I tried to contact them to have details. Except for asking meeting, I didn't receive any details of a security issue. It might be fixed due to the changes I have done on regex and I think it might be something related to that. I don't see how this could be used or leveraged for attacks except maybe DOS but a lot of the consumers of the package (if not all) would not be impacted.
@holblin is the issue fixed in your fork?
I created a pul req for this in the adobe fork: https://github.com/adobe/css-tools/pull/97
Dupe of #2 but I got an actual API proposition
What about this
// sync
rework(css).use(plugin).toString()
// async; promise-based
rework(css)
.then(function(object) {
return plugin(object);
})
.then(function(object) {
return object.toString();
})
// or similar
@necolas