chore(deps): override @babel/core to ^7.29.6 (CVE fix)

[cliffhall]

Summary

Adds an npm override forcing @babel/core to ^7.29.6 to remediate a transitive dev-dependency vulnerability.

@babel/core is pulled in transitively (via the client toolchain / babel plugins) and previously resolved to 7.28.5, which is affected by an arbitrary file read via a crafted sourceMappingURL (fixed in >= 7.29.6). With this override it now resolves to 7.29.7, and npm ls @babel/core --all shows no instances below 7.29.6.

The change is intentionally minimal:

• Root package.json: add "@babel/core": "^7.29.6" to overrides (the existing get-intrinsic override is preserved).
• package-lock.json: refreshed with a targeted update of only the @babel/* subtree (no unrelated dependency bumps).

Verification

• npx prettier --check . — pass
• npm run check-version — pass
• cd client && npm run lint — pass
• cd client && npm test — pass (535 tests)
• cd cli && npm test — pass (85 tests)
• npm run build — pass
• E2e tests skipped (require Playwright browser downloads unavailable in this environment)

Resolves Dependabot alert 132

Part of #1706

🤖 Generated with Claude Code

https://claude.ai/code/session_01HiccCEh9mwCfVzE8qYcop1

[cliffhall]

@claude review — security dependency fix adding a @babel/core override to ^7.29.6 (part of #1706). Verify it resolves the advisory, the override is correct/minimal, and nothing is broken. Flag anything actionable.

[claude]

Claude finished @cliffhall's task in 2m 1s —— View job

---

Review: @babel/core override (^7.29.6)

• Gather context (package.json + lockfile diff)
• Verify the override resolves the advisory
• Confirm the override is correct & minimal
• Check nothing is broken (install/resolution)
• Post review findings

Verdict: ✅ LGTM. The override is correct, minimal, and resolves the affected package to a patched version. No blocking issues.

---

What I verified

1. Advisory remediation — resolves correctly

• There is exactly one resolved @babel/core in the lockfile (node_modules/@babel/core), now at 7.29.7, satisfying the ^7.29.6 floor.
• The consumer is @vitejs/plugin-react@5.1.2 (a dev dependency), which declares @babel/core: ^7.28.5 — that's what previously pulled the vulnerable 7.28.5. With the override it now resolves to 7.29.7.
• The entire @babel/core subtree (generator, parser, traverse, template, helpers, types, compat-data, helper-*) moved consistently to 7.29.7. No orphaned @babel/core internals left below 7.29.6.
• All other @babel/core occurrences in the lockfile are peer-dependency ranges (^7.0.0, ^7.11.6, …), not resolved installs — all satisfied by 7.29.7.

2. Correct & minimal

• package.json: one line added to overrides; the existing get-intrinsic: 1.3.0 override is preserved. ✅
• Caret (^7.29.6) is the right choice — it stays on the patched line while allowing future 7.x patch/minor fixes, and satisfies every consumer's ^7.x range.
• package-lock.json changes are confined to the @babel/* subtree — no unrelated dependency bumps. ✅
• Both package.json and package-lock.json parse as valid JSON. ✅

3. Nothing broken

• Every @babel/core dependency edge is internally consistent at 7.29.7; all peer ranges (^7.x) remain satisfied, so no ERESOLVE risk.
• I relied on the author's reported npm run build / client & CLI test runs for the functional check — a full npm install + build was not run in this review environment (node_modules is not present here), but the resolution graph is sound.

---

Non-blocking notes

• Dev-only exposure. Every affected @babel/* entry is marked "dev": true and reaches the tree only through @vitejs/plugin-react. @babel/core is not in the production/runtime dependency graph, so real-world exposure is limited to the local/CI build toolchain. The fix is still correct hygiene and clears the Dependabot alert.
• Minor lockfile duplication. The bump introduced nested @babel/code-frame@7.29.7 copies under core/template/traverse, while a top-level @babel/code-frame@7.27.1 remains for other consumers. This is harmless npm dedup behavior, not something to fix.
• Advisory ID not independently confirmed. WebSearch/WebFetch were not permitted in this environment, so I could not fetch GHSA/CVE metadata to cross-check the "arbitrary file read via sourceMappingURL, fixed in ≥ 7.29.6" description against the advisory DB. The version math (7.28.5 → 7.29.7, floor ^7.29.6) matches the PR description; worth a quick glance that Dependabot alert 132 flips to resolved once merged.
  · deps/security-babel-core