[Snyk] Upgrade core-js from 3.37.0 to 3.44.0 by tufstraka · Pull Request #213 · tufstraka/BFR

tufstraka · 2025-08-16T07:57:28Z

Snyk has created this PR to upgrade core-js from 3.37.0 to 3.44.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 9 versions ahead of your current version.
The recommended version was released a month ago.

Release notes

Package name: core-js

3.44.0 - 2025-07-07
- Changes v3.43.0...v3.44.0 (87 commits)
- Uint8Array to / from base64 and hex stage 3 proposal:
  - Fixed several V8 bugs in Uint8Array.fromHex and Uint8Array.prototype.{ setFromBase64, toBase64, toHex }, thanks @ brc-dd
- Joint iteration stage 2.7 proposal:
  - Uses Get in Iterator.zipKeyed, following tc39/proposal-joint-iteration#43
- Iterator sequencing stage 2.7 proposal:
  - Iterator.concat no longer reuses IteratorResult object of concatenated iterators, following tc39/proposal-iterator-sequencing#26
- Iterator chunking stage 2 proposal:
  - Added built-ins:
    - Iterator.prototype.sliding
- Number.prototype.clamp stage 2 proposal:
  - clamp no longer throws an error on NaN as min or max, following tc39/proposal-math-clamp#d2387791c265edf66fbe2455eab919016717ce6f
- Fixed some cases of Set.prototype.{ symmetricDifference, union } detection
- Added missing dependencies to some entries of static Iterator methods
- Added missing /full/{ instance, number/virtual }/clamp entries
- Some minor stylistic changes
- Compat data improvements:
  - Added Electron 38 and 39 compat data mapping
  - Added Oculus Quest Browser 38 and 39 compat data mapping
  - Iterator helpers marked as fixed and updated following the latest spec changes in Safari 26.0
  - Set.prototype.{ difference, symmetricDifference, union } marked as fixed in Safari 26.0
  - SuppressedError marked as fixed in FF141
  - Error.isError marked as fixed in Node 24.3
  - setImmediate and clearImmediate marked as available from Deno 2.4
  - Math.sumPrecise marked as shipped in Bun 1.2.18
  - %TypedArray%.prototype.with marked as fixed in Bun 1.2.18
3.43.0 - 2025-06-09
- Changes v3.42.0...v3.43.0 (139 commits)
- Explicit Resource Management proposals:
  - Built-ins:
    - Symbol.dispose
    - Symbol.asyncDispose
    - SuppressedError
    - DisposableStack
      - DisposableStack.prototype.dispose
      - DisposableStack.prototype.use
      - DisposableStack.prototype.adopt
      - DisposableStack.prototype.defer
      - DisposableStack.prototype.move
      - DisposableStack.prototype[@@ dispose]
    - AsyncDisposableStack
      - AsyncDisposableStack.prototype.disposeAsync
      - AsyncDisposableStack.prototype.use
      - AsyncDisposableStack.prototype.adopt
      - AsyncDisposableStack.prototype.defer
      - AsyncDisposableStack.prototype.move
      - AsyncDisposableStack.prototype[@@ asyncDispose]
    - Iterator.prototype[@@ dispose]
    - AsyncIterator.prototype[@@ asyncDispose]
  - Moved to stable ES, May 2025 TC39 meeting
  - Added es. namespace module, /es/ and /stable/ namespaces entries
- Array.fromAsync proposal:
  - Built-ins:
    - Array.fromAsync
  - Moved to stable ES, May 2025 TC39 meeting
  - Added es. namespace module, /es/ and /stable/ namespaces entries
- Error.isError proposal:
  - Built-ins:
    - Error.isError
  - Moved to stable ES, May 2025 TC39 meeting
  - Added es. namespace module, /es/ and /stable/ namespaces entries
- Added Joint iteration stage 2.7 proposal:
  - Added built-ins:
    - Iterator.zip
    - Iterator.zipKeyed
- Added Iterator chunking stage 2 proposal:
  - Added built-ins:
    - Iterator.prototype.chunks
    - Iterator.prototype.windows
- Number.prototype.clamp proposal:
  - Built-ins:
    - Number.prototype.clamp
  - Moved to stage 2, May 2025 TC39 meeting
  - Math.clamp was replaced with Number.prototype.clamp
  - Removed a RangeError if min <= max or +0 min and -0 max, tc39/proposal-math-clamp/#22
- Always check regular expression flags by flags getter PR. Native methods are not fixed, only own implementation updated for:
  - RegExp.prototype[@@ match]
  - RegExp.prototype[@@ replace]
- Improved handling of RegExp flags in polyfills of some methods in engines without proper support of RegExp.prototype.flags and without polyfill of this getter
- Added feature detection for a WebKit bug that occurs when this is updated while Set.prototype.difference is being executed
- Added feature detection for a WebKit bug that occurs when iterator record of a set-like object isn't called before cloning this in the following methods:
  - Set.prototype.symmetricDifference
  - Set.prototype.union
- Added feature detection for a bug in V8 ~ Chromium < 126. Following methods should throw an error on invalid iterator:
  - Iterator.prototype.drop
  - Iterator.prototype.filter
  - Iterator.prototype.flatMap
  - Iterator.prototype.map
- Added feature detection for a WebKit bug: incorrect exception thrown by Iterator.from when underlying iterator's return method is null
- Added feature detection for a FF bug: incorrect exception thrown by Array.prototype.with when index coercion fails
- Added feature detection for a WebKit bug: TypedArray.prototype.with should truncate negative fractional index to zero, but instead throws an error
- Worked around a bug of many different tools (example) with incorrect transforming and breaking JS syntax on getting a method from a number literal
- Fixed deoptimization of the Promise polyfill in the pure version
- Added some missed dependencies to /iterator/flat-map entries
- Some other minor fixes and improvements
- Compat data improvements:
  - Added Deno 2.3 and Deno 2.3.2 compat data mapping
  - Updated Electron 37 compat data mapping
  - Added Opera Android 90 compat data mapping
  - Error.isError marked not supported in Node because of a bug
  - Set.prototype.difference marked as not supported in Safari and supported only from Bun 1.2.5 because of a bug
  - Set.prototype.{ symmetricDifference, union } marked as not supported in Safari and supported only from Bun 1.2.5 because of a bug
  - Iterator.from marked as not supported in Safari and supported only from Bun 1.2.5 because of a bug
  - Iterators closing on early errors in Iterator helpers marked as implemented from FF141
  - Array.prototype.with marked as supported only from FF140 because it throws an incorrect exception when index coercion fails
  - TypedArray.prototype.with marked as unsupported in Bun and Safari because it should truncate negative fractional index to zero, but instead throws an error
  - DisposableStack and AsyncDisposableStack marked as shipped in FF141 (SuppressedError has a bug)
  - AsyncDisposableStack bugs marked as fixed in Deno 2.3.2
  - SuppressedError bugs (extra arguments support and arity) marked as fixed in Bun 1.2.15
3.42.0 - 2025-04-29
- Changes v3.41.0...v3.42.0 (142 commits)
- Map upsert proposal:
  - Moved to stage 2.7, April 2025 TC39 meeting
  - Validation order of WeakMap.prototype.getOrInsertComputed updated following tc39/proposal-upsert#79
  - Built-ins:
    - Map.prototype.getOrInsert
    - Map.prototype.getOrInsertComputed
    - WeakMap.prototype.getOrInsert
    - WeakMap.prototype.getOrInsertComputed
- Don't call well-known Symbol methods for RegExp on primitive values following tc39/ecma262#3009:
  - For avoid performance regression, temporarily, only in own core-js implementations
  - Built-ins:
    - String.prototype.matchAll
    - String.prototype.match
    - String.prototype.replaceAll
    - String.prototype.replace
    - String.prototype.search
    - String.prototype.split
- Added workaround for the Uint8Array.prototype.setFromBase64 bug in some of Linux builds of WebKit
- Implemented early-error iterator closing following tc39/ecma262#3467, including fix of a WebKit bug, in the following methods:
  - Iterator.prototype.drop
  - Iterator.prototype.every
  - Iterator.prototype.filter
  - Iterator.prototype.find
  - Iterator.prototype.flatMap
  - Iterator.prototype.forEach
  - Iterator.prototype.map
  - Iterator.prototype.reduce
  - Iterator.prototype.some
  - Iterator.prototype.take
- Fixed missing forced replacement of AsyncIterator helpers
- Added closing of sync iterator when async wrapper yields a rejection following tc39/ecma262#2600. Affected methods:
  - Array.fromAsync (due to the lack of async feature detection capability - temporarily, only in own core-js implementation)
  - AsyncIterator.from
  - Iterator.prototype.toAsync
- Added detection for throwing on undefined initial parameter in Iterator.prototype.reduce (see WebKit bug)
- core-js-compat and core-js-builder API:
  - Added 'intersect' support for targets.esmodules (Babel 7 behavior)
  - Fixed handling of targets.esmodules: true (Babel 7 behavior)
- Compat data improvements:
  - Explicit Resource Management features disabled (again) in V8 ~ Chromium 135 and re-added in 136
  - RegExp.escape marked as shipped from V8 ~ Chromium 136
  - Error.isError marked as shipped from FF138
  - Explicit Resource Management features re-enabled in Deno 2.2.10
  - Iterator helpers proposal features marked as supported from Deno 1.38.1 since it seems they were disabled in 1.38.0
  - Iterator.prototype.{ drop, reduce, take } methods marked as fixed in Bun 1.2.11
  - Added NodeJS 24.0 compat data mapping
  - Updated Electron 36 and added Electron 37 compat data mapping
  - Added Opera Android 88 and 89 compat data mapping
  - Added Oculus Quest Browser 37 compat data mapping
3.41.0 - 2025-03-01
- Changes v3.40.0...v3.41.0 (85 commits)
- RegExp.escape proposal:
  - Built-ins:
    - RegExp.escape
  - Moved to stable ES, February 2025 TC39 meeting
  - Added es. namespace module, /es/ and /stable/ namespaces entries
- Float16 proposal:
  - Built-ins:
    - Math.f16round
    - DataView.prototype.getFloat16
    - DataView.prototype.setFloat16
  - Moved to stable ES, February 2025 TC39 meeting
  - Added es. namespace modules, /es/ and /stable/ namespaces entries
- Math.clamp stage 1 proposal:
  - Built-ins:
    - Math.clamp
  - Extracted from old Math extensions proposal, February 2025 TC39 meeting
  - Added arguments validation
  - Added new entries
- Added a workaround of a V8 AsyncDisposableStack bug, tc39/proposal-explicit-resource-management/256
- Compat data improvements:
  - DisposableStack, SuppressedError and Iterator.prototype[@@ dispose] marked as shipped from V8 ~ Chromium 134
  - Error.isError added and marked as shipped from V8 ~ Chromium 134
  - Math.f16round and DataView.prototype.{ getFloat16, setFloat16 } marked as shipped from V8 ~ Chromium 135
  - Iterator helpers proposal features marked as shipped from Safari 18.4
  - JSON.parse source text access proposal features marked as shipped from Safari 18.4
  - Math.sumPrecise marked as shipped from FF137
  - Added Deno 2.2 compat data and compat data mapping
    - Explicit Resource Management features are available in V8 ~ Chromium 134, but not in Deno 2.2 based on it
  - Updated Electron 35 and added Electron 36 compat data mapping
  - Updated Opera Android 87 compat data mapping
  - Added Samsung Internet 28 compat data mapping
  - Added Oculus Quest Browser 36 compat data mapping
3.40.0 - 2025-01-07
- Changes v3.39.0...v3.40.0 (130 commits)
- Added Error.isError stage 3 proposal:
  - Added built-ins:
    - Error.isError
  - We have no bulletproof way to polyfill this method / check if the object is an error, so it's an enough naive implementation that is marked as .sham
- Explicit Resource Management stage 3 proposal:
  - Updated the way async disposing of only sync disposable resources, tc39/proposal-explicit-resource-management/218
- Iterator sequencing stage 2.7 proposal:
  - Reuse IteratorResult objects when possible, tc39/proposal-iterator-sequencing/17, tc39/proposal-iterator-sequencing/18, December 2024 TC39 meeting
- Added a fix of V8 < 12.8 / NodeJS < 22.10 bug with handling infinite length of set-like objects in Set methods
- Optimized DataView.prototype.{ getFloat16, setFloat16 } performance, #1379, thanks @ LeviPesin
- Dropped unneeded feature detection of non-standard %TypedArray%.prototype.toSpliced
- Dropped possible re-usage of some non-standard / early stage features (like Math.scale) available on global
- Some other minor improvements
- Compat data improvements:
  - RegExp.escape marked as shipped from Safari 18.2
  - Promise.try marked as shipped from Safari 18.2
  - Math.f16round and DataView.prototype.{ getFloat16, setFloat16 } marked as shipped from Safari 18.2
  - Uint8Array to / from base64 and hex proposal methods marked as shipped from Safari 18.2
  - JSON.parse source text access proposal features marked as shipped from FF135
  - RegExp.escape marked as shipped from FF134
  - Promise.try marked as shipped from FF134
  - Symbol.dispose, Symbol.asyncDispose and Iterator.prototype[@@ dispose] marked as shipped from FF135
  - JSON.parse source text access proposal features marked as shipped from Bun 1.1.43
  - Fixed NodeJS version where URL.parse was added - 22.1 instead of 22.0
  - Added Deno 2.1 compat data mapping
  - Added Rhino 1.8.0 compat data with significant number of modern features
  - Added Electron 35 compat data mapping
  - Updated Opera 115+ compat data mapping
  - Added Opera Android 86 and 87 compat data mapping
3.39.0 - 2024-10-31
- Changes v3.38.1...v3.39.0
- Iterator helpers proposal:
  - Built-ins:
    - Iterator
      - Iterator.from
      - Iterator.prototype.drop
      - Iterator.prototype.every
      - Iterator.prototype.filter
      - Iterator.prototype.find
      - Iterator.prototype.flatMap
      - Iterator.prototype.forEach
      - Iterator.prototype.map
      - Iterator.prototype.reduce
      - Iterator.prototype.some
      - Iterator.prototype.take
      - Iterator.prototype.toArray
      - Iterator.prototype[@@ toStringTag]
  - Moved to stable ES, October 2024 TC39 meeting
  - Added es. namespace modules, /es/ and /stable/ namespaces entries
- Promise.try:
  - Built-ins:
    - Promise.try
  - Moved to stable ES, October 2024 TC39 meeting
  - Added es. namespace module, /es/ and /stable/ namespaces entries
  - Fixed /actual|full/promise/try entries for the callback arguments support
- Math.sumPrecise proposal:
  - Built-ins:
    - Math.sumPrecise
  - Moved to stage 3, October 2024 TC39 meeting
  - Added /actual/ namespace entries, unconditional forced replacement changed to feature detection
- Added Iterator sequencing stage 2.7 proposal:
  - Added built-ins:
    - Iterator.concat
- Map upsert stage 2 proposal:
  - Updated to the new API following the October 2024 TC39 meeting
  - Added built-ins:
    - Map.prototype.getOrInsert
    - Map.prototype.getOrInsertComputed
    - WeakMap.prototype.getOrInsert
    - WeakMap.prototype.getOrInsertComputed
- Extractors proposal moved to stage 2, October 2024 TC39 meeting
- Usage of @@ species pattern removed from %TypedArray% and ArrayBuffer methods, tc39/ecma262/3450:
  - Built-ins:
    - %TypedArray%.prototype.filter
    - %TypedArray%.prototype.filterReject
    - %TypedArray%.prototype.map
    - %TypedArray%.prototype.slice
    - %TypedArray%.prototype.subarray
    - ArrayBuffer.prototype.slice
- Some other minor improvements
- Compat data improvements:
  - Uint8Array to / from base64 and hex proposal methods marked as shipped from FF133
  - Added NodeJS 23.0 compat data mapping
  - self descriptor is fixed in Deno 1.46.0
  - Added Deno 1.46 and 2.0 compat data mapping
  - Iterator helpers proposal methods marked as shipped from Bun 1.1.31
  - Added Electron 34 and updated Electron 33 compat data mapping
  - Added Opera Android 85 compat data mapping
  - Added Oculus Quest Browser 35 compat data mapping
3.38.1 - 2024-08-20
- Changes v3.38.0...v3.38.1
- Fixed some cases of URLSearchParams percent decoding, #1357, #1361, thanks @ slowcheetah
- Some stylistic changes and minor optimizations
- Compat data improvements:
  - Iterator helpers proposal methods marked as shipped from FF131
  - Math.f16round and DataView.prototype.{ getFloat16, setFloat16 } marked as shipped from Bun 1.1.23
  - RegExp.escape marked as shipped from Bun 1.1.22
  - Promise.try marked as shipped from Bun 1.1.22
  - Uint8Array to / from base64 and hex proposal methods marked as shipped from Bun 1.1.22
  - Added Hermes 0.13 compat data, similar to React Native 0.75 Hermes
  - Added Opera Android 84 compat data mapping
3.38.0 - 2024-08-04
- Changes v3.37.1...v3.38.0
- RegExp.escape proposal:
  - Built-ins:
    - RegExp.escape
  - Moved to stage 3, June 2024 and July 2024 TC39 meetings
  - Updated the way of escaping, regex-escaping/77
  - Throw an error on non-strings, regex-escaping/58
  - Added /actual/ namespace entries, unconditional forced replacement changed to feature detection
- Promise.try proposal:
  - Built-ins:
    - Promise.try
  - Moved to stage 3, June 2024 TC39 meeting
  - Added /actual/ namespace entries, unconditional forced replacement changed to feature detection
- Uint8Array to / from base64 and hex stage 3 proposal:
  - Built-ins:
    - Uint8Array.fromBase64
    - Uint8Array.fromHex
    - Uint8Array.prototype.setFromBase64
    - Uint8Array.prototype.setFromHex
    - Uint8Array.prototype.toBase64
    - Uint8Array.prototype.toHex
  - Added Uint8Array.prototype.{ setFromBase64, setFromHex } methods
  - Added Uint8Array.fromBase64 and Uint8Array.prototype.setFromBase64 lastChunkHandling option, proposal-arraybuffer-base64/33
  - Added Uint8Array.prototype.toBase64 omitPadding option, proposal-arraybuffer-base64/60
  - Added throwing a TypeError on arrays backed by detached buffers
  - Unconditional forced replacement changed to feature detection
- Fixed RegExp named capture groups polyfill in combination with non-capturing groups, #1352, thanks @ Ulop
- Improved some cases of environment detection
- Uses process.getBuiltinModule for getting built-in NodeJS modules where it's available
- Uses https instead of http in URL constructor feature detection to avoid extra notifications from some overly vigilant security scanners, #1345
- Some minor optimizations
- Updated browserslist in core-js-compat dependencies that fixes an upstream issue with incorrect interpretation of some browserslist queries, #1344, browserslist/829, browserslist/836
- Compat data improvements:
  - Added Safari 18.0 compat data:
  - Math.f16round and DataView.prototype.{ getFloat16, setFloat16 } marked as shipped from FF129
  - Symbol.asyncDispose added and marked as supported from V8 ~ Chromium 127
  - Promise.try added and marked as supported from V8 ~ Chromium 128
  - Added Deno 1.44 and 1.45 compat data mapping
  - self descriptor is broken in Deno 1.45.3 (again)
  - Added Electron 32 and 33 compat data mapping
  - Added Opera Android 83 compat data mapping
  - Added Samsung Internet 27 compat data mapping
  - Added Oculus Quest Browser 34 compat data mapping
3.37.1 - 2024-05-14
- Changes v3.37.0...v3.37.1
- Fixed URL.parse feature detection for some specific cases
- Compat data improvements:
  - Set methods proposal added and marked as supported from FF 127
  - Symbol.dispose added and marked as supported from V8 ~ Chromium 125
  - Math.f16round and DataView.prototype.{ getFloat16, setFloat16 } added and marked as supported from Deno 1.43
  - URL.parse added and marked as supported from Chromium 126
  - URL.parse added and marked as supported from NodeJS 22.0
  - URL.parse added and marked as supported from Deno 1.43
  - Added Rhino 1.7.15 compat data, many features marked as supported
  - Added NodeJS 22.0 compat data mapping
  - Added Deno 1.43 compat data mapping
  - Added Electron 31 compat data mapping
  - Updated Opera Android 82 compat data mapping
  - Added Samsung Internet 26 compat data mapping
  - Added Oculus Quest Browser 33 compat data mapping
3.37.0 - 2024-04-16
- Changes v3.36.1...v3.37.0
- New Set methods proposal:
  - Built-ins:
    - Set.prototype.intersection
    - Set.prototype.union
    - Set.prototype.difference
    - Set.prototype.symmetricDifference
    - Set.prototype.isSubsetOf
    - Set.prototype.isSupersetOf
    - Set.prototype.isDisjointFrom
  - Moved to stable ES, April 2024 TC39 meeting
  - Added es. namespace modules, /es/ and /stable/ namespaces entries
- Explicit Resource Management stage 3 proposal
  - Some minor updates like explicit-resource-management/217
- Added Math.sumPrecise stage 2.7 proposal:
  - Built-ins:
    - Math.sumPrecise
- Promise.try proposal:
  - Built-ins:
    - Promise.try
  - Added optional arguments support, promise-try/16
  - Moved to stage 2.7, April 2024 TC39 meeting
- RegExp.escape stage 2 proposal:
  - Moved to hex-escape semantics, regex-escaping/67
    - It's not the final change of the way of escaping, waiting for regex-escaping/77 soon
- Pattern matching stage 1 proposal:
  - Built-ins:
    - Symbol.customMatcher
  - Once again, the used well-known symbol was renamed
  - Added new entries for that
- Added Extractors stage 1 proposal:
  - Built-ins:
    - Symbol.customMatcher
  - Since the Symbol.customMatcher well-known symbol from the pattern matching proposal is also used in the exactors proposal, added an entry also for this proposal
- Added URL.parse, url/825
- Engines bugs fixes:
  - Added a fix of Safari { Object, Map }.groupBy bug that does not support iterable primitives
  - Added a fix of Safari bug with double call of constructor in Array.fromAsync
- Compat data improvements:
  - URL.parse added and marked as supported from FF 126
  - URL.parse added and marked as supported from Bun 1.1.4
  - URL.canParse fixed and marked as supported from Bun 1.1.0
  - New Set methods fixed in JavaScriptCore and marked as supported from Bun 1.1.1
  - Added Opera Android 82 compat data mapping

from core-js GitHub release notes

Important

Check the changes in this PR to ensure they won't cause issues with your project.
This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

📜 Customise PR templates

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

Snyk has created this PR to upgrade core-js from 3.37.0 to 3.44.0. See this package in npm: core-js See this project in Snyk: https://app.snyk.io/org/kadimakeith/project/b8e8a269-157d-48b1-b50e-2c3f048e60c5?utm_source=github&utm_medium=referral&page=upgrade-pr

netlify · 2025-08-16T08:01:17Z

❌ Deploy Preview for biasedfilmreview failed. Why did it fail? →

Name	Link
🔨 Latest commit	`a1e1196`
🔍 Latest deploy log	https://app.netlify.com/projects/biasedfilmreview/deploys/68a039ebf9bfa20008f9a65a

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Upgrade core-js from 3.37.0 to 3.44.0#213

[Snyk] Upgrade core-js from 3.37.0 to 3.44.0#213
tufstraka wants to merge 1 commit intomainfrom
snyk-upgrade-8ca0783a8a1321108fd532489ed1398d

tufstraka commented Aug 16, 2025

Uh oh!

netlify bot commented Aug 16, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

tufstraka commented Aug 16, 2025

Snyk has created this PR to upgrade core-js from 3.37.0 to 3.44.0.

Uh oh!

netlify bot commented Aug 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ Deploy Preview for biasedfilmreview failed. Why did it fail? →

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

netlify bot commented Aug 16, 2025 •

edited

Loading