Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Snyk] Upgrade sass from 1.47.0 to 1.53.0 #262

Closed

Conversation

snyk-bot
Copy link

Snyk has created this PR to upgrade sass from 1.47.0 to 1.53.0.

merge advice
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.


  • The recommended version is 21 versions ahead of your current version.
  • The recommended version was released a month ago, on 2022-06-22.

The recommended version fixes:

Severity Issue PriorityScore (*) Exploit Maturity
Arbitrary File Overwrite
SNYK-JS-TAR-1536528
410/1000
Why? CVSS 8.2
No Known Exploit
Arbitrary File Overwrite
SNYK-JS-TAR-1536531
410/1000
Why? CVSS 8.2
No Known Exploit
Arbitrary File Write
SNYK-JS-TAR-1579147
410/1000
Why? CVSS 8.2
No Known Exploit
Arbitrary File Write
SNYK-JS-TAR-1579152
410/1000
Why? CVSS 8.2
No Known Exploit
Arbitrary File Write
SNYK-JS-TAR-1579155
410/1000
Why? CVSS 8.2
No Known Exploit
Regular Expression Denial of Service (ReDoS)
SNYK-JS-AXIOS-1579269
410/1000
Why? CVSS 8.2
Proof of Concept
Prototype Pollution
SNYK-JS-JSONSCHEMA-1920922
410/1000
Why? CVSS 8.2
No Known Exploit
Command Injection
SNYK-JS-LODASH-1040724
410/1000
Why? CVSS 8.2
Proof of Concept
Remote Code Execution (RCE)
SNYK-JS-SHELLQUOTE-1766506
410/1000
Why? CVSS 8.2
No Known Exploit
Regular Expression Denial of Service (ReDoS)
SNYK-JS-SSRI-1246392
410/1000
Why? CVSS 8.2
Proof of Concept
Regular Expression Denial of Service (ReDoS)
SNYK-JS-TERSER-2806366
410/1000
Why? CVSS 8.2
No Known Exploit
Regular Expression Denial of Service (ReDoS)
SNYK-JS-TERSER-2806366
410/1000
Why? CVSS 8.2
No Known Exploit
Regular Expression Denial of Service (ReDoS)
SNYK-JS-UGLIFYJS-1727251
410/1000
Why? CVSS 8.2
No Known Exploit
Cryptographic Issues
SNYK-JS-ELLIPTIC-1064899
410/1000
Why? CVSS 8.2
No Known Exploit
Information Exposure
SNYK-JS-FOLLOWREDIRECTS-2332181
410/1000
Why? CVSS 8.2
Proof of Concept
Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-1018905
410/1000
Why? CVSS 8.2
Proof of Concept
Information Exposure
SNYK-JS-NANOID-2332193
410/1000
Why? CVSS 8.2
Proof of Concept
Information Exposure
SNYK-JS-NODEFETCH-2342118
410/1000
Why? CVSS 8.2
No Known Exploit
Cross-site Scripting (XSS)
SNYK-JS-PARSEURL-2935944
410/1000
Why? CVSS 8.2
Proof of Concept
Information Exposure
SNYK-JS-PARSEURL-2935947
410/1000
Why? CVSS 8.2
Proof of Concept
Cross-site Scripting (XSS)
SNYK-JS-PARSEURL-2942134
410/1000
Why? CVSS 8.2
Proof of Concept
Regular Expression Denial of Service (ReDoS)
SNYK-JS-PATHPARSE-1077067
410/1000
Why? CVSS 8.2
Proof of Concept
Regular Expression Denial of Service (ReDoS)
SNYK-JS-TAR-1536758
410/1000
Why? CVSS 8.2
No Known Exploit
Information Exposure
SNYK-JS-FOLLOWREDIRECTS-2396346
410/1000
Why? CVSS 8.2
No Known Exploit
Prototype Pollution
SNYK-JS-MINIMIST-2429795
410/1000
Why? CVSS 8.2
Proof of Concept
Server-side Request Forgery (SSRF)
SNYK-JS-PARSEURL-2936249
410/1000
Why? CVSS 8.2
Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Release notes
Package name: sass
  • 1.53.0 - 2022-06-22

    To install Sass 1.53.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

    Changes

    • Add support for calling var() with an empty second argument, such as var(--side, ).

    JS API

    • Fix a bug where meta.load-css() would sometimes resolve relative URLs incorrectly when called from a mixin using the legacy JS API.

    Embedded Sass

    • Respect npm's proxy settings when downloading the embedded Sass compiler.

    See the full changelog for changes in earlier releases.

  • 1.52.3 - 2022-06-08

    To install Sass 1.52.3, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

    Changes

    • Fix crash when trailing loud comments (/* ... */) appear twice in a row across two different imports which themselves imported the same file each.

    See the full changelog for changes in earlier releases.

  • 1.52.2 - 2022-06-03

    To install Sass 1.52.2, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

    Changes

    • Preserve location of trailing loud comments (/* ... */) instead of pushing the comment to the next line.

    See the full changelog for changes in earlier releases.

  • 1.52.1 - 2022-05-20

    To install Sass 1.52.1, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

    Changes

    Command Line Interface

    • Fix a bug where --watch mode would close immediately in TTY mode. This was caused by our change to close --watch when stdin was closed outside of TTY mode, which has been reverted for now while we work on a fix.

    See the full changelog for changes in earlier releases.

  • 1.52.0 - 2022-05-20
  • 1.51.0 - 2022-04-26
  • 1.50.1 - 2022-04-19
  • 1.50.0 - 2022-04-07
  • 1.49.11 - 2022-04-01
  • 1.49.10 - 2022-03-30
  • 1.49.9 - 2022-02-24
  • 1.49.8 - 2022-02-17
  • 1.49.7 - 2022-02-01
  • 1.49.6 - 2022-02-01
  • 1.49.5 - 2022-02-01
  • 1.49.4 - 2022-02-01
  • 1.49.3 - 2022-02-01
  • 1.49.2 - 2022-02-01
  • 1.49.1 - 2022-01-31
  • 1.49.0 - 2022-01-18
  • 1.48.0 - 2022-01-13
  • 1.47.0 - 2022-01-07
from sass GitHub release notes
Commit messages
Package name: sass

Compare


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

@fzn0x fzn0x closed this Aug 1, 2022
@fzn0x fzn0x deleted the snyk-upgrade-7115d7622b507a299614262ac9e2d192 branch October 31, 2022 22:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants