fix(deps): runtime dependency security fixes

[javascript-sdk-gitflow]

Summary

Batched runtime dependency security fixes. One commit per vulnerability.

Fixes

• @babel/core 7.29.0 → 7.29.7 — CVE-2026-49356 / GHSA-4x5r-pxfx-6jf8 (low) — https://github.com/getsentry/sentry-javascript/security/dependabot/1949

Skipped — needs human

• @opentelemetry/core — needs a coordinated OpenTelemetry SDK upgrade. The vulnerable 2.6.1 is pinned at an exact version by a whole family of sibling OTel packages (stable sdk-trace-base@2.6.1, resources@2.6.1, sdk-metrics@2.6.1 and experimental exporter-trace-otlp-http/otlp-transformer/otlp-exporter-base/sdk-logs/instrumentation-http@0.214.0). Removing it requires bumping the entire OTel stack to the 2.8.0 train — including raising the experimental ^0.214.0 ranges (a caret bump alone won't satisfy) — which is a breaking-risk upgrade needing full regression testing, not a safe automated minor bump. Bumping only the direct @opentelemetry/core declaration would leave two copies of @opentelemetry/core in the tree (a context-propagation footgun) without resolving the alert. — https://github.com/getsentry/sentry-javascript/security/dependabot/1962

Note

The @babel/core fix resolves the primary hoisted 7.29.0. A deep transitive 7.18.10 remains, pinned exactly by @angular-devkit/build-angular (dev-only Angular build tooling); clearing it needs a major devkit upgrade.

🤖 Generated with Claude Code