[dependabot]

Bumps @babel/preset-env from 8.0.6 to 8.0.7.

Release notes

Sourced from @​babel/preset-env's releases.

v8.0.7 (2026-10-07)

Thanks @​brunoborta, @​CINC0S, @​hoobnn, and @​jpradelle for your first PRs!

🐛 Bug Fix

• babel-helper-create-regexp-features-plugin, babel-plugin-transform-dotall-regex, babel-plugin-transform-unicode-sets-regex, babel-preset-env
  • #18295 Bump regexpu-core to 6.5.3 (@​JLHwung)
• babel-plugin-transform-for-of
  • #18292 Skip for await in transform-for-of (@​brunoborta)
• babel-helpers, babel-plugin-transform-async-generator-functions, babel-runtime-corejs3
  • #18283 Fix asyncIterator helper forwarding .throw() to .return() (@​brunoborta)
• babel-parser
  • #18288 fix(parser): allow await as a function expression name inside async arrow (@​JLHwung)
• babel-helpers, babel-plugin-transform-class-properties, babel-plugin-transform-modules-systemjs, babel-runtime-corejs3
  • #18284 Guard @@toPrimitive usage in toPrimitive helper (@​nicolo-ribaudo)
• babel-plugin-transform-block-scoping
  • #18195 fix: closures in for-loop init capture wrong binding (@​joelle-a-dev)
• babel-helper-create-class-features-plugin, babel-plugin-transform-private-property-in-object
  • #18265 Return false for #x in on static private fields before initialization (@​hoobnn)
• babel-traverse
  • #18151 Evaluate TypeScript expression wrappers in NodePath#evaluate (@​CINC0S)
  • #18250 fix(traverse): do not evaluate destructured bindings in path.evaluate (@​wulu007)
• Other
  • #18257 Fix eslint-parser AST definition of AccessorProperty (@​jpradelle)
• babel-core
  • #18254 fix(core): createConfigItem allows cb as 2nd arg (@​JLHwung)

🏠 Internal

• babel-helpers, babel-plugin-transform-modules-commonjs, babel-runtime-corejs3
  • #18255 Simplify interopRequireWildcard helper (@​nicolo-ribaudo)

Committers: 11

• Babel Bot (@​babel-bot)
• Bruno "Borta" Bortagaray (@​brunoborta)
• CINC05 (@​CINC0S)
• Huáng Jùnliàng (@​JLHwung)
• Joelle Mahfoud (@​joelle-a-dev)
• Julien Pradelle (@​jpradelle)
• Kevin Deng (@​sxzz)
• Nicolò Ribaudo (@​nicolo-ribaudo)
• Samual Norman (@​samualtnorman)
• @​wulu007
• hoobnn (@​hoobnn)

Changelog

Sourced from @​babel/preset-env's changelog.

v8.0.7 (2026-10-07)

🐛 Bug Fix

• babel-helper-create-regexp-features-plugin, babel-plugin-transform-dotall-regex, babel-plugin-transform-unicode-sets-regex, babel-preset-env
  • #18295 Bump regexpu-core to 6.5.3 (@​JLHwung)
• babel-plugin-transform-for-of
  • #18292 Skip for await in transform-for-of (@​brunoborta)
• babel-helpers, babel-plugin-transform-async-generator-functions, babel-runtime-corejs3
  • #18283 Fix asyncIterator helper forwarding .throw() to .return() (@​brunoborta)
• babel-parser
  • #18288 fix(parser): allow await as a function expression name inside async arrow (@​JLHwung)
• babel-helpers, babel-plugin-transform-class-properties, babel-plugin-transform-modules-systemjs, babel-runtime-corejs3
  • #18284 Guard @@toPrimitive usage in toPrimitive helper (@​nicolo-ribaudo)
• babel-plugin-transform-block-scoping
  • #18195 fix: closures in for-loop init capture wrong binding (@​joelle-a-dev)
• babel-helper-create-class-features-plugin, babel-plugin-transform-private-property-in-object
  • #18265 Return false for #x in on static private fields before initialization (@​hoobnn)
• babel-traverse
  • #18151 Evaluate TypeScript expression wrappers in NodePath#evaluate (@​CINC0S)
  • #18250 fix(traverse): do not evaluate destructured bindings in path.evaluate (@​wulu007)
• Other
  • #18257 Fix eslint-parser AST definition of AccessorProperty (@​jpradelle)
• babel-core
  • #18254 fix(core): createConfigItem allows cb as 2nd arg (@​JLHwung)

🏠 Internal

• babel-helpers, babel-plugin-transform-modules-commonjs, babel-runtime-corejs3
  • #18255 Simplify interopRequireWildcard helper (@​nicolo-ribaudo)

Commits

• 1fc0073 v8.0.7
• 2dd0e6e Bump regexpu-core to 6.5.3 (#18295)
• fd66590 chore: upgrade verkit to v0.5.0 and obug to v3.0.0 (#18248)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Tagging @rajbos for notifications

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 7ef3b01.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

OpenSSF Scorecard

Package	Version	Score	Details
npm/@babel/helper-compilation-targets	8.0.7	🟢 7.2	Details Check Score Reason Code-Review 🟢 7 Found 23/30 approved changesets -- score normalized to 7 Maintained 🟢 10 30 commit(s) and 23 issue activity found in the last 90 days -- score normalized to 10 Security-Policy 🟢 10 security policy file detected Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions License 🟢 10 license file detected CII-Best-Practices ⚠️ 2 badge detected: InProgress Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Binary-Artifacts 🟢 10 no binaries found in the repo Fuzzing ⚠️ 0 project is not fuzzed SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/@babel/plugin-transform-block-scoping	8.0.7	🟢 7.2	Details Check Score Reason Code-Review 🟢 7 Found 23/30 approved changesets -- score normalized to 7 Maintained 🟢 10 30 commit(s) and 23 issue activity found in the last 90 days -- score normalized to 10 Security-Policy 🟢 10 security policy file detected Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions License 🟢 10 license file detected CII-Best-Practices ⚠️ 2 badge detected: InProgress Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Binary-Artifacts 🟢 10 no binaries found in the repo Fuzzing ⚠️ 0 project is not fuzzed SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/@babel/plugin-transform-for-of	8.0.7	🟢 7.2	Details Check Score Reason Code-Review 🟢 7 Found 23/30 approved changesets -- score normalized to 7 Maintained 🟢 10 30 commit(s) and 23 issue activity found in the last 90 days -- score normalized to 10 Security-Policy 🟢 10 security policy file detected Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions License 🟢 10 license file detected CII-Best-Practices ⚠️ 2 badge detected: InProgress Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Binary-Artifacts 🟢 10 no binaries found in the repo Fuzzing ⚠️ 0 project is not fuzzed SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/@babel/preset-env	8.0.7	🟢 7.2	Details Check Score Reason Code-Review 🟢 7 Found 23/30 approved changesets -- score normalized to 7 Maintained 🟢 10 30 commit(s) and 23 issue activity found in the last 90 days -- score normalized to 10 Security-Policy 🟢 10 security policy file detected Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions License 🟢 10 license file detected CII-Best-Practices ⚠️ 2 badge detected: InProgress Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Binary-Artifacts 🟢 10 no binaries found in the repo Fuzzing ⚠️ 0 project is not fuzzed SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/verkit	0.5.0	Unknown	Unknown

Scanned Files

• package-lock.json