postcss 7.x (stable branch dependency) is unsupported and has an active security advisory

[jthornhill]

A yarn audit this morning brought this one to light. There's currently a moderate security advisory in postcss.

Unfortunately, the postcss maintainer has indicated that no fix will be provided for the 7.x branch, and advises the solution is to switch to 8.x

[joshbuker]

Found this elsewhere, but you can add the following to your package.json to help resolve this dependency:

"resolutions": {
  "postcss": ">= 8.2.10"
}

Edit: This will cause yarn to resolve to the fixed version of postcss, but seems to be silently incompatible with the libraries that use it. CI/CD failed when attempting this resolution.

Been spending my day so far in dependency hell. 😕

[jaredbeck]

Does the major breaking change in postcss 8 make it difficult to upgrade webpacker 5 to postcss 8?

We now serve ES6+ sources in the npm package without Babel compilation.
https://github.com/postcss/postcss/releases/tag/8.0.0

Or, is it only an issue for people who use postcss in the browser?

PS: If you do use postcss 8, in the browser, in webpacker 5, you will want to be aware of this solution.

PPS: Webpacker 6 drops its "nodeModules" loader which should make it easier to use postcss 8 in the browser.

[joshbuker]

If your use-case does not care about a regex denial of service, you can switch from yarn audit to audit-ci to allow ignoring this CVE until webpacker fixes their dependency.

1. Add audit-ci to your devDependencies:

"devDependencies": {
  "audit-ci": "4.x"
}

2. Run yarn install

3. Update yarn audit to one of the following options:

• npx audit-ci --high
• npx audit-ci --low --allowlist 1693 (functionally equivalent to yarn audit while ignoring this particular CVE)

Edit: I found out recently that npx audit-ci is not functionally equivalent to npx audit-ci --high, it appears to never error code and is useful only for seeing what vulnerabilities are present. 😕

[Eusebius1920]

You can also use https://github.com/djfdyuruiry/improved-yarn-audit which works as a thin wrapper around yarn audit but filters out specified CVEs (via .iyarc file in the repository or via command-line flag)

Nonetheless the root issue should be fixed.

[guemidiborhane]

+1

[davidpocina]

It looks like webpacker 6 still uses postcss-preset-env, so this won't be solved until that project updates to postcss 8 too

csstools/postcss-preset-env#191

[afdev82]

The fix has been backported to v7: postcss/postcss#1574 (comment)

[dhh]

6.0 will not have a hard dependency on postcss any more. If someone wants to do the work to validate that it's safe to bump the dependency for 5-stable, please do so 🙏

[Eusebius1920]

The postcss maintainer already stepped in and released a backport to postcss 7.x that can be used with webpacker v5. So this issue can be closed.