Post

It is unlikely that you are affected, as the security vulnerability only applies when passing a user-provided string to the second argument of RegExp.prototype.replace.

We apologize to all the maintainers of libraries that depend on @babel/runtime, do not actually trigger the vulnerable code path, and will get bug reports asking to "please upgrade Babel because it's insecure" 😅

oof I sure hope security bots know to make this distinction and don't spam unaffected users of the API, thus reducing our trust in the system or belief in security work