fix(bugfix): bound check before array access - #18457

This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [@babel/core](https://babel.dev/docs/en/next/babel-core) ([source](https://github.com/babel/babel/tree/HEAD/packages/babel-core)) | [`7.29.7` → `7.29.13`](https://renovatebot.com/diffs/npm/@babel%2fcore/7.29.7/7.29.13) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@babel%2fcore/7.29.13?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@babel%2fcore/7.29.7/7.29.13?slim=true) |
| [@babel/runtime](https://babel.dev/docs/en/next/babel-runtime) ([source](https://github.com/babel/babel/tree/HEAD/packages/babel-runtime)) | [`7.29.10` → `7.29.13`](https://renovatebot.com/diffs/npm/@babel%2fruntime/7.29.10/7.29.13) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@babel%2fruntime/7.29.13?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@babel%2fruntime/7.29.10/7.29.13?slim=true) |

---

### Release Notes

<details>
<summary>babel/babel (@&#8203;babel/core)</summary>

### [`v7.29.13`](https://github.com/babel/babel/releases/tag/v7.29.13)

[Compare Source](babel/babel@v7.29.7...v7.29.13)

##### v7.29.13 (2026-11-04)

##### 🐛 Bug Fix

- `babel-generator`, `babel-parser`
  - [#&#8203;18522](babel/babel#18522) fix(parser): start decorated object members at their first decorator ([@&#8203;babel-bot](https://github.com/babel-bot))
- `babel-parser`
  - [#&#8203;18520](babel/babel#18520) fix(parser): allow TS imports to define exports declared before them ([@&#8203;babel-bot](https://github.com/babel-bot))
  - [#&#8203;18485](babel/babel#18485) fix(parser): allow lone `yield` before `in` in an Annex B for-in init ([@&#8203;babel-bot](https://github.com/babel-bot))
  - [#&#8203;18483](babel/babel#18483) fix(parser): respect unicode escape in `isUnparsedContextual` ([@&#8203;babel-bot](https://github.com/babel-bot))
  - [#&#8203;18452](babel/babel#18452) fix(parser): remove non-decimal prefix from bigint ([@&#8203;babel-bot](https://github.com/babel-bot))
  - [#&#8203;18449](babel/babel#18449) fix(parser): allow await as a function expression name inside async arrow ([@&#8203;babel-bot](https://github.com/babel-bot))
  - [#&#8203;18453](babel/babel#18453) Disallow new import prop access ([@&#8203;babel-bot](https://github.com/babel-bot))
  - [#&#8203;18450](babel/babel#18450) Improve F# pipeline direct body check ([@&#8203;babel-bot](https://github.com/babel-bot))
  - [#&#8203;18446](babel/babel#18446) fix(parser): set phase: null for non-deferred imports with deferredImportEvaluation ([#&#8203;18313](babel/babel#18313)) ([@&#8203;babel-bot](https://github.com/babel-bot))
  - [#&#8203;18448](babel/babel#18448) Fix TypeScript parser failing on async calls in ternary consequent ([@&#8203;babel-bot](https://github.com/babel-bot))
- `babel-generator`
  - [#&#8203;18521](babel/babel#18521) fix(generator): print override modifier of TSParameterProperty ([@&#8203;babel-bot](https://github.com/babel-bot))
  - [#&#8203;18509](babel/babel#18509) fix(generator): do not apply `jsesc` number radix to non-integer literals ([@&#8203;babel-bot](https://github.com/babel-bot))
  - [#&#8203;18500](babel/babel#18500) fix(generator): escape `of` binding of a using declaration in for-of head ([@&#8203;babel-bot](https://github.com/babel-bot))
  - [#&#8203;18461](babel/babel#18461) fix: invalid `minified: true` output for new expression ([@&#8203;babel-bot](https://github.com/babel-bot))
  - [#&#8203;18476](babel/babel#18476) fix: preserve trailing comma in optional call args ([@&#8203;babel-bot](https://github.com/babel-bot))
  - [#&#8203;18456](babel/babel#18456) fix(generator): keep parens for ?. chain in tag ([@&#8203;babel-bot](https://github.com/babel-bot))
  - [#&#8203;18454](babel/babel#18454) fix(generator): preserve type modifier in TSImportEqualsDeclaration ([@&#8203;babel-bot](https://github.com/babel-bot))
- `babel-plugin-transform-block-scoping`
  - [#&#8203;18518](babel/babel#18518) Fix initialization of nested for loop head declarations ([@&#8203;babel-bot](https://github.com/babel-bot))
  - [#&#8203;18465](babel/babel#18465) fix: improve for loop closure environment check ([@&#8203;babel-bot](https://github.com/babel-bot))
  - [#&#8203;18464](babel/babel#18464) fix: assign closure body after handling return ([@&#8203;babel-bot](https://github.com/babel-bot))
- `babel-helper-module-transforms`, `babel-plugin-transform-modules-commonjs`
  - [#&#8203;18499](babel/babel#18499) fix: commonjs namespace re-export with a string export name ([@&#8203;babel-bot](https://github.com/babel-bot))
- `babel-helper-skip-transparent-expression-wrappers`, `babel-plugin-transform-optional-chaining`
  - [#&#8203;18482](babel/babel#18482) Fix optional call losing the receiver through a TS instantiation expression ([@&#8203;babel-bot](https://github.com/babel-bot))
- `babel-plugin-proposal-partial-application`
  - [#&#8203;18479](babel/babel#18479) fix(partial-app): support super method call ([@&#8203;babel-bot](https://github.com/babel-bot))
- `babel-register`
  - [#&#8203;18481](babel/babel#18481) fix(register): skip hook for ignored files ([@&#8203;babel-bot](https://github.com/babel-bot))
- `babel-helper-create-class-features-plugin`, `babel-plugin-transform-private-property-in-object`
  - [#&#8203;18462](babel/babel#18462) Return false for `#x in` on static private fields before initialization ([@&#8203;babel-bot](https://github.com/babel-bot))
- `babel-traverse`
  - [#&#8203;18480](babel/babel#18480) fix(babel-traverse): check variable shadowing for global object callees ([@&#8203;babel-bot](https://github.com/babel-bot))
- `babel-helper-create-class-features-plugin`, `babel-plugin-proposal-decorators`
  - [#&#8203;18478](babel/babel#18478) Fix decorators interaction with abstract/declare fields ([@&#8203;babel-bot](https://github.com/babel-bot))
- `babel-core`
  - [#&#8203;18463](babel/babel#18463) fix(core): createConfigItem allows cb as 2nd arg ([@&#8203;babel-bot](https://github.com/babel-bot))
- `babel-plugin-bugfix-safari-rest-destructuring-rhs-array`
  - [#&#8203;18457](babel/babel#18457) fix(bugfix): bound check before array access ([@&#8203;babel-bot](https://github.com/babel-bot))
- Other
  - [#&#8203;18459](babel/babel#18459) Fix eslint-parser AST definition of AccessorProperty ([@&#8203;babel-bot](https://github.com/babel-bot))
- `babel-plugin-transform-destructuring`
  - [#&#8203;18460](babel/babel#18460) fix: only collapse the empty-object check when it targets the declared binding ([@&#8203;babel-bot](https://github.com/babel-bot))
- `babel-helpers`, `babel-plugin-transform-async-generator-functions`, `babel-runtime-corejs3`
  - [#&#8203;18458](babel/babel#18458) Fix `asyncIterator` helper forwarding `.throw()` to `.return()` ([@&#8203;babel-bot](https://github.com/babel-bot))
- `babel-plugin-transform-for-of`
  - [#&#8203;18455](babel/babel#18455) Skip `for await` in `transform-for-of` ([@&#8203;babel-bot](https://github.com/babel-bot))
- `babel-helper-string-parser`, `babel-parser`
  - [#&#8203;18447](babel/babel#18447) fix: polish error message for invalid binary 0b19 ([@&#8203;babel-bot](https://github.com/babel-bot))

##### Committers: 1

- Babel Bot ([@&#8203;babel-bot](https://github.com/babel-bot))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - "before 9am on tuesday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4yMDYuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjIwNi4yIiwidGFyZ2V0QnJhbmNoIjoiZGV2ZWxvcCIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJyZW5vdmF0ZSJdfQ==-->

Reviewed-on: https://code.futo.org/harbor/harbor/pulls/2245