optimize: bump @babel/runtime to ^7.27.0

[jihun4452]

• I have read the CONTRIBUTING.md guidelines.
• I have registered the PR changes.

Ⅰ. Describe what this PR did

Update console-fe/package.json to bump @babel/runtime from ^7.26.10 to ^7.27.0.

This aligns the direct dependency with the already resolved version in package-lock.json and addresses the potential security risk (CVE-2025-27789).

Ⅱ. Does this pull request fix one issue?

fixes #7660

Ⅲ. Why don't you add test cases (unit test/integration test)?

Not applicable. This PR only updates a dependency version in package.json.

Ⅳ. Describe how to verify it

1. Run npm install under console-fe.
2. Confirm that node_modules/@babel/runtime is installed at version 7.27.0.
3. Build and run console-fe successfully without errors.

Ⅴ. Special notes for reviews

None.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 61.31%. Comparing base (3f86ccd) to head (456d2e4).
⚠️ Report is 3 commits behind head on 2.x.

Additional details and impacted files

@@             Coverage Diff              @@
##                2.x    #7673      +/-   ##
============================================
+ Coverage     61.27%   61.31%   +0.04%     
  Complexity      666      666              
============================================
  Files          1314     1314              
  Lines         49817    49817              
  Branches       5858     5858              
============================================
+ Hits          30524    30544      +20     
+ Misses        16549    16529      -20     
  Partials       2744     2744              

see 9 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[maple525866]

Please register your PR in those two files :
https://github.com/apache/incubator-seata/blob/2.x/changes/zh-cn/2.x.md
https://github.com/apache/incubator-seata/blob/2.x/changes/en-us/2.x.md

[xingfudeshi]

Hi,
Please register this PR in change logs.

[jihun4452]

Hi, I have updated the changelog in both zh-cn/2.x.md and en-us/2.x.md as requested. Thanks!

[slievrly]

Is it necessary to make an update in package-lock.json?

[xingfudeshi]

Hi, I have updated the changelog in both zh-cn/2.x.md and en-us/2.x.md as requested. Thanks!

Add your Github ID at the bottom of the change logs as well.

[jihun4452]

Is it necessary to make an update in package-lock.json?

I took a closer look and noticed that package-lock.json already resolves @babel/runtime to version 7.27.0,
so from my side there didn’t seem to be anything further required in that file.
Would it be necessary for me to commit the lock file as well in this PR?

[xingfudeshi]

Is it necessary to make an update in package-lock.json?

I took a closer look and noticed that package-lock.json already resolves @babel/runtime to version 7.27.0, so from my side there didn’t seem to be anything further required in that file. Would it be necessary for me to commit the lock file as well in this PR?

Okay, I acknowledge your point. But, In order to address the CVE notifications, it wound be necessary to upgrade the @babel/runtimedependency version within the package-lock.json file.

[slievrly]

Is it necessary to make an update in package-lock.json?

I took a closer look and noticed that package-lock.json already resolves @babel/runtime to version 7.27.0, so from my side there didn’t seem to be anything further required in that file. Would it be necessary for me to commit the lock file as well in this PR?

package-lock.json is used to lock the version of the installation dependency. Some dependencies specify the version of @babel/runtime. Of course, some are cross-version. We need to upgrade the version-compatible dependencies to the patch-free version.

[jihun4452]

Thank you for the clarification. I understand your point regarding the CVE notifications and version-locked dependencies.
I will update and commit the package-lock.json in this PR to ensure all relevant dependencies are upgraded to the patched version.

[jihun4452]

Updated package-lock.json and added an overrides entry to enforce @babel/runtime ^7.27.0.
The lock now resolves @babel/runtime to 7.28.4, removing older prerelease copies (e.g., 7.0.0-beta.46 under dva/dva-core) and addressing CVE-2025-27789 across transitive dependencies.
If you prefer not to use overrides, I will revise this PR accordingly.

[xingfudeshi]

LGTM

[Copilot]

Pull Request Overview

Bumps @babel/runtime dependency from ^7.26.10 to ^7.27.0 to address security vulnerability CVE-2025-27789 and align with the resolved version in package-lock.json.

• Updates @babel/runtime version in package.json dependencies
• Adds changelog entries in both English and Chinese documentation
• Includes contributor acknowledgment for the security fix

Reviewed Changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.

File	Description
console/src/main/resources/static/console-fe/package.json	Updates @babel/runtime dependency version and adds it to overrides section
changes/zh-cn/2.x.md	Adds Chinese changelog entry for the dependency update
changes/en-us/2.x.md	Adds English changelog entry for the dependency update

Files not reviewed (1)

• console/src/main/resources/static/console-fe/package-lock.json: Language not supported

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

The @babel/runtime entry is duplicated - it's already defined in the dependencies section at line 34. This duplication in what appears to be an overrides section could lead to confusion about which version takes precedence.

Suggested change

	"cipher-base": "1.0.6",
	"@babel/runtime": "^7.27.0"
	"cipher-base": "1.0.6"

[slievrly]

LGTM