SUPPLY-001D8: patch Babel SystemJS compiler chain

[daliu]

The root production build graph no longer resolves the high-severity Babel SystemJS compiler defect. The patch stays inside the existing compatible parent range, changes no manifest or application code, and leaves every non-source-map build file byte-identical.

Officer impact: None. Officers use the website and current no-terminal procedures unchanged.

Officer documentation: None — this build-dependency repair changes no public content, navigation, collected data, permissions, deployment procedure, external account, payment, incident, backup, or recovery workflow.

Deployment evidence: Source and lock changed; all local gates passed and hosted PR checks are pending. The website was not published or verified, Firebase was not deployed, outside providers were not configured or contacted, production data was not inspected, and production behavior is unverified.

What changed

• Resolved the sole @babel/plugin-transform-modules-systemjs node from affected 7.25.9 to reviewed 7.29.7 through @babel/preset-env@7.26.9's unchanged ^7.25.9 range.
• Kept package.json byte-for-byte unchanged (SHA-256 af7101c5af46fb704fcf1de8f1dc5f50ab4beba9aeabc03e46dab1d3eff4a68d) with no direct dependency or override.
• Limited package-lock.json to exactly 16 records: 13 Babel records, two Jridgewell mapping records, and removal of one now-unused mapping helper.
• Added a dependency-free topology/identity test and Babel's safe upstream string-export regression.
• Updated the authoritative security, tracker, slice, and operations evidence while keeping officer procedures unchanged.

Invariant and failure behavior

Every SystemJS transform path must resolve once to a patched 7.x release through the unchanged parent. A direct declaration, override, second copy, affected version, missing public-registry identity, changed preset, changed manifest, or unexpected closure now fails the focused test. The fixture also rejects the old malformed identifier output.

There is no schema, data, account, payment, Firebase, provider, or runtime migration. Rollback requires a separately reviewed revert that explicitly reassesses the reopened advisory.

RED proof

On exact main 937e336031ffe064aa120460327538aab0d45d30:

• the identity test received vulnerable 7.25.9 instead of reviewed 7.29.7;
• the upstream fixture emitted _exportObj.default exports, failed the computed-key assertion, and was not valid JavaScript.

After the lock refresh, the focused dependency suite passes 14/14 and the fixture emits _exportObj["default exports"].

Verification

• Node 20.19.5/npm 10.8.2 clean lifecycle-disabled install: passed, 2,152 packages.
• Root dependency security: 14/14 passed.
• Targeted npm ls: one SystemJS 7.29.7 through preset-env 7.26.9; passed.
• Root full audit: 65 → 64; high 33 → 32; critical 2 unchanged; SystemJS advisory absent.
• Root production audit: 4 → 3; high 3 → 2; low 1 unchanged; SystemJS advisory absent.
• Frontend Jest: 14 suites, 727/727 passed.
• Frontend lint: exact reviewed 111-file baseline, 113 legacy errors and 6 warnings; no drift.
• Functions lint: passed.
• Functions Jest: 65 suites passed plus 2 intentional skips; 6,231 passed plus 64 intentional skips.
• Firestore Rules emulator: 378/378 passed on demo-rules-test.
• Commerce concurrency emulator: 63/63 passed on demo-pay002b2-test.
• SPA callback suite: 11/11 passed.
• Workflow/release/artifact/dependency suite: 56/56 passed.
• CI/deploy YAML parsing: passed.
• Diagnostic production build: passed.
• Clean-build comparison: all 49 non-map files are byte-identical, 9,975,968 bytes, aggregate SHA-256 3fa30c6d66827277432dcf7d42b0ead9e9fd543c9907571b092cfa43ba3f1e46. Only main.85f5094a.js.map changes; its 477 source paths and contents are identical, while mapping/name metadata adds 2,574 bytes.
• Final diff, whitespace, clean-checkout, lock-topology, authorization/App Check, input bounds, PII/secrets, idempotency, impossible transitions, and production-fallback review: clean.

Review

Three independent adversarial reviews inspected the final branch:

1. lock/test review reproduced the exact 16-record closure, public registry identity, audit result, and upstream fixture;
2. security/scope review found no unsafe dynamic execution, scope drift, or production fallback;
3. documentation/claims review independently reproduced the advisory, audit, and build numbers. Its one clarity finding was fixed in a0ca3bd and re-reviewed clean.

Residual risk

The separate Babel-core low and brace-expansion/minimatch high findings remain open and are not accepted as safe. The old development-only Firebase CLI critical paths require a separate CLI 15 + Java 21 compatibility child. Functions audit findings remain open. Native npm sbom remains blocked by the pre-existing @types/react peer mismatch; no SBOM was committed or uploaded, and SUPPLY-001G retains dependency-inventory automation.

Closes #453

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	a0ca3bd
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a60c19f2f0b7e00096a68f3
😎 Deploy Preview	https://deploy-preview-454--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.