[Snyk] Upgrade sass from 1.65.1 to 1.72.0

[busyb0x]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to upgrade sass from 1.65.1 to 1.72.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 16 versions ahead of your current version.
• The recommended version was released a month ago, on 2024-03-13.

The recommended version fixes:

Severity	Issue	PriorityScore (*)	Exploit Maturity
	Regular Expression Denial of Service (ReDoS) SNYK-JS-ADOBECSSTOOLS-6096077	375/1000 Why? CVSS 7.5	No Known Exploit
	Regular Expression Denial of Service (ReDoS) SNYK-JS-ES5EXT-6095076	375/1000 Why? CVSS 7.5	Proof of Concept
	Improper Input Validation SNYK-JS-FOLLOWREDIRECTS-6141137	375/1000 Why? CVSS 7.5	Proof of Concept
	Server-side Request Forgery (SSRF) SNYK-JS-IP-6240864	375/1000 Why? CVSS 7.5	Proof of Concept
	Improper Verification of Cryptographic Signature SNYK-JS-BROWSERIFYSIGN-6037026	375/1000 Why? CVSS 7.5	No Known Exploit
	Open Redirect SNYK-JS-EXPRESS-6474509	375/1000 Why? CVSS 7.5	No Known Exploit
	Information Exposure SNYK-JS-FOLLOWREDIRECTS-6444610	375/1000 Why? CVSS 7.5	Proof of Concept
	Incomplete List of Disallowed Inputs SNYK-JS-BABELTRAVERSE-5962462	375/1000 Why? CVSS 7.5	Proof of Concept
	Uncontrolled Resource Consumption ('Resource Exhaustion') SNYK-JS-TAR-6476909	375/1000 Why? CVSS 7.5	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: sass

• 1.72.0 - 2024-03-13
  

  To install Sass 1.72.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

  Changes

  • Support adjacent /s without whitespace in between when parsing plain CSS expressions.

  • Allow the Node.js pkg: importer to load Sass stylesheets for package.json exports field entries without extensions.

  • When printing suggestions for variables, use underscores in variable names when the original usage used underscores.

  JavaScript API

  • Properly resolve pkg: imports with the Node.js package importer when arguments are passed to the JavaScript process.

  See the full changelog for changes in earlier releases.

• 1.71.1 - 2024-02-21
  

  To install Sass 1.71.1, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

  Changes

  Command-Line Interface

  • Ship the musl Linux release with the proper Dart executable.

  JavaScript API

  • Export the NodePackageImporter class in ESM mode.

  • Allow NodePackageImporter to locate a default directory even when the entrypoint is an ESM module.

  Dart API

  • Make passing a null argument to NodePackageImporter() a static error rather than just a runtime error.

  Embedded Sass

  • In the JS Embedded Host, properly install the musl Linux embedded compiler when running on musl Linux.

  See the full changelog for changes in earlier releases.

• 1.71.0 - 2024-02-16
  

  To install Sass 1.71.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

  Changes

  For more information about pkg: importers, see the announcement on the Sass blog.

  Command-Line Interface

  • Add a --pkg-importer flag to enable built-in pkg: importers. Currently this only supports the Node.js package resolution algorithm, via --pkg-importer=node. For example, @ use "pkg:bootstrap" will load node_modules/bootstrap/scss/bootstrap.scss.

  JavaScript API

  • Add a NodePackageImporter importer that can be passed to the importers option. This loads files using the pkg: URL scheme according to the Node.js package resolution algorithm. For example, @ use "pkg:bootstrap" will load node_modules/bootstrap/scss/bootstrap.scss. The constructor takes a single optional argument, which indicates the base directory to use when locating node_modules directories. It defaults to path.dirname(require.main.filename).

  Dart API

  • Add a NodePackageImporter importer that can be passed to the importers option. This loads files using the pkg: URL scheme according to the Node.js package resolution algorithm. For example, @ use "pkg:bootstrap" will load node_modules/bootstrap/scss/bootstrap.scss. The constructor takes a single argument, which indicates the base directory to use when locating node_modules directories.

  See the full changelog for changes in earlier releases.

• 1.70.0 - 2024-01-18
  

  To install Sass 1.70.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

  Changes

  JavaScript API

  • Add a sass.initCompiler() function that returns a sass.Compiler object which supports compile() and compileString() methods with the same API as the global Sass object. On the Node.js embedded host, each sass.Compiler object uses a single long-lived subprocess, making compiling multiple stylesheets much more efficient.

  • Add a sass.initAsyncCompiler() function that returns a sass.AsyncCompiler object which supports compileAsync() and compileStringAsync() methods with the same API as the global Sass object. On the Node.js embedded host, each sass.AsynCompiler object uses a single long-lived subprocess, making compiling multiple stylesheets much more efficient.

  Embedded Sass

  • Support the CompileRequest.silent field. This allows compilations with no logging to avoid unnecessary request/response cycles.

  • The Dart Sass embedded compiler now reports its name as "dart-sass" rather than "Dart Sass", to match the JS API's info field.

  See the full changelog for changes in earlier releases.

• 1.69.7 - 2024-01-02
• 1.69.6 - 2023-12-28
• 1.69.5 - 2023-10-26
• 1.69.4 - 2023-10-17
• 1.69.3 - 2023-10-12
• 1.69.2 - 2023-10-10
• 1.69.1 - 2023-10-09
• 1.69.0 - 2023-10-05
• 1.68.0 - 2023-09-21
• 1.67.0 - 2023-09-14
• 1.66.1 - 2023-08-18
• 1.66.0 - 2023-08-17
• 1.65.1 - 2023-08-09

from sass GitHub release notes

Commit messages

Package name: sass

• ce16b35 Cut a release (#2194)
• 9af6bbf Properly handle `pkg:` imports with args (#2193)
• 0330491 Update to node 20 (#2192)
• 48e2d0c Preserve underscores in `VariableExpression.toString()` (#2185)
• 6e2d637 Allow adjacent forward slashes in plain CSS expressions (#2190)
• fa4d909 Bump softprops/action-gh-release from 1 to 2 (#2191)
• fd67fe6 [Hotfix Node Package Importer]- Handle subpath without extensions (#2184)
• 1b4d703 Release 1.71.1 (#2182)
• 6d66c43 Properly handle `new NodePackageImporter()` with an ESM entrypoint (#2181)
• 85a932f Add missing ESM export of NodePackageImporter (#2177)
• 786dd63 Fix linux musl builds (#2175)
• 3e6721e Fix new static warnings with Dart 3.3 (#2173)
• 2cab33e Update the language revision in Homebrew on release (#2171)
• 84ededd Use musl support in cli_pkg (#2172)
• 00571ec Add a `--pkg-importer` flag (#2169)
• 84f31f0 Update pubspec/changelog for `pkg:` importers (#2168)
• 9ee5408 [Package Importer] Dart Implementation (#2130)
• 9423aa5 Use macos-14 runner instead of macos-latest-xlarge runner (#2167)
• bbf97b4 Remove the sass dependency from package.json (#2162)
• 076414d [Shared Resources] dart-sass implementation (#2134)
• 0d91c92 Support CompileRequest.silent of embedded protocol (#2160)
• b263a72 Use implementation name dart-sass for VersionResponse (#2156)
• 006baa5 Update the pubspec and changelog for Correct usage on win32-on-arm64 platforms to look for x64 native variant sass/embedded-host-node#266 (#2158)
• 6205eac Add wait time before update website (#2153)

Compare

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs