security: vulnerability remediation

[kernel-internal]

Vulnerability Remediation

This PR was generated by the Socket-centric vulnerability remediation workflow. Review the planned dependency changes and confirmation evidence before merging.

Fixed

CVE/GHSA	Package	Ecosystem	Old Version	New Version	Manifest	Confirmation
GHSA-4x5r-pxfx-6jf8	%40babel/core, jest	None	29.7.0	7.29.6		confirmed

Not Included

• Deferred by batch limit: 12 advisories. They will be considered by future runs.
• Other deferred scanner findings: 1.
• Unconfirmed attempted fixes: 0.

Deferred details

CVE/GHSA	Package	Reason
Unavailable from detector	highlight.js	Non-CVE alert is not handled by dependency remediation.

---

Note

Low Risk
Lockfile-only dev-dependency bump for Babel/Jest with no production code changes; typical patch-level compiler update risk.

Overview
Addresses GHSA-4x5r-pxfx-6jf8 by refreshing yarn.lock so the Jest toolchain resolves @babel/core 7.29.6 (from 7.28.6) and pulls in matching 7.29.x @babel/* packages (code-frame, generator, parser, traverse, types, helpers, etc.).

There are no application or manifest source changes—only lockfile resolution updates from the automated vulnerability remediation workflow. Other deferred findings (e.g. highlight.js) are unchanged.

^{Reviewed by Cursor Bugbot for commit fe1df2b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[ulziibay-kernel]

Verified the bump against the advisory's first patched version; rebuilt on current main and confirmed the toolchain lock/build is clean. CI green.

[ulziibay-kernel]

Approving: single-advisory dependency bump, lockfile/manifest only, no source changes.

[ulziibay-kernel]

Verified: yarn.lock only, @babel/core 7.28.6 -> 7.29.6 (patched version for GHSA-4x5r-pxfx-6jf8).