Skip to content

Remove @types/stylelint since stylelint has it's own types  #259

@PodaruDragos

Description

@PodaruDragos

Bug report

using this plugin will result in Expression Denial of Service in postcss from @types/stylelint

Actual Behavior

Expression Denial of Service in postcss - GHSA-566m-qj78-rww5

Expected Behavior

no denial of service

How Do We Reproduce?

just use styleint-webpack-plugin and you'll get the audit report

postcss  <8.2.13
Severity: moderate
Regular Expression Denial of Service in postcss - https://github.com/advisories/GHSA-566m-qj78-rww5
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/@types/stylelint/node_modules/postcss
node_modules/postcss-filter-plugins/node_modules/postcss
node_modules/postcss-icss-keyframes/node_modules/postcss
node_modules/postcss-icss-selectors/node_modules/postcss
  @types/stylelint  9.10.0 - 13.13.3
  Depends on vulnerable versions of postcss
  node_modules/@types/stylelint
    stylelint-webpack-plugin  >=2.2.0
    Depends on vulnerable versions of @types/stylelint
    node_modules/stylelint-webpack-plugin
  icss-utils  <=4.1.1
  Depends on vulnerable versions of postcss
  node_modules/postcss-icss-keyframes/node_modules/icss-utils
  node_modules/postcss-filter-plugins
    typescript-plugin-css-modules  *
    Depends on vulnerable versions of postcss-filter-plugins
    Depends on vulnerable versions of postcss-icss-keyframes
    Depends on vulnerable versions of postcss-icss-selectors
    node_modules/typescript-plugin-css-modules
  postcss-icss-keyframes  *
  Depends on vulnerable versions of postcss
  node_modules/postcss-icss-keyframes
  postcss-icss-selectors  *
  Depends on vulnerable versions of postcss
  node_modules/postcss-icss-selectors

8 moderate severity vulnerabilities

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions