🔒 Security: Fix 6 vulnerable packages

[razorgupta]

🔐 Security Updates

This PR fixes security vulnerabilities found by Semgrep SCA.

📦 Updated Packages

NPM:

• @babel/helper-define-polyfill-provider: transitive → 0.6.5
• @babel/plugin-transform-runtime: transitive → 7.28.5
• @babel/preset-env: transitive → 7.28.5
• babel-plugin-polyfill-corejs2: transitive → 0.4.14
• babel-plugin-polyfill-corejs3: transitive → 0.13.0
• babel-plugin-polyfill-regenerator: transitive → 0.6.5

Note: 56 total updates across multiple package files

🛡️ Vulnerabilities Fixed

• CVE-2023-45133

⚙️ Changes Made

• Updated dependency files with secure versions
• Regenerated lock files

---

🤖 This PR was created automatically by Security Bot
⚠️ Please review and test before merging

[changeset-bot]

🦋 Changeset detected

Latest commit: f4e593a

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@razorpay/blade	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

❌ PR title doesn't follow Conventional Commits specification.

Details:

No release type found in pull request title "🔒 Security: Fix 6 vulnerable packages". Add a prefix to indicate what kind of release this pull request corresponds to. For reference, see https://www.conventionalcommits.org/

Available types:
 - feat: A new feature
 - fix: A bug fix
 - docs: Documentation only changes
 - style: Changes that do not affect the meaning of the code (white-space, formatting, missing semi-colons, etc)
 - refactor: A code change that neither fixes a bug nor adds a feature
 - perf: A code change that improves performance
 - test: Adding missing tests or correcting existing tests
 - build: Changes that affect the build system or external dependencies (example scopes: gulp, broccoli, npm)
 - ci: Changes to our CI configuration files and scripts (example scopes: Travis, Circle, BrowserStack, SauceLabs)
 - chore: Other changes that don't modify src or test files
 - revert: Reverts a previous commit

[codesandbox-ci]

This pull request is automatically built and testable in CodeSandbox.

To see build info of the built libraries, click here or the icon next to each commit SHA.

Latest deployment of this branch, based on commit f4e593a:

Sandbox	Source
razorpay/blade: basic	Configuration

[tewarig]

we should lock @babel/plugin-transform-runtime at 7.28.5 and should lock all other packages as well.
don't want this package to auto update. since it can break things or if some vulnerable package is published it will be auto installed.

[razorgupta]

I have Fixed the caret versions.
Regarding the build failure with @babel/plugin-proposal-private-property-in-object, This plugin was renamed in Babel 7.22+ to @babel/plugin-transform-private-property-in-object (proposal → transform).
The babel config in the codebase needs to be updated to use the new plugin name
Options:

1. Update babel.config.js to use @babel/plugin-transform-private-property-in-object
2. Or remove the explicit plugin if @babel/preset-env handles it automatically
   Can someone from the team help with this?

[tewarig]

currently build is also failing for @razorpay/blade package since it's not able to find this '@babel/plugin-proposal-private-property-in-object' . i think @babel might have removed that package

[tewarig]

we also need to add changeset for @razorpay/blade since we would need to release a version. so consumers using these packages have latest version

[tewarig]

@razorgupta the test cases are still failing can you check ?

[razorgupta]

@razorgupta the test cases are still failing can you check ?

The tests are failing because of the Babel plugin rename issue we discussed earlier:
@babel/plugin-proposal-private-property-in-object → renamed to @babel/plugin-transform-private-property-in-object
This requires the Blade team to help because:
It needs changes to babel.config.js
This is codebase-specific, not something we can automate

[razorgupta]

we also need to add changeset for @razorpay/blade since we would need to release a version. so consumers using these packages have latest version

Created .changeset/security-fix-babel.md with a patch version bump for @razorpay/blade.