Skip to content

chore(deps): remove unused @babel/runtime-corejs3 dependency#11586

Merged
slorber merged 3 commits intofacebook:mainfrom
JustinBeckwith:remove-unused-runtime-corejs3
Dec 4, 2025
Merged

chore(deps): remove unused @babel/runtime-corejs3 dependency#11586
slorber merged 3 commits intofacebook:mainfrom
JustinBeckwith:remove-unused-runtime-corejs3

Conversation

@JustinBeckwith
Copy link
Copy Markdown
Contributor

Description

Removes the unused @babel/runtime-corejs3 dependency from @docusaurus/babel.

Evidence this dependency is unused

  1. The Babel preset explicitly disables corejs in transform-runtime:

    In packages/docusaurus-babel/src/preset.ts:

    [
      require.resolve('@babel/plugin-transform-runtime'),
      {
        corejs: false,  // <-- NOT using @babel/runtime-corejs3
        helpers: true,
        // ...
        absoluteRuntime: absoluteRuntimePath,  // points to @babel/runtime, not runtime-corejs3
      },
    ]
  2. No source code imports from @babel/runtime-corejs3 - a code search only returns hits in CHANGELOG.md and package.json

  3. The polyfill strategy uses @babel/preset-env with useBuiltIns: 'entry' and corejs: '3', which uses regular core-js (global polyfills), not @babel/runtime-corejs3 (sandboxed polyfills)

Why this matters

@babel/runtime-corejs3 depends on core-js-pure, which executes a postinstall script during npm install. Removing unused dependencies that run install scripts helps reduce supply chain attack surface.

Test plan

  • Existing tests pass (the dependency is unused, so no behavior change expected)
  • Build succeeds

Fixes #11585

The @docusaurus/babel package lists @babel/runtime-corejs3 as a
dependency, but it is not used anywhere in the codebase:

1. The Babel preset explicitly sets `corejs: false` in the
   transform-runtime plugin configuration
2. The absoluteRuntime path points to @babel/runtime, not
   @babel/runtime-corejs3
3. No source files import from @babel/runtime-corejs3

This dependency brings in core-js-pure, which executes a postinstall
script during npm install. Removing unused dependencies that run
install scripts helps reduce supply chain attack surface.

Fixes facebook#11585
@meta-cla meta-cla bot added the CLA Signed Signed Facebook CLA label Nov 30, 2025
@socket-security
Copy link
Copy Markdown

socket-security bot commented Nov 30, 2025

@netlify
Copy link
Copy Markdown

netlify bot commented Nov 30, 2025

[V2]

Name Link
🔨 Latest commit e33a01e
🔍 Latest deploy log https://app.netlify.com/projects/docusaurus-2/deploys/693166e9e0131000084cdee1
😎 Deploy Preview https://deploy-preview-11586--docusaurus-2.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@slorber
Copy link
Copy Markdown
Collaborator

slorber commented Dec 1, 2025

Thanks, I'll check that as soon as our GitHub actions are back

@slorber slorber merged commit ebb0d0e into facebook:main Dec 4, 2025
44 of 45 checks passed
@slorber slorber added the pr: maintenance This PR does not produce any behavior differences to end users when upgrading. label Dec 4, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

CLA Signed Signed Facebook CLA pr: maintenance This PR does not produce any behavior differences to end users when upgrading.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

chore(deps): Remove unused @babel/runtime-corejs3 dependency

2 participants