Chore(deps): Bump the major group across 5 directories with 43 updates

[dependabot]

Bumps the major group with 41 updates in the / directory:

Package	From	To
@actions/core	1.11.1	3.0.1
@babel/core	7.29.7	8.0.1
@babel/eslint-parser	7.29.7	8.0.1
@babel/preset-env	7.29.7	8.0.2
@babel/preset-react	7.29.7	8.0.1
@babel/preset-typescript	7.29.7	8.0.1
babel-jest	29.7.0	30.4.1
eslint	9.18.0	10.6.0
eslint-import-resolver-typescript	3.7.0	4.4.5
eslint-plugin-react-hooks	5.1.0	7.1.1
eslint-webpack-plugin	5.0.0	6.0.0
glob	12.0.0	13.0.6
globals	16.0.0	17.7.0
got	14.4.5	15.0.6
jest	29.7.0	30.4.2
@types/jest	29.5.14	30.0.0
jsdom	26.0.0	29.1.1
lint-staged	15.4.1	17.0.8
react-i18next	15.4.1	17.0.8
typescript	5.7.3	6.0.3
webpack-cli	6.0.1	7.1.0
@lavamoat/allow-scripts	3.3.1	5.1.0
@lavamoat/preinstall-always-fail	2.1.0	3.0.0
eslint-plugin-jsdoc	50.6.2	63.0.10
@blockaid/client	0.31.0	1.4.0
bignumber.js	9.3.0	11.1.4
@sentry/browser	9.13.0	10.62.0
@stellar/typescript-wallet-sdk-km	1.9.0	3.0.1
@types/jsdom	21.1.7	28.0.3
@types/node	22.14.1	26.0.1
concurrently	9.1.2	10.0.3
copy-webpack-plugin	13.0.0	14.0.0
dotenv-webpack	8.1.0	9.0.0
i18next	25.0.1	26.3.3
i18next-scanner-webpack	0.9.1	1.0.0
jest-environment-jsdom	29.7.0	30.4.1
js-yaml	4.2.0	5.2.0
sass-loader	16.0.5	17.0.0
ses	1.12.0	2.2.0
@sentry/webpack-plugin	3.3.1	5.3.0
shadcn	3.8.4	4.12.0

Bumps the major group with 4 updates in the /@shared/api directory: typescript, @lavamoat/allow-scripts, @blockaid/client and bignumber.js.
Bumps the major group with 2 updates in the /@shared/helpers directory: typescript and bignumber.js.
Bumps the major group with 1 update in the /@stellar/freighter-api directory: @lavamoat/allow-scripts.
Bumps the major group with 19 updates in the /extension directory:

Package	From	To
@lavamoat/allow-scripts	3.3.2	5.1.0
bignumber.js	9.3.0	11.1.4
@amplitude/analytics-browser	2.44.4	2.44.3
@amplitude/experiment-js-client	1.21.2	1.21.1
@sentry/browser	9.13.0	10.62.0
@stellar/typescript-wallet-sdk-km	1.9.0	3.0.1
@types/jsdom	21.1.7	28.0.3
@types/node	22.14.1	26.0.1
concurrently	9.1.2	10.0.3
copy-webpack-plugin	13.0.0	14.0.0
dotenv-webpack	8.1.0	9.0.0
i18next	25.0.1	26.3.3
i18next-scanner-webpack	0.9.1	1.0.0
jest-environment-jsdom	29.7.0	30.4.1
js-yaml	4.2.0	5.2.0
sass-loader	16.0.5	17.0.0
ses	1.12.0	2.2.0
@sentry/webpack-plugin	3.3.1	5.3.0
shadcn	3.8.4	4.12.0

Updates @actions/core from 1.11.1 to 3.0.1

Changelog

Sourced from @​actions/core's changelog.

3.0.1

• Bump undici from 6.23.0 to 6.24.1 #2348

3.0.0

• Breaking change: Package is now ESM-only
  • CommonJS consumers must use dynamic import() instead of require()

2.0.3

• Bump @actions/http-client to 3.0.2

2.0.1

• Bump @​actions/exec from 1.1.1 to 2.0.0 #2199

2.0.0

• Add support for Node 24 #2110
• Bump @​actions/http-client from 2.0.1 to 3.0.0

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​actions/core since your current version.

Updates @babel/core from 7.29.7 to 8.0.1

Release notes

Sourced from @​babel/core's releases.

v8.0.1 (2026-06-17)

This release includes a breaking change that was in the Babel 8 migration guide's Getting ready section and in the release post, but the actual removal of the feature from the codebase was accidentally not complete.

💥 Breaking Change

• babel-core, babel-plugin-transform-object-rest-spread, babel-plugin-transform-runtime, babel-preset-env, babel-standalone
  • #18079 Actually remove preset-env's useBuiltIns (@​nicolo-ribaudo)

Committers: 2

• Huáng Jùnliàng (@​JLHwung)
• Nicolò Ribaudo (@​nicolo-ribaudo)

v8.0.0 (2026-06-16)

NOTE: The changelog below is relative to v8.0.0-rc.6. You can find a summary of all the breaking changes shipped in the Babel 8 release line in the migration guide for users and migration guide for plugin developers.

Read the release blog post at http://babeljs.io/blog/2026/06/16/8.0.0!

👓 Spec Compliance

• babel-core
  • #18039 perf: Only extract source map comments at the end of the file (@​liuxingbaoyu)

💥 Breaking Change

• babel-cli, babel-node, babel-plugin-proposal-decorators, babel-plugin-transform-classes, babel-plugin-transform-function-name, babel-plugin-transform-modules-commonjs, babel-plugin-transform-object-rest-spread, babel-plugin-transform-parameters, babel-plugin-transform-react-constant-elements, babel-plugin-transform-regenerator, babel-preset-env, babel-register
  • #18069 Fallback to assuming ESM support with modules: auto (@​nicolo-ribaudo)
• babel-plugin-transform-runtime, babel-runtime-corejs3, babel-runtime
  • #18036 Remove corejs exports for @babe/runtime-corejs3 (@​liuxingbaoyu)
• babel-parser
  • #18034 Remove locations: "packed" (@​liuxingbaoyu)

🐛 Bug Fix

• babel-generator
  • #18046 fix(generator): improve new callee parens check (@​JLHwung)
• babel-plugin-transform-modules-systemjs
  • #18032 fix(systemjs): support proto as an export name (@​JLHwung)

📝 Documentation

• #18070 Add EOL date for Babel 7 (end of June 2027) to SECURITY.md (@​nicolo-ribaudo)

🏠 Internal

• #18018 ci: enforce yarn integrity (@​JLHwung)

🏃‍♀️ Performance

• babel-core
  • #18039 perf: Only extract source map comments at the end of the file (@​liuxingbaoyu)

Committers: 6

• Babel Bot (@​babel-bot)
• Huáng Jùnliàng (@​JLHwung)
• James Garbutt (@​43081j)

... (truncated)

Changelog

Sourced from @​babel/core's changelog.

v8.0.1 (2026-06-17)

💥 Breaking Change

• babel-core, babel-plugin-transform-object-rest-spread, babel-plugin-transform-runtime, babel-preset-env, babel-standalone
  • #18079 Actually remove preset-env's useBuiltIns (@​nicolo-ribaudo)

v8.0.0 (2026-06-16)

👓 Spec Compliance

• babel-core
  • #18039 perf: Only extract source map comments at the end of the file (@​liuxingbaoyu)

💥 Breaking Change

• babel-cli, babel-node, babel-plugin-proposal-decorators, babel-plugin-transform-classes, babel-plugin-transform-function-name, babel-plugin-transform-modules-commonjs, babel-plugin-transform-object-rest-spread, babel-plugin-transform-parameters, babel-plugin-transform-react-constant-elements, babel-plugin-transform-regenerator, babel-preset-env, babel-register
  • #18069 Fallback to assuming ESM support with modules: auto (@​nicolo-ribaudo)
• babel-plugin-transform-runtime, babel-runtime-corejs3, babel-runtime
  • #18036 Remove corejs exports for @babe/runtime-corejs3 (@​liuxingbaoyu)
• babel-parser
  • #18034 Remove locations: "packed" (@​liuxingbaoyu)

🐛 Bug Fix

• babel-generator
  • #18046 fix(generator): improve new callee parens check (@​JLHwung)
• babel-plugin-transform-modules-systemjs
  • #18032 fix(systemjs): support proto as an export name (@​JLHwung)

📝 Documentation

• #18070 Add EOL date for Babel 7 (end of June 2027) to SECURITY.md (@​nicolo-ribaudo)

🏠 Internal

• #18018 ci: enforce yarn integrity (@​JLHwung)

🏃‍♀️ Performance

• babel-core
  • #18039 perf: Only extract source map comments at the end of the file (@​liuxingbaoyu)

v8.0.0-rc.6 (2026-05-25)

🐛 Bug Fix

• babel-generator
  • #18011 Catchup source map position in preserveFormat (@​nicolo-ribaudo)
• babel-core
  • #17999 fix: improve inputSourceMap URL handling (@​JLHwung)
• babel-core, babel-generator
  • #17992 Preserve original identifier names from input sourcemaps (@​Andarist)

🏠 Internal

• babel-core
  • #17970 Always use native Node.js TS support for config files (@​nicolo-ribaudo)
• babel-compat-data, babel-register
  • #17993 chore: use bundled dts for register and eslint-* (@​JLHwung)
• babel-helper-transform-fixture-test-runner, babel-node

... (truncated)

Commits

• b4be199 v8.0.1
• b68b1cb Actually remove preset-env's useBuiltIns (#18079)
• de007ea Avoid trailing zeroes in Babel 9 generated version (#18078)
• 7dc825a v8.0.0
• b71c35a perf: Only extract source map comments at the end of the file (#18039)
• e74b70d chore: Remove unused file (#18033)
• ae57969 chore: consolidate upwards traversal to empathic (#18030)
• 827d003 Change jest snapshotFormat (#18029)
• 34cf24e Update deps (#18023)
• 73bceef v8.0.0-rc.6
• Additional commits viewable in compare view

Updates @babel/eslint-parser from 7.29.7 to 8.0.1

Release notes

Sourced from @​babel/eslint-parser's releases.

v8.0.1 (2026-06-17)

This release includes a breaking change that was in the Babel 8 migration guide's Getting ready section and in the release post, but the actual removal of the feature from the codebase was accidentally not complete.

💥 Breaking Change

• babel-core, babel-plugin-transform-object-rest-spread, babel-plugin-transform-runtime, babel-preset-env, babel-standalone
  • #18079 Actually remove preset-env's useBuiltIns (@​nicolo-ribaudo)

Committers: 2

• Huáng Jùnliàng (@​JLHwung)
• Nicolò Ribaudo (@​nicolo-ribaudo)

v8.0.0 (2026-06-16)

NOTE: The changelog below is relative to v8.0.0-rc.6. You can find a summary of all the breaking changes shipped in the Babel 8 release line in the migration guide for users and migration guide for plugin developers.

Read the release blog post at http://babeljs.io/blog/2026/06/16/8.0.0!

👓 Spec Compliance

• babel-core
  • #18039 perf: Only extract source map comments at the end of the file (@​liuxingbaoyu)

💥 Breaking Change

• babel-cli, babel-node, babel-plugin-proposal-decorators, babel-plugin-transform-classes, babel-plugin-transform-function-name, babel-plugin-transform-modules-commonjs, babel-plugin-transform-object-rest-spread, babel-plugin-transform-parameters, babel-plugin-transform-react-constant-elements, babel-plugin-transform-regenerator, babel-preset-env, babel-register
  • #18069 Fallback to assuming ESM support with modules: auto (@​nicolo-ribaudo)
• babel-plugin-transform-runtime, babel-runtime-corejs3, babel-runtime
  • #18036 Remove corejs exports for @babe/runtime-corejs3 (@​liuxingbaoyu)
• babel-parser
  • #18034 Remove locations: "packed" (@​liuxingbaoyu)

🐛 Bug Fix

• babel-generator
  • #18046 fix(generator): improve new callee parens check (@​JLHwung)
• babel-plugin-transform-modules-systemjs
  • #18032 fix(systemjs): support proto as an export name (@​JLHwung)

📝 Documentation

• #18070 Add EOL date for Babel 7 (end of June 2027) to SECURITY.md (@​nicolo-ribaudo)

🏠 Internal

• #18018 ci: enforce yarn integrity (@​JLHwung)

🏃‍♀️ Performance

• babel-core
  • #18039 perf: Only extract source map comments at the end of the file (@​liuxingbaoyu)

Committers: 6

• Babel Bot (@​babel-bot)
• Huáng Jùnliàng (@​JLHwung)
• James Garbutt (@​43081j)

... (truncated)

Changelog

Sourced from @​babel/eslint-parser's changelog.

v8.0.1 (2026-06-17)

💥 Breaking Change

• babel-core, babel-plugin-transform-object-rest-spread, babel-plugin-transform-runtime, babel-preset-env, babel-standalone
  • #18079 Actually remove preset-env's useBuiltIns (@​nicolo-ribaudo)

v8.0.0 (2026-06-16)

👓 Spec Compliance

• babel-core
  • #18039 perf: Only extract source map comments at the end of the file (@​liuxingbaoyu)

💥 Breaking Change

• babel-cli, babel-node, babel-plugin-proposal-decorators, babel-plugin-transform-classes, babel-plugin-transform-function-name, babel-plugin-transform-modules-commonjs, babel-plugin-transform-object-rest-spread, babel-plugin-transform-parameters, babel-plugin-transform-react-constant-elements, babel-plugin-transform-regenerator, babel-preset-env, babel-register
  • #18069 Fallback to assuming ESM support with modules: auto (@​nicolo-ribaudo)
• babel-plugin-transform-runtime, babel-runtime-corejs3, babel-runtime
  • #18036 Remove corejs exports for @babe/runtime-corejs3 (@​liuxingbaoyu)
• babel-parser
  • #18034 Remove locations: "packed" (@​liuxingbaoyu)

🐛 Bug Fix

• babel-generator
  • #18046 fix(generator): improve new callee parens check (@​JLHwung)
• babel-plugin-transform-modules-systemjs
  • #18032 fix(systemjs): support proto as an export name (@​JLHwung)

📝 Documentation

• #18070 Add EOL date for Babel 7 (end of June 2027) to SECURITY.md (@​nicolo-ribaudo)

🏠 Internal

• #18018 ci: enforce yarn integrity (@​JLHwung)

🏃‍♀️ Performance

• babel-core
  • #18039 perf: Only extract source map comments at the end of the file (@​liuxingbaoyu)

v8.0.0-rc.6 (2026-05-25)

🐛 Bug Fix

• babel-generator
  • #18011 Catchup source map position in preserveFormat (@​nicolo-ribaudo)
• babel-core
  • #17999 fix: improve inputSourceMap URL handling (@​JLHwung)
• babel-core, babel-generator
  • #17992 Preserve original identifier names from input sourcemaps (@​Andarist)

🏠 Internal

• babel-core
  • #17970 Always use native Node.js TS support for config files (@​nicolo-ribaudo)
• babel-compat-data, babel-register
  • #17993 chore: use bundled dts for register and eslint-* (@​JLHwung)
• babel-helper-transform-fixture-test-runner, babel-node

... (truncated)

Commits

• b4be199 v8.0.1
• cd96c47 chore(pkg): set @​babel/core peer deps to ^8.0.0 (#18076)
• 7dc825a v8.0.0
• 34cf24e Update deps (#18023)
• 73bceef v8.0.0-rc.6
• cedb08b chore: use bundled dts for register and eslint-* (#17993)
• 0b91d35 Add file URL support for test runners (#18002)
• dc91f90 v8.0.0-rc.5
• b34c4e7 Bump typescript-eslint to 8.59.2 (#17984)
• 7f2dda1 chore: add custom no-extraneous-dependencies rule (#17971)
• Additional commits viewable in compare view

Updates @babel/preset-env from 7.29.7 to 8.0.2

Release notes

Sourced from @​babel/preset-env's releases.

v8.0.2 (2026-06-18)

🐛 Bug Fix

• Other
  • #18083 Use the @babel/core version when asserting version in @babel/standalone (@​nicolo-ribaudo)
• babel-helper-validator-identifier
  • #18075 fix(identifier): avoid double escaping slash (@​JLHwung)

🏠 Internal

• babel-plugin-proposal-decorators, babel-plugin-transform-regenerator, babel-preset-env
  • #18081 Update @babel/preset-modules and polyfill packages (@​nicolo-ribaudo)

Committers: 2

• Huáng Jùnliàng (@​JLHwung)
• Nicolò Ribaudo (@​nicolo-ribaudo)

v8.0.1 (2026-06-17)

This release includes a breaking change that was in the Babel 8 migration guide's Getting ready section and in the release post, but the actual removal of the feature from the codebase was accidentally not complete.

💥 Breaking Change

• babel-core, babel-plugin-transform-object-rest-spread, babel-plugin-transform-runtime, babel-preset-env, babel-standalone
  • #18079 Actually remove preset-env's useBuiltIns (@​nicolo-ribaudo)

Committers: 2

• Huáng Jùnliàng (@​JLHwung)
• Nicolò Ribaudo (@​nicolo-ribaudo)

v8.0.0 (2026-06-16)

NOTE: The changelog below is relative to v8.0.0-rc.6. You can find a summary of all the breaking changes shipped in the Babel 8 release line in the migration guide for users and migration guide for plugin developers.

Read the release blog post at http://babeljs.io/blog/2026/06/16/8.0.0!

👓 Spec Compliance

• babel-core
  • #18039 perf: Only extract source map comments at the end of the file (@​liuxingbaoyu)

💥 Breaking Change

• babel-cli, babel-node, babel-plugin-proposal-decorators, babel-plugin-transform-classes, babel-plugin-transform-function-name, babel-plugin-transform-modules-commonjs, babel-plugin-transform-object-rest-spread, babel-plugin-transform-parameters, babel-plugin-transform-react-constant-elements, babel-plugin-transform-regenerator, babel-preset-env, babel-register
  • #18069 Fallback to assuming ESM support with modules: auto (@​nicolo-ribaudo)
• babel-plugin-transform-runtime, babel-runtime-corejs3, babel-runtime
  • #18036 Remove corejs exports for @babe/runtime-corejs3 (@​liuxingbaoyu)
• babel-parser
  • #18034 Remove locations: "packed" (@​liuxingbaoyu)

🐛 Bug Fix

• babel-generator
  • #18046 fix(generator): improve new callee parens check (@​JLHwung)
• babel-plugin-transform-modules-systemjs

... (truncated)

Changelog

Sourced from @​babel/preset-env's changelog.

v8.0.2 (2026-06-18)

🐛 Bug Fix

• Other
  • #18083 Use the @babel/core version when asserting version in @babel/standalone (@​nicolo-ribaudo)
• babel-helper-validator-identifier
  • #18075 fix(identifier): avoid double escaping slash (@​JLHwung)

🏠 Internal

• babel-plugin-proposal-decorators, babel-plugin-transform-regenerator, babel-preset-env
  • #18081 Update @babel/preset-modules and polyfill packages (@​nicolo-ribaudo)

v8.0.1 (2026-06-17)

💥 Breaking Change

• babel-core, babel-plugin-transform-object-rest-spread, babel-plugin-transform-runtime, babel-preset-env, babel-standalone
  • #18079 Actually remove preset-env's useBuiltIns (@​nicolo-ribaudo)

v8.0.0 (2026-06-16)

👓 Spec Compliance

• babel-core
  • #18039 perf: Only extract source map comments at the end of the file (@​liuxingbaoyu)

💥 Breaking Change

• babel-cli, babel-node, babel-plugin-proposal-decorators, babel-plugin-transform-classes, babel-plugin-transform-function-name, babel-plugin-transform-modules-commonjs, babel-plugin-transform-object-rest-spread, babel-plugin-transform-parameters, babel-plugin-transform-react-constant-elements, babel-plugin-transform-regenerator, babel-preset-env, babel-register
  • #18069 Fallback to assuming ESM support with modules: auto (@​nicolo-ribaudo)
• babel-plugin-transform-runtime, babel-runtime-corejs3, babel-runtime
  • #18036 Remove corejs exports for @babe/runtime-corejs3 (@​liuxingbaoyu)
• babel-parser
  • #18034 Remove locations: "packed" (@​liuxingbaoyu)

🐛 Bug Fix

• babel-generator
  • #18046 fix(generator): improve new callee parens check (@​JLHwung)
• babel-plugin-transform-modules-systemjs
  • #18032 fix(systemjs): support proto as an export name (@​JLHwung)

📝 Documentation

• #18070 Add EOL date for Babel 7 (end of June 2027) to SECURITY.md (@​nicolo-ribaudo)

🏠 Internal

• #18018 ci: enforce yarn integrity (@​JLHwung)

🏃‍♀️ Performance

• babel-core
  • #18039 perf: Only extract source map comments at the end of the file (@​liuxingbaoyu)

v8.0.0-rc.6 (2026-05-25)

🐛 Bug Fix

• babel-generator
  • #18011 Catchup source map position in preserveFormat (@​nicolo-ribaudo)

... (truncated)

Commits

• 73940a0 v8.0.2
• 59a63a6 Update @babel/preset-modules and polyfill packages (#18081)
• b4be199 v8.0.1
• b68b1cb Actually remove preset-env's useBuiltIns (#18079)
• cd96c47 chore(pkg): set @​babel/core peer deps to ^8.0.0 (#18076)
• 7dc825a v8.0.0
• 004f4b4 Fallback to assuming ESM support with modules: auto (#18069)
• 73bceef v8.0.0-rc.6
• c6d71f3 Enable strictFunctionTypes (#17946)
• dc91f90 v8.0.0-rc.5
• Additional commits viewable in compare view

Updates @babel/preset-react from 7.29.7 to 8.0.1

Release notes

Sourced from @​babel/preset-react's releases.

v8.0.1 (2026-06-17)

This release includes a breaking change that was in the Babel 8 migration guide's Getting ready section and in the release post, but the actual removal of the feature from the codebase was accidentally not complete.

💥 Breaking Change

• babel-core, babel-plugin-transform-object-rest-spread, babel-plugin-transform-runtime, babel-preset-env, babel-standalone
  • #18079 Actually remove preset-env's useBuiltIns (@​nicolo-ribaudo)

Committers: 2

• Huáng Jùnliàng (@​JLHwung)
• Nicolò Ribaudo (@​nicolo-ribaudo)

v8.0.0 (2026-06-16)

NOTE: The changelog below is relative to v8.0.0-rc.6. You can find a summary of all the breaking changes shipped in the Babel 8 release line in the migration guide for users and migration guide for plugin developers.

Read the release blog post at http://babeljs.io/blog/2026/06/16/8.0.0!

👓 Spec Compliance

• babel-core
  • #18039 perf: Only extract source map comments at the end of the file (@​liuxingbaoyu)

💥 Breaking Change

• babel-cli, babel-node, babel-plugin-proposal-decorators, babel-plugin-transform-classes, babel-plugin-transform-function-name, babel-plugin-transform-modules-commonjs, babel-plugin-transform-object-rest-spread, babel-plugin-transform-parameters, babel-plugin-transform-react-constant-elements, babel-plugin-transform-regenerator, babel-preset-env, babel-register
  • #18069 Fallback to assuming ESM support with modules: auto (@​nicolo-ribaudo)
• babel-plugin-transform-runtime, babel-runtime-corejs3, babel-runtime
  • #18036 Remove corejs exports for @babe/runtime-corejs3 (@​liuxingbaoyu)
• babel-parser
  • #18034 Remove locations: "packed" (@​liuxingbaoyu)

🐛 Bug Fix

• babel-generator
  • #18046 fix(generator): improve new callee parens check (@​JLHwung)
• babel-plugin-transform-modules-systemjs
  • #18032 fix(systemjs): support proto as an export name (@​JLHwung)

📝 Documentation

• #18070 Add EOL date for Babel 7 (end of June 2027) to SECURITY.md (@​nicolo-ribaudo)

🏠 Internal

• #18018 ci: enforce yarn integrity (@​JLHwung)

🏃‍♀️ Performance

• babel-core
  • #18039 perf: Only extract source map comments at the end of the file (@​liuxingbaoyu)

Committers: 6

• Babel Bot (@​babel-bot)
• Huáng Jùnliàng (@​JLHwung)
• James Garbutt (@​43081j)

... (truncated)

Changelog

Sourced from @​babel/preset-react's changelog.

v8.0.1 (2026-06-17)

💥 Breaking Change

• babel-core, babel-plugin-transform-object-rest-spread, babel-plugin-transform-runtime, babel-preset-env, babel-standalone
  • #18079 Actually remove preset-env's useBuiltIns (@​nicolo-ribaudo)

v8.0.0 (2026-06-16)

👓 Spec Compliance

• babel-core
  • #18039 perf: Only extract source map comments at the end of the file (@​liuxingbaoyu)

💥 Breaking Change

• babel-cli, babel-node, babel-plugin-proposal-decorators, babel-plugin-transform-classes, babel-plugin-transform-function-name, babel-plugin-transform-modules-commonjs, babel-plugin-transform-object-rest-spread, babel-plugin-transform-parameters, babel-plugin-transform-react-constant-elements, babel-plugin-transform-regenerator, babel-preset-env, babel-register
  • #18069 Fallback to assuming ESM support with modules: auto (@​nicolo-ribaudo)
• babel-plugin-transform-runtime, babel-runtime-corejs3, babel-runtime
  • #18036 Remove corejs exports for @babe/runtime-corejs3 (@​liuxingbaoyu)
• babel-parser
  • #18034 Remove locations: "packed" (@​liuxingbaoyu)

🐛 Bug Fix

• babel-generator
  • #18046 fix(generator): improve new callee parens check (@​JLHwung)
• babel-plugin-transform-modules-systemjs
  • #18032 fix(systemjs): support proto as an export name (@​JLHwung)

📝 Documentation

• #18070 Add EOL date for Babel 7 (end of June 2027) to SECURITY.md (@​nicolo-ribaudo)

🏠 Internal

• #18018 ci: enforce yarn integrity (@​JLHwung)

🏃‍♀️ Performance

• babel-core
  • #18039 perf: Only extract source map comments at the end of the file (@​liuxingbaoyu)

v8.0.0-rc.6 (2026-05-25)

🐛 Bug Fix

• babel-generator
  • #18011 Catchup source map position in preserveFormat (@​nicolo-ribaudo)
• babel-core
  • #17999 fix: improve inputSourceMap URL handling (@​JLHwung)
• babel-core, babel-generator
  • #17992 Preserve original identifier names from input sourcemaps (@​Andarist)

🏠 Internal

• babel-core
  • #17970 Always use native Node.js TS support for config files (@​nicolo-ribaudo)
• babel-compat-data, babel-register
  • #17993 chore: use bundled dts for register and eslint-* (@​JLHwung)
• babel-helper-transform-fixture-test-runner, babel-node

... (truncated)

Commits

• b4be199 v8.0.1
• cd96c47 chore(pkg): set @​babel/core peer deps to ^8.0.0 (#18076)
• 7dc825a v8.0.0
• 827d003 Change jest snapshotFormat (#18029)
• 73bceef v8.0.0-rc.6
• dc91f90 v8.0.0-rc.5
• f297c42 Add testing for plugin options (#17957)
• 0e5a59d Require Node.js ^22.18.0 || >=24.11.0 (#17969)
• 7300a66 v8.0.0-rc.4
• 3b1954b chore: inline REQUIRED_VERSION(7) special case (#17897)
• Additional commits viewable in compare view

Updates @babel/preset-typescript from 7.29.7 to 8.0.1

Release notes

Sourced from @​babel/preset-typescript's releases.

v8.0.1 (2026-06-17)

This release includes a breaking change that was in the Babel 8 migration guide's Getting ready section and in the release post, but the actual removal of the feature from the codebase was accidentally not complete.

💥 Breaking Change

• babel-core, babel-plugin-transform-object-rest-spread, babel-plugin-transform-runtime, babel-preset-env, babel-standalone
  • #18079 Actually remove preset-env's useBuiltIns (@​nicolo-ribaudo)

Committers: 2

• Huáng Jùnliàng (@​JLHwung)
• Nicolò Ribaudo (@​nicolo-ribaudo)

v8.0.0 (2026-06-16)

NOTE: The changelog below is relative to v8.0.0-rc.6. You can find a summary of all the breaking changes shipped in the Babel 8 release line in the migration guide for users and migration guide for plugin developers.

Read the release blog post at http://babeljs.io/blog/2026/06/16/8.0.0!

👓 Spec Compliance

• babel-core
  • #18039 perf: Only extract source map comments at the end of the file (@​liuxingbaoyu)

💥 Breaking Change

• babel-cli, babel-node, babel-plugin-proposal-decorators, babel-plugin-transform-classes, babel-plugin-transform-function-name, babel-plugin-transform-modules-commonjs, babel-plugin-transform-object-rest-spread, babel-plugin-transform-parameters, babel-plugin-transform-react-constant-elements, babel-plugin-transform-regenerator, babel-preset-env, babel-register
  • #18069 Fallback to assuming ESM support with modules: auto (@​nicolo-ribaudo)
• babel-plugin-transform-runtime, babel-runtime-corejs3, babel-runtime
  • #18036 Remove corejs exports for @babe/runtime-corejs3 (@​liuxingbaoyu)
• babel-parser
  • #18034 Remove locations: "packed" (@​liuxingbaoyu)

🐛 Bug Fix

• babel-generator
  • #18046 fix(generator): improve new callee parens check (@​JLHwung)
• babel-plugin-transform-modules-systemjs
  • #18032 fix(systemjs): support proto as an export name (@​JLHwung)

📝 Documentation

• #18070 Add EOL date for Babel 7 (end of June 2027) to SECURITY.md (@​nicolo-ribaudo)

🏠 Internal

• #18018 ci: enforce yarn integrity (@​JLHwung)

🏃‍♀️ Performance

• babel-core
  • #18039 perf: Only extract source map comments at the end of the file (@​liuxingbaoyu)

Committers: 6

• Babel Bot (@​babel-bot)
• Huáng Jùnliàng (@​JLHwung)
• James Garbutt (@​43081j)

... (truncated)

Changelog

Sourced from @​babel/preset-typescript's c...

Description has been truncated

[Copilot]

Copilot can't review bot-authored pull requests automatically. A user with Copilot access can request a review manually.

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​lavamoat/​preinstall-always-fail@​2.1.0 ⏵ 3.0.0
	npm/​@​amplitude/​analytics-browser@​2.44.1 ⏵ 2.44.4	+3		+1	+1
	npm/​@​amplitude/​experiment-js-client@​1.21.1 ⏵ 1.21.2	+1		+1	+4
	npm/​i18next-scanner-webpack@​0.9.1 ⏵ 1.0.0	+2		+1	+2
	npm/​@​sentry/​browser@​9.13.0 ⏵ 10.62.0	+1		+1
	npm/​@​stellar/​typescript-wallet-sdk-km@​1.9.0 ⏵ 3.0.1			+1	+11
	npm/​dotenv-webpack@​8.1.0 ⏵ 9.0.0
	npm/​@​types/​node@​18.19.124 ⏵ 26.0.1			+1
	npm/​@​blockaid/​client@​0.31.0 ⏵ 1.4.0	-6		+1	-1
	npm/​glob@​9.3.5 ⏵ 13.0.6	-3			+35
	npm/​globals@​14.0.0 ⏵ 17.7.0			+1
	npm/​@​actions/​core@​1.11.1 ⏵ 3.0.1
	npm/​copy-webpack-plugin@​13.0.0 ⏵ 14.0.0	+1
	npm/​eslint-webpack-plugin@​5.0.0 ⏵ 6.0.0	+1
	npm/​ses@​1.12.0 ⏵ 2.2.0	-4			+4
	npm/​eslint-import-resolver-typescript@​3.7.0 ⏵ 4.4.5	+1
	npm/​@​eslint/​js@​9.18.0 ⏵ 10.0.1			+13
	npm/​eslint-plugin-jsdoc@​50.6.2 ⏵ 63.0.10	-10			+1
	npm/​typescript@​4.9.5 ⏵ 6.0.3	+1
	npm/​@​sentry/​webpack-plugin@​3.3.1 ⏵ 5.3.0	+1
	npm/​sass-loader@​16.0.5 ⏵ 17.0.0	+1
	npm/​shadcn@​3.8.4 ⏵ 4.12.0	+1		+4	+1
	npm/​concurrently@​9.1.2 ⏵ 10.0.3	+1		+1	-1
	npm/​react-i18next@​15.4.1 ⏵ 17.0.8
	npm/​i18next@​21.10.0 ⏵ 26.3.3	+1		+1
	npm/​js-yaml@​4.1.0 ⏵ 5.2.0	+1	+3		+1
	npm/​got@​14.4.5 ⏵ 15.0.6	+1		+1
	npm/​webpack-cli@​6.0.1 ⏵ 7.1.0	+1
	npm/​@​lavamoat/​allow-scripts@​3.3.1 ⏵ 5.1.0	+1			+1
	npm/​eslint@​9.18.0 ⏵ 10.6.0	+1			-1
	npm/​lint-staged@​15.4.1 ⏵ 17.0.8	+1		+1	-1
	npm/​eslint-plugin-react-hooks@​5.1.0 ⏵ 7.1.1			+7

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @amplitude/plugin-custom-enrichment-browser is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → npm/@amplitude/analytics-browser@2.44.4 → npm/@amplitude/plugin-custom-enrichment-browser@0.1.13 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@amplitude/plugin-custom-enrichment-browser@0.1.13. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @sentry/cli under LicenseRef-FSL-1.1-MIT License: LicenseRef-FSL-1.1-MIT - The applicable license policy does not permit this license (5) (package/LICENSE) From: ? → npm/@sentry/webpack-plugin@5.3.0 → npm/@sentry/cli@2.58.6 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@sentry/cli@2.58.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm cheerio is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → npm/i18next-scanner-webpack@1.0.0 → npm/cheerio@1.2.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/cheerio@1.2.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm eslint-plugin-jsdoc is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package.json → npm/eslint-plugin-jsdoc@63.0.10 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/eslint-plugin-jsdoc@63.0.10. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm htmlparser2 is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → npm/i18next-scanner-webpack@1.0.0 → npm/htmlparser2@10.1.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/htmlparser2@10.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm typescript under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/ThirdPartyNoticeText.txt) License: LicenseRef-W3C-Community-Final-Specification-Agreement - The applicable license policy does not permit this license (5) (package/ThirdPartyNoticeText.txt) From: ? → npm/i18next-scanner-webpack@1.0.0 → npm/typescript@5.9.3 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/typescript@5.9.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm typescript under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/ThirdPartyNoticeText.txt) License: LicenseRef-W3C-Community-Final-Specification-Agreement - The applicable license policy does not permit this license (5) (package/ThirdPartyNoticeText.txt) From: @shared/api/package.json → npm/typescript@6.0.3 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/typescript@6.0.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm yargs is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → npm/@lavamoat/allow-scripts@5.1.0 → npm/jest@29.7.0 → npm/yargs@17.7.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/yargs@17.7.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[piyalbasu]

Trimmed this grouped-major PR to the bumps that are actually green

TL;DR: This grouped-major PR bundled ~43 major bumps, and a few of them require real migrations (they break the test suite or regress runtime behavior) that don't belong in a version-currency bump. I pushed a commit that keeps every bump that builds and tests clean and reverts the handful that don't, so this PR can merge as a safe subset. The deferred ones (the jest/Babel-8 test-runner stack and bignumber.js 11) should each get their own dedicated migration PR.

Verified locally (Node 22, Yarn 4.10): yarn install --immutable (hardened mode) ✅ · build:freighter-api ✅ · build:extension ✅ · jest --ci full unit suite 180 passed / 0 failed ✅. e2e (Playwright) not run locally — it needs a browser + backend secrets, so it'll run here in CI.

What was reverted and why (for reviewers/agents)

Reverted to master versions (deferred to dedicated migrations):

• Test-runner stack — jest, babel-jest, @types/jest, jest-environment-jsdom, jsdom, @types/jsdom, and the Babel 8 set (@babel/core, @babel/eslint-parser, @babel/preset-env, @babel/preset-react, @babel/preset-typescript).
  Root cause: jest 30 / babel-jest 30 mis-transform @stellar/design-system's Icon ESM namespace re-export — Icon.User, Icon.ArrowLeft, etc. resolve to undefined, so every component that renders an icon throws "Element type is invalid" (~200 suite failures). Confirmed by bisection: the same AssetTile suite passes on master (babel-jest 29) and fails on the bumped branch. babel-jest 29 also peers on @babel/core ^7, so Babel stays on 7 as a set.
• bignumber.js 11 (reverted in all three workspaces: extension, @shared/api, @shared/helpers).
  v11 throws on a malformed numeric string instead of yielding a non-finite value. usdValueOf() in balance.ts relies on the old behavior (new BigNumber(priceStr) → non-finite → treated as unpriced). Under v11 a bad price string throws, breaking balance sorting — a real runtime regression, not just a test failure.

Kept (all validated green by build + tests): typescript 6, eslint 10.6, @actions/core 3, glob 13, got 15, globals 17, lint-staged 17, webpack-cli 7, eslint plugins, @lavamoat/* 5, @sentry/browser 10.62, i18next 26 / react-i18next 17, ses 2, @stellar/typescript-wallet-sdk-km 3, @blockaid/client 1.4, js-yaml 5, @types/node 26, shadcn 4, amplitude, etc.

Supporting fixes required by the kept bumps:

• @actions/core v3 is ESM-only → load it via dynamic import() in the chrome-extension-upload action and rebuild the ncc bundle.
• TypeScript 6 → add ignoreDeprecations: "6.0"; explicit rootDir + node types for @stellar/freighter-api; declare *.scss/*.css modules.
• ESLint 10 → add @eslint/js as an explicit dep; disable the newly-recommended no-useless-assignment / preserve-caught-error (pre-existing violations, tracked for a follow-up).
• lavamoat → deny eslint-import-resolver-typescript>unrs-resolver's postinstall (native binary ships via its optional dependency).
• Pin docs @stellar/freighter-api off the moving latest tag; add a @stellar/freighter-api → workspace:* resolution (needed once typescript-wallet-sdk-km 3 depends on freighter-api 6.0.1, which collides with the local workspace under Yarn hardened mode).

Follow-ups (out of scope here):

1. Jest 30 / Babel 8 migration (fix the design-system Icon transform, e.g. resolver/babel-config work).
2. bignumber.js 11 (guard usdValueOf construction, then bump).
3. Consider ungrouping majors in dependabot.yml so one migration-blocker no longer holds the rest hostage.

[github-actions]

PR Preview build is ready: https://github.com/stellar/freighter/releases/tag/untagged-f4f2154081f632249b7e (SDF collaborators only — install instructions in the release description)