Advisory for v7

[tombrown-ibm]

Would it be possible or is there a plan to patch v7 for the following advisory?

https://www.npmjs.com/advisories/1693

[tombrowndev]

Here's my attempt

#1575

[ai]

Nope. I supported PostCSS 7 for a 6 month after PostCSS 8 support. The support was ended at January 1, 2021.

Only commercial support is possible right now.

[tombrowndev]

Ok, feel free to close

[stephane-arista]

react-scripts relies on v7, so this is probably breaking a ton of peoples environments, and there is no straightforward upgrade path.

[ai]

@stephane-arista yeap, I know. I even created a PR to CRA with PostCSS 8 and their t help them in migration.

Unfortunately, CRA support is very bad. It will be unfair for me to work more because CRA team want to work less.

Force, CRA team to migrate ASAP since they didn’t do it for almost a year and didn’t create an upgrade path for their users.

[Hypnosphi]

Here's the PR for reference facebook/create-react-app#9716

I hoped it would include some replacement for postcss-preset-env though, as it still depends on v7

[stephane-arista]

So what's the problem with just patching v7, since it's a very minor fix. (from my quick look)

[ai]

So what's the problem with just patching v7, since it's a very minor fix. (from my quick look)

Releasing and then supporting the issue.

In open source you need about 3-5x more work in additional to writing a code. Everything can go bad, and then I will fix instead of the sleep (for instance, I didn’t sleep well today because I fixed bug after caniuse-lite security fixes).