chore(deps): update dependency @babel/core to v7.29.6 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@babel/core (source)	7.29.0 → 7.29.6

---

@​babel/core: Arbitrary File Read via sourceMappingURL Comment

CVE-2026-49356 / GHSA-4x5r-pxfx-6jf8

More information

Details

Impact

Using @babel/core to compile maliciously crafted code can allow ab attacker to read any source map from the system that is running Babel, if these conditions are all true:

• the attacker controls the input source code
• the attacker can read the output source code
• the attacker knows the path of the source map file that they want to read

Users that only compile trusted code are not impacted.

Patches

The vulnerability has been fixed in @babel/core@7.29.6 and @babel/core@8.0.0-rc.6.

Workarounds

Callers can mitigate the issue without upgrading by setting inputSourceMap: false in their Babel options.

Callers can also manually extract the #sourceMappingURL comment from the input source code, validate whether the source map that it links to is allowed to be read, and if it is pass an object to inputSourceMap (passing false when it's not).

Credits

Thanks Teodor-Cristian Radoi for reporting the vulnerability.

Severity

• CVSS Score: 3.2 / 10 (Low)
• Vector String: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

References

• https://github.com/babel/babel/security/advisories/GHSA-4x5r-pxfx-6jf8
• https://nvd.nist.gov/vuln/detail/CVE-2026-49356
• https://babeljs.io/docs/options#inputsourcemap
• https://github.com/babel/babel

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

babel/babel (@​babel/core)

v7.29.6

Compare Source

v7.29.6 (2026-05-25)

🐛 Bug Fix

• babel-generator
  • #​18014 Catchup source map position in preserveFormat (@​nicolo-ribaudo)
• babel-core
  • #​18001 [7.x packport]Improve input source map handling (@​JLHwung)
• babel-core, babel-generator
  • #​17998 Preserve original identifier names from input sourcemaps (#​17992) (@​Andarist)

Committers: 3

• Huáng Jùnliàng (@​JLHwung)
• Mateusz Burzyński (@​Andarist)
• Nicolò Ribaudo (@​nicolo-ribaudo)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
next-enterprise	Ready	Preview	Aug 26, 2026 2:55pm

[github-actions]

📦 Next.js Bundle Analysis for next-enterprise

This analysis was generated by the Next.js Bundle Analysis action. 🤖

🎉 Global Bundle Size Decreased

Page	Size (compressed)
global	99.5 KB (🟢 -94 B)

Details

The global bundle is the javascript bundle that loads alongside every page. It is in its own category because its impact is much higher - an increase to its size means that every page on your website loads slower, and a decrease means every page loads faster.

Any third party scripts you have added directly to your app using the <script> tag are not accounted for in this analysis

If you want further insight into what is behind the changes, give @next/bundle-analyzer a try!

Four Pages Changed Size

The following pages changed size from the code in this PR compared to its base branch:

Page	Size (compressed)	First Load
/_not-found/page	994 B (🟢 8 B)	100.48 KB
/layout	3.23 KB (🟢 1 B)	102.73 KB
/api/health/route	127 B (🟢 1 B)	99.63 KB
/page	127 B (🟢 1 B)	99.63 KB

Details

Only the gzipped size is provided here based on an expert tip.

First Load is the size of the global bundle plus the bundle for the individual page. If a user were to show up to your website and land on a given page, the first load size represents the amount of javascript that user would need to download. If next/link is used, subsequent page loads would only need to download that page's bundle (the number in the "Size" column), since the global bundle has already been downloaded.

Any third party scripts you have added directly to your app using the <script> tag are not accounted for in this analysis

Next to the size is how much the size has increased or decreased compared with the base branch of this PR. If this percentage has increased by undefined% or more, there will be a red status indicator applied, indicating that special attention should be given to this.