CVE-2023-44270 on package dependencies

[BulatSa]

Hello, i have alert from scanning about dependencie postcss.
component-compiler-utils use "postcss": "^7.0.36", but
"id":"CVE-2023-44270","package":"postcss","version":"7.0.39","fix_version":"8.4.31","severity":"Medium"

Please update to postcss@8.4.31

[KonRatt]

See also #122

[planetchili]

Seconding this request

[3zzy]

+1

[brock-rb2t]

samsies. seconding this

[SebasAnasco1517]

Seconding the request. Is this project still maintained?

[g-scalvini]

Any update regarding this issue? Over 3 months are passed...

+1

[waruyama]

I would be really nice to have this one final update. All other subpackages of @vue/cli-service@5.0.8 are using the newer postcss version 8.4.31.

Updating the version of postcss in package.json and releasing a new minor version would make quite a few maintainers of legacy Vue apps happy.
`

[kly-htun]

Hello, Any update package yet?
Seconding this request

[mikkowsx]

Any updates? Seconding this...

[Vhivi]

Hi, there,

I tried a pull request #140 for updating postcss to version 8.4.49 as well as migrating plugins from version 7 to 8, pending.