security: vulnerability remediation

[kernel-internal]

Vulnerability Remediation

This PR was generated by the Socket-centric vulnerability remediation workflow. Review the planned dependency changes and confirmation evidence before merging.

Fixed

CVE/GHSA	Package	Ecosystem	Old Version	New Version	Manifest	Confirmation
GHSA-4x5r-pxfx-6jf8	%40babel/core, jest	None	29.7.0	7.29.6		confirmed

Not Included

• Deferred by batch limit: 6 advisories. They will be considered by future runs.
• Other deferred scanner findings: 1.
• Unconfirmed attempted fixes: 0.

Deferred details

CVE/GHSA	Package	Reason
Unavailable from detector	highlight.js	Non-CVE alert is not handled by dependency remediation.

---

Note

Low Risk
Dependency-only security pin with no runtime or SDK API changes; main risk is a Jest/Babel toolchain regression if 7.29.6 behaves differently in tests.

Overview
Pins @babel/core to 7.29.6 across npm overrides, pnpm overrides, and Yarn resolutions so the whole dependency tree (including Jest’s transitive Babel) uses a non-vulnerable version for GHSA-4x5r-pxfx-6jf8.

yarn.lock is refreshed so the resolved @babel/core and its 7.29.x @babel/* peers match that pin; no application or SDK source changes.

^{Reviewed by Cursor Bugbot for commit 5fc2a79. Bugbot is set up for automated code reviews on this repo. Configure here.}