chore(deps-dev): bump @babel/core from 7.29.6 to 7.29.7 in /samples/weather-forecast

[dependabot]

Bumps @babel/core from 7.29.6 to 7.29.7.

Release notes

Sourced from @​babel/core's releases.

v7.29.7 (2026-05-25)

Re-release all packages with npm provenance attestations

Commits

• 4fba754 v7.29.7
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[robertvangor]

Pi Dependabot assessment

Dependency and version movement

• Single update: samples/weather-forecast direct development dependency @babel/core ^7.29.6 -> ^7.29.7.
• Yarn v1 lockfile resolves @babel/core 7.29.6 -> 7.29.7 and updates its changed subtree: @babel/compat-data 7.29.0 -> 7.29.7; @babel/helper-compilation-targets 7.28.6 -> 7.29.7; @babel/helper-globals 7.28.0 -> 7.29.7; @babel/helper-module-imports 7.28.6 -> 7.29.7; @babel/helper-module-transforms 7.28.6 -> 7.29.7; @babel/helper-validator-option 7.27.1 -> 7.29.7; @babel/traverse 7.29.0 -> 7.29.7.
• Descriptor-only lock refreshes for @babel/code-frame, @babel/generator, @babel/helpers, @babel/parser, @babel/template, and @babel/types now reference ^7.29.7; those records already resolved to 7.29.7. No non-Babel package moves are present in the PR diff; 35 lock descriptors changed.
• Resolved head graph has no unresolved lock descriptors for the @babel/core subtree; direct @babel/preset-env, @babel/preset-react, @babel/preset-typescript, and other Babel tooling versions remain unchanged.

Authoritative changelog / advisory links

• https://github.com/babel/babel/releases/tag/v7.29.7
• https://github.com/babel/babel/releases/tag/v7.29.6
• babel/babel@v7.29.6...v7.29.7
• GHSA-4x5r-pxfx-6jf8
• https://www.npmjs.com/package/@babel/core/v/7.29.7

Application usage and potentially disruptive effects

• Babel v7.29.7 upstream release is a provenance re-release; upstream comparison has no implementation-file changes. Published core tarballs have the same file count and implementation content apart from package/exported version and dependency metadata.
• @babel/core is development-only and is used through babel-loader/Webpack and the project Babel/Jest transform configuration; no production runtime import or user-controlled compilation path was found.
• No API, migration, configuration, data, runtime-engine, or platform requirement change was found. Babel engine remains >=6.9.0; repository CI uses Node 20.
• Local build emits two asset-size warnings but succeeds; no update-specific compatibility change was needed.

Validation

• command: npx --yes yarn@1.22.22 install --frozen-lockfile --ignore-scripts; outcome: passed; details: Resolved and linked the exact frozen Yarn v1 lockfile. Yarn emitted existing incompatible-resolution and peer-dependency warnings; no lockfile rewrite occurred.
• command: npx --yes yarn@1.22.22 build; outcome: passed; details: Webpack production build completed successfully; only asset-size warnings were emitted.
• command: npx --yes yarn@1.22.22 lint; outcome: passed; details: ESLint completed successfully.
• command: npx --yes yarn@1.22.22 type-check; outcome: passed; details: TypeScript noEmit check completed successfully.
• command: PATH=Node-v20.20.2 npx --yes yarn@1.22.22 test --maxWorkers=2; outcome: passed; details: 10 test suites and 19 tests passed on the repository CI-supported Node 20 runtime.
• command: PATH=Node-v20.20.2 npx --yes yarn@1.22.22 test --runInBand; outcome: passed; details: 10 test suites and 19 tests passed.
• command: git diff --check e885e19..b6312a7; outcome: passed; details: No whitespace errors. Tracked worktree is clean; only ignored node_modules/dist artifacts exist from validation.
• command: npx --yes yarn@1.22.22 audit --groups dependencies devDependencies; outcome: completed with unrelated baseline findings; details: Exit 8 with three high advisory records: two brace-expansion advisories and one fast-uri advisory; none is changed by this PR.
• command: GitHub checks at final handoff; outcome: CI/policy/Socket/Autodev successful; CLA Assistant failed; review required; details: Head remains b6312a7. Autodev run 32648162335 succeeded; no deployment claim made.

Conversation state / unresolved concerns

• No unresolved human conversation threads; GitHub review is still required.
• CLA Assistant check remains failed and the PR remains merge-blocked; this is unrelated to the dependency behavior.
• Yarn audit reports unrelated baseline high advisories: brace-expansion@1.1.16 via ESLint/minimatch (GHSA-mh99-v99m-4gvg and GHSA-rgw5-rvv9-x895) and fast-uri@3.1.4 via AJV/@rjsf (GHSA-7p8r-x3mc-p8w7). These are outside this PR's lockfile movement and need separate remediation.
• A default-worker Node 26 local test run hit one five-second timeout; supported Node 20 reruns passed all tests.

Change risk: 2/10 — Development-only Babel patch/provenance re-release with no upstream implementation-file changes, no API/config/migration change, unchanged engine requirement, and successful supported-runtime build/type/test validation.

Remediation importance: 3/10 — Routine dependency hygiene. The known @babel/core sourceMappingURL advisory is already patched by 7.29.6, so 7.29.7 adds no new security remediation or production-runtime exposure.

Final exact head SHA: b6312a7969d15fd06fff75500e068ad1a6ec8c59

Dev deployment evidence

• Not confirmed for final SHA b6312a7
• Reason: No source-to-runtime mapping exists in the delivered repository or read-only dev-de1 inventory. Workflows are Autodev, CI Tests, and CLA Assistant only; tracked tree has no Dockerfile, Helm, Kustomize, or deployment manifest. GitHub deployment records for the exact SHA and dev ref are empty. Therefore branch merge and green CI cannot establish a running deployment.
• 2026-08-23T15:18:54Z-15:19:16Z: GitHub Autodev run 32648162335 completed successfully for PR 301 with headSha b6312a7.
• 2026-08-23T15:19:10Z: Autodev logs show PR 301 SHA b6312a7... merged into dev; GitHub API commit 15653af has parents e88159b and the requested b6312a7. This proves Git ancestry only.
• 2026-08-23T15:19:13Z-15:20:37Z: CI Tests run 32648180562 succeeded on branch dev at 15653af; this is branch/CI evidence, not deployment confirmation.
• 2026-08-23T16:16:15Z: kubectl read-only inspection on context dev-de1 found zero objects matching custom-widgets-examples, custom-widget-examples, weather-forecast, or b6312a7 across Deployment, StatefulSet, DaemonSet, Job, Pod, ConfigMap, Ingress, Service, and CronJob; matching-image and matching-event queries were empty.
• 2026-08-23T16:16:15Z: pacman namespace had 251 build Jobs and zero slugs matching custom-widgets-examples, custom-widget-examples, weather-forecast, or b6312a7. The only checked generic sample (staffbasedev) was a completed frontend-builder:main-81801e14 job from 2026-08-21, imageID frontend-builder@sha256:0c22d5fbc223e5db4fdf00392faf7b3976a685022c7ceb3c08ac63cf54f94c1a; it has no link to this repository or SHA.
• 2026-08-23T16:16:15Z: closest generic runtime candidate gatekeeper/frontend-cache-service was Available 1/1 with image frontend-cache-service:dev-20260820092605-2600e616 and imageID frontend-cache-service@sha256:97c763e287da32c4c625b2e4b74587e72355833bb970e6602aa9b6932946fb19; rollout last updated 2026-08-20T09:34:53Z and has no source SHA. It is not attributable to this PR.
• 2026-08-23T16:16:15Z: repository tree contains only .github/workflows/autodev.yaml, ci.yaml, and cla.yml for automation; catalog-info.yaml declares Backstage type library. No Dockerfile/container build, Helm/Kustomize, or deployment manifest is tracked.
• 2026-08-23T16:16:15Z: GitHub deployments API returned no records for requested SHA b6312a7... or ref dev.

Status: blocked

check_after: not set (exact deployment not confirmed)

Residual risks / blocking reason

• CLA Assistant failure and required human review leave the PR merge-blocked.
• Yarn audit baseline highs remain in brace-expansion@1.1.16 and fast-uri@3.1.4 and should be handled by separate dependency PRs.
• Autodev success/bot comment is not treated as proof of deployment; parent read-only operations worker must verify rollout.
• The default Node 26 local worker run had a test timeout under concurrent resource pressure, while Node 20 CI-runtime reruns passed.

[staffbase-actions]

🟢 Sucessfully merged into the dev branch.
It can take up to a few minutes until the changes are rolled out to the dev system.
The following Pull Requests are merged into the dev branch:

• https://redirect.github.com/Staffbase/custom-widgets-examples/pull/301
• https://redirect.github.com/Staffbase/custom-widgets-examples/pull/303

[maximizeIT]

Superseded by #310, which consolidates all open Dependabot PRs into a single validated update (deps installed, build/lint/type-check/tests all green).

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.