@remotion/bundler: Fork and inline css-loader, resolving security vulnerability#6883
@remotion/bundler: Fork and inline css-loader, resolving security vulnerability#6883JonnyBurger merged 3 commits intomainfrom
@remotion/bundler: Fork and inline css-loader, resolving security vulnerability#6883Conversation
Replace the css-loader npm dependency with a stripped-down fork that only includes what Remotion actually uses (url and import handling). Removes 8 transitive dependencies including CSS Modules and ICSS support which were never used. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@remotion/bundler: Fork and inline css-loader@remotion/bundler: Fork and inline css-loader, resolving security vulnerability
There was a problem hiding this comment.
Review: @remotion/bundler: Fork and inline css-loader
Critical: Missing variable declaration in index.js
There's a ReferenceError bug in packages/bundler/css-loader/index.js:55 — plugins is assigned without being declared:
// Line 55 - missing 'const'
plugins = [
importParser({ ... }),
];
// Should be:
const plugins = [
importParser({ ... }),
];This will cause the loader to crash at runtime when processing CSS files. All 5 bundler tests may have passed because they might not exercise the import plugin path, or the error surfaces only during actual CSS bundling.
Other observations
- Fork is well-scoped: removes CSS Modules, ICSS, schema-utils, and semver checks as advertised
- MIT license attribution preserved from original
css-loaderv5.2.7 - Runtime files (
api.js,getUrl.js,cssWithMappingToString.js) look clean - No other obvious runtime issues found
Recommendation
Fix the missing const declaration and re-run the bundler tests before merging.
|
Fixed the missing |
…ckages Add `@remotion/bundler/css-loader` export so other packages can use the inlined fork instead of depending on css-loader directly. Update @remotion/tailwind and @remotion/tailwind-v4 to use it. Add CssLoaderTest composition to packages/example. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Summary
css-loadernpm dependency with a stripped-down fork atpackages/bundler/css-loader/url()handling and@importprocessingcss-loader,schema-utils,semver,icss-utils,postcss-modules-values,postcss-modules-local-by-default,postcss-modules-extract-imports,postcss-modules-scope)Test plan
cd packages/example && bun run dev)🤖 Generated with Claude Code