a vulnerability CVE-2020-7598 is introduced in css-modules-flow-types-cli

[ayaka-kms]

Hi, a vulnerability CVE-2021-23382 is introduced in css-modules-flow-types-cli via:
● [email protected] ➔ [email protected] ➔ [email protected]

css-modules-loader-core is a legacy package. It has not been maintained for about 4 years, and is not likely to be updated.
Is it possible to migrate css-modules-loader-core to other package to remediate this vulnerability?

I noticed several migration records for css-modules-loader-core in other js repos, such as

1. in postcss-modules, version 2.0.0 ➔ 3.0.0, remove css-modules-loader-core via commit
2. in broccoli-css-modules, version 0.5.0 ➔ 0.5.1, remove css-modules-loader-core via commit

Are there any efforts planned that would remediate this vulnerability or migrate css-modules-loader-core?

Thanks
; )

[skovhus]

Thanks for reporting this.

I'm not actively maintaining this repository, but contributions are more than welcome.

Do you have energy to look into this?