security: vulnerability remediation

[kernel-internal]

Vulnerability Remediation

This PR was generated by the Socket-centric vulnerability remediation workflow. Review the planned dependency changes and confirmation evidence before merging.

Fixed

CVE/GHSA	Package	Ecosystem	Old Version	New Version	Manifest	Confirmation
GHSA-4x5r-pxfx-6jf8	%40babel/core, jest	None	29.7.0	7.29.6		confirmed

Not Included

• Deferred by batch limit: 9 advisories. They will be considered by future runs.
• Other deferred scanner findings: 464.
• Unconfirmed attempted fixes: 0.

Deferred details

CVE/GHSA	Package	Reason
Unavailable from detector	debug	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	debug	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	node	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	node	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	node	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	eslint-visitor-keys	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	eslint-visitor-keys	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	eslint-visitor-keys	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	semver	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	semver	Non-CVE alert is not handled by dependency remediation.
...	...	454 additional items omitted from PR body. See workflow artifacts for full details.

---

Note

Low Risk
Lockfile-only patch upgrade of dev/build-time Babel packages for a known advisory, with no application runtime or auth logic changes.

Overview
This PR only updates yarn.lock to remediate GHSA-4x5r-pxfx-6jf8 by resolving @babel/core to 7.29.6 (from 7.28.6) and aligning the rest of the @babel/* toolchain (parser, generator, helpers, traverse, types, templates, and related helpers) on the 7.29.x line.

There are no package.json manifest changes in the diff; the bump is driven by transitive resolution for tooling that already depends on @babel/core (e.g. Jest). Other deferred advisories from the Socket workflow are not addressed here.

^{Reviewed by Cursor Bugbot for commit c5654e7. Bugbot is set up for automated code reviews on this repo. Configure here.}

[ulziibay-kernel]

Verified the bump against the advisory's first patched version; rebuilt on current main and confirmed the toolchain lock/build is clean. CI green.

[ulziibay-kernel]

Approving: single-advisory dependency bump, lockfile/manifest only, no source changes.