On October 10th, 2023, I stumbled upon an arbitrary code execution vulnerability in Babel, which was subsequently assigned the identifier CVE-2023-45133. In this post, I’ll walk you through the journey of discovering and exploiting this intriguing flaw.
We just released Babel 7.23.0! 🎉
It includes transform support for the Decorator Metadata, Source Phase Import, Deferred Import Evaluation, and Optional Chaining Assignment proposals. We also updated our parser to support the new TypeScript 5.2 version, and added a transform option to let you use the .ts extension within TypeScript imports.
In addition to releasing version 7.23.0, we also recently published the first Babel 8 alpha release!
You can read the whole changelog on GitHub.
Babel 7.22.0 is out, with parsing/transform support for the Explicit Resource Management proposal, including both the sync and async variants, and with parsing support for the Import Attributes (an evolution of the old Import Assertions proposal).
We also updated our implementation of decorators following some changes in the proposal, and added support for the TypeScript import ... = and export ... = statements.
@babel/preset-env now includes transform support for the v regular expressions flag, which was recently approved as part of the ECMAScript standard, by default. Lastly, we renamed all the plugins for stable ECMAScript features from -proposal- to -transform-.
You can read the whole changelog on GitHub.
We just published Babel 7.21.0!
Babel now supports the Inline RegExp modifiers proposal, the latest version of the Decorators proposal, and the new TypeScript 5.0 syntax.
You can read the whole changelog on GitHub.
We just published Babel 7.20.0!
This release includes support for TypeScript 4.9, and parser support for the Import Reflection and Explicit Resource Management Stage 2 proposals. Additionally, you can now use Deno as one of your compilation targets.
In the past few releases we have made gradual improvements @babel/generator's code location tracking, which lead to higher source map quality and better positioning of comments in the generated output.
We are also releasing version 9.0.0 of babel-loader, the Babel loader for Webpack.
You can read the whole changelog on GitHub.
We just published Babel 7.19.0!
This release updates our implementation of the decorators proposal, which reached Stage 3 in March. It also includes support for the new duplicate named capturing groups proposal for regular expressions.
You can read the whole changelog on GitHub.
We just published Babel 7.18.0!
This release includes support for the private destructuring proposal and for TypeScript 4.7.
You can read the whole changelog on GitHub.
We just published Babel 7.17.0!
After years of iterations, rewrites and adjustments it looks like the decorators proposal has finally stabilized again on a new design! This release includes both parse and transform support for the new proposal.
We also implemented the RegExp v flag proposal and added parsing support for destructuring private fields, both currently Stage 2. Lastly, a new experimental implementation of @babel/register.
You can read the whole changelog on GitHub.
We just published Babel 7.16.0!
This release enables class static initialization blocks by default. It includes support for a new variant of the pipeline operator proposal, as well as TypeScript 4.5 compatibility.
Furthermore, @babel/eslint-parser now supports ESLint 8.
You can read the whole changelog on GitHub.
This release enables parsing top-level await (Stage 4 at the May meeting) and transforming ergonomic brand checks for private fields (Stage 4 at the July meeting) by default. There is also now support for the Hack-style pipeline operator. We also improved our TypeScript support, implementing transform support for const enums and namespace aliases, and we expanded our heuristics to add .displayName to React components created by React.createContext() (#13501).
We also introduced a new compiler assumption, noIncompleteNsImportDetection, to produce a smaller output when compiling ECMAScript modules to CommonJS without worrying about partially initialized namespace imports caused by module cycles.
Additionally, you can now specify Rhino as a compilation target.
You can read the whole changelog on GitHub.