You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@vue/vue2-jest@29.2.6 requires postcss@^7.0.36 via @vue/component-compiler-utils@3.3.0
@nextcloud/webpack-vue-config@6.0.1 requires postcss@^7.0.36 via a transitive dependency on @vue/component-compiler-utils@3.3.0
vite@5.0.12 requires postcss@^8.4.32
@vitejs/plugin-vue2@2.3.1 requires postcss@^8.4.32 via vite@5.0.12
No patched version available for postcss
So right now we include postcss@7 and postcss@8.
Both requirements of postcss@7 come from @vue/component-compiler-utils@3.3.0 which should not be required anymore since vue 2.7. However we still require it due to the need for vue-loader@15 for using webpack with vue 2.
Describe the bug
https://github.com/nextcloud/text/security/dependabot/42 reports a regexp DOS in postcss 7.x
We actually have conflicting requirements here:
So right now we include
postcss@7
andpostcss@8
.Both requirements of postcss@7 come from
@vue/component-compiler-utils@3.3.0
which should not be required anymore since vue 2.7. However we still require it due to the need for vue-loader@15 for using webpack with vue 2.Looks like this might be the way forward:
@vue/component-compiler-utils
thus no more old postcss.The text was updated successfully, but these errors were encountered: