[security] Fix json5 to fix CVE-2022-46175 vulnerability

storybookjs / addon-postcss

This Storybook addon can be used to run the PostCSS preprocessor against your stories.

MIT License

20 stars 22 forks source link

[security] Fix json5 to fix CVE-2022-46175 vulnerability #42

Closed idanrozin closed 1 year ago

idanrozin commented 1 year ago

Hello there, there is a new npm vulnerability which needs to be fix ASAP.

Suggested solution: Bump css-loader to version >= 6

The vulnerability is in json5 library which is used in loader-utils package which is being used by previous versions of css-loader which your library is using. I think that this can be fixed by bumping the version of css-loader to version 6 and above, because v6 is not using loader-utils (the vulnerable library) at all! Thank you in advance :)

idanrozin commented 1 year ago

Closing this as it seems that the issue has been fix from the JSON5 end. https://github.com/json5/json5/pull/298 https://github.com/github/advisory-database/pull/1541