This repository has been archived by the owner on Jul 24, 2022. It is now read-only.

Update dependency node-sass to v7 [SECURITY] #7

Open

renovate wants to merge 1 commit into gh-pages from renovate/npm-node-sass-vulnerability

Contributor

renovate bot commented Jul 24, 2022 •

edited

Loading

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
node-sass	`~3.3.3` -> `~7.0.0`

GitHub Vulnerability Alerts

GHSA-9v62-24cr-58cx

Affected versions of node-sass are vulnerable to Denial of Service (DoS). Crafted objects passed to the renderSync function may trigger C++ assertions in CustomImporterBridge::get_importer_entry and CustomImporterBridge::post_process_return_value that crash the Node process. This may allow attackers to crash the system's running Node process and lead to Denial of Service.

Recommendation

Upgrade to version 4.13.1 or later

CVE-2020-24025

Certificate validation in node-sass 2.0.0 to 4.14.1 is disabled when requesting binaries even if the user is not specifying an alternative download path.

Release Notes

sass/node-sass

`v7.0.0`

Breaking changes

Drop support for Node 15 (@nschonni)
Set rejectUnauthorized to true by default (@scott-ut, #3149)

Features

Add support for Node 17 (@nschonni)

Dependencies

Bump eslint from 7.32.0 to 8.0.0 (@nschonni, #3191)
Bump fs-extra from 0.30.0 to 10.0.0 (@nschonni, #3102)
Bump npmlog from 4.1.2 to 5.0.0 (@nschonni, #3156)
Bump chalk from 1.1.3 to 4.1.2 (@nschonni, #3161)

Community

Remove double word "support" from documentation (@pzrq, #3159)

Misc

Bump various GitHub Actions dependencies (@nschonni)

Supported Environments

OS	Architecture	Node
Windows	x86 & x64	12, 14, 16, 17
OSX	x64	12, 14, 16, 17
Linux*	x64	12, 14, 16, 17
Alpine Linux	x64	12, 14, 16, 17
FreeBSD	i386 amd64	12, 14

*Linux support refers to major distributions like Ubuntu, and Debian

`v6.0.1`

Dependencies

Remove mkdirp (@jimmywarting, #3108)
Bump meow to 9.0.0 (@ykolbin, #3125)
Bump mocha to 9.0.1 (@xzyfer, #3134)

Misc

Use default Apline version from docker-node (@nschonni, #3121)

Supported Environments

OS	Architecture	Node
Windows	x86 & x64	12, 14, 15, 16
OSX	x64	12, 14, 15, 16
Linux*	x64	12, 14, 15, 16
Alpine Linux	x64	12, 14, 15, 16
FreeBSD	i386 amd64	12, 14, 15

*Linux support refers to major distributions like Ubuntu, and Debian

`v6.0.0`

Breaking changes

Drop support for Node 10 (@nschonni)
Remove deprecated process.sass API (@xzyfer, #2986)

Features

Add support for Node 16

Community

Fix typos in Troubleshooting guide (@independencyinjection, #3051)
Improve dependabot configuration (@nschonni)

Supported Environments

OS	Architecture	Node
Windows	x86 & x64	12, 14, 15, 16
OSX	x64	12, 14, 15, 16
Linux*	x64	12, 14, 15, 16
Alpine Linux	x64	12, 14, 15, 16
FreeBSD	i386 amd64	12, 14, 15

*Linux support refers to major distributions like Ubuntu, and Debian

`v5.0.0`

Breaking changes

Only support LTS and current Node versions (@nschonni)
Remove deprecated process.sass API (@xzyfer, #2986)

Features

Add support for Node 15
New node-gyp version that supports building with Python 3

Community

More inclusive documentation (@rgeerts, #2944)
Enabled dependabot (@nschonni)
Improve release automation (@nschonni)

Fixes

Bumped many dependencies (@nschonni)

Supported Environments

OS	Architecture	Node
Windows	x86 & x64	10, 12, 14, 15
OSX	x64	10, 12, 14, 15
Linux*	x64	10, 12, 14, 15
Alpine Linux	x64	10, 12, 14, 15
FreeBSD	i386 amd64	10, 12, 14, 15

*Linux support refers to major distributions like Ubuntu, and Debian

`v4.14.1`

Community

Add GitHub Actions for Alpine CI (@nschonni, #2823)

Fixes

Bump [email protected] (@xzyfer, #2912)

Supported Environments

OS	Architecture	Node
Windows	x86 & x64	0.10, 0.12, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14
OSX	x64	0.10, 0.12, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14
Linux*	x86 & x64	0.10, 0.12, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10^, 11^, 12^, 13^, 14**^
Alpine Linux	x64	6, 8, 10, 11, 12, 13, 14
FreeBSD	i386 amd64	10, 12, 13

*Linux support refers to Ubuntu, Debian, and CentOS 5+
** Not available on CentOS 5
^ Only available on x64

`v4.14.0`

https://github.com/sass/node-sass/releases/tag/v4.14.0

`v4.13.1`

https://github.com/sass/node-sass/releases/tag/v4.13.1

`v4.13.0`

https://github.com/sass/node-sass/releases/tag/v4.13.0

`v4.12.0`

https://github.com/sass/node-sass/releases/tag/v4.12.0

`v4.11.0`

https://github.com/sass/node-sass/releases/tag/v4.11.0

`v4.10.0`

https://github.com/sass/node-sass/releases/tag/v4.10.0

`v4.9.4`

https://github.com/sass/node-sass/releases/tag/v4.9.4

`v4.9.3`

https://github.com/sass/node-sass/releases/tag/v4.9.3

`v4.9.2`

https://github.com/sass/node-sass/releases/tag/v4.9.2

`v4.9.1`

https://github.com/sass/node-sass/releases/tag/v4.9.1

`v4.9.0`

https://github.com/sass/node-sass/releases/tag/v4.9.0

`v4.8.3`

https://github.com/sass/node-sass/releases/tag/v4.8.3

`v4.8.2`

https://github.com/sass/node-sass/releases/tag/v4.8.2

`v4.8.1`

https://github.com/sass/node-sass/releases/tag/v4.8.1

`v4.7.2`

https://github.com/sass/node-sass/releases/tag/v4.7.2

`v4.7.1`

https://github.com/sass/node-sass/releases/tag/v4.7.1

`v4.6.1`

https://github.com/sass/node-sass/releases/tag/v4.6.1

`v4.6.0`

https://github.com/sass/node-sass/releases/tag/v4.6.0

`v4.5.3`

Fixes

Installation error on Node 8 (@xzyfer, #1969)

Supported Environments

OS	Architecture	Node
Windows	x86 & x64	0.10, 0.12, 1, 2, 3, 4, 5, 6, 7, 8
OSX	x64	0.10, 0.12, 1, 2, 3, 4, 5, 6, 7, 8
Linux*	x86 & x64	0.10, 0.12, 1, 2, 3, 4, 5, 6, 7, 8
Alpine	x64	4, 6, 7, 8
FreeBSD 10+	i386	4, 6, 8
FreeBSD 10+	amd64	4, 6, 8

*Linux support refers to Ubuntu, Debian, and CentOS 5

`v4.5.2`

Fixes

Installation error on Node 8 (@mscdex, #1934)

Supported Environments

OS	Architecture	Node
Windows	x86 & x64	0.10, 0.12, 1, 2, 3, 4, 5, 6,7
OSX	x64	0.10, 0.12, 1, 2, 3, 4, 5, 6, 7
Linux*	x86 & x64	0.10, 0.12, 1, 2, 3, 4, 5, 6, 7
Alpine	x64	4, 6, 7

*Linux support refers to Ubuntu, Debian, and CentOS 5

`v4.5.1`

Fixes

Fix instructions about rebuilding the binary (@xzyfer, #1885)
Add binding.js to Coveralls coverage (@nschonni, #1902)
Update request version to avoid npm warn (@arzafran, #1915)
Update link for VS 2013 download (@hweeks, #1921)
Make binding tests less fragile (@xzyfer, #1929)
Don't throw when being run on Node 8 (@xzyfer, #1929)

Supported Environments

OS	Architecture	Node
Windows	x86 & x64	0.10, 0.12, 1, 2, 3, 4, 5, 6,7
OSX	x64	0.10, 0.12, 1, 2, 3, 4, 5, 6, 7
Linux*	x86 & x64	0.10, 0.12, 1, 2, 3, 4, 5, 6, 7
Alpine	x64	4, 6, 7

*Linux support refers to Ubuntu, Debian, and CentOS 5

`v4.5.0`

https://github.com/sass/node-sass/releases/tag/v4.5.0

`v4.4.0`

https://github.com/sass/node-sass/releases/tag/v4.4.0

`v4.3.0`

https://github.com/sass/node-sass/releases/tag/v4.3.0

`v4.2.0`

https://github.com/sass/node-sass/releases/tag/v4.2.0

`v4.1.1`

https://github.com/sass/node-sass/releases/tag/v4.1.1

`v4.1.0`

https://github.com/sass/node-sass/releases/tag/v4.1.0

`v4.0.0`

https://github.com/sass/node-sass/releases/tag/v4.0.0

`v3.13.1`

https://github.com/sass/node-sass/releases/tag/v3.13.1

`v3.13.0`

https://github.com/sass/node-sass/releases/tag/v3.13.0

`v3.12.5`

https://github.com/sass/node-sass/releases/tag/v3.12.5

`v3.12.4`

https://github.com/sass/node-sass/releases/tag/v3.12.4

`v3.12.3`

https://github.com/sass/node-sass/releases/tag/v3.12.3

`v3.12.2`

https://github.com/sass/node-sass/releases/tag/v3.12.2

`v3.12.1`

https://github.com/sass/node-sass/releases/tag/v3.12.1

`v3.12.0`

https://github.com/sass/node-sass/releases/tag/v3.12.0

`v3.11.3`

https://github.com/sass/node-sass/releases/tag/v3.11.3

`v3.11.2`

https://github.com/sass/node-sass/releases/tag/v3.11.2

`v3.11.1`

https://github.com/sass/node-sass/releases/tag/v3.11.1

`v3.11.0`

https://github.com/sass/node-sass/releases/tag/v3.11.0

`v3.10.1`

https://github.com/sass/node-sass/releases/tag/v3.10.1

`v3.10.0`

https://github.com/sass/node-sass/releases/tag/v3.10.0

`v3.9.3`

https://github.com/sass/node-sass/releases/tag/v3.9.3

`v3.9.2`

(removed)

`v3.9.1`

(removed)

`v3.9.0`

https://github.com/sass/node-sass/releases/tag/v3.9.0

`v3.8.0`

https://github.com/sass/node-sass/releases/tag/v3.8.0

`v3.7.0`

https://github.com/sass/node-sass/releases/tag/v3.7.0

`v3.6.0`

https://github.com/sass/node-sass/releases/tag/v3.6.0

`v3.5.3`

https://github.com/sass/node-sass/releases/tag/v3.5.3

`v3.5.2`

https://github.com/sass/node-sass/releases/tag/v3.5.2

`v3.5.1`

https://github.com/sass/node-sass/releases/tag/v3.5.1

`v3.4.2`

https://github.com/sass/node-sass/releases/tag/v3.4.2

`v3.4.1`

https://github.com/sass/node-sass/releases/tag/v3.4.1

`v3.4.0`

https://github.com/sass/node-sass/releases/tag/v3.4.0

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, click this checkbox.

This PR has been generated by Mend Renovate. View repository job log here.

renovate bot force-pushed the renovate/npm-node-sass-vulnerability branch 3 times, most recently from aef3b47 to 4321ef2 Compare

July 24, 2022 09:46

renovate bot changed the title ~~Pin dependency node-sass to v [SECURITY]~~ Update dependency node-sass to v7 [SECURITY]

renovate bot force-pushed the renovate/npm-node-sass-vulnerability branch from 4321ef2 to 79d8ced Compare

July 24, 2022 09:46

renovate bot changed the title ~~Update dependency node-sass to v7 [SECURITY]~~ Pin dependency node-sass to v [SECURITY]


          Update dependency node-sass to v7 [SECURITY]

7633f7b

renovate bot force-pushed the renovate/npm-node-sass-vulnerability branch from 79d8ced to 7633f7b Compare

July 24, 2022 09:47

renovate bot changed the title ~~Pin dependency node-sass to v [SECURITY]~~ Update dependency node-sass to v7 [SECURITY]

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet