search

vuejs / component-compiler-utils

Lower level utilities for compiling Vue single file components
319 stars 75 forks source link

CVE-2023-44270 on package dependencies #136

Open BulatSa opened 7 months ago

BulatSa commented 7 months ago

Hello, i have alert from scanning about dependencie postcss. component-compiler-utils use "postcss": "^7.0.36", but "id":"CVE-2023-44270","package":"postcss","version":"7.0.39","fix_version":"8.4.31","severity":"Medium"

Please update to postcss@8.4.31

KonRatt commented 7 months ago

See also #122

planetchili commented 7 months ago

Seconding this request

3zzy commented 6 months ago

+1

brock-rb2t commented 6 months ago

samsies. seconding this

SebasAnasco1517 commented 5 months ago

Seconding the request. Is this project still maintained?

g-scalvini commented 4 months ago

Any update regarding this issue? Over 3 months are passed...

Gabrieltrinidad0101 commented 2 months ago

+1

waruyama commented 4 weeks ago

I would be really nice to have this one final update. All other subpackages of @vue/cli-service@5.0.8 are using the newer postcss version 8.4.31.

Updating the version of postcss in package.json and releasing a new minor version would make quite a few maintainers of legacy Vue apps happy. `