search

postcss / postcss-load-config

Autoload Config for PostCSS
MIT License
638 stars 71 forks source link

Moderate vulnerability in yaml version #242

Closed Ericlm closed 1 year ago

Ericlm commented 1 year ago

According to the GitHub Advisory Database, there is a moderate severity issue in yaml version 2.2.1, which is fixed in 2.2.2. I think the dependency should be upgraded.

ai commented 1 year ago

We are using ^ in version and all clients can update dependencies by calling npm update.

But I updated dependencies inside this repo https://github.com/postcss/postcss-load-config/commit/03adf207615dcc7cd650e8d4ceebb71d4044f850

alex-r-redfern commented 1 year ago

Is there any chance of tagging the above commit? Thanks for all you do :)

ai commented 1 year ago

@alex-r-redfern why do you need it?

alex-r-redfern commented 1 year ago

This is possibly me being dumb, but on the 4.0.1 tag, yaml is required at ^2.1.1 which will accept any patch version changes, but yaml have fixed this under a minor so the change won't be picked up. I could be wrong on this?

ai commented 1 year ago

@alex-r-redfern why you can’t bump yaml instead?

pnpm has useful pnpm -R update yaml command.

npm also have tool for nested dependencies update.

alex-r-redfern commented 1 year ago

Hey Andrey, It's only because I'm not requiring this package, or indeed yaml, directly: it's via tailwindcss so me requiring yaml directly I don't think will help in this instance. No worries though, I'll bring it up on the tailwind issues instead. All the best, Alex