chore(deps): bump core-js to ^3.32.2

[katesaikishore]

By submitting a PR to this repository, you agree to the terms within the Auth0 Code of Conduct. Please see the contributing guidelines for how to create and submit a high-quality PR for this repo.

Description

This PR resolves SEC-2156 by replacing the deprecated [email protected] dependency with the actively maintained core-js@^3.32.2, and by configuring Babel to inject only the necessary polyfills from Core-JS 3 at build time. Specifically:

• Dependency upgrades
  • Removed [email protected]
  • Added core-js@^3.32.2 and regenerator-runtime for async/await support
• Build configuration
  • Updated webpack.config.js so that @babel/preset-env now uses:

    useBuiltIns: "usage",
    corejs: 3

    enabling automatic, usage-based polyfill injection from Core-JS 3.
• No breaking changes to the public API; runtime behavior is preserved, but modern environments can now tree-shake and avoid shipping the full polyfill bundle.

This change fully addresses the high-severity install-script and deprecation alerts raised by Socket.dev.

References

• JIRA: SEC-2156
• Socket.dev alerts for [email protected] (deprecated & install-script risk)
• Related issue: https://github.com/katesaikishore/openidconnect-playground/issues/XX

Testing

1. Install & build

   npm install
   npm run build