postcss-url version causing security warning

[shaycraft]

So GitHub is complaining my project has a dependency on a vulnerable version of handlebars. It appears the cli pulls this in from postcss-url (via directory-encoder). This was referenced (and closed) earlier in #7660 but closed as the problem is apparently with postcss-url.

However, the version @angular/cli is using of postcss-url (5.1.2) appears to be out of date. The latest version of postcss-url (7.1.2) appears to have completely removed the dependency on directory-encoder (as of version 6). Are there any plans to update the postcss-url dependency?

Versions

Angular CLI: 1.5.0
Node: 8.6.0
OS: win32 x64
Angular: 4.4.4
... animations, common, compiler, compiler-cli, core, forms
... http, language-service, platform-browser
... platform-browser-dynamic, router, tsc-wrapped

@angular/cli: 1.5.0
@angular-devkit/build-optimizer: 0.0.33
@angular-devkit/core: 0.0.20
@angular-devkit/schematics: 0.0.36
@ngtools/json-schema: 1.1.0
@ngtools/webpack: 1.8.0
@schematics/angular: 0.1.5
typescript: 2.3.4
webpack: 3.8.1

[shusson]

Yeah just saw this too, the XSS vulnerability sounds serious enough to update the dep, although I have no idea how angular-cli is using postcss.

[CharlBest]

I'm also seeing this. Have to say, it is quit scary too see all the packages in one list and you don't know what 70% of them do and can potentially have security vulnerabilities. Anyway. @shusson I think they use it for Auto-prefixing CSS with vendor specific properties to increase style compatibility. Not sure how the CLI team will fix this because it's in another package but can't believe we have handlebars as an dependency.

[benc-uk]

I got the same warning from github about handlebars and traced it back to postcss-url. An update to the package dependencies would be good

[angular-automatic-lock-bot]

This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

_{This action has been performed automatically by a bot.}