Skip to content

Conversation

@robertbrignull
Copy link
Contributor

@robertbrignull robertbrignull commented Jul 23, 2025

This PR removes typescript-plugin-css-modules, with the end goal of removing our transitive dependency on stylus. Unfortunately the stylus package was found to contain malicious code so it has been wiped and version 0.62.0 that we depended on no longer exists.

As far as I can tell, the typescript-plugin-css-modules package was only giving us extra type information in the IDE and doesn't contribute to actual compilation or error checking at compile time. So maybe we can just do without this until we find a replacement.

@robertbrignull robertbrignull requested review from a team and Copilot July 23, 2025 08:42
@robertbrignull robertbrignull requested a review from a team as a code owner July 23, 2025 08:42
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR removes the typescript-plugin-css-modules dependency and its configuration to eliminate a transitive dependency on the problematic stylus package, which has been wiped from npm and is no longer available.

  • Removes the TypeScript plugin configuration from the tsconfig.json file
  • Removes the typescript-plugin-css-modules package dependency from package.json

Reviewed Changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.

File Description
extensions/ql-vscode/src/view/tsconfig.json Removes the TypeScript plugin configuration for css-modules
extensions/ql-vscode/package.json Removes the typescript-plugin-css-modules dependency
Files not reviewed (1)
  • extensions/ql-vscode/package-lock.json: Language not supported

@robertbrignull
Copy link
Contributor Author

Looks like we won't need this. The flagging of stylus might have been an error and will be rolled back, or if we do still need to work around stylus then we'll use a npm package override instead.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants