@parcel/transformer-postcss depends on dead css-modules-loader-core

[palfrey]

css-module-loader-core is very dead which is a problem as it depends on things like a 3 year old version of postcss (last 6.x version came out in 2018) which means you're pulling in things like a version of ansi-regex with security issues.

css-modules/css-modules-loader-core#231 (comment) provides some hints towards how others are solving this issue.

[HHogg]

I think this is related, I'm getting an error trying to run parcel because it's having trouble finding the right version of postcss.

🚨 Build failed.

unknown: Could not resolve package "postcss" that satisfies ^8.2.1. Found 7.0.38.
💡 Looks like the incompatible version was installed transitively. Add this package as a direct dependency with a compatible version range.

Looking in my yarn.lock file, I can see multiple different version of postcss coming from parcel dependencies.

This is a bare project inside yarn workspaces with the following dependencies, all latest

"autoprefixer": "^10.4.0",
"parcel": "^2.0.1"
"postcss": "^8.3.11",
"postcss-preset-env": "^6.7.0"

I get...

postcss@6.0.1:
  version "6.0.1"
  resolved "https://registry.yarnpkg.com/postcss/-/postcss-6.0.1.tgz#000dbd1f8eef217aa368b9a212c5fc40b2a8f3f2"
  integrity sha1-AA29H47vIXqjaLmiEsX8QLKo8/I=
  dependencies:
    chalk "^1.1.3"
    source-map "^0.5.6"
    supports-color "^3.2.3"

postcss@^6.0.1:
  version "6.0.23"
  resolved "https://registry.yarnpkg.com/postcss/-/postcss-6.0.23.tgz#61c82cc328ac60e677645f979054eb98bc0e3324"
  integrity sha512-soOk1h6J3VMTZtVeVpv15/Hpdl2cBLX3CAw4TAbkpTJiNPk9YP/zWcD1ND+xEtvyuuvKzbxliTOIyvkSeSJ6ag==
  dependencies:
    chalk "^2.4.1"
    source-map "^0.6.1"
    supports-color "^5.4.0"

postcss@^7.0.14, postcss@^7.0.2, postcss@^7.0.21, postcss@^7.0.26, postcss@^7.0.32, postcss@^7.0.35, postcss@^7.0.6:
  version "7.0.38"
  resolved "https://registry.yarnpkg.com/postcss/-/postcss-7.0.38.tgz#5365a9c5126643d977046ad239f60eadda2491d6"
  integrity sha512-wNrSHWjHDQJR/IZL5IKGxRtFgrYNaAA/UrkW2WqbtZO6uxSLMxMN+s2iqUMwnAWm3fMROlDYZB41dr0Mt7vBwQ==
  dependencies:
    nanocolors "^0.2.2"
    source-map "^0.6.1"

postcss@^7.0.17, postcss@^7.0.5:
  version "7.0.39"
  resolved "https://registry.yarnpkg.com/postcss/-/postcss-7.0.39.tgz#9624375d965630e2e1f2c02a935c82a59cb48309"
  integrity sha512-yioayjNbHn6z1/Bywyb2Y4s3yvDAeXGOyxqD+LnVOinq6Mdmd++SW2wUNVzavyyHxd6+DxzWGIuosg6P1Rj8uA==
  dependencies:
    picocolors "^0.2.1"
    source-map "^0.6.1"

postcss@^8.2.1, postcss@^8.3.0, postcss@^8.3.6:
  version "8.3.9"
  resolved "https://registry.yarnpkg.com/postcss/-/postcss-8.3.9.tgz#98754caa06c4ee9eb59cc48bd073bb6bd3437c31"
  integrity sha512-f/ZFyAKh9Dnqytx5X62jgjhhzttjZS7hMsohcI7HEI5tjELX/HxCy3EFhsRxyzGvrzFF+82XPvCS8T9TFleVJw==
  dependencies:
    nanoid "^3.1.28"
    picocolors "^0.2.1"
    source-map-js "^0.6.2"

postcss@^8.3.11:
  version "8.3.11"
  resolved "https://registry.yarnpkg.com/postcss/-/postcss-8.3.11.tgz#c3beca7ea811cd5e1c4a3ec6d2e7599ef1f8f858"
  integrity sha512-hCmlUAIlUiav8Xdqw3Io4LcpA1DOt7h3LSTAC4G6JGHFFaWzI6qvFt9oilvl8BmkbBRX1IhM90ZAmpk68zccQA==
  dependencies:
    nanoid "^3.1.30"
    picocolors "^1.0.0"
    source-map-js "^0.6.2"

This can be resolved by adding PostCSS to the workspaces root package.json as well.

[mischnic]

Duplicate of #4079 and/or #6315

[devongovett]

I'm also working on a new CSS compiler written in Rust, which will eventually handle CSS modules: https://github.com/parcel-bundler/parcel-css