You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Avoid emitting rgb() or rgba() functions with non-percent decimal
channels. Older browsers only support integer values or (potentially decimal)
percentages for these functions, so in order to preserve
backwards-compatibility while retaining full precision for modern browsers,
legacy colors that contain at least one non-integer channel will now use
percentages for their channels (for example, rgb(0%, 100%, 50%) rather than rgb(0, 255, 127.5)).
Fix a bug where the values of plain-CSS if() expressions were emitted using
their meta.inspect() format rather than their CSS serialization format.
Potentially breaking bug fix: The Node package importer now properly
supports resolving import-only variants of Sass files declared in the exports, sass, and style fields of package.json. Previously, these
files were ignored even when loaded via @import, so any code relying on
loading module-system-only files this way may break.
Writing two compound selectors adjacent to one another without any whitespace
between them, such as [class]a, is now deprecated. This was always an error
in CSS and Sass only supported it by mistake.
Add support for parent selectors (&) at the root of the document. These are
emitted as-is in the CSS output, where they're interpreted as the scoping
root.
User-defined functions named calc or clamp are no longer forbidden. If
such a function exists without a namespace in the current module, it will be
used instead of the built-in calc() or clamp() function.
User-defined functions whose names begin with - and end with -expression, -url, -and, -or, or -not are no longer forbidden. These were
originally intended to match vendor prefixes, but in practice no vendor
prefixes for these functions ever existed in real browsers.
User-defined functions named EXPRESSION, URL, and ELEMENT, those that
begin with - and end with -ELEMENT, as well as the same names with some
lowercase letters are now deprecated, These are names conflict with plain CSS
functions that have special syntax.
In a future release, calls to functions whose names begin with - and end
with -expression and -url will no longer have special parsing. For now,
these calls are deprecated if their behavior will change in the future.
Gracefully handle dependency loops in --watch mode.
Dart API
Add a const Logger.defaultLogger field. This provides a logger that emits to
standard error or the browser console, but automatically chooses whether to
use terminal colors.
JavaScript API
Fix a crash when manually constructing a SassCalculation for 'calc' with
an argument that can't be simplified.
Properly emit deprecation warnings as text rather than StringBuffer objects
when running in a browser.
Emit colored warnings and other messages on the console when running in a
browser.
Allow numbers with complex units (more than one numerator unit or more than
zero denominator units) to be emitted to CSS. These are now emitted as calc() expressions, which now support complex units in plain CSS.
Add support for the CSS-style if() function. In addition to supporting the
plain CSS syntax, this also supports a sass() query that takes a Sass
expression that evaluates to true or false at preprocessing time depending
on whether the Sass value is truthy. If there are no plain-CSS queries, the
function will return the first value whose query returns true during
preprocessing. For example, if(sass(false): 1; sass(true): 2; else: 3)
returns 2.
The old Sass if() syntax is now deprecated. Users are encouraged to migrate
to the new CSS syntax. if($condition, $if-true, $if-false) can be changed to if(sass($condition): $if-true; else: $if-false).
Plain-CSS if() functions are now considered "special numbers", meaning that
they can be used in place of arguments to CSS color functions.
Plain-CSS if() functions and attr() functions are now considered "special
variable strings" (like var()), meaning they can now be used in place of
multiple arguments or syntax fragments in various CSS functions.
Potentially breaking compatibility fix:@function rules whose names
begin with -- are now parsed as unknown at-rules to support the plain CSS @function rule. Within this rule, the result property is parsed as raw
CSS just like custom properties.
Potentially breaking compatibility fix:@mixin rules whose names begin
with -- are now errors. These are not yet parsed as unknown at-rules because
no browser currently supports CSS mixins.
Fix a crash when a style rule contains a nested @import, and the loaded file @uses a user-defined module as well as @includes a top-level mixin which
emits top-level declarations.
JavaScript API
Release a @sass/types package which contains the type annotations used by
both the sass and sass-embedded package without any additional code or
dependencies.
Fix a bug where variable definitions from one imported, forwarded module
would not be passed as implicit configuration to a later imported, forwarded
module.
Breaking change: Emit declarations, childless at-rules, and comments in
the order they appear in the source even when they're interleaved with nested
rules. This obsoletes the mixed-decls deprecation.
Breaking change: The function name type() is now fully reserved for the
plain CSS function. This means that @function definitions with the name type will produce errors, while function calls will be parsed as special
function strings.
Configuring private variables using @use ... with, @forward ... with, and meta.load-css(..., $with: ...) is now deprecated. Private variables were
always intended to be fully encapsulated within the module that defines them,
and this helps enforce that encapsulation.
Fix a bug where @extend rules loaded through a mixture of @import and @use rules could fail to apply correctly.
Command-Line Interface
In --watch mode, delete the source map when the associated source file is
deleted.
Potentially breaking change:meta.inspect() (as well as other systems
that use it such as @debug and certain error messages) now emits numbers
with as high precision as is available instead of rounding to the nearest
1e⁻¹⁰ as we do when serializing to CSS. This better fits the purpose of meta.inspect(), which is to provide full information about the structure of
a Sass value.
Passing a rest argument ($arg...) before a positional or named argument when
calling a function or mixin is now deprecated. This was always outside the
specified syntax, but it was historically treated the same as passing the rest
argument at the end of the argument list whether or not that matched the
visual order of the arguments.
Allow a @forwarded module to be loaded with a configuration when that module
has already been loaded with a different configuration and the module
doesn't define any variables that would have been configured anyway.
Allow the Node package importer to load files even when there are multiple
potential resolutions, as long as those resolutions all point to the same
file.
Potentially breaking bug fix: When a plain CSS file with a top-level
nesting selector & is loaded into a nested Sass context via meta.load-css() or @import, Sass now emits plain CSS nesting rather than
incorrectly combining it with the parent selector using a descendant
combinator.
Add support for % as an expression in its own right. It will still be parsed
as the modulo operator when between two other expressions, but in any other
context it will be an expression whose value is the unquoted string %.
Consider attr() to be a special number function that can be used as a
channel in color functions.
Deprecate user-defined functions named type() so that we can eventually
support the new CSS type() function.
Fix a bug where global Sass functions whose names overlap with CSS math
functions could incorrectly be treated as CSS math functions even though they
used Sass-only features, causing compilation failures. For example, round(-$var / 2) previously threw an error but now works as intended.
No longer fully trim redundant selectors generated by @extend. This caused
unacceptable performance issues for certain heavy users of @extend. We'll
try to find a more performant way to accomplish it in the future.
Allow newlines in whitespace in the indented syntax.
Potentially breaking bug fix: Selectors with unmatched brackets now always
produce a parser error. Previously, some edge cases like [foo#{"]:is(bar"}) {a: b} would compile without error, but this was an unintentional bug.
Fix a bug in which various Color Level 4 functions weren't allowed in plain
CSS.
Fix the error message for @extend without a selector and possibly other
parsing edge-cases in contexts that allow interpolation.
Embedded Host
Fixed the implementation of the SassBoolean type to adhere to the spec,
now using a class instead of an interface.
Fix a bug where @import url("...") would crash in plain CSS files.
Improve consistency of how warnings are emitted by different parts of the
compiler. This should result in minimal user-visible changes, but different
types of warnings should now respond more reliably to flags like --quiet, --verbose, and --silence-deprecation.
@import is now officially deprecated, as are global built-in functions that
are available within built-in modules. See the Sass blog post for more
details on the deprecation process.
Embedded Host
Fix an error that would sometimes occur when deprecation warnings were
emitted when using a custom importer with the legacy API.
Changes to how selector.unify() and @extend combine selectors:
The relative order of pseudo-classes (like :hover) and pseudo-elements
(like ::before) within each original selector is now preserved when
they're combined.
Pseudo selectors are now consistently placed at the end of the combined
selector, regardless of which selector they came from. Previously, this
reordering only applied to pseudo-selectors in the second selector.
Tweak the color transformation matrices for OKLab and OKLCH to match the
newer, more accurate values in the CSS spec.
Fix a slight inaccuracy case when converting to srgb-linear and display-p3.
Potentially breaking bug fix:math.unit() now wraps multiple denominator
units in parentheses. For example, px/(em*em) instead of px/em*em.
Command-Line Interface
Use @parcel/watcher to watch the filesystem when running from JavaScript and
not using --poll. This should mitigate more frequent failures users have
been seeing since version 4.0.0 of Chokidar, our previous watching tool, was
released.
JS API
Fix SassColor.interpolate() to allow an undefined options parameter, as
the types indicate.
Embedded Sass
Properly pass missing color channel values to and from custom functions.
Update the $channel parameter in the suggested replacement for color.red(), color.green(), color.blue(), color.hue(), color.saturation(), color.lightness(), color.whiteness(), and color.blackness() to use a quoted string.
Add a $space parameter to the suggested replacement for color.red(), color.green(), color.blue(), color.hue(), color.saturation(), color.lightness(), color.whiteness(), and color.blackness().
Update deprecation warnings for the legacy JS API to include a link to relevant documentation.
Breaking change: Passing a number with unit % to the $alpha parameter
of color.change(), color.adjust(), change-color(), and adjust-color()
is now interpreted as a percentage, instead of ignoring the unit. For example, color.change(red, $alpha: 50%) now returns rgb(255 0 0 / 0.5).
Potentially breaking compatibility fix: Sass no longer rounds RGB channels
to the nearest integer. This means that, for example, rgb(0 0 1) != rgb(0 0 0.6). This matches the latest version of the CSS spec and browser behavior.
Potentially breaking compatibility fix: Passing large positive or negative
values to color.adjust() can now cause a color's channels to go outside that
color's gamut. In most cases this will currently be clipped by the browser and
end up showing the same color as before, but once browsers implement gamut
mapping it may produce a different result.
Add support for CSS Color Level 4 color spaces. Each color value now tracks
its color space along with the values of each channel in that color space.
There are two general principles to keep in mind when dealing with new color
spaces:
With the exception of legacy color spaces (rgb, hsl, and hwb), colors
will always be emitted in the color space they were defined in unless
they're explicitly converted.
The color.to-space() function is the only way to convert a color to
another color space. Some built-in functions may do operations in a
different color space, but they'll always convert back to the original space
afterwards.
rgb colors can now have non-integer channels and channels outside the normal
gamut of 0-255. These colors are always emitted using the rgb() syntax so
that modern browsers that are being displayed on wide-gamut devices can
display the most accurate color possible.
Add support for all the new color syntax defined in Color Level 4, including:
oklab(), oklch(), lab(), and lch() functions;
a top-level hwb() function that matches the space-separated CSS syntax;
and a color() function that supports the srgb, srgb-linear, display-p3, a98-rgb, prophoto-rgb, rec2020, xyz, xyz-d50, and xyz-d65 color spaces.
Add new functions for working with color spaces:
color.to-space($color, $space) converts $color to the given $space. In
most cases this conversion is lossless—the color may end up out-of-gamut for
the destination color space, but browsers will generally display it as best
they can regardless. However, the hsl and hwb spaces can't represent
out-of-gamut colors and so will be clamped.
color.channel($color, $channel, $space: null) returns the value of the
given $channel in $color, after converting it to $space if necessary.
It should be used instead of the old channel-specific functions such as color.red() and color.hue().
color.same($color1, $color2) returns whether two colors represent the same
color even across color spaces. It differs from $color1 == $color2 because == never consider colors in different (non-legacy) spaces as equal.
color.is-in-gamut($color, $space: null) returns whether $color is
in-gamut for its color space (or $space if it's passed).
color.to-gamut($color, $space: null) returns $color constrained to its
space's gamut (or to $space's gamut, if passed). This is generally not
recommended since even older browsers will display out-of-gamut colors as
best they can, but it may be necessary in some cases.
color.space($color): Returns the name of $color's color space.
color.is-legacy($color): Returns whether $color is in a legacy color
space (rgb, hsl, or hwb).
color.is-powerless($color, $channel, $space: null): Returns whether the
given $channel of $color is powerless in $space (or its own color
space). A channel is "powerless" if its value doesn't affect the way the
color is displayed, such as hue for a color with 0 chroma.
color.is-missing($color, $channel): Returns whether $channel's value is
missing in $color. Missing channels can be explicitly specified using the
special value none and can appear automatically when color.to-space()
returns a color with a powerless channel. Missing channels are usually
treated as 0, except when interpolating between two colors and in color.mix() where they're treated as the same value as the other color.
Update existing functions to support color spaces:
hsl() and color.hwb() no longer forbid out-of-bounds values. Instead,
they follow the CSS spec by clamping them to within the allowed range.
color.change(), color.adjust(), and color.scale() now support all
channels of all color spaces. However, if you want to modify a channel
that's not in $color's own color space, you have to explicitly specify the
space with the $space parameter. (For backwards-compatibility, this
doesn't apply to legacy channels of legacy colors—for example, you can still
adjust an rgb color's saturation without passing $space: hsl).
color.mix() and color.invert() now support the standard CSS algorithm
for interpolating between two colors (the same one that's used for gradients
and animations). To use this, pass the color space to use for interpolation
to the $method parameter. For polar color spaces like hsl and oklch,
this parameter also allows you to specify how hue interpolation is handled.
color.complement() now supports a $space parameter that indicates which
color space should be used to take the complement.
color.grayscale() now operates in the oklch space for non-legacy colors.
color.ie-hex-str() now automatically converts its color to the rgb space
and gamut-maps it so that it can continue to take colors from any color
space.
The following functions are now deprecated, and uses should be replaced with
the new color-space-aware functions defined above:
The color.red(), color.green(), color.blue(), color.hue(), color.saturation(), color.lightness(), color.whiteness(), and color.blackness() functions, as well as their global counterparts, should
be replaced with calls to color.channel().
The global adjust-hue(), saturate(), desaturate(), lighten(), darken(), transaprentize(), fade-out(), opacify(), and fade-in()
functions should be replaced by color.adjust() or color.scale().
Add a global-builtin future deprecation, which can be opted-into with the --future-deprecation flag or the futureDeprecations option in the JS or
Dart API. This emits warnings when any global built-in functions that are
now available in sass: modules are called. It will become active by default
in an upcoming release alongside the @import deprecation.
Dart API
Added a ColorSpace class which represents the various color spaces defined
in the CSS spec.
Added SassColor.space which returns a color's color space.
Added SassColor.channels and .channelsOrNull which returns a list
of channel values, with missing channels converted to 0 or exposed as null,
respectively.
Added SassColor.isLegacy, .isInGamut, .channel(), .isChannelMissing(), .isChannelPowerless(), .toSpace(), .toGamut(), .changeChannels(), and .interpolate() which do the same thing as the Sass functions of the
corresponding names.
SassColor.rgb() now allows out-of-bounds and non-integer arguments.
SassColor.hsl() and .hwb() now allow out-of-bounds arguments.
Deprecated SassColor.red, .green, .blue, .hue, .saturation, .lightness, .whiteness, and .blackness in favor of SassColor.channel().
Deprecated SassColor.changeRgb(), .changeHsl(), and .changeHwb() in
favor of SassColor.changeChannels().
Added SassNumber.convertValueToUnit() as a shorthand for SassNumber.convertValue() with a single numerator.
Added InterpolationMethod and HueInterpolationMethod which collectively
represent the method to use to interpolate two colors.
JS API
While the legacy API has been deprecated since we released the modern API, we
now emit warnings when the legacy API is used to make sure users are aware
that it will be removed in Dart Sass 2.0.0. In the meantime, you can silence
these warnings by passing legacy-js-api in silenceDeprecations when using
the legacy API.
Modify SassColor to accept a new space option, with support for all the
new color spaces defined in Color Level 4.
Add SassColor.space which returns a color's color space.
Add SassColor.channels and .channelsOrNull which returns a list of channel
values, with missing channels converted to 0 or exposed as null, respectively.
Add SassColor.isLegacy, .isInGamut(), .channel(), .isChannelMissing(), .isChannelPowerless(), .toSpace(), .toGamut(), .change(), and .interpolate() which do the same thing as the Sass functions of the
corresponding names.
Deprecate SassColor.red, .green, .blue, .hue, .saturation, .lightness, .whiteness, and .blackness in favor of SassColor.channel().
Embedded Sass
Add Color SassScript value, with support for all the new color spaces
defined in Color Level 4.
Remove RgbColor, HslColor and HwbColor SassScript values.
The meta.feature-exists function is now deprecated. This deprecation is
named feature-exists.
Fix a crash when using @at-root without any queries or children in the
indented syntax.
JS API
Backport the deprecation options (fatalDeprecations, futureDeprecations,
and silenceDeprecations) to the legacy JS API. The legacy JS API is itself
deprecated, and you should move off of it if possible, but this will allow
users of bundlers and other tools that are still using the legacy API to
still control deprecation warnings.
Fix a bug where accessing SourceSpan.url would crash when a relative URL was
passed to the Sass API.
Embedded Sass
Explicitly expose a sass executable from the sass-embedded npm package.
This was intended to be included in 1.63.0, but due to the way
platform-specific dependency executables are installed it did not work as
intended. Now users can run npx sass for local installs or just sass when sass-embedded is installed globally.
Add linux-riscv64, linux-musl-riscv64, and android-riscv64 support for the sass-embedded npm package.
Fix an edge case where the Dart VM could hang when shutting down when requests
were in flight.
Fix a race condition where the embedded host could fail to shut down if it was
closed around the same time a new compilation was started.
Fix a bug where parse-time deprecation warnings could not be controlled by
the deprecation options in some circumstances.
Declarations that appear after nested rules are deprecated, because the
semantics Sass has historically used are different from the semantics
specified by CSS. In the future, Sass will adopt the standard CSS semantics.
Potentially breaking bug fix:// in certain places such as unknown
at-rule values was being preserved in the CSS output, leading to potentially
invalid CSS. It's now properly parsed as a silent comment and omitted from the
CSS output.
Deprecation.duplicateVariableFlags has been deprecated and replaced with Deprecation.duplicateVarFlags to make it consistent with the duplicate-var-flags name used on the command line and in the JS API.
Throw errors for misplaced statements in keyframe blocks.
Mixins and functions whose names begin with -- are now deprecated for
forwards-compatibility with the in-progress CSS functions and mixins spec.
This deprecation is named css-function-mixin.
Fix a bug in which stylesheet canonicalization could be cached incorrectly
when custom importers or the Node.js package importer made decisions based on
the URL of the containing stylesheet.
JS API
Allow importer to be passed without url in StringOptionsWithImporter.
For more information about pkg: importers, see the
announcement on the Sass blog.
Command-Line Interface
Add a --pkg-importer flag to enable built-in pkg: importers. Currently
this only supports the Node.js package resolution algorithm, via --pkg-importer=node. For example, @use "pkg:bootstrap" will load node_modules/bootstrap/scss/bootstrap.scss.
JavaScript API
Add a NodePackageImporter importer that can be passed to the importers
option. This loads files using the pkg: URL scheme according to the Node.js
package resolution algorithm. For example, @use "pkg:bootstrap" will load node_modules/bootstrap/scss/bootstrap.scss. The constructor takes a single
optional argument, which indicates the base directory to use when locating node_modules directories. It defaults to path.dirname(require.main.filename).
Dart API
Add a NodePackageImporter importer that can be passed to the importers
option. This loads files using the pkg: URL scheme according to the Node.js
package resolution algorithm. For example, @use "pkg:bootstrap" will load node_modules/bootstrap/scss/bootstrap.scss. The constructor takes a single
argument, which indicates the base directory to use when locating node_modules directories.
Add a sass.initCompiler() function that returns a sass.Compiler object
which supports compile() and compileString() methods with the same API as
the global Sass object. On the Node.js embedded host, each sass.Compiler
object uses a single long-lived subprocess, making compiling multiple
stylesheets much more efficient.
Add a sass.initAsyncCompiler() function that returns a sass.AsyncCompiler
object which supports compileAsync() and compileStringAsync() methods with
the same API as the global Sass object. On the Node.js embedded host, each sass.AsynCompiler object uses a single long-lived subprocess, making
compiling multiple stylesheets much more efficient.
Embedded Sass
Support the CompileRequest.silent field. This allows compilations with no
logging to avoid unnecessary request/response cycles.
The Dart Sass embedded compiler now reports its name as "dart-sass" rather
than "Dart Sass", to match the JS API's info field.
Produce better output for numbers with complex units in meta.inspect() and
debugging messages.
Escape U+007F DELETE when serializing strings.
When generating CSS error messages to display in-browser, escape all code
points that aren't in the US-ASCII region. Previously only code points U+0100
LATIN CAPITAL LETTER A WITH MACRON were escaped.
Provide official releases for musl LibC and for Android.
Don't crash when running meta.apply() in asynchronous mode.
JS API
Fix a bug where certain exceptions could produce SourceSpans that didn't
follow the documented SourceSpan API.
Add a meta.get-mixin() function that returns a mixin as a first-class Sass
value.
Add a meta.apply() mixin that includes a mixin value.
Add a meta.module-mixins() function which returns a map from mixin names in
a module to the first-class mixins that belong to those names.
Add a meta.accepts-content() function which returns whether or not a mixin
value can take a content block.
Add support for the relative color syntax from CSS Color 5. This syntax
cannot be used to create Sass color values. It is always emitted as-is in the
CSS output.
Dart API
Deprecate Deprecation.calcInterp since it was never actually emitted as a
deprecation.
Embedded Sass
Fix a rare race condition where the embedded compiler could freeze when a
protocol error was immediately followed by another request.
Fix the source spans associated with the abs-percent deprecation.
JS API
Non-filesystem importers can now set the nonCanonicalScheme field, which
declares that one or more URL schemes (without :) will never be used for
URLs returned by the canonicalize() method.
Add a containingUrl field to the canonicalize() and findFileUrl()
methods of importers, which is set to the canonical URL of the stylesheet that
contains the current load. For filesystem importers, this is always set; for
other importers, it's set only if the current load has no URL scheme, or if
its URL scheme is declared as non-canonical by the importer.
Dart API
Add AsyncImporter.isNonCanonicalScheme, which importers (async or sync) can
use to indicate that a certain URL scheme will never be used for URLs returned
by the canonicalize() method.
Add AsyncImporter.containingUrl, which is set during calls to the canonicalize() method to the canonical URL of the stylesheet that contains
the current load. This is set only if the current load has no URL scheme, or
if its URL scheme is declared as non-canonical by the importer.
Embedded Sass
The CalculationValue.interpolation field is deprecated and will be removed
in a future version. It will no longer be set by the compiler, and if the host
sets it it will be treated as equivalent to CalculationValue.string except
that "(" and ")" will be added to the beginning and end of the string
values.
Properly include TypeScript types in the sass-embedded package.
All functions defined in CSS Values and Units 4 are now once again parsed as
calculation objects: round(), mod(), rem(), sin(), cos(), tan(), asin(), acos(), atan(), atan2(), pow(), sqrt(), hypot(), log(), exp(), abs(), and sign().
Unlike in 1.65.0, function calls are not locked into being parsed as
calculations or plain Sass functions at parse-time. This means that
user-defined functions will take precedence over CSS calculations of the same
name. Although the function names calc() and clamp() are still forbidden,
users may continue to freely define functions whose names overlap with other
CSS calculations (including abs(), min(), max(), and round() whose
names overlap with global Sass functions).
Breaking change: As a consequence of the change in calculation parsing
described above, calculation functions containing interpolation are now parsed
more strictly than before. However, almost all interpolations that would
have produced valid CSS will continue to work. The only exception is #{$variable}% which is not valid in Sass and is no longer valid in
calculations. Instead of this, either use $variable directly and ensure it
already has the % unit, or write ($variable * 1%).
Potentially breaking bug fix: The importer used to load a given file is no
longer used to load absolute URLs that appear in that file. This was
unintented behavior that contradicted the Sass specification. Absolute URLs
will now correctly be loaded only from the global importer list. This applies
to the modern JS API, the Dart API, and the embedded protocol.
Embedded Sass
Substantially improve the embedded compiler's performance when compiling many
files or files that require many importer or function call round-trips with
the embedded host.
Breaking change: Drop support for the additional CSS calculations defined
in CSS Values and Units 4. Custom Sass functions whose names overlapped with
these new CSS functions were being parsed as CSS calculations instead, causing
an unintentional breaking change outside our normal [compatibility policy] for
CSS
✂ Note
PR body was truncated to here.
Configuration
📅 Schedule: (UTC)
Branch creation
At any time (no schedule defined)
Automerge
At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
If you want to rebase/retry this PR, check this box
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (automation)
Scope: Diff is limited to web/package.json (sass~1.32.12 → ~1.99.0) and web/package-lock.json regeneration. No application, API, or auth code changed.
Findings: None rated medium or higher with a credible exploit path tied to this PR.
Rationale:
sass is a devDependency used at build time to compile stylesheets; it is not part of the shipped runtime attack surface in the same way as server handlers or client bundles processing untrusted input.
The change is a mainline dependency bump on the official sass package (supply-chain posture unchanged vs. any other npm install from the registry).
Public advisory snapshots (e.g. Snyk) report no known direct vulnerabilities on sass@1.99.0 at review time; no separate CVE-backed issue was identified that is introduced by this bump.
Prior threads: Previous automation security-review threads were cleared so this assessment is the active one.
Slack-ready one-liner: PR #3787 (sass ~1.99.0): no medium+ security findings — dev-only compiler bump + lockfile; no auth/injection/sink changes in diff.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (sass ~1.99.0)
Scope: Diff is limited to web/package.json (sass devDependency bump ~1.32.12 → ~1.99.0) and web/package-lock.json regeneration.
Assessment: No medium/high/critical security findings.
sass (Dart Sass) is a build-time SCSS compiler (dev: true in the lockfile). It does not run in the browser or handle untrusted remote input in production.
No application/auth/API code changed.
Known CVE literature around Sass tooling refers to legacy node-sass (different package), not sass.
Lockfile pins sass@1.99.0 with npm integrity — routine supply-chain hygiene for a dependency bump.
Prior automation security-review threads are cleared so this assessment is the active one.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (automation)
Scope:web/package.json bumps sass from ~1.32.12 to ~1.99.0; web/package-lock.json is regenerated. No application source, API, or auth code changed.
Findings: None at medium or above with a plausible production attack path tied to this diff.
Analysis (concise):
Runtime exposure:sass is a devDependency used at build time (Vue CLI + sass-loader) to compile repo-controlled .scss / <style lang="scss"> sources. It is not part of the shipped browser bundle as an executable compiler; there is no new attacker-controlled sink in deployed code from this change alone.
Supply chain: Version resolves to the published sass package on the npm registry with standard lockfile integrity semantics; no substitution or postinstall script change was identified in the edited manifest lines beyond the declared sass range bump.
npm audit (baseline vs PR head): Compared npm audit metadata using base vs head package.json + package-lock.json; vulnerability counts are unchanged (44 total: 17 high, 18 moderate, 9 low, 0 critical). No new advisory surface attributable to this bump was established.
Prior automation threads are cleared via cleanup_previous so this assessment is the active one. Re-open if future commits add non–dev-only dependency changes or application code.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (automation)
Scope:web/package.json — sass devDependency ~1.32.12 → ~1.100.0, plus regenerated web/package-lock.json.
Outcome: No medium, high, or critical issues identified in added or modified code paths.
Rationale: Changes are limited to a dev-time stylesheet compiler and its transitive lockfile entries. There is no new application logic, no new network sinks, and no auth/permission surface. The resolved sass tarball uses the official npm registry URL with subresource integrity, which is the expected supply-chain control for this change.
Prior findings: No open automation threads required re-reporting; previous assessment threads were cleared so this review is the single active assessment.
Scope: This PR only updates the sass devDependency (~1.32.12 → ~1.100.0) and refreshes web/package-lock.json. There are no changes to application source, APIs, auth, or runtime configuration.
Supply chain / dependency boundary:sass is a build-time tool (SCSS → CSS) and is not shipped to end users as part of the production JS bundle in the usual Vue/webpack setup. A programmatic comparison of the lockfile shows no version or integrity changes for any packages entry that is not marked dev: true—production dependency pins are unchanged; the churn is confined to the dev dependency graph.
Prior automation threads: Resolved via cleanup_previous so this assessment is the single active automation review.
Residual risk (informational, below reporting threshold): Any npm install / CI build still trusts the npm registry and lockfile integrity; that is unchanged in kind from the pre-PR baseline, not a new vulnerability introduced here.
Verdict: No medium, high, or critical issues introduced by this change.
What changed:sass (~1.32.12 → ~1.100.0) under devDependencies in web/package.json, plus a large mechanical refresh of web/package-lock.json (same lockfileVersion: 2). No application or server code was modified.
Why this is low risk: The sass package is Dart Sass used only at build time to compile SCSS. It is not part of the runtime attack surface for deployed users. There is no plausible external attacker path (injection, auth bypass, SSRF, etc.) tied solely to this version bump without also controlling the repository or build environment.
Prior threads: Earlier automation findings were cleared so this assessment is the single active security review for this run.
Inline findings: None (no diff lines warrant severity-tagged security comments).
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (sass ~1.100.0)
Scope: Diff is limited to web/package.json (sass devDependency ~1.32.12 → ~1.100.0) and web/package-lock.json regeneration. No application, API, auth, or server code changed.
Assessment: No medium, high, or critical security findings tied to this PR.
Rationale:
sass (Dart Sass) is a devDependency used only at build time via sass-loader / Vue CLI to compile repository SCSS (e.g. main.scss, Vuetify imports). It is not a runtime handler for untrusted user input.
Resolved package is official npm (registry.npmjs.org/sass/-/sass-1.100.0.tgz) with a valid integrity hash; no non-registry sources introduced for sass.
New sass transitive deps (chokidar, immutable, source-map-js; optional @parcel/watcher) are standard, reputable packages for file watching / compilation—still confined to the developer build path.
sass@1.100.0 has no known direct CVEs in public advisory databases at review time; npm audit did not flag sass for this bump (other lockfile advisories are unchanged/pre-existing and outside this diff’s exploit path).
Prior automation assessments were validated; no prior inline finding threads remain open. No credible injection, authz bypass, SSRF, XSS, or secret-exposure path was identified from this change alone.
Slack-ready one-liner: PR #3787 (sass ~1.100.0): no medium+ security findings — dev-only CSS compiler bump + lockfile; no auth/injection/sink changes in diff.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (sass ~1.100.0)
Scope:web/package.json bumps sass devDependency ~1.32.12 → ~1.100.0; web/package-lock.json is regenerated. No application, API, auth, or server code changed.
Assessment: No medium, high, or critical security findings tied to this PR.
Rationale:
sass (Dart Sass) is a devDependency (dev: true in the lockfile) used only at build time via Vue CLI / sass-loader to compile repository-controlled SCSS. It is not a runtime handler for untrusted remote input.
Resolved artifact is the official npm package (registry.npmjs.org/sass/-/sass-1.100.0.tgz) with a valid integrity hash; no alternate registry sources for sass.
Production dependency pins are unchanged (0 non-dev lockfile entries with version/integrity diffs between base and head).
npm audit reports no advisories on sass for this tree; remaining audit items are pre-existing dev-toolchain noise, not introduced exploit paths from this diff.
Prior automation assessments were re-validated; no prior inline finding threads remain open. No credible injection, authz bypass, SSRF, XSS, path traversal, or secret-exposure path from this change alone.
Inline findings: None.
Slack-ready one-liner: PR #3787 (sass ~1.100.0): no medium+ security findings — dev-only CSS compiler bump + lockfile; no auth/injection/sink changes in diff.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (sass ~1.100.0)
Scope:web/package.json bumps sass devDependency ~1.32.12 → ~1.100.0; web/package-lock.json is regenerated. No application, API, auth, or server code changed.
Assessment: No medium, high, or critical security findings tied to this PR.
Rationale:
sass (Dart Sass) is a devDependency (dev: true in the lockfile) used only at build time via Vue CLI / sass-loader to compile repository-controlled SCSS. It is not a runtime handler for untrusted remote input.
Resolved artifact is the official npm package (registry.npmjs.org/sass/-/sass-1.100.0.tgz) with a valid integrity hash; no alternate registry sources for sass.
Production dependency pins are unchanged (0 non-dev lockfile entries with version/integrity diffs between base and head).
New transitive dev packages (chokidar, immutable, source-map-js, optional @parcel/watcher) are standard build-tooling dependencies; they do not expand the deployed runtime attack surface.
No credible injection, authz bypass, SSRF, XSS, path traversal, or secret-exposure path from this change alone.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (sass ~1.100.0)
Scope:web/package.json bumps sass devDependency ~1.32.12 → ~1.100.0; web/package-lock.json is regenerated. No application, API, auth, or server code changed.
Assessment: No medium, high, or critical security findings tied to this PR.
Rationale:
sass (Dart Sass) is a devDependency (dev: true in the lockfile) used only at build time via Vue CLI / sass-loader to compile repository-controlled SCSS. It is not a runtime handler for untrusted remote input.
Resolved artifact is the official npm package (registry.npmjs.org/sass/-/sass-1.100.0.tgz) with a valid integrity hash; no alternate registry sources for sass.
Production dependency pins are unchanged (0 non-dev lockfile entries with version/integrity diffs between base and head).
New transitive dev packages (immutable@5.1.6, chokidar, source-map-js, optional @parcel/watcher) are standard build-tooling dependencies; immutable is at a patched version (≥5.1.5) for the prior prototype-pollution advisory fixed in sass ≥1.98.0.
npm audit vulnerability counts are unchanged between base and head lockfiles (47 total); no advisories target sass or its new transitive deps in this tree.
No credible injection, authz bypass, SSRF, XSS, path traversal, or secret-exposure path from this change alone.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (sass ~1.101.0)
Scope:web/package.json bumps sass devDependency ~1.32.12 → ~1.101.0; web/package-lock.json is regenerated. No application, API, auth, or server code changed.
Assessment: No medium, high, or critical security findings tied to this PR.
Rationale:
sass (Dart Sass) is a devDependency (dev: true in the lockfile) used only at build time via Vue CLI / sass-loader to compile repository-controlled SCSS. It is not a runtime handler for untrusted remote input.
Resolved artifact is the official npm package (registry.npmjs.org/sass/-/sass-1.101.0.tgz) with a valid integrity hash; no alternate registry sources for sass.
Production dependency pins are unchanged (0 non-dev lockfile entries with version/integrity diffs between base and head).
Transitive dev deps (immutable@5.1.6, chokidar@5.0.0, source-map-js, optional @parcel/watcher) are standard build-tooling; immutable is at a patched version (≥5.1.5) for the prior prototype-pollution advisory fixed in sass ≥1.98.0.
npm audit vulnerability counts are unchanged between base and head lockfiles (49 total); no advisories target sass or its new transitive deps in this tree.
No credible injection, authz bypass, SSRF, XSS, path traversal, or secret-exposure path from this change alone.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (sass ~1.101.0)
Scope:web/package.json bumps sass devDependency ~1.32.12 → ~1.101.0; web/package-lock.json is regenerated. No application, API, auth, or server code changed.
Assessment: No medium, high, or critical findings.
sass is a devDependency used only at build time (vue-cli-service build via sass-loader). Compiled styles come from trusted repo sources (src/assets/scss/, Vuetify imports); there is no runtime path where attacker-controlled input reaches the Sass compiler in the deployed product.
Lockfile analysis shows 39 package version changes, all confined to the sass upgrade and new transitive deps (immutable@5.1.6, chokidar@5.0.0, optional @parcel/watcher@2.5.6). No unrelated production dependency drift.
This bump remediates transitive CVE-2026-29063 (prototype pollution in immutable) by pulling sass ≥ 1.98.0 with patched immutable@5.1.6. Residual build-time risk is limited to CI/developer machines compiling trusted sources.
New native optional dep @parcel/watcher is used for Sass --watch during development only; it is not invoked in production builds and does not expand the runtime attack surface.
Prior findings: No unresolved automation threads; previous assessments remain valid for this revision.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (sass ~1.101.0)
Scope:web/package.json bumps sass devDependency ~1.32.12 → ~1.101.0; web/package-lock.json is regenerated. No application, API, auth, or server code changed.
Assessment: No medium, high, or critical findings.
sass (Dart Sass) is a devDependency (dev: true in the lockfile) used only at build time via Vue CLI / sass-loader to compile repository-controlled SCSS. It is not a runtime handler for untrusted remote input in the deployed product.
Lockfile resolves the official npm artifact (registry.npmjs.org/sass/-/sass-1.101.0.tgz) with a valid integrity hash; 0 production dependency version/integrity changes between base and head.
Transitive dev deps (immutable@5.1.6, chokidar@5.0.0, source-map-js, optional @parcel/watcher) are standard build-tooling; immutable is at a patched version (≥5.1.5).
npm audit vulnerability counts are unchanged between base and head lockfiles (48 total: 1 critical, 14 high, 27 moderate, 6 low); no advisories target sass or its new transitive deps in this tree.
No credible injection, authz bypass, SSRF, XSS, path traversal, or secret-exposure path from this change alone.
Prior automation assessments: Re-validated on head a1168ddd; no unresolved inline finding threads.
Inline findings: None.
Slack-ready one-liner: PR #3787 (sass ~1.101.0): no medium+ security findings — dev-only CSS compiler bump + lockfile; no auth/injection/sink changes in diff.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (sass ~1.101.0)
Outcome: No medium, high, or critical findings.
Scope:web/package.json bumps sass devDependency ~1.32.12 → ~1.101.0; web/package-lock.json is regenerated. No application, API, auth, or server code changed.
Assessment:
sass is a devDependency used only at build time via sass-loader / vue-cli-service build; compiled SCSS sources are static project files (e.g. Vuetify imports), not attacker-controlled runtime input.
sass@1.101.0 has no known direct CVEs (Snyk/npm advisory databases).
New transitive deps (chokidar@5.0.0, immutable, source-map-js) likewise show no known vulnerabilities; npm audit total count is unchanged (31) vs base.
No plausible attack path from external input to a sass compilation sink in production.
It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.
Use the following commands to manage reviews:
@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.
Use the checkboxes below for quick actions:
▶️ Resume reviews
🔍 Trigger review
📝 Walkthrough
Walkthrough
The web package updates its Sass development dependency from ~1.32.12 to ~1.101.0.
Changes
Sass dependency update
Layer / File(s)
Summary
Update Sass development dependency web/package.json
Changes the sass dev dependency version from ~1.32.12 to ~1.101.0.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (automation)
Outcome: No medium, high, or critical findings.
Scope:web/package.json bumps sass devDependency (~1.32.12 → ~1.101.0); web/package-lock.json is regenerated. No application, API, auth, or runtime configuration code changed.
Analysis:
Attack surface:sass is a build-time SCSS compiler (dev: true in the lockfile) invoked via Vue CLI / sass-loader on repository-controlled stylesheets. It is not shipped to end users as an executable compiler and there is no new attacker-controlled input sink in deployed code from this diff alone.
Supply chain: Resolved to https://registry.npmjs.org/sass/-/sass-1.101.0.tgz with npm subresource integrity; no suspicious registry sources or install-script changes identified in the edited manifest.
Production deps: Programmatic lockfile comparison shows zero non-dev (dev: false/unset prod) version or integrity changes — churn is confined to the dev dependency graph.
Advisories:npm audit reports no vulnerabilities for sass or its direct transitive deps (chokidar, immutable, source-map-js, @parcel/watcher). Public advisory databases (e.g. Snyk) list no known direct CVEs for sass@1.101.0.
Prior threads: No open automation review threads required re-reporting; previous assessments were cleared via cleanup_previous.
Inline findings: None.
Slack-ready one-liner: PR #3787 (sass ~1.101.0): no medium+ security findings — dev-only compiler bump + lockfile; no auth/injection/sink changes in diff.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (sass ~1.101.0)
Outcome: No medium, high, or critical findings.
Scope:web/package.json bumps sass devDependency (~1.32.12 → ~1.101.0); web/package-lock.json is regenerated. No application, API, auth, or runtime configuration code changed.
Analysis:
Attack surface:sass is a build-time SCSS compiler (dev: true in the lockfile) invoked via Vue CLI / sass-loader on repository-controlled stylesheets. It is not shipped to end users as an executable compiler and there is no new attacker-controlled input sink in deployed code from this diff alone.
Supply chain: Resolved to https://registry.npmjs.org/sass/-/sass-1.101.0.tgz with npm subresource integrity; new transitive dev deps (immutable@5.1.9, chokidar@5.0.0, source-map-js, optional @parcel/watcher@2.5.6) have no install/postinstall scripts and are standard build/watch tooling.
Production deps: Lockfile comparison shows 0 non-dev version/integrity changes — churn is confined to the dev dependency graph.
Advisories:npm audit totals are unchanged between base and head (29 total: 0 critical, 8 high, 18 moderate, 3 low); no advisories target sass or its new transitive deps. Public advisory databases list no known direct CVEs for sass@1.101.0.
Prior threads: Re-validated; no prior inline finding threads remain open.
Inline findings: None.
Slack-ready one-liner: PR #3787 (sass ~1.101.0): no medium+ security findings — dev-only compiler bump + lockfile; no auth/injection/sink changes in diff.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (sass ~1.101.0)
Outcome: No medium, high, or critical findings.
Scope:web/package.json bumps sass devDependency (~1.32.12 → ~1.101.0); web/package-lock.json is regenerated. No application, API, auth, or runtime configuration code changed.
Analysis:
Attack surface:sass is a build-time SCSS compiler (dev: true) invoked via Vue CLI / sass-loader on repository-controlled static sources (Vuetify styles, src/assets/scss/). It is not shipped to production and does not process untrusted remote input.
Lockfile delta: Only 21 package version entries changed — all within the sass subtree (sass@1.101.0, immutable, chokidar@5, optional @parcel/watcher platform packages). No production dependencies versions changed.
Supply chain:sass@1.101.0 resolves from registry.npmjs.org with an integrity hash; Snyk/npm advisory databases report no direct CVEs for this version.
Prior threads: No unresolved inline security findings from earlier automation runs.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (sass ~1.101.0)
Outcome: No medium, high, or critical findings.
Scope:web/package.json bumps sass devDependency (~1.32.12 → ~1.101.0); web/package-lock.json is regenerated. No application, API, auth, or runtime configuration code changed.
Analysis:
Attack surface:sass is a build-time SCSS compiler (dev: true) invoked via Vue CLI / sass-loader on repository-controlled static sources (Vuetify styles, src/assets/scss/). It is not shipped to production and does not process untrusted remote input.
Lockfile delta: 21 package version entries changed — all within the sass subtree (sass@1.101.0, immutable@5.1.9, nested chokidar@5.0.0, optional @parcel/watcher platform packages). 0 production dependency version/integrity changes.
Supply chain:sass@1.101.0 resolves from registry.npmjs.org with an integrity hash; Snyk/npm advisory databases report no direct CVEs for this version or its new transitive dev deps.
npm audit: Vulnerability counts are unchanged between base and head (29 total: 0 critical, 8 high, 18 moderate, 3 low).
Prior threads: Re-validated; no unresolved inline security findings from earlier automation runs.
Inline findings: None.
Slack summary: PR #3787 (sass ~1.101.0): no medium+ security findings — dev-only CSS compiler bump + lockfile; no auth/injection/sink changes in diff.
Scope:sass is a build-time devDependency consumed by sass-loader / Vue CLI during frontend compilation. SCSS sources are project-controlled; there is no runtime path from attacker-controlled input to the Sass compiler in production.
Checks performed:
Traced usage: no direct sass API imports; only static .scss assets under web/src/.
Supply chain: resolved sass@1.101.0 has no known direct CVEs (Snyk/npm advisory databases).
No new auth, injection, SSRF, XSS, or deserialization surfaces introduced by this diff.
Outcome: No medium, high, or critical vulnerabilities identified in added/modified code.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (sass ~1.101.0)
Scope:web/package.json bumps sass devDependency ~1.32.12 → ~1.101.0; web/package-lock.json is regenerated. No application, API, auth, or server code changed.
Assessment: No medium, high, or critical findings.
sass (Dart Sass) is a devDependency (dev: true in the lockfile) used only at build time via Vue CLI / sass-loader to compile repository-controlled SCSS/Sass. It is not a runtime handler for untrusted remote input in the deployed product.
Lockfile resolves the official npm artifact (registry.npmjs.org/sass/-/sass-1.101.0.tgz) with a valid integrity hash; 0 production dependency version/integrity changes between base and head (21 dev-only lockfile deltas, all under the sass upgrade graph).
Transitive dev deps (immutable@5.1.9, nested chokidar@5.0.0, source-map-js, optional @parcel/watcher@2.5.6) are standard build-tooling; immutable is at a patched version (≥5.1.5).
npm audit vulnerability counts are unchanged between base and head lockfiles (29 total: 0 critical, 8 high, 18 moderate, 3 low); no advisories target sass or its new transitive deps in this tree.
No credible injection, authz bypass, SSRF, XSS, path traversal, or secret-exposure path from this change alone.
Prior automation assessments: Re-validated on head 316664b3; no unresolved inline finding threads.
Inline findings: None.
Slack-ready one-liner: PR #3787 (sass ~1.101.0): no medium+ security findings — dev-only CSS compiler bump + lockfile; no auth/injection/sink changes in diff.
Prior threads: No unresolved automation inline threads on this PR; prior runs reached the same conclusion.
Assessment:
sass is a devDependency used only at build time via sass-loader/Vue CLI; compiled CSS is emitted to api/public and the compiler is not shipped to production.
SCSS/SASS inputs are static repository sources (e.g. Vue SFC <style lang="scss">, Vuetify imports). There is no runtime path where remote/user-controlled content reaches the Sass compiler.
Lockfile pins sass@1.101.0 with an integrity hash; npm audit reports no sass-related vulnerabilities.
Snyk/advisory databases list no known CVEs for sass@1.101.0.
CI uses Node 24, satisfying the new sass engine requirement (>=20.19.0).
No exploitable injection, authz, SSRF, XSS, path-traversal, or supply-chain issue was identified in the added/modified code.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (sass ~1.101.0)
Outcome: No medium, high, or critical findings.
Scope:web/package.json bumps sass devDependency ~1.32.12 → ~1.101.0; web/package-lock.json is regenerated (21 transitive version changes, all tied to the sass upgrade: chokidar 5.x, immutable, source-map-js, @parcel/watcher).
Assessment:
sass is a build-time-only devDependency compiled via sass-loader / Vue CLI; it is not invoked at runtime and does not process attacker-controlled HTTP input.
No application source changes; SCSS/SASS inputs remain trusted repository files compiled during CI/local builds.
sass@1.101.0 and its new transitive dependencies have no known CVEs (Snyk/npm advisory databases).
Prior automation review threads: none open; no residual findings to re-report.
Verdict: Safe to merge from a security perspective.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (sass ~1.101.0)
Outcome: No medium, high, or critical findings.
Scope:web/package.json bumps sass devDependency ~1.32.12 → ~1.101.0; web/package-lock.json is regenerated. No application, API, auth, or server code changed.
Assessment:
sass is consumed only at build time via sass-loader / Vue CLI webpack; it is not bundled into the production runtime.
All SCSS inputs are developer-authored source files (Vue <style lang="scss"> blocks and static imports); there is no attacker-controlled path to the Sass compiler.
Resolved version 1.101.3 has no known direct CVEs in public vulnerability databases.
New transitive deps (chokidar, immutable, source-map-js, optional @parcel/watcher) are dev-only and do not expand the production attack surface.
Prior threads: No unresolved inline security findings from earlier automation runs.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (sass ~1.101.0)
Outcome: No medium, high, or critical findings.
Scope:web/package.json bumps sass devDependency ~1.32.12 → ~1.101.0; web/package-lock.json is regenerated. No application, API, auth, or server code changed.
Prior threads: No unresolved automation inline threads on this PR; prior assessments reached the same conclusion.
Assessment:
sass is a build-time-only devDependency (dev: true) consumed by sass-loader / Vue CLI during npm run build and npm run serve. Compiled SCSS sources are repository-controlled static files; there is no runtime path from attacker-controlled input to the Sass compiler in production.
Lockfile analysis shows 20 package version changes, all confined to the sass upgrade subtree (sass 1.32.13 → 1.101.6, optional @parcel/watcher platform packages, immutable, chokidar@5). Zero production dependency versions changed.
Supply chain: all new entries resolve from registry.npmjs.org with integrity hashes; no typosquatting or non-registry URLs observed.
Known-vulnerability check: no published CVEs for sass@1.101.x (Snyk/npm advisory databases as of review date).
No inline comments — nothing in the diff warrants medium+ severity with a plausible exploit path.
The reason will be displayed to describe this comment to others. Learn more.
Security review (sass ~1.101.0)
Scope:web/package.json bumps sass devDependency ~1.32.12 → ~1.101.0; web/package-lock.json is regenerated (resolves to sass@1.101.7). No application, API, auth, or server code changed.
Assessment: No medium, high, or critical findings.
Rationale:
sass (Dart Sass) is a devDependency (dev: true in the lockfile) used only at build time via Vue CLI / sass-loader to compile repository-controlled SCSS/Sass (e.g. src/assets/scss/, Vuetify imports). It is not a runtime handler for untrusted remote input in the deployed product.
Lockfile resolves the official npm artifact (registry.npmjs.org/sass/-/sass-1.101.7.tgz) with a valid integrity hash; 0 production dependency version/integrity changes between base and head.
New transitive dev deps (immutable@5.1.9, nested chokidar@5.0.0, source-map-js, optional @parcel/watcher@2.6.0) are standard build/watch tooling confined to the developer build path.
npm audit vulnerability counts are unchanged between base and head lockfiles (34 total: 0 critical, 14 high, 16 moderate, 4 low); no advisories target sass or its new transitive deps in this tree.
Public advisory databases report no known direct CVEs on sass@1.101.x at review time.
No credible injection, authz bypass, SSRF, XSS, path traversal, or secret-exposure path from this change alone.
Prior automation assessments: Re-validated on head 47aaf5e5; no unresolved inline finding threads.
Inline findings: None.
Slack-ready one-liner: PR #3787 (sass ~1.101.0): no medium+ security findings — dev-only CSS compiler bump + lockfile; no auth/injection/sink changes in diff.
Sent by Cursor Automation: Find vulnerabilities
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
~1.32.12→~1.101.0Release Notes
sass/dart-sass (sass)
v1.101.7Compare Source
v1.101.6Compare Source
v1.101.5Compare Source
v1.101.4Compare Source
Avoid emitting
rgb()orrgba()functions with non-percent decimalchannels. Older browsers only support integer values or (potentially decimal)
percentages for these functions, so in order to preserve
backwards-compatibility while retaining full precision for modern browsers,
legacy colors that contain at least one non-integer channel will now use
percentages for their channels (for example,
rgb(0%, 100%, 50%)rather thanrgb(0, 255, 127.5)).Fix a bug where the values of plain-CSS
if()expressions were emitted usingtheir
meta.inspect()format rather than their CSS serialization format.v1.101.3Compare Source
v1.101.0Compare Source
supports resolving import-only variants of Sass files declared in the
exports,sass, andstylefields ofpackage.json. Previously, thesefiles were ignored even when loaded via
@import, so any code relying onloading module-system-only files this way may break.
v1.100.0Compare Source
Writing two compound selectors adjacent to one another without any whitespace
between them, such as
[class]a, is now deprecated. This was always an errorin CSS and Sass only supported it by mistake.
See the Sass website for
details.
v1.99.0Compare Source
Add support for parent selectors (
&) at the root of the document. These areemitted as-is in the CSS output, where they're interpreted as the scoping
root.
User-defined functions named
calcorclampare no longer forbidden. Ifsuch a function exists without a namespace in the current module, it will be
used instead of the built-in
calc()orclamp()function.User-defined functions whose names begin with
-and end with-expression,-url,-and,-or, or-notare no longer forbidden. These wereoriginally intended to match vendor prefixes, but in practice no vendor
prefixes for these functions ever existed in real browsers.
User-defined functions named
EXPRESSION,URL, andELEMENT, those thatbegin with
-and end with-ELEMENT, as well as the same names with somelowercase letters are now deprecated, These are names conflict with plain CSS
functions that have special syntax.
See the Sass website for details.
In a future release, calls to functions whose names begin with
-and endwith
-expressionand-urlwill no longer have special parsing. For now,these calls are deprecated if their behavior will change in the future.
See the Sass website for details.
Calls to functions whose names begin with
-and end with-progid:...aredeprecated.
See the Sass website for details.
v1.98.0Compare Source
Command-Line Interface
--watchmode.Dart API
const Logger.defaultLoggerfield. This provides a logger that emits tostandard error or the browser console, but automatically chooses whether to
use terminal colors.
JavaScript API
Fix a crash when manually constructing a
SassCalculationfor'calc'withan argument that can't be simplified.
Properly emit deprecation warnings as text rather than
StringBufferobjectswhen running in a browser.
Emit colored warnings and other messages on the console when running in a
browser.
v1.97.3Compare Source
could cause outer style rules to be omitted.
v1.97.2Compare Source
v1.97.1Compare Source
if()syntax where values would be evaluatedeven if their conditions didn't match.
v1.97.0Compare Source
display-p3-linearcolor space.v1.96.0Compare Source
zero denominator units) to be emitted to CSS. These are now emitted as
calc()expressions, which now support complex units in plain CSS.v1.95.1Compare Source
v1.95.0Compare Source
Add support for the CSS-style
if()function. In addition to supporting theplain CSS syntax, this also supports a
sass()query that takes a Sassexpression that evaluates to
trueorfalseat preprocessing time dependingon whether the Sass value is truthy. If there are no plain-CSS queries, the
function will return the first value whose query returns true during
preprocessing. For example,
if(sass(false): 1; sass(true): 2; else: 3)returns
2.The old Sass
if()syntax is now deprecated. Users are encouraged to migrateto the new CSS syntax.
if($condition, $if-true, $if-false)can be changed toif(sass($condition): $if-true; else: $if-false).See the Sass website for details.
Plain-CSS
if()functions are now considered "special numbers", meaning thatthey can be used in place of arguments to CSS color functions.
Plain-CSS
if()functions andattr()functions are now considered "specialvariable strings" (like
var()), meaning they can now be used in place ofmultiple arguments or syntax fragments in various CSS functions.
v1.94.3Compare Source
%expressions followed by whitespace.v1.94.2Compare Source
Command-Line Interface
--fatal-deprecation <version>no longer emits warnings aboutdeprecations that are obsolete.
Dart API
Deprecation.forVersionnow excludes obsolete deprecations from the set itreturns.
JS API
fatalDeprecationswhen aVersionispassed.
Node.js Embedded Host
async compilation.
v1.94.1Compare Source
v1.94.0Compare Source
Potentially breaking compatibility fix:
@functionrules whose namesbegin with
--are now parsed as unknown at-rules to support the plain CSS@functionrule. Within this rule, theresultproperty is parsed as rawCSS just like custom properties.
Potentially breaking compatibility fix:
@mixinrules whose names beginwith
--are now errors. These are not yet parsed as unknown at-rules becauseno browser currently supports CSS mixins.
v1.93.3Compare Source
v1.93.2Compare Source
JavaScript API
@sass/types.v1.93.1Compare Source
JavaScript API
@sass/types.v1.93.0Compare Source
@import, and the loaded file@uses a user-defined module as well as@includes a top-level mixin whichemits top-level declarations.
JavaScript API
@sass/typespackage which contains the type annotations used byboth the
sassandsass-embeddedpackage without any additional code ordependencies.
v1.92.1Compare Source
would not be passed as implicit configuration to a later imported, forwarded
module.
v1.92.0Compare Source
Breaking change: Emit declarations, childless at-rules, and comments in
the order they appear in the source even when they're interleaved with nested
rules. This obsoletes the
mixed-declsdeprecation.Breaking change: The function name
type()is now fully reserved for theplain CSS function. This means that
@functiondefinitions with the nametypewill produce errors, while function calls will be parsed as specialfunction strings.
Configuring private variables using
@use ... with,@forward ... with, andmeta.load-css(..., $with: ...)is now deprecated. Private variables werealways intended to be fully encapsulated within the module that defines them,
and this helps enforce that encapsulation.
Fix a bug where
@extendrules loaded through a mixture of@importand@userules could fail to apply correctly.Command-Line Interface
--watchmode, delete the source map when the associated source file isdeleted.
v1.91.0Compare Source
Potentially breaking change:
meta.inspect()(as well as other systemsthat use it such as
@debugand certain error messages) now emits numberswith as high precision as is available instead of rounding to the nearest
1e⁻¹⁰ as we do when serializing to CSS. This better fits the purpose of
meta.inspect(), which is to provide full information about the structure ofa Sass value.
Passing a rest argument (
$arg...) before a positional or named argument whencalling a function or mixin is now deprecated. This was always outside the
specified syntax, but it was historically treated the same as passing the rest
argument at the end of the argument list whether or not that matched the
visual order of the arguments.
v1.90.0Compare Source
@forwarded module to be loaded with a configuration when that modulehas already been loaded with a different configuration and the module
doesn't define any variables that would have been configured anyway.
v1.89.2Compare Source
Embedded Host
bufdependency.v1.89.1Compare Source
v1.89.0Compare Source
potential resolutions, as long as those resolutions all point to the same
file.
v1.88.0Compare Source
Allow custom properties with empty values (such as
--var:;).Fix a bug when calculating source spans for interpolations.
Dart and JS APIs
mixin object from one compilation to another.
Dart API
compileString()and related functions.v1.87.0Compare Source
nesting selector
&is loaded into a nested Sass context viameta.load-css()or@import, Sass now emits plain CSS nesting rather thanincorrectly combining it with the parent selector using a descendant
combinator.
v1.86.3Compare Source
a
..segment.v1.86.2Compare Source
v1.86.1Compare Source
file:URL case canonicalization on Windows andMac OS.
v1.86.0Compare Source
Add support for
%as an expression in its own right. It will still be parsedas the modulo operator when between two other expressions, but in any other
context it will be an expression whose value is the unquoted string
%.Consider
attr()to be a special number function that can be used as achannel in color functions.
Deprecate user-defined functions named
type()so that we can eventuallysupport the new CSS
type()function.Dart API
v1.85.1Compare Source
functions could incorrectly be treated as CSS math functions even though they
used Sass-only features, causing compilation failures. For example,
round(-$var / 2)previously threw an error but now works as intended.v1.85.0Compare Source
@extend. This causedunacceptable performance issues for certain heavy users of
@extend. We'lltry to find a more performant way to accomplish it in the future.
v1.84.0Compare Source
Allow newlines in whitespace in the indented syntax.
Potentially breaking bug fix: Selectors with unmatched brackets now always
produce a parser error. Previously, some edge cases like
[foo#{"]:is(bar"}) {a: b}would compile without error, but this was an unintentional bug.Fix a bug in which various Color Level 4 functions weren't allowed in plain
CSS.
Fix the error message for
@extendwithout a selector and possibly otherparsing edge-cases in contexts that allow interpolation.
Embedded Host
SassBooleantype to adhere to the spec,now using a class instead of an interface.
v1.83.4Compare Source
v1.83.3Compare Source
v1.83.2Compare Source
Properly display deprecation IDs for the JS Sass API.
Don't display deprecation IDs for user-defined deprecations.
v1.83.1Compare Source
Fix a bug where
--quiet-depswould get deactivated for@contentblocks,even when those blocks were entirely contained within dependencies.
Include deprecation IDs in deprecation warnings to make it easier to determine
what to pass to
--silence-deprecationor--fatal-deprecation.v1.83.0Compare Source
v1.82.0Compare Source
Command-Line Interface
Improve
--watchmode reliability when making multiple changes at once, suchas checking out a different Git branch.
Parse the
calc-size()function as a calculation now that it's supported insome browsers.
Dart API
SassCalculation.calcSize()function.v1.81.1Compare Source
v1.81.0Compare Source
Fix a few cases where deprecation warnings weren't being emitted for global
built-in functions whose names overlap with CSS calculations.
Add support for the CSS
round()calculation with a single argument, as longas that argument might be a unitless number.
v1.80.7Compare Source
Embedded Host
0asundefinedfor thegreenandbluechannels in theLegacyColorconstructor.v1.80.6Compare Source
Command-Line Interface
@parcel/watcheran optional dependency so this can still be installedon operating systems where it's unavailable.
v1.80.5Compare Source
Embedded Host
@importdeprecations when using an importer with thelegacy API.
v1.80.4Compare Source
v1.80.3Compare Source
Fix a bug where
@import url("...")would crash in plain CSS files.Improve consistency of how warnings are emitted by different parts of the
compiler. This should result in minimal user-visible changes, but different
types of warnings should now respond more reliably to flags like
--quiet,--verbose, and--silence-deprecation.v1.80.2Compare Source
plain-CSS
invert()function.v1.80.1Compare Source
v1.80.0Compare Source
@importis now officially deprecated, as are global built-in functions thatare available within built-in modules. See the Sass blog post for more
details on the deprecation process.
Embedded Host
emitted when using a custom importer with the legacy API.
v1.79.6Compare Source
Fix a bug where Sass would add an extra
*/after loud comments withwhitespace after an explicit
*/in the indented syntax.Potentially breaking bug fix: Adding text after an explicit
*/in theindented syntax is now an error, rather than silently generating invalid CSS.
Embedded Host
SassBooleantype.v1.79.5Compare Source
Changes to how
selector.unify()and@extendcombine selectors:The relative order of pseudo-classes (like
:hover) and pseudo-elements(like
::before) within each original selector is now preserved whenthey're combined.
Pseudo selectors are now consistently placed at the end of the combined
selector, regardless of which selector they came from. Previously, this
reordering only applied to pseudo-selectors in the second selector.
Tweak the color transformation matrices for OKLab and OKLCH to match the
newer, more accurate values in the CSS spec.
Fix a slight inaccuracy case when converting to
srgb-linearanddisplay-p3.Potentially breaking bug fix:
math.unit()now wraps multiple denominatorunits in parentheses. For example,
px/(em*em)instead ofpx/em*em.Command-Line Interface
@parcel/watcherto watch the filesystem when running from JavaScript andnot using
--poll. This should mitigate more frequent failures users havebeen seeing since version 4.0.0 of Chokidar, our previous watching tool, was
released.
JS API
SassColor.interpolate()to allow an undefinedoptionsparameter, asthe types indicate.
Embedded Sass
v1.79.4Compare Source
JS API
greenorbluetocolor.change()for legacycolors would fail.
v1.79.3Compare Source
$channelparameter in the suggested replacement forcolor.red(),color.green(),color.blue(),color.hue(),color.saturation(),color.lightness(),color.whiteness(), andcolor.blackness()to use a quoted string.v1.79.2Compare Source
Add a
$spaceparameter to the suggested replacement forcolor.red(),color.green(),color.blue(),color.hue(),color.saturation(),color.lightness(),color.whiteness(), andcolor.blackness().Update deprecation warnings for the legacy JS API to include a link to
relevant documentation.
v1.79.1Compare Source
v1.79.0Compare Source
Breaking change: Passing a number with unit
%to the$alphaparameterof
color.change(),color.adjust(),change-color(), andadjust-color()is now interpreted as a percentage, instead of ignoring the unit. For example,
color.change(red, $alpha: 50%)now returnsrgb(255 0 0 / 0.5).Potentially breaking compatibility fix: Sass no longer rounds RGB channels
to the nearest integer. This means that, for example,
rgb(0 0 1) != rgb(0 0 0.6). This matches the latest version of the CSS spec and browser behavior.Potentially breaking compatibility fix: Passing large positive or negative
values to
color.adjust()can now cause a color's channels to go outside thatcolor's gamut. In most cases this will currently be clipped by the browser and
end up showing the same color as before, but once browsers implement gamut
mapping it may produce a different result.
Add support for CSS Color Level 4 color spaces. Each color value now tracks
its color space along with the values of each channel in that color space.
There are two general principles to keep in mind when dealing with new color
spaces:
With the exception of legacy color spaces (
rgb,hsl, andhwb), colorswill always be emitted in the color space they were defined in unless
they're explicitly converted.
The
color.to-space()function is the only way to convert a color toanother color space. Some built-in functions may do operations in a
different color space, but they'll always convert back to the original space
afterwards.
rgbcolors can now have non-integer channels and channels outside the normalgamut of 0-255. These colors are always emitted using the
rgb()syntax sothat modern browsers that are being displayed on wide-gamut devices can
display the most accurate color possible.
Add support for all the new color syntax defined in Color Level 4, including:
oklab(),oklch(),lab(), andlch()functions;hwb()function that matches the space-separated CSS syntax;color()function that supports thesrgb,srgb-linear,display-p3,a98-rgb,prophoto-rgb,rec2020,xyz,xyz-d50, andxyz-d65color spaces.Add new functions for working with color spaces:
color.to-space($color, $space)converts$colorto the given$space. Inmost cases this conversion is lossless—the color may end up out-of-gamut for
the destination color space, but browsers will generally display it as best
they can regardless. However, the
hslandhwbspaces can't representout-of-gamut colors and so will be clamped.
color.channel($color, $channel, $space: null)returns the value of thegiven
$channelin$color, after converting it to$spaceif necessary.It should be used instead of the old channel-specific functions such as
color.red()andcolor.hue().color.same($color1, $color2)returns whether two colors represent the samecolor even across color spaces. It differs from
$color1 == $color2because==never consider colors in different (non-legacy) spaces as equal.color.is-in-gamut($color, $space: null)returns whether$colorisin-gamut for its color space (or
$spaceif it's passed).color.to-gamut($color, $space: null)returns$colorconstrained to itsspace's gamut (or to
$space's gamut, if passed). This is generally notrecommended since even older browsers will display out-of-gamut colors as
best they can, but it may be necessary in some cases.
color.space($color): Returns the name of$color's color space.color.is-legacy($color): Returns whether$coloris in a legacy colorspace (
rgb,hsl, orhwb).color.is-powerless($color, $channel, $space: null): Returns whether thegiven
$channelof$coloris powerless in$space(or its own colorspace). A channel is "powerless" if its value doesn't affect the way the
color is displayed, such as hue for a color with 0 chroma.
color.is-missing($color, $channel): Returns whether$channel's value ismissing in
$color. Missing channels can be explicitly specified using thespecial value
noneand can appear automatically whencolor.to-space()returns a color with a powerless channel. Missing channels are usually
treated as 0, except when interpolating between two colors and in
color.mix()where they're treated as the same value as the other color.Update existing functions to support color spaces:
hsl()andcolor.hwb()no longer forbid out-of-bounds values. Instead,they follow the CSS spec by clamping them to within the allowed range.
color.change(),color.adjust(), andcolor.scale()now support allchannels of all color spaces. However, if you want to modify a channel
that's not in
$color's own color space, you have to explicitly specify thespace with the
$spaceparameter. (For backwards-compatibility, thisdoesn't apply to legacy channels of legacy colors—for example, you can still
adjust an
rgbcolor's saturation without passing$space: hsl).color.mix()andcolor.invert()now support the standard CSS algorithmfor interpolating between two colors (the same one that's used for gradients
and animations). To use this, pass the color space to use for interpolation
to the
$methodparameter. For polar color spaces likehslandoklch,this parameter also allows you to specify how hue interpolation is handled.
color.complement()now supports a$spaceparameter that indicates whichcolor space should be used to take the complement.
color.grayscale()now operates in theoklchspace for non-legacy colors.color.ie-hex-str()now automatically converts its color to thergbspaceand gamut-maps it so that it can continue to take colors from any color
space.
The following functions are now deprecated, and uses should be replaced with
the new color-space-aware functions defined above:
The
color.red(),color.green(),color.blue(),color.hue(),color.saturation(),color.lightness(),color.whiteness(), andcolor.blackness()functions, as well as their global counterparts, shouldbe replaced with calls to
color.channel().The global
adjust-hue(),saturate(),desaturate(),lighten(),darken(),transaprentize(),fade-out(),opacify(), andfade-in()functions should be replaced by
color.adjust()orcolor.scale().Add a
global-builtinfuture deprecation, which can be opted-into with the--future-deprecationflag or thefutureDeprecationsoption in the JS orDart API. This emits warnings when any global built-in functions that are
now available in
sass:modules are called. It will become active by defaultin an upcoming release alongside the
@importdeprecation.Dart API
Added a
ColorSpaceclass which represents the various color spaces definedin the CSS spec.
Added
SassColor.spacewhich returns a color's color space.Added
SassColor.channelsand.channelsOrNullwhich returns a listof channel values, with missing channels converted to 0 or exposed as null,
respectively.
Added
SassColor.isLegacy,.isInGamut,.channel(),.isChannelMissing(),.isChannelPowerless(),.toSpace(),.toGamut(),.changeChannels(), and.interpolate()which do the same thing as the Sass functions of thecorresponding names.
SassColor.rgb()now allows out-of-bounds and non-integer arguments.SassColor.hsl()and.hwb()now allow out-of-bounds arguments.Added
SassColor.hwb(),.srgb(),.srgbLinear(),.displayP3(),.a98Rgb(),.prophotoRgb(),.rec2020(),.xyzD50(),.xyzD65(),.lab(),.lch(),.oklab(),.oklch(), and.forSpace()constructors.Deprecated
SassColor.red,.green,.blue,.hue,.saturation,.lightness,.whiteness, and.blacknessin favor ofSassColor.channel().Deprecated
SassColor.changeRgb(),.changeHsl(), and.changeHwb()infavor of
SassColor.changeChannels().Added
SassNumber.convertValueToUnit()as a shorthand forSassNumber.convertValue()with a single numerator.Added
InterpolationMethodandHueInterpolationMethodwhich collectivelyrepresent the method to use to interpolate two colors.
JS API
While the legacy API has been deprecated since we released the modern API, we
now emit warnings when the legacy API is used to make sure users are aware
that it will be removed in Dart Sass 2.0.0. In the meantime, you can silence
these warnings by passing
legacy-js-apiinsilenceDeprecationswhen usingthe legacy API.
Modify
SassColorto accept a newspaceoption, with support for all thenew color spaces defined in Color Level 4.
Add
SassColor.spacewhich returns a color's color space.Add
SassColor.channelsand.channelsOrNullwhich returns a list of channelvalues, with missing channels converted to 0 or exposed as null, respectively.
Add
SassColor.isLegacy,.isInGamut(),.channel(),.isChannelMissing(),.isChannelPowerless(),.toSpace(),.toGamut(),.change(), and.interpolate()which do the same thing as the Sass functions of thecorresponding names.
Deprecate
SassColor.red,.green,.blue,.hue,.saturation,.lightness,.whiteness, and.blacknessin favor ofSassColor.channel().Embedded Sass
Add
ColorSassScript value, with support for all the new color spacesdefined in Color Level 4.
Remove
RgbColor,HslColorandHwbColorSassScript values.v1.78.0Compare Source
The
meta.feature-existsfunction is now deprecated. This deprecation isnamed
feature-exists.Fix a crash when using
@at-rootwithout any queries or children in theindented syntax.
JS API
Backport the deprecation options (
fatalDeprecations,futureDeprecations,and
silenceDeprecations) to the legacy JS API. The legacy JS API is itselfdeprecated, and you should move off of it if possible, but this will allow
users of bundlers and other tools that are still using the legacy API to
still control deprecation warnings.
Fix a bug where accessing
SourceSpan.urlwould crash when a relative URL waspassed to the Sass API.
Embedded Sass
Explicitly expose a
sassexecutable from thesass-embeddednpm package.This was intended to be included in 1.63.0, but due to the way
platform-specific dependency executables are installed it did not work as
intended. Now users can run
npx sassfor local installs or justsasswhensass-embeddedis installed globally.Add linux-riscv64, linux-musl-riscv64, and android-riscv64 support for the
sass-embeddednpm package.Fix an edge case where the Dart VM could hang when shutting down when requests
were in flight.
Fix a race condition where the embedded host could fail to shut down if it was
closed around the same time a new compilation was started.
Fix a bug where parse-time deprecation warnings could not be controlled by
the deprecation options in some circumstances.
v1.77.8Compare Source
v1.77.7Compare Source
Declarations that appear after nested rules are deprecated, because the
semantics Sass has historically used are different from the semantics
specified by CSS. In the future, Sass will adopt the standard CSS semantics.
See the Sass website for details.
Potentially breaking bug fix:
//in certain places such as unknownat-rule values was being preserved in the CSS output, leading to potentially
invalid CSS. It's now properly parsed as a silent comment and omitted from the
CSS output.
v1.77.6Compare Source
between the end of Sass statements and the following semicolon.
v1.77.5Compare Source
@extend.v1.77.4Compare Source
Embedded Sass
Support passing
Versioninput forfatalDeprecationsas string overembedded protocol.
Fix a bug in the JS Embedded Host where
Versioncould be incorrectly acceptedas input for
silenceDeprecationsandfutureDeprecationsin pure JS.v1.77.3Compare Source
Dart API
Deprecation.duplicateVariableFlagshas been deprecated and replaced withDeprecation.duplicateVarFlagsto make it consistent with theduplicate-var-flagsname used on the command line and in the JS API.v1.77.2Compare Source
Don't emit deprecation warnings for functions and mixins beginning with
__.Allow user-defined functions whose names begin with
_and otherwise looklike vendor-prefixed functions with special CSS syntax.
Command-Line Interface
Properly handle the
--silence-deprecationflag.Handle the
--fatal-deprecationand--future-deprecationflags for--interactivemode.v1.77.1Compare Source
v1.77.0Compare Source
v1.76.0Compare Source
Throw errors for misplaced statements in keyframe blocks.
Mixins and functions whose names begin with
--are now deprecated forforwards-compatibility with the in-progress CSS functions and mixins spec.
This deprecation is named
css-function-mixin.v1.75.0Compare Source
when custom importers or the Node.js package importer made decisions based on
the URL of the containing stylesheet.
JS API
importerto be passed withouturlinStringOptionsWithImporter.v1.74.1Compare Source
v1.72.0Compare Source
Support adjacent
/s without whitespace in between when parsing plain CSSexpressions.
Allow the Node.js
pkg:importer to load Sass stylesheets forpackage.jsonexportsfield entries without extensions.When printing suggestions for variables, use underscores in variable names
when the original usage used underscores.
JavaScript API
pkg:imports with the Node.js package importer whenarguments are passed to the JavaScript process.
v1.71.1Compare Source
Command-Line Interface
JavaScript API
Export the
NodePackageImporterclass in ESM mode.Allow
NodePackageImporterto locate a default directory even when theentrypoint is an ESM module.
Dart API
NodePackageImporter()a static error ratherthan just a runtime error.
Embedded Sass
when running on musl Linux.
v1.71.0Compare Source
For more information about
pkg:importers, see theannouncement on the Sass blog.
Command-Line Interface
--pkg-importerflag to enable built-inpkg:importers. Currentlythis only supports the Node.js package resolution algorithm, via
--pkg-importer=node. For example,@use "pkg:bootstrap"will loadnode_modules/bootstrap/scss/bootstrap.scss.JavaScript API
NodePackageImporterimporter that can be passed to theimportersoption. This loads files using the
pkg:URL scheme according to the Node.jspackage resolution algorithm. For example,
@use "pkg:bootstrap"will loadnode_modules/bootstrap/scss/bootstrap.scss. The constructor takes a singleoptional argument, which indicates the base directory to use when locating
node_modulesdirectories. It defaults topath.dirname(require.main.filename).Dart API
NodePackageImporterimporter that can be passed to theimportersoption. This loads files using the
pkg:URL scheme according to the Node.jspackage resolution algorithm. For example,
@use "pkg:bootstrap"will loadnode_modules/bootstrap/scss/bootstrap.scss. The constructor takes a singleargument, which indicates the base directory to use when locating
node_modulesdirectories.v1.70.0Compare Source
JavaScript API
Add a
sass.initCompiler()function that returns asass.Compilerobjectwhich supports
compile()andcompileString()methods with the same API asthe global Sass object. On the Node.js embedded host, each
sass.Compilerobject uses a single long-lived subprocess, making compiling multiple
stylesheets much more efficient.
Add a
sass.initAsyncCompiler()function that returns asass.AsyncCompilerobject which supports
compileAsync()andcompileStringAsync()methods withthe same API as the global Sass object. On the Node.js embedded host, each
sass.AsynCompilerobject uses a single long-lived subprocess, makingcompiling multiple stylesheets much more efficient.
Embedded Sass
Support the
CompileRequest.silentfield. This allows compilations with nologging to avoid unnecessary request/response cycles.
The Dart Sass embedded compiler now reports its name as "dart-sass" rather
than "Dart Sass", to match the JS API's
infofield.v1.69.7Compare Source
Embedded Sass
ARM64 Windows.
v1.69.6Compare Source
Produce better output for numbers with complex units in
meta.inspect()anddebugging messages.
Escape U+007F DELETE when serializing strings.
When generating CSS error messages to display in-browser, escape all code
points that aren't in the US-ASCII region. Previously only code points U+0100
LATIN CAPITAL LETTER A WITH MACRON were escaped.
Provide official releases for musl LibC and for Android.
Don't crash when running
meta.apply()in asynchronous mode.JS API
SourceSpans that didn'tfollow the documented
SourceSpanAPI.v1.69.5Compare Source
JS API
v1.69.4Compare Source
v1.69.3Compare Source
Embedded Sass
package.json.v1.69.2Compare Source
JS API
variable named
process.v1.69.1Compare Source
v1.69.0Compare Source
Add a
meta.get-mixin()function that returns a mixin as a first-class Sassvalue.
Add a
meta.apply()mixin that includes a mixin value.Add a
meta.module-mixins()function which returns a map from mixin names ina module to the first-class mixins that belong to those names.
Add a
meta.accepts-content()function which returns whether or not a mixinvalue can take a content block.
Add support for the relative color syntax from CSS Color 5. This syntax
cannot be used to create Sass color values. It is always emitted as-is in the
CSS output.
Dart API
Deprecation.calcInterpsince it was never actually emitted as adeprecation.
Embedded Sass
protocol error was immediately followed by another request.
v1.68.0Compare Source
abs-percentdeprecation.JS API
Non-filesystem importers can now set the
nonCanonicalSchemefield, whichdeclares that one or more URL schemes (without
:) will never be used forURLs returned by the
canonicalize()method.Add a
containingUrlfield to thecanonicalize()andfindFileUrl()methods of importers, which is set to the canonical URL of the stylesheet that
contains the current load. For filesystem importers, this is always set; for
other importers, it's set only if the current load has no URL scheme, or if
its URL scheme is declared as non-canonical by the importer.
Dart API
Add
AsyncImporter.isNonCanonicalScheme, which importers (async or sync) canuse to indicate that a certain URL scheme will never be used for URLs returned
by the
canonicalize()method.Add
AsyncImporter.containingUrl, which is set during calls to thecanonicalize()method to the canonical URL of the stylesheet that containsthe current load. This is set only if the current load has no URL scheme, or
if its URL scheme is declared as non-canonical by the importer.
Embedded Sass
The
CalculationValue.interpolationfield is deprecated and will be removedin a future version. It will no longer be set by the compiler, and if the host
sets it it will be treated as equivalent to
CalculationValue.stringexceptthat
"("and")"will be added to the beginning and end of the stringvalues.
Properly include TypeScript types in the
sass-embeddedpackage.v1.67.0Compare Source
All functions defined in CSS Values and Units 4 are now once again parsed as
calculation objects:
round(),mod(),rem(),sin(),cos(),tan(),asin(),acos(),atan(),atan2(),pow(),sqrt(),hypot(),log(),exp(),abs(), andsign().Unlike in 1.65.0, function calls are not locked into being parsed as
calculations or plain Sass functions at parse-time. This means that
user-defined functions will take precedence over CSS calculations of the same
name. Although the function names
calc()andclamp()are still forbidden,users may continue to freely define functions whose names overlap with other
CSS calculations (including
abs(),min(),max(), andround()whosenames overlap with global Sass functions).
Breaking change: As a consequence of the change in calculation parsing
described above, calculation functions containing interpolation are now parsed
more strictly than before. However, almost all interpolations that would
have produced valid CSS will continue to work. The only exception is
#{$variable}%which is not valid in Sass and is no longer valid incalculations. Instead of this, either use
$variabledirectly and ensure italready has the
%unit, or write($variable * 1%).Potentially breaking bug fix: The importer used to load a given file is no
longer used to load absolute URLs that appear in that file. This was
unintented behavior that contradicted the Sass specification. Absolute URLs
will now correctly be loaded only from the global importer list. This applies
to the modern JS API, the Dart API, and the embedded protocol.
Embedded Sass
files or files that require many importer or function call round-trips with
the embedded host.
v1.66.1Compare Source
JS API
callback that threw a string, boolean, number, symbol, or bignum.
v1.66.0Compare Source
in CSS Values and Units 4. Custom Sass functions whose names overlapped with
these new CSS functions were being parsed as CSS calculations instead, causing
an unintentional breaking change outside our normal [compatibility policy] for
CSS
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.