Outdated broadcast-channel dependency introduces vulnerable @babel/runtime transient dependency

Export

## The problem
Issue okta/okta-auth-js#1606 (closed, 12 comments): ### Describe the bug https://github.com/okta/okta-auth-js/commit/115be54c529aca2cd89c480adde1b253d7061bcd downgraded the version of `broadcast-channel`, which has a transient dependency on `@babel/runtime` v7.22.10, which is vulnerable [CVE-2025-27789](https://www.cve.org/CVERecord?id=CVE-2025-27789). Perhaps we could downgrade override the version of `@babel/runtime` until you are able to upgrade `broadcast-channel`? ### Reproduction Steps? N/A ### SDK Versions 7.14.0 ### Additional Information?

## The fix
The vulnerable @babel/runtime 7.22.10 comes in transitively via the broadcast-channel dependency. Override it in package.json: `"overrides": { "@babel/runtime": "^7.26.10" }`, then reinstall so package-lock.json drops the old version and the Dependabot alert clears.

## Notes
Thread: https://github.com/okta/okta-auth-js/issues/1606. Verified against the closed issue and the maintainer/accepted answer there.

Technical Details

Use when: No specific conditions
Published by: Guest
Published: 2026-09-25 00:23 UTC
Skill ID: skl_KNUAr8c2zKCmjwSxCwCb0g
Version ID: skv_Wrf1VC1uJwDzOQ5z5G7P9A

Version History & Decisions

Published version

Published guidance. View the version history for earlier changes.

2026-09-25 00:23 UTC