title: postcss 7.0.0 - 8.2.9 Severity: moderate Regular Expression Denial of Service
body: <p>When creating a new project under <code>create-react-app</code>, you get warnings straight away regarding a vulnerability found in <code>postcss</code>.</p>
  <p>Issue reported by npm: <a href="https://www.npmjs.com/advisories/1693" rel="noreferrer">https://www.npmjs.com/advisories/1693</a></p>
  <p>Related open issues can be found here:</p>
  <ul>
  <li><a href="https://github.com/postcss/postcss/issues/1574" rel="noreferrer">https://github.com/postcss/postcss/issues/1574</a></li>
  <li><a href="https://github.com/facebook/create-react-app/issues/10945" rel="noreferrer">https://github.com/facebook/create-react-app/issues/10945</a></li>
  </ul>
  <p>The issue has been patched on <code>postcss v8.2.10</code>, but it's still present when creating new projects as <code>react-scripts</code> hasn't upgraded the dependency yet.</p>
  <p>So, my problem here is I can no longer run builds as they fail due to the vulnerability.</p>
  <p>Since I can't wait for them to get it patched before to keep working on my stuff (they seem to be aware of it since a year ago), is there some workaround that could be applied to solve it?</p>
  <p>I tried adding a <code>postcss</code> resolution on <code>package.json</code>:</p>
  <pre class="lang-js prettyprint-override"><code>  &quot;resolutions&quot;: {
      &quot;postcss&quot;: &quot;^8.2.10&quot;
    },
  </code></pre>
  <p>but that didn't land me far.</p>
  <p>Any idea?</p>