Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Snyk] Upgrade node-sass from 5.0.0 to 7.0.1 #1

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

snyk-bot
Copy link

Snyk has created this PR to upgrade node-sass from 5.0.0 to 7.0.1.

merge advice
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.


Warning: This is a major version upgrade, and may be a breaking change.

  • The recommended version is 4 versions ahead of your current version.
  • The recommended version was released a month ago, on 2021-12-27.

The recommended version fixes:

Severity Issue PriorityScore (*) Exploit Maturity
Denial of Service (DoS)
SNYK-JS-TRIMNEWLINES-1298042
375/1000
Why? CVSS 7.5
No Known Exploit
Arbitrary File Write
SNYK-JS-TAR-1579155
375/1000
Why? CVSS 7.5
No Known Exploit
Arbitrary File Write
SNYK-JS-TAR-1579152
375/1000
Why? CVSS 7.5
No Known Exploit
Arbitrary File Write
SNYK-JS-TAR-1579147
375/1000
Why? CVSS 7.5
No Known Exploit
Arbitrary File Overwrite
SNYK-JS-TAR-1536531
375/1000
Why? CVSS 7.5
No Known Exploit
Arbitrary File Overwrite
SNYK-JS-TAR-1536528
375/1000
Why? CVSS 7.5
No Known Exploit
Command Injection
SNYK-JS-LODASH-1040724
375/1000
Why? CVSS 7.5
Proof of Concept
Prototype Pollution
SNYK-JS-JSONSCHEMA-1920922
375/1000
Why? CVSS 7.5
No Known Exploit
Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIREGEX-1583908
375/1000
Why? CVSS 7.5
Proof of Concept
Regular Expression Denial of Service (ReDoS)
SNYK-JS-PATHPARSE-1077067
375/1000
Why? CVSS 7.5
Proof of Concept
Improper Certificate Validation
SNYK-JS-NODESASS-1059081
375/1000
Why? CVSS 7.5
No Known Exploit
Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-1018905
375/1000
Why? CVSS 7.5
Proof of Concept
Regular Expression Denial of Service (ReDoS)
SNYK-JS-HOSTEDGITINFO-1088355
375/1000
Why? CVSS 7.5
Proof of Concept
Regular Expression Denial of Service (ReDoS)
SNYK-JS-TAR-1536758
375/1000
Why? CVSS 7.5
No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes
Package name: node-sass
  • 7.0.1 - 2021-12-27

    Dependencies

    • Bump node-gyp from 7.1.2 to 8.4.1
    • Bump sass-graph from 2.2.5 to 4.0.0

    Supported Environments

    OS Architecture Node
    Windows x86 & x64 12, 14, 16, 17
    OSX x64 12, 14, 16, 17
    Linux* x64 12, 14, 16, 17
    Alpine Linux x64 12, 14, 16, 17
    FreeBSD i386 amd64 12, 14

    *Linux support refers to major distributions like Ubuntu, and Debian

  • 7.0.0 - 2021-12-06

    Breaking changes

    Features

    Dependencies

    Community

    • Remove double word "support" from documentation (@ pzrq, #3159)

    Misc

    • Bump various GitHub Actions dependencies (@ nschonni)

    Supported Environments

    OS Architecture Node
    Windows x86 & x64 12, 14, 16, 17
    OSX x64 12, 14, 16, 17
    Linux* x64 12, 14, 16, 17
    Alpine Linux x64 12, 14, 16, 17
    FreeBSD i386 amd64 12, 14

    *Linux support refers to major distributions like Ubuntu, and Debian

  • 6.0.1 - 2021-06-24

    Dependencies

    Misc

    Supported Environments

    OS Architecture Node
    Windows x86 & x64 12, 14, 15, 16
    OSX x64 12, 14, 15, 16
    Linux* x64 12, 14, 15, 16
    Alpine Linux x64 12, 14, 15, 16
    FreeBSD i386 amd64 12, 14, 15

    *Linux support refers to major distributions like Ubuntu, and Debian

  • 6.0.0 - 2021-05-08

    Breaking changes

    Features

    • Add support for Node 16

    Community

    Supported Environments

    OS Architecture Node
    Windows x86 & x64 12, 14, 15, 16
    OSX x64 12, 14, 15, 16
    Linux* x64 12, 14, 15, 16
    Alpine Linux x64 12, 14, 15, 16
    FreeBSD i386 amd64 12, 14, 15

    *Linux support refers to major distributions like Ubuntu, and Debian

  • 5.0.0 - 2020-10-31

    Breaking changes

    Features

    • Add support for Node 15
    • New node-gyp version that supports building with Python 3

    Community

    Fixes

    Supported Environments

    OS Architecture Node
    Windows x86 & x64 10, 12, 14, 15
    OSX x64 10, 12, 14, 15
    Linux* x64 10, 12, 14, 15
    Alpine Linux x64 10, 12, 14, 15
    FreeBSD i386 amd64 10, 12, 14, 15

    *Linux support refers to major distributions like Ubuntu, and Debian

from node-sass GitHub release notes
Commit messages
Package name: node-sass
  • 99242d7 7.0.1
  • 77049d1 build(deps): bump sass-graph from 2.2.5 to 4.0.0 (#3224)
  • c929f25 build(deps): bump node-gyp from 7.1.2 to 8.4.1 (#3209)
  • 918dcb3 Lint fix
  • 0a21792 Set rejectUnauthorized to true by default (#3149)
  • e80d4af chore: Drop EOL Node 15 (#3122)
  • d753397 feat: Add Node 17 support (#3195)
  • dcf2e75 build(deps-dev): bump eslint from 7.32.0 to 8.0.0
  • bfa1a3c build(deps): bump actions/setup-node from 2.4.0 to 2.4.1
  • 80d6c00 chore: Windows x86 on GitHub Actions (#3041)
  • 566dc27 build(deps-dev): bump fs-extra from 0.30.0 to 10.0.0 (#3102)
  • 7bb5157 build(deps): bump npmlog from 4.1.2 to 5.0.0 (#3156)
  • 2efb38f build(deps): bump chalk from 1.1.3 to 4.1.2 (#3161)
  • fca5257 build(deps): bump actions/setup-node from 2.3.0 to 2.4.0
  • 6200b21 docs: Double word "support" (#3159)
  • eaf791a build(deps): bump actions/setup-node from 2.1.5 to 2.3.0
  • 16b8d4b build(deps): bump coverallsapp/github-action from 1.1.2 to 1.1.3
  • c167004 6.0.1
  • 911d4db remove mkdirp dep (#3108)
  • 30a52f7 build(deps): bump meow from 3.7.0 to 9.0.0
  • 7e08463 build(deps-dev): bump mocha from 8.4.0 to 9.0.1
  • cfcbb2c chore: Use default Apline version from docker-node (#3121)
  • 886319b chore: Drop Node 10 support
  • c908f4f fix: Bump OSX minimum to 10.11

Compare


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

@atomist atomist bot added auto-branch-delete:on-close Delete branch when pull request gets closed auto-merge-method:merge Auto-merge with merge commit auto-merge:on-bpr-success Auto-merge on passed branch protection rule labels Jan 29, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
auto-branch-delete:on-close Delete branch when pull request gets closed auto-merge:on-bpr-success Auto-merge on passed branch protection rule auto-merge-method:merge Auto-merge with merge commit
Projects
None yet
1 participant