hub
+        with:
+          environment: ${{ steps.var.outputs.branch }}


In general, the fix is to add an explicit permissions block that scopes GITHUB_TOKEN to the least privileges needed. This can be done at the workflow root (applies to all jobs) or inside the specific job. Here we only have one job, so either level is fine; using the workflow root is slightly clearer and matches the CodeQL suggestion of a minimal starting point contents: read.

The best minimal change, without altering functionality, is to add a permissions block near the top of .github/workflows/sentry.yml, after the name: (or on:) key. The job uses actions/checkout, which requires contents: read at minimum. The Sentry release action uses an auth token in env and does not need GITHUB_TOKEN write scopes for GitHub resources based on the provided snippet. Therefore, we can safely restrict the token to contents: read. No additional methods, imports, or external dependencies are needed; this is a pure YAML configuration change in .github/workflows/sentry.yml.

.github/workflows/sentry.yml

+        run: echo ${{ steps.var.outputs.branch }}
+      - name: Notify Sentry
+        # https://github.com/getsentry/action-release
+        uses: getsentry/action-release@v1.1.6


hub-search-proxy/handler.js

+
+module.exports.search = async (event, context) => {
+    try {
+        console.log(`Received query: ${event.body}`);


In general, to fix log injection when logging user-controlled data, sanitize the data before logging. For plain-text logs, this typically means removing or replacing line breaks (\n, \r) and optionally clearly marking the portion that comes from user input. For HTML logs, HTML-encode the value before logging.

In this file, the best minimal-impact fix is to avoid logging event.body directly. Instead, derive a sanitized version—e.g., convert it to a string and strip carriage returns and newlines—then log that sanitized value. This preserves existing functionality (a human-readable record of the received body) while preventing an attacker from injecting additional log lines. Concretely, change line 53 so that it logs a sanitized version, such as String(event.body).replace(/[\r\n]/g, ''). No additional imports or helpers are needed; a small inline transformation suffices.

Only hub-search-proxy/handler.js needs editing, and only the logging line within module.exports.search at line 53.

Trombach and others added 30 commits November 16, 2021 13:01

formatting

712a773

Merge branch 'master' into expandable-page-part

c0dd75a

Merge pull request #170 from UoA-eResearch/expandable-page-part

fa63cc1

Expandable page part

streamlined observables

29f8ad1

remove mat-menu

75e83f2

sign out button suggestion

ac0a474

workaround for 404 page flashing when viewing protected content

17f18a1

redirect to list page if no slug is present

6837b6c

Merge branch 'master' into content-pages-refactor

e2aa65d

unit tests WIP

71b6b9e

unit tests wip

a4b7875

error handling

0627388

more error handling

cc31dff

removing icons

1d468df

delete unneeded module

0cc3aa5

unit tests clean ups and mock breadcrumbs

4c60400

breadcrumbs unit test

bc98231

add page titles for list pages

7f7905e

content page unit tests passing and moving collection list tests

39ef5aa

fix event page unit test

42a543d

list pages unit tests passing

6508af7

delete unused queries, add limit to all-items queries

01a0e40

minor fix for empty collection

fa8734b

Merge branch 'master' into login-menu

17c6645

fix empty doc and org cards for items in draft

6f8c141

added breadcrumbs unit tests

0b0f74d

fix breadcrumbs bug

029f140

remove matmenumodule and unused styles

f6c8388

improved 500 error message

190d6e3

clean up global variables

247adfd

cakr322 and others added 12 commits April 14, 2023 14:19

Merge pull request #367 from UoA-eResearch/add-capabilities-navbar-link

660223b

Add capabilities navbar link

Change activities label to research stage

17f8920

Merge pull request #398 from UoA-eResearch/change-activities-label-name

1292fa2

Change activities label to research stage

Update Content Security Policy

fffc2b5

Update Content Security Policy

e4fb73c

Merge pull request #400 from UoA-eResearch/bugfix/update-csp

8e32a1b

Bugfix/update csp

Fix failed start up due to Contentful type changes

f1ca6cd

Remove import used for debug

f8a217f

Clarify purpose of getProtectedTypes in doc

1a23b79

Also include collection resolvers as per original

31acef8

Merge pull request #402 from UoA-eResearch/fix-proxy-not-starting-up

69286e3

Fix failed start up due to Contentful type changes

Version number change

171f95d

dependabot bot added the dependencies Pull requests that update a dependency file label Oct 17, 2023

etan221 and others added 12 commits October 30, 2023 15:02

RSM-3036: stage: replace search with url

6af2a3b

RSM-3036: stage: use reference instead of string

52f7fd8

Merge pull request #419 from UoA-eResearch/feature/RSM-3036-update-re…

edc423f

…search-stage-url RSM-3036: stage: replace search with url

Update linting.yml

7493289

Update linting.yml

0d5f28a

Merge pull request #423 from UoA-eResearch/hotfix/update-lint-node-ve…

cc5d81a

…rsion Update linting.yml

RSM-3250 Change filter query logic

f404729

RSM-3250 Revert dev environment parameter names

a5f6514

RSM-3250 Revert dev parameters

2bf6a1b

Merge pull request #422 from UoA-eResearch/feature/RSM-3250-search-logic

7acfc9d

Feature/rsm 3250 search logic

Update version number

a304ebf

dependabot bot force-pushed the dependabot/npm_and_yarn/research-hub-web/babel/traverse-7.23.2 branch from 672fd86 to 407f99b Compare November 9, 2023 01:31

lugn621 force-pushed the dependabot/npm_and_yarn/research-hub-web/babel/traverse-7.23.2 branch from 407f99b to d377031 Compare April 2, 2026 02:11

github-advanced-security bot found potential problems Apr 2, 2026

View reviewed changes

@@ -1,5 +1,8 @@
             name: Sentry Release
+            permissions:
+              contents: read
             on:
               push:
                 branches:

@@ -50,7 +50,7 @@
             module.exports.search = async (event, context) => {
                 try {
-                    console.log(`Received query: ${event.body}`);
+                    console.log(`Received query: ${String(event.body).replace(/[\r\n]/g, '')}`);
                     const requestBody = JSON.parse(event.body);
                     let queryString = '';
                     let size = 10;

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump @babel/traverse from 7.16.10 to 7.23.2 in /research-hub-web#410

Bump @babel/traverse from 7.16.10 to 7.23.2 in /research-hub-web#410
dependabot[bot] wants to merge 2148 commits intomasterfrom
dependabot/npm_and_yarn/research-hub-web/babel/traverse-7.23.2

dependabot bot commented on behalf of github Oct 17, 2023 •

edited

Loading

Uh oh!

dependabot bot commented on behalf of github Oct 17, 2023

Uh oh!

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Check warning

Check warning

Copilot Autofix

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

@@ -1,4 +1,6 @@
             name: Lint
+            permissions:
+              contents: read
             on:
               # Trigger the workflow on push or pull request,

Conversation

dependabot bot commented on behalf of github Oct 17, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v7.23.2 (2023-10-11)

🐛 Bug Fix

Committers: 5

v7.23.1 (2023-09-25)

v7.23.0 (2023-09-25)

🚀 New Feature

v7.23.2 (2023-10-11)

🐛 Bug Fix

v7.23.0 (2023-09-25)

🚀 New Feature

🐛 Bug Fix

💅 Polish

🔬 Output optimization

v7.22.20 (2023-09-16)

Uh oh!

dependabot bot commented on behalf of github Oct 17, 2023

Uh oh!

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Check warning

Uh oh!

Check warning

Uh oh!

Copilot Autofix

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

dependabot bot commented on behalf of github Oct 17, 2023 •

edited

Loading