You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
chore(deps): update dependency sass to ~1.107.0 - #3787
The --fatal-deprecation flag can now exclude deprecations that would
otherwise be included by passing a version number. To exclude a deprecation,
add - before its name. For example, --fatal-deprecation=1.107.0,-import
includes all deprecations that were present in Dart Sass 1.107.0 except for
the @import deprecation.
The --fatal-deprecation flag now takes the special value dart-sass-2,
which treats as fatal all deprecations that will become fatal in Dart Sass
2.0.0.
JavaScript API
Options.fatalDeprecations can now take a DeprecationSelectorDifference
object of the form {include: ..., except: ...}, where the include field
lists deprecations to mark fatal (which can be version numbers) and the except field lists deprecations not to mark fatal. The except field
takes precedence over include.
Add a (non-enumerable) sass.deprecations.dartSass2 property which can be
passed to Options.fatalDeprecations to mark as fatal exactly the
deprecations that will become fatal in Dart Sass 2.0.0. This can be combined
with other deprecations or used in a DeprecationSelectorDifference to modify
exactly which deprecations it covers.
Passing a version number beyond the current Dart Sass version to Options.fatalDeprecations is now deprecated. See the Sass
website for details.
Dart API
Add a Deprecation.dartSass2 property which returns exactly the set of
deprecations that will become fatal in Dart Sass 2.0.0.
Passing a version number beyond the current Dart Sass version to Deprecation.forVersion is now deprecated.
Embedded Protocol
Add a CompileRequest.fatal_deprecation_except field which excludes
deprecations from being considered fatal if they would have been enabled by CompileRequest.fatal_deprecation.
Don't normalize CSS escapes in statement contexts that can contain
interpolation. For example, @f\6Fo is now emitted as written rather than
normalized to @foo.
Fix a bug where quotes would be removed from attribute selector values that
contained backslashes.
Fix invalid source spans that could cause crashes when encountering a syntax
error in selectors or media queries that also contain escape sequences.
Fix a bug where the indented syntax parser would crash when parsing a file
where the first statement was indented and appeared after the first line.
Fix a bug that could cause crashes when encountering errors or warnings in
interpolations that contain patterns like // */.
Potentially breaking compatibility fix: CSS escape codes whose values are
0, for Unicode surrogates, or greater than the maximum allowed code point are
now consistently normalized to U+FFFD REPLACEMENT CHARACTER in expression
contexts. Previously, in some cases these were instead normalized to the
normalized form of the original escape sequence, which violates the principle
that all escape sequences for identical values should be normalized the same
way. In other cases, these would simply throw errors.
As a special case, \0 on its own will continue to be normalized to \0 to
support historical CSS hacks.
Potentially breaking bug fix: Throw an error for mixins and functions that
have rest parameters which are the same as normal parameters. Previously, the
positional parameters wouldn't be accessible and calling such a mixin or
function with a named argument would crash the compiler.
Potentially breaking bug fix: Fix various cases where using a CSS escape
code at the beginning of an identifier would change parsing behavior versus
using the character directly.
Potentially breaking bug fix: When a number's unit is ambiguous with a
numeric exponent, the unit is now serialized as an escape code rather than a
literal e to avoid being interpreted as an exponent by CSS.
Potentially breaking bug fix: Don't parse a CSS escape code for U+45 LATIN
CAPITAL LETTER E or U+65 LATIN LOWERCASE LETTER E as an exponent in @keyframes percentage selectors.
Potentially breaking bug fix: Properly normalize underscores written as
CSS escape codes in variable, mixin, and function names.
Add support for first-class modules. These can be accessed using the new meta.load() and meta.get-module() functions, and may be passed as the $module argument to numerous eisting sass:meta functions.
Add the meta.css() mixin, which includes CSS from a first-class module.
JS API
Add a SassModule class and a corresponding Value.assertModule() method.
Dart API
Add a SassModule class and a corresponding Value.assertModule() method.
Fix a bug where loud comments before @use rules could be emitted multiple
times under certain circumstances.
Fix a bug in which an invalid selector at the end of an indented syntax
stylesheet would cause the parser to crash instead of emitting a useful error
message.
Command Line Interface
Many-to-many compilations no longer compile any files that appear in the
output directory if the output directory is also within the source directory.
This fixes a bug where --watch mode could enter an infinite loop recompiling
the same CSS file over and over.
Sass now sets the modification time of output files to the time compilation started rather than the time it ended. This ensures that, if a source file
is modified during compilation, --watch and --update mode will recompile
the outputs to include the new source file contents.
Potentially breaking compatibility fix: Colors now convert the special
values NaN and negative zero, as well as infinity and negative infinity for
polar-hue channels, to 0 as per the CSS spec.
The special value negative zero is now serialized as -0 instead of 0 for
greater compatibility when using it in CSS calculations.
Potentially breaking compatibility fix: Colors now preserve "analogous
sets" of missing channels during conversions, per the CSS spec. For example, color.to-space(lch(50% none none), lab) now returns lab(50% none none)
instead of lab(50% 0 0).
Avoid emitting rgb() or rgba() functions with non-percent decimal
channels. Older browsers only support integer values or (potentially decimal)
percentages for these functions, so in order to preserve
backwards-compatibility while retaining full precision for modern browsers,
legacy colors that contain at least one non-integer channel will now use
percentages for their channels (for example, rgb(0%, 100%, 50%) rather than rgb(0, 255, 127.5)).
Fix a bug where the values of plain-CSS if() expressions were emitted using
their meta.inspect() format rather than their CSS serialization format.
Potentially breaking bug fix: The Node package importer now properly
supports resolving import-only variants of Sass files declared in the exports, sass, and style fields of package.json. Previously, these
files were ignored even when loaded via @import, so any code relying on
loading module-system-only files this way may break.
Writing two compound selectors adjacent to one another without any whitespace
between them, such as [class]a, is now deprecated. This was always an error
in CSS and Sass only supported it by mistake.
Add support for parent selectors (&) at the root of the document. These are
emitted as-is in the CSS output, where they're interpreted as the scoping
root.
User-defined functions named calc or clamp are no longer forbidden. If
such a function exists without a namespace in the current module, it will be
used instead of the built-in calc() or clamp() function.
User-defined functions whose names begin with - and end with -expression, -url, -and, -or, or -not are no longer forbidden. These were
originally intended to match vendor prefixes, but in practice no vendor
prefixes for these functions ever existed in real browsers.
User-defined functions named EXPRESSION, URL, and ELEMENT, those that
begin with - and end with -ELEMENT, as well as the same names with some
lowercase letters are now deprecated, These are names conflict with plain CSS
functions that have special syntax.
In a future release, calls to functions whose names begin with - and end
with -expression and -url will no longer have special parsing. For now,
these calls are deprecated if their behavior will change in the future.
Gracefully handle dependency loops in --watch mode.
Dart API
Add a const Logger.defaultLogger field. This provides a logger that emits to
standard error or the browser console, but automatically chooses whether to
use terminal colors.
JavaScript API
Fix a crash when manually constructing a SassCalculation for 'calc' with
an argument that can't be simplified.
Properly emit deprecation warnings as text rather than StringBuffer objects
when running in a browser.
Emit colored warnings and other messages on the console when running in a
browser.
Allow numbers with complex units (more than one numerator unit or more than
zero denominator units) to be emitted to CSS. These are now emitted as calc() expressions, which now support complex units in plain CSS.
Add support for the CSS-style if() function. In addition to supporting the
plain CSS syntax, this also supports a sass() query that takes a Sass
expression that evaluates to true or false at preprocessing time depending
on whether the Sass value is truthy. If there are no plain-CSS queries, the
function will return the first value whose query returns true during
preprocessing. For example, if(sass(false): 1; sass(true): 2; else: 3)
returns 2.
The old Sass if() syntax is now deprecated. Users are encouraged to migrate
to the new CSS syntax. if($condition, $if-true, $if-false) can be changed to if(sass($condition): $if-true; else: $if-false).
Plain-CSS if() functions are now considered "special numbers", meaning that
they can be used in place of arguments to CSS color functions.
Plain-CSS if() functions and attr() functions are now considered "special
variable strings" (like var()), meaning they can now be used in place of
multiple arguments or syntax fragments in various CSS functions.
Potentially breaking compatibility fix:@function rules whose names
begin with -- are now parsed as unknown at-rules to support the plain CSS @function rule. Within this rule, the result property is parsed as raw
CSS just like custom properties.
Potentially breaking compatibility fix:@mixin rules whose names begin
with -- are now errors. These are not yet parsed as unknown at-rules because
no browser currently supports CSS mixins.
Fix a crash when a style rule contains a nested @import, and the loaded file @uses a user-defined module as well as @includes a top-level mixin which
emits top-level declarations.
JavaScript API
Release a @sass/types package which contains the type annotations used by
both the sass and sass-embedded package without any additional code or
dependencies.
Fix a bug where variable definitions from one imported, forwarded module
would not be passed as implicit configuration to a later imported, forwarded
module.
Breaking change: Emit declarations, childless at-rules, and comments in
the order they appear in the source even when they're interleaved with nested
rules. This obsoletes the mixed-decls deprecation.
Breaking change: The function name type() is now fully reserved for the
plain CSS function. This means that @function definitions with the name type will produce errors, while function calls will be parsed as special
function strings.
Configuring private variables using @use ... with, @forward ... with, and meta.load-css(..., $with: ...) is now deprecated. Private variables were
always intended to be fully encapsulated within the module that defines them,
and this helps enforce that encapsulation.
Fix a bug where @extend rules loaded through a mixture of @import and @use rules could fail to apply correctly.
Command-Line Interface
In --watch mode, delete the source map when the associated source file is
deleted.
Potentially breaking change:meta.inspect() (as well as other systems
that use it such as @debug and certain error messages) now emits numbers
with as high precision as is available instead of rounding to the nearest
1e⁻¹⁰ as we do when serializing to CSS. This better fits the purpose of meta.inspect(), which is to provide full information about the structure of
a Sass value.
Passing a rest argument ($arg...) before a positional or named argument when
calling a function or mixin is now deprecated. This was always outside the
specified syntax, but it was historically treated the same as passing the rest
argument at the end of the argument list whether or not that matched the
visual order of the arguments.
Allow a @forwarded module to be loaded with a configuration when that module
has already been loaded with a different configuration and the module
doesn't define any variables that would have been configured anyway.
Allow the Node package importer to load files even when there are multiple
potential resolutions, as long as those resolutions all point to the same
file.
Potentially breaking bug fix: When a plain CSS file with a top-level
nesting selector & is loaded into a nested Sass context via meta.load-css() or @import, Sass now emits plain CSS nesting rather than
incorrectly combining it with the parent selector using a descendant
combinator.
Add support for % as an expression in its own right. It will still be parsed
as the modulo operator when between two other expressions, but in any other
context it will be an expression whose value is the unquoted string %.
Consider attr() to be a special number function that can be used as a
channel in color functions.
Deprecate user-defined functions named type() so that we can eventually
support the new CSS type() function.
Fix a bug where global Sass functions whose names overlap with CSS math
functions could incorrectly be treated as CSS math functions even though they
used Sass-only features, causing compilation failures. For example, round(-$var / 2) previously threw an error but now works as intended.
No longer fully trim redundant selectors generated by @extend. This caused
unacceptable performance issues for certain heavy users of @extend. We'll
try to find a more performant way to accomplish it in the future.
Allow newlines in whitespace in the indented syntax.
Potentially breaking bug fix: Selectors with unmatched brackets now always
produce a parser error. Previously, some edge cases like [foo#{"]:is(bar"}) {a: b} would compile without error, but this was an unintentional bug.
Fix a bug in which various Color Level 4 functions weren't allowed in plain
CSS.
Fix the error message for @extend without a selector and possibly other
parsing edge-cases in contexts that allow interpolation.
Embedded Host
Fixed the implementation of the SassBoolean type to adhere to the spec,
now using a class instead of an interface.
Fix a bug where @import url("...") would crash in plain CSS files.
Improve consistency of how warnings are emitted by different parts of the
compiler. This should result in minimal user-visible changes, but different
types of warnings should now respond more reliably to flags like --quiet, --verbose, and --silence-deprecation.
@import is now officially deprecated, as are global built-in functions that
are available within built-in modules. See the Sass blog post for more
details on the deprecation process.
Embedded Host
Fix an error that would sometimes occur when deprecation warnings were
emitted when using a custom importer with the legacy API.
Changes to how selector.unify() and @extend combine selectors:
The relative order of pseudo-classes (like :hover) and pseudo-elements
(like ::before) within each original selector is now preserved when
they're combined.
Pseudo selectors are now consistently placed at the end of the combined
selector, regardless of which selector they came from. Previously, this
reordering only applied to pseudo-selectors in the second selector.
Tweak the color transformation matrices for OKLab and OKLCH to match the
newer, more accurate values in the CSS spec.
Fix a slight inaccuracy case when converting to srgb-linear and display-p3.
Potentially breaking bug fix:math.unit() now wraps multiple denominator
units in parentheses. For example, px/(em*em) instead of px/em*em.
Command-Line Interface
Use @parcel/watcher to watch the filesystem when running from JavaScript and
not using --poll. This should mitigate more frequent failures users have
been seeing since version 4.0.0 of Chokidar, our previous watching tool, was
released.
JS API
Fix SassColor.interpolate() to allow an undefined options parameter, as
the types indicate.
Embedded Sass
Properly pass missing color channel values to and from custom functions.
Update the $channel parameter in the suggested replacement for color.red(), color.green(), color.blue(), color.hue(), color.saturation(), color.lightness(), color.whiteness(), and color.blackness() to use a quoted string.
Add a $space parameter to the suggested replacement for color.red(), color.green(), color.blue(), color.hue(), color.saturation(), color.lightness(), color.whiteness(), and color.blackness().
Update deprecation warnings for the legacy JS API to include a link to relevant documentation.
Breaking change: Passing a number with unit % to the $alpha parameter
of color.change(), color.adjust(), change-color(), and adjust-color()
is now interpreted as a percentage, instead of ignoring the unit. For example, color.change(red, $alpha: 50%) now returns rgb(255 0 0 / 0.5).
Potentially breaking compatibility fix: Sass no longer rounds RGB channels
to the nearest integer. This means that, for example, rgb(0 0 1) != rgb(0 0 0.6). This matches the latest version of the CSS spec and browser behavior.
Potentially breaking compatibility fix: Passing large positive or negative
values to color.adjust() can now cause a color's channels to go outside that
color's gamut. In most cases this will currently be clipped by the browser and
end up showing the same color as before, but once browsers implement gamut
mapping it may produce a different result.
Add support for CSS Color Level 4 color spaces. Each color value now tracks
its color space along with the values of each channel in that color space.
There are two general principles to keep in mind when dealing with new color
spaces:
With the exception of legacy color spaces (rgb, hsl, and hwb), colors
will always be emitted in the color space they were defined in unless
they're explicitly converted.
The color.to-space() function is the only way to convert a color to
another color space. Some built-in functions may do operations in a
different color space, but they'll always convert back to the original space
afterwards.
rgb colors can now have non-integer channels and channels outside the normal
gamut of 0-255. These colors are always emitted using the rgb() syntax so
that modern browsers that are being displayed on wide-gamut devices can
display the most accurate color possible.
Add support for all the new color syntax defined in Color Level 4, including:
oklab(), oklch(), lab(), and lch() functions;
a top-level hwb() function that matches the space-separated CSS syntax;
and a color() function that supports the srgb, srgb-linear, display-p3, a98-rgb, prophoto-rgb, rec2020, xyz, xyz-d50, and xyz-d65 color spaces.
Add new functions for working with color spaces:
color.to-space($color, $space) converts $color to the given $space. In
most cases this conversion is lossless—the color may end up out-of-gamut for
the destination color space, but browsers will generally display it as best
they can regardless. However, the hsl and hwb spaces can't represent
out-of-gamut colors and so will be clamped.
color.channel($color, $channel, $space: null) returns the value of the
given $channel in $color, after converting it to $space if necessary.
It should be used instead of the old channel-specific functions such as color.red() and color.hue().
color.same($color1, $color2) returns whether two colors represent the same
color even across color spaces. It differs from $color1 == $color2 because == never consider colors in different (non-legacy) spaces as equal.
color.is-in-gamut($color, $space: null) returns whether $color is
in-gamut for its color space (or $space if it's passed).
color.to-gamut($color, $space: null) returns $color constrained to its
space's gamut (or to $space's gamut, if passed). This is generally not
recommended since even older browsers will display out-of-gamut colors as
best they can, but it may be necessary in some cases.
color.space($color): Returns the name of $color's color space.
color.is-legacy($color): Returns whether $color is in a legacy color
space (rgb, hsl, or hwb).
color.is-powerless($color, $channel, $space: null): Returns whether the
given $channel of $color is powerless in $space (or its own color
space). A channel is "powerless" if its value doesn't affect the way the
color is displayed, such as hue for a color with 0 chroma.
color.is-missing($color, $channel): Returns whether $channel's value is
missing in $color. Missing channels can be explicitly specified using the
special value none and can appear automatically when color.to-space()
returns a color with a powerless channel. Missing channels are usually
treated as 0, except when interpolating between two colors and in color.mix() where they're treated as the same value as the other color.
Update existing functions to support color spaces:
hsl() and color.hwb() no longer forbid out-of-bounds values. Instead,
they follow the CSS spec by clamping them to within the allowed range.
color.change(), color.adjust(), and color.scale() now support all
channels of all color spaces. However, if you want to modify a channel
that's not in $color's own color space, you have to explicitly specify the
space with the $space parameter. (For backwards-compatibility, this
doesn't apply to legacy channels of legacy colors—for example, you can still
adjust an rgb color's saturation without passing $space: hsl).
color.mix() and color.invert() now support the standard CSS algorithm
for interpolating between two colors (the same one that's used for gradients
and animations). To use this, pass the color space to use for interpolation
to the $method parameter. For polar color spaces like hsl and oklch,
this parameter also allows you to specify how hue interpolation is handled.
color.complement() now supports a $space parameter that indicates which
color space should be used to take the complement.
color.grayscale() now operates in the oklch space for non-legacy colors.
color.ie-hex-str() now automatically converts its color to the rgb space
and gamut-maps it so that it can continue to take colors from any color
space.
The following functions are now deprecated, and uses should be replaced with
the new color-space-aware functions defined above:
The color.red(), color.green(), color.blue(), color.hue(), color.saturation(), color.lightness(), color.whiteness(), and color.blackness() functions, as well as their global counterparts, should
be replaced with calls to color.channel().
The global adjust-hue(), saturate(), desaturate(), lighten(), darken(), transaprentize(), fade-out(), opacify(), and fade-in()
functions should be replaced by color.adjust() or color.scale().
Add a global-builtin future deprecation, which can be opted-into with the --future-deprecation flag or the futureDeprecations option in the JS or
Dart API. This emits warnings when any global built-in functions that are
now available in sass: modules are called. It will become active by default
in an upcoming release alongside the @import deprecation.
Dart API
Added a ColorSpace class which represents the various color spaces defined
in the CSS spec.
Added SassColor.space which returns a color's color space.
Added SassColor.channels and .channelsOrNull which returns a list
of channel values, with missing channels converted to 0 or exposed as null,
respectively.
Added SassColor.isLegacy, .isInGamut, .channel(), .isChannelMissing(), .isChannelPowerless(), .toSpace(), .toGamut(), .changeChannels(), and .interpolate() which do the same thing as the Sass functions of the
corresponding names.
SassColor.rgb() now allows out-of-bounds and non-integer arguments.
SassColor.hsl() and .hwb() now allow out-of-bounds arguments.
Deprecated SassColor.red, .green, .blue, .hue, .saturation, .lightness, .whiteness, and .blackness in favor of SassColor.channel().
Deprecated SassColor.changeRgb(), .changeHsl(), and .changeHwb() in
favor of SassColor.changeChannels().
Added SassNumber.convertValueToUnit() as a shorthand for SassNumber.convertValue() with a single numerator.
Added InterpolationMethod and HueInterpolationMethod which collectively
represent the method to use to interpolate two colors.
JS API
While the legacy API has been deprecated since we released the modern API, we
now emit warnings when the legacy API is used to make sure users are aware
that it will be removed in Dart Sass 2.0.0. In the meantime, you can silence
these warnings by passing legacy-js-api in silenceDeprecations when using
the legacy API.
Modify SassColor to accept a new space option, with support for all the
new color spaces defined in Color Level 4.
Add SassColor.space which returns a color's color space.
Add SassColor.channels and .channelsOrNull which returns a list of channel
values, with missing channels converted to 0 or exposed as null, respectively.
Add SassColor.isLegacy, .isInGamut(), .channel(), .isChannelMissing(), .isChannelPowerless(), .toSpace(), .toGamut(), .change(), and .interpolate() which do the same thing as the Sass functions of the
corresponding names.
Deprecate SassColor.red, .green, .blue, .hue, .saturation, .lightness, .whiteness, and .blackness in favor of SassColor.channel().
Embedded Sass
Add Color SassScript value, with support for all the new color spaces
defined in Color Level 4.
Remove RgbColor, HslColor and HwbColor SassScript values.
The meta.feature-exists function is now deprecated. This deprecation is
named feature-exists.
Fix a crash when using @at-root without any queries or children in the
indented syntax.
JS API
Backport the deprecation options (fatalDeprecations, futureDeprecations,
and silenceDeprecations) to the legacy JS API. The legacy JS API is itself
deprecated, and you should move off of it if possible, but this will allow
users of bundlers and other tools that are still using the legacy API to
still control deprecation warnings.
Fix a bug where accessing SourceSpan.url would crash when a relative URL was
passed to the Sass API.
Embedded Sass
Explicitly expose a sass executable from the sass-embedded npm package.
This was intended to be included in 1.63.0, but due to the way
platform-specific dependency executables are installed it did not work as
intended. Now users can run npx sass for local installs or just sass when sass-embedded is installed globally.
Add linux-riscv64, linux-musl-riscv64, and android-riscv64 support for the sass-embedded npm package.
Fix an edge case where the Dart VM could hang when shutting down when requests
were in flight.
Fix a race condition where the embedded host could fail to shut down if it was
closed around the same time a new compilation was started.
Fix a bug where parse-time deprecation warnings could not be controlled by
the deprecation options in some circumstances.
Declarations that appear after nested rules are deprecated, because the
semantics Sass has historically used are different from the semantics
specified by CSS. In the future, Sass will adopt the standard CSS semantics.
Potentially breaking bug fix:// in certain places such as unknown
at-rule values was being preserved in the CSS output, leading to potentially
invalid CSS. It's now properly parsed as a silent comment and omitted from the
CSS output.
Deprecation.duplicateVariableFlags has been deprecated and replaced with Deprecation.duplicateVarFlags to make it consistent with the duplicate-var-flags name used on the command line and in the JS API.
Throw errors for misplaced statements in keyframe blocks.
Mixins and functions whose names begin with -- are now deprecated for
forwards-compatibility with the in-progress CSS functions and mixins spec.
This deprecation is named css-function-mixin.
Fix a bug in which stylesheet canonicalization could be cached incorrectly
when custom importers or the Node.js package importer made decisions based on
the URL of the containing stylesheet.
JS API
Allow importer to be passed without url in StringOptionsWithImporter.
For more information about pkg: importers, see the
announcement on the Sass blog.
Command-Line Interface
Add a --pkg-importer flag to enable built-in pkg: importers. Currently
this only supports the Node.js package resolution algorithm, via --pkg-importer=node. For example, @use "pkg:bootstrap" will load node_modules/bootstrap/scss/bootstrap.scss.
JavaScript API
Add a NodePackageImporter importer that can be passed to the importers
option. This loads files using the pkg: URL scheme according to the Node.js
package resolution algorithm. For example, @use "pkg:bootstrap" will load node_modules/bootstrap/scss/bootstrap.scss. The constructor takes a single
optional argument, which indicates the base directory to use when locating node_modules directories. It defaults to path.dirname(require.main.filename).
Dart API
Add a NodePackageImporter importer that can be passed to the importers
option. This loads files using the pkg: URL scheme according to the Node.js
package resolution algorithm. For example, @use "pkg:bootstrap" will load node_modules/bootstrap/scss/bootstrap.scss. The constructor takes a single
argument, which indicates the base directory to use when locating node_modules directories.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (automation)
Scope: Diff is limited to web/package.json (sass~1.32.12 → ~1.99.0) and web/package-lock.json regeneration. No application, API, or auth code changed.
Findings: None rated medium or higher with a credible exploit path tied to this PR.
Rationale:
sass is a devDependency used at build time to compile stylesheets; it is not part of the shipped runtime attack surface in the same way as server handlers or client bundles processing untrusted input.
The change is a mainline dependency bump on the official sass package (supply-chain posture unchanged vs. any other npm install from the registry).
Public advisory snapshots (e.g. Snyk) report no known direct vulnerabilities on sass@1.99.0 at review time; no separate CVE-backed issue was identified that is introduced by this bump.
Prior threads: Previous automation security-review threads were cleared so this assessment is the active one.
Slack-ready one-liner: PR #3787 (sass ~1.99.0): no medium+ security findings — dev-only compiler bump + lockfile; no auth/injection/sink changes in diff.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (sass ~1.99.0)
Scope: Diff is limited to web/package.json (sass devDependency bump ~1.32.12 → ~1.99.0) and web/package-lock.json regeneration.
Assessment: No medium/high/critical security findings.
sass (Dart Sass) is a build-time SCSS compiler (dev: true in the lockfile). It does not run in the browser or handle untrusted remote input in production.
No application/auth/API code changed.
Known CVE literature around Sass tooling refers to legacy node-sass (different package), not sass.
Lockfile pins sass@1.99.0 with npm integrity — routine supply-chain hygiene for a dependency bump.
Prior automation security-review threads are cleared so this assessment is the active one.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (automation)
Scope:web/package.json bumps sass from ~1.32.12 to ~1.99.0; web/package-lock.json is regenerated. No application source, API, or auth code changed.
Findings: None at medium or above with a plausible production attack path tied to this diff.
Analysis (concise):
Runtime exposure:sass is a devDependency used at build time (Vue CLI + sass-loader) to compile repo-controlled .scss / <style lang="scss"> sources. It is not part of the shipped browser bundle as an executable compiler; there is no new attacker-controlled sink in deployed code from this change alone.
Supply chain: Version resolves to the published sass package on the npm registry with standard lockfile integrity semantics; no substitution or postinstall script change was identified in the edited manifest lines beyond the declared sass range bump.
npm audit (baseline vs PR head): Compared npm audit metadata using base vs head package.json + package-lock.json; vulnerability counts are unchanged (44 total: 17 high, 18 moderate, 9 low, 0 critical). No new advisory surface attributable to this bump was established.
Prior automation threads are cleared via cleanup_previous so this assessment is the active one. Re-open if future commits add non–dev-only dependency changes or application code.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (automation)
Scope:web/package.json — sass devDependency ~1.32.12 → ~1.100.0, plus regenerated web/package-lock.json.
Outcome: No medium, high, or critical issues identified in added or modified code paths.
Rationale: Changes are limited to a dev-time stylesheet compiler and its transitive lockfile entries. There is no new application logic, no new network sinks, and no auth/permission surface. The resolved sass tarball uses the official npm registry URL with subresource integrity, which is the expected supply-chain control for this change.
Prior findings: No open automation threads required re-reporting; previous assessment threads were cleared so this review is the single active assessment.
Scope: This PR only updates the sass devDependency (~1.32.12 → ~1.100.0) and refreshes web/package-lock.json. There are no changes to application source, APIs, auth, or runtime configuration.
Supply chain / dependency boundary:sass is a build-time tool (SCSS → CSS) and is not shipped to end users as part of the production JS bundle in the usual Vue/webpack setup. A programmatic comparison of the lockfile shows no version or integrity changes for any packages entry that is not marked dev: true—production dependency pins are unchanged; the churn is confined to the dev dependency graph.
Prior automation threads: Resolved via cleanup_previous so this assessment is the single active automation review.
Residual risk (informational, below reporting threshold): Any npm install / CI build still trusts the npm registry and lockfile integrity; that is unchanged in kind from the pre-PR baseline, not a new vulnerability introduced here.
Verdict: No medium, high, or critical issues introduced by this change.
What changed:sass (~1.32.12 → ~1.100.0) under devDependencies in web/package.json, plus a large mechanical refresh of web/package-lock.json (same lockfileVersion: 2). No application or server code was modified.
Why this is low risk: The sass package is Dart Sass used only at build time to compile SCSS. It is not part of the runtime attack surface for deployed users. There is no plausible external attacker path (injection, auth bypass, SSRF, etc.) tied solely to this version bump without also controlling the repository or build environment.
Prior threads: Earlier automation findings were cleared so this assessment is the single active security review for this run.
Inline findings: None (no diff lines warrant severity-tagged security comments).
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (sass ~1.100.0)
Scope: Diff is limited to web/package.json (sass devDependency ~1.32.12 → ~1.100.0) and web/package-lock.json regeneration. No application, API, auth, or server code changed.
Assessment: No medium, high, or critical security findings tied to this PR.
Rationale:
sass (Dart Sass) is a devDependency used only at build time via sass-loader / Vue CLI to compile repository SCSS (e.g. main.scss, Vuetify imports). It is not a runtime handler for untrusted user input.
Resolved package is official npm (registry.npmjs.org/sass/-/sass-1.100.0.tgz) with a valid integrity hash; no non-registry sources introduced for sass.
New sass transitive deps (chokidar, immutable, source-map-js; optional @parcel/watcher) are standard, reputable packages for file watching / compilation—still confined to the developer build path.
sass@1.100.0 has no known direct CVEs in public advisory databases at review time; npm audit did not flag sass for this bump (other lockfile advisories are unchanged/pre-existing and outside this diff’s exploit path).
Prior automation assessments were validated; no prior inline finding threads remain open. No credible injection, authz bypass, SSRF, XSS, or secret-exposure path was identified from this change alone.
Slack-ready one-liner: PR #3787 (sass ~1.100.0): no medium+ security findings — dev-only CSS compiler bump + lockfile; no auth/injection/sink changes in diff.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (sass ~1.100.0)
Scope:web/package.json bumps sass devDependency ~1.32.12 → ~1.100.0; web/package-lock.json is regenerated. No application, API, auth, or server code changed.
Assessment: No medium, high, or critical security findings tied to this PR.
Rationale:
sass (Dart Sass) is a devDependency (dev: true in the lockfile) used only at build time via Vue CLI / sass-loader to compile repository-controlled SCSS. It is not a runtime handler for untrusted remote input.
Resolved artifact is the official npm package (registry.npmjs.org/sass/-/sass-1.100.0.tgz) with a valid integrity hash; no alternate registry sources for sass.
Production dependency pins are unchanged (0 non-dev lockfile entries with version/integrity diffs between base and head).
npm audit reports no advisories on sass for this tree; remaining audit items are pre-existing dev-toolchain noise, not introduced exploit paths from this diff.
Prior automation assessments were re-validated; no prior inline finding threads remain open. No credible injection, authz bypass, SSRF, XSS, path traversal, or secret-exposure path from this change alone.
Inline findings: None.
Slack-ready one-liner: PR #3787 (sass ~1.100.0): no medium+ security findings — dev-only CSS compiler bump + lockfile; no auth/injection/sink changes in diff.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (sass ~1.100.0)
Scope:web/package.json bumps sass devDependency ~1.32.12 → ~1.100.0; web/package-lock.json is regenerated. No application, API, auth, or server code changed.
Assessment: No medium, high, or critical security findings tied to this PR.
Rationale:
sass (Dart Sass) is a devDependency (dev: true in the lockfile) used only at build time via Vue CLI / sass-loader to compile repository-controlled SCSS. It is not a runtime handler for untrusted remote input.
Resolved artifact is the official npm package (registry.npmjs.org/sass/-/sass-1.100.0.tgz) with a valid integrity hash; no alternate registry sources for sass.
Production dependency pins are unchanged (0 non-dev lockfile entries with version/integrity diffs between base and head).
New transitive dev packages (chokidar, immutable, source-map-js, optional @parcel/watcher) are standard build-tooling dependencies; they do not expand the deployed runtime attack surface.
No credible injection, authz bypass, SSRF, XSS, path traversal, or secret-exposure path from this change alone.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (sass ~1.100.0)
Scope:web/package.json bumps sass devDependency ~1.32.12 → ~1.100.0; web/package-lock.json is regenerated. No application, API, auth, or server code changed.
Assessment: No medium, high, or critical security findings tied to this PR.
Rationale:
sass (Dart Sass) is a devDependency (dev: true in the lockfile) used only at build time via Vue CLI / sass-loader to compile repository-controlled SCSS. It is not a runtime handler for untrusted remote input.
Resolved artifact is the official npm package (registry.npmjs.org/sass/-/sass-1.100.0.tgz) with a valid integrity hash; no alternate registry sources for sass.
Production dependency pins are unchanged (0 non-dev lockfile entries with version/integrity diffs between base and head).
New transitive dev packages (immutable@5.1.6, chokidar, source-map-js, optional @parcel/watcher) are standard build-tooling dependencies; immutable is at a patched version (≥5.1.5) for the prior prototype-pollution advisory fixed in sass ≥1.98.0.
npm audit vulnerability counts are unchanged between base and head lockfiles (47 total); no advisories target sass or its new transitive deps in this tree.
No credible injection, authz bypass, SSRF, XSS, path traversal, or secret-exposure path from this change alone.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (sass ~1.101.0)
Scope:web/package.json bumps sass devDependency ~1.32.12 → ~1.101.0; web/package-lock.json is regenerated. No application, API, auth, or server code changed.
Assessment: No medium, high, or critical security findings tied to this PR.
Rationale:
sass (Dart Sass) is a devDependency (dev: true in the lockfile) used only at build time via Vue CLI / sass-loader to compile repository-controlled SCSS. It is not a runtime handler for untrusted remote input.
Resolved artifact is the official npm package (registry.npmjs.org/sass/-/sass-1.101.0.tgz) with a valid integrity hash; no alternate registry sources for sass.
Production dependency pins are unchanged (0 non-dev lockfile entries with version/integrity diffs between base and head).
Transitive dev deps (immutable@5.1.6, chokidar@5.0.0, source-map-js, optional @parcel/watcher) are standard build-tooling; immutable is at a patched version (≥5.1.5) for the prior prototype-pollution advisory fixed in sass ≥1.98.0.
npm audit vulnerability counts are unchanged between base and head lockfiles (49 total); no advisories target sass or its new transitive deps in this tree.
No credible injection, authz bypass, SSRF, XSS, path traversal, or secret-exposure path from this change alone.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (sass ~1.101.0)
Scope:web/package.json bumps sass devDependency ~1.32.12 → ~1.101.0; web/package-lock.json is regenerated. No application, API, auth, or server code changed.
Assessment: No medium, high, or critical findings.
sass is a devDependency used only at build time (vue-cli-service build via sass-loader). Compiled styles come from trusted repo sources (src/assets/scss/, Vuetify imports); there is no runtime path where attacker-controlled input reaches the Sass compiler in the deployed product.
Lockfile analysis shows 39 package version changes, all confined to the sass upgrade and new transitive deps (immutable@5.1.6, chokidar@5.0.0, optional @parcel/watcher@2.5.6). No unrelated production dependency drift.
This bump remediates transitive CVE-2026-29063 (prototype pollution in immutable) by pulling sass ≥ 1.98.0 with patched immutable@5.1.6. Residual build-time risk is limited to CI/developer machines compiling trusted sources.
New native optional dep @parcel/watcher is used for Sass --watch during development only; it is not invoked in production builds and does not expand the runtime attack surface.
Prior findings: No unresolved automation threads; previous assessments remain valid for this revision.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (sass ~1.101.0)
Scope:web/package.json bumps sass devDependency ~1.32.12 → ~1.101.0; web/package-lock.json is regenerated. No application, API, auth, or server code changed.
Assessment: No medium, high, or critical findings.
sass (Dart Sass) is a devDependency (dev: true in the lockfile) used only at build time via Vue CLI / sass-loader to compile repository-controlled SCSS. It is not a runtime handler for untrusted remote input in the deployed product.
Lockfile resolves the official npm artifact (registry.npmjs.org/sass/-/sass-1.101.0.tgz) with a valid integrity hash; 0 production dependency version/integrity changes between base and head.
Transitive dev deps (immutable@5.1.6, chokidar@5.0.0, source-map-js, optional @parcel/watcher) are standard build-tooling; immutable is at a patched version (≥5.1.5).
npm audit vulnerability counts are unchanged between base and head lockfiles (48 total: 1 critical, 14 high, 27 moderate, 6 low); no advisories target sass or its new transitive deps in this tree.
No credible injection, authz bypass, SSRF, XSS, path traversal, or secret-exposure path from this change alone.
Prior automation assessments: Re-validated on head a1168ddd; no unresolved inline finding threads.
Inline findings: None.
Slack-ready one-liner: PR #3787 (sass ~1.101.0): no medium+ security findings — dev-only CSS compiler bump + lockfile; no auth/injection/sink changes in diff.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (sass ~1.104.0)
Outcome: No medium, high, or critical findings.
Scope:web/package.json bumps sass devDependency ~1.32.12 → ~1.104.0; web/package-lock.json is regenerated. No application, API, auth, or server code changed.
Assessment:
sass is a build-time devDependency used by sass-loader / Vue CLI to compile SCSS/SASS during frontend builds. It is not shipped to production or exposed to runtime attacker-controlled input.
Usage in the repo is limited to static @import directives in Vue SFCs (App.vue, Settings.vue); no dynamic or user-supplied Sass input.
sass@1.104.0 has no known direct CVEs in public vulnerability databases (Snyk, npm advisory DB).
Transitive dependency changes (chokidar 3→5, plus immutable, source-map-js) are build-time tooling only; no plausible attack path to production.
Prior automation reviews (through ~1.101.0) reported no findings; re-validation on ~1.104.0 reaches the same conclusion.
Prior threads: No unresolved inline security findings from earlier runs.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (sass ~1.104.0)
Outcome: No medium, high, or critical findings.
Scope:web/package.json bumps sass devDependency ~1.32.12 → ~1.104.0; web/package-lock.json is regenerated. No application, API, auth, or server code changed.
Prior threads: No unresolved automation inline threads; prior assessments reached the same conclusion and are cleared.
Assessment:
sass (Dart Sass) is a devDependency (dev: true) used only at build time via Vue CLI / sass-loader to compile repository-controlled SCSS (e.g. src/assets/scss/, Vuetify imports). It is not shipped to production and does not process untrusted remote input.
Lockfile resolves the official npm artifact (registry.npmjs.org/sass/-/sass-1.104.0.tgz) with valid integrity; 0 production dependency version/integrity changes between base and head.
sass@1.104.0 and new transitive deps (chokidar@5, immutable, source-map-js, optional @parcel/watcher) have no known CVEs (Snyk/npm advisory databases); npm audit reports no sass-related vulnerabilities.
No plausible attack path (injection, auth bypass, SSRF, XSS, path traversal, unsafe deserialization) is introduced by this diff alone.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (sass ~1.104.0)
Outcome: No medium, high, or critical findings.
Scope:web/package.json bumps sass devDependency ~1.32.12 → ~1.104.0; web/package-lock.json is regenerated. No application, API, auth, or server code changed.
Assessment:
sass is a build-time devDependency (consumed by sass-loader / Vue CLI during frontend compilation). It is not shipped in the production Semaphore binary and does not process attacker-controlled runtime input.
Lockfile delta is limited to sass1.32.13 → 1.104.0 and its new transitive deps (immutable, optional @parcel/watcher native bindings, nested chokidar@5 / readdirp@5). Production dependencies are unchanged.
No known CVEs in sass@1.104.0, @parcel/watcher@2.6.0, or chokidar@5.0.0 (Snyk/advisory DB checks).
@parcel/watcher has an install script for optional native compilation; this is expected for file-watching during dev builds and does not expand the deployed attack surface.
Prior automation threads: None with open inline findings; previous no-finding assessments remain valid for this bump.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (sass ~1.104.0)
Outcome: No medium, high, or critical findings.
Scope:web/package.json bumps sass devDependency (~1.32.12 → ~1.104.0); web/package-lock.json is regenerated. No application, API, auth, or server code changed.
Assessment:
sass is a build-time devDependency consumed by sass-loader / Vue CLI during frontend compilation. It does not ship to production or process runtime user input.
SCSS sources are developer-controlled project files (e.g. Vuetify style imports); there is no attacker-controlled input path to the Sass compiler.
Lockfile adds optional @parcel/watcher (dev-only file watcher for faster rebuilds). This is also confined to the build/dev toolchain.
No known direct CVEs for sass@1.104.0 (Snyk/npm advisory databases report none).
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (sass ~1.104.0)
Outcome: No medium, high, or critical findings.
Scope:web/package.json bumps sass devDependency (~1.32.12 → ~1.104.0); web/package-lock.json is regenerated. No application, API, auth, or server code changed.
Prior threads: No unresolved automation inline threads; prior top-level assessments re-validated on this revision (a566da4).
Assessment:
Runtime exposure:sass is a build-time devDependency (dev: true) consumed by sass-loader / Vue CLI to compile repository-controlled SCSS (e.g. <style lang="scss"> in .vue files). It is not bundled into the production Semaphore UI runtime and does not process untrusted remote input in deployed code.
Supply chain: Resolved artifact is the official npm package (registry.npmjs.org/sass/-/sass-1.104.0.tgz) with a valid integrity hash. Lockfile comparison shows 0 production dependency version/integrity changes between base and head; all churn is confined to the dev dependency graph (20 dev-only entries, including transitive chokidar@5, immutable@5.1.9, source-map-js, optional @parcel/watcher@2.6.0).
Advisories:npm audit reports 0 sass-related vulnerabilities in the current lockfile.
Attack paths reviewed: No plausible injection, auth bypass, SSRF, XSS, path traversal, or deserialization paths are introduced by this diff alone; exploitation would require compromising the build environment or repository sources, which is outside the scope of this dependency bump.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (sass ~1.104.0)
Outcome: No medium, high, or critical findings.
Scope:web/package.json bumps sass devDependency (~1.32.12 → ~1.104.0); web/package-lock.json is regenerated. No application, API, auth, or runtime code changed.
Assessment:
sass is a build-time devDependency consumed by sass-loader / Vue CLI during frontend compilation; it is not shipped to production runtime.
No direct sass API usage in application code; SCSS is limited to static @import in .vue files compiled at build time.
Resolved sass@1.104.0 matches the declared range; lockfile integrity hashes are present.
New transitive deps (chokidar@5, immutable@5, optional @parcel/watcher) are dev-only file-watcher / compiler support with no known CVEs at these versions.
No attacker-controlled input path to a dangerous sink was introduced by this diff.
Prior threads: No unresolved inline security findings from earlier automation runs; this assessment supersedes prior top-level reviews.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (sass ~1.104.0)
Outcome: No medium, high, or critical findings.
Scope:web/package.json bumps sass devDependency (~1.32.12 → ~1.104.0); web/package-lock.json is regenerated. No application, API, auth, or server code changed.
Assessment:
sass is a build-time devDependency consumed by sass-loader / Vue CLI during frontend compilation; it is not bundled into or executed by the production Semaphore server.
Lockfile delta is limited to the sass subtree (20 version changes): sass 1.32.13 → 1.104.0, plus transitive deps (immutable 5.1.9, chokidar 5.x, optional @parcel/watcher). No unrelated package version bumps.
Transitive immutable is at 5.1.9 (≥ 5.1.5), addressing CVE-2026-29063; regardless, there is no attacker-controlled input path to immutable merge APIs at runtime.
No injection, authn/authz, SSRF, XSS, path traversal, secret leakage, or unsafe deserialization surfaces were introduced in added/modified code.
Prior threads: No unresolved automation findings; previous assessments remain valid for this revision.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (sass ~1.104.0)
Outcome: No medium, high, or critical findings.
Scope:web/package.json bumps sass devDependency ~1.32.12 → ~1.104.0; web/package-lock.json is regenerated (adds optional @parcel/watcher, immutable, chokidar@5, source-map-js). No application, API, auth, or server code changed.
Prior threads: No unresolved automation inline threads on this PR; prior runs reached the same conclusion.
Assessment:
sass is a build-time-only devDependency (dev: true) consumed by sass-loader / Vue CLI during npm run build and npm run serve. It is not shipped in the production JS bundle.
Input boundary: SCSS sources are repository-controlled static files (src/assets/scss/main.scss, Vuetify imports). There is no runtime path from attacker-controlled input to the Sass compiler.
Supply chain:sass@1.104.0 resolves from registry.npmjs.org with a lockfile integrity hash. New transitive packages are also dev-only. Known Sass CVEs (e.g. CVE-2022-43357/43358) affect deprecated LibSass, not Dart Sass.
No new sinks: No changes to injection, SSRF, authn/authz, deserialization, or secret-handling code paths.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (sass ~1.104.0)
Outcome: No medium, high, or critical findings.
Scope:web/package.json bumps sass devDependency ~1.32.12 → ~1.104.0; web/package-lock.json is regenerated (adds/updates transitive dev-only deps: immutable, chokidar@5, optional @parcel/watcher platform packages). No application, API, auth, or server code changed.
Prior threads: No unresolved automation inline threads; prior assessments remain valid for this bump.
Assessment:
sass is a build-time-only devDependency consumed by sass-loader / Vue CLI during npm run build and npm run serve. Compiled SCSS sources are repository-controlled static files (e.g. Vuetify imports); there is no production runtime path from attacker-controlled input to the Sass compiler.
No direct require('sass') usage in application code; usage is limited to webpack/sass-loader at build time.
Lockfile entries resolve from registry.npmjs.org with integrity hashes; no typosquat or alternate registry introduced.
npm audit reports no advisories for sass, chokidar, immutable, or @parcel/watcher. Snyk also reports no known direct vulnerabilities for sass 1.104.x.
Supply-chain note: Optional @parcel/watcher includes native install scripts, but this is standard for Dart Sass file watching and is not exposed to untrusted input in this project's build pipeline.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (sass ~1.104.0)
Outcome: No medium, high, or critical findings.
Scope:web/package.json bumps sass devDependency ~1.32.12 → ~1.104.0; web/package-lock.json is regenerated (resolves sass@1.104.1, optional @parcel/watcher, nested chokidar@5). No application, API, auth, or server code changed.
Prior threads: Earlier automation runs reported no actionable issues; re-validated on this revision — still no attacker-controlled input path to a new sink.
Assessment:
sass remains under devDependencies and is consumed at build time (sass-loader / Vue CLI npm run build); compiled CSS is what ships — no runtime exposure of the Sass compiler in the Semaphore server image.
Lockfile adds optional native @parcel/watcher (hasInstallScript: true) for faster rebuilds in dev/CI; this affects install/build hosts only, not deployed app users, and does not introduce a plausible product attack path without compromise of the npm registry or build pipeline (pre-existing supply-chain posture).
No injection, authz, SSRF, XSS, deserialization, or secret-handling changes in this diff.
No inline comments — nothing to flag at medium+ confidence.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (sass ~1.104.0)
Outcome: No medium, high, or critical findings.
Scope:web/package.json bumps sass devDependency ~1.32.12 → ~1.104.0; web/package-lock.json is regenerated (resolves sass@1.104.1, adds optional @parcel/watcher, immutable, nested chokidar@5). No application, API, auth, or server code changed.
Prior threads: No unresolved automation inline findings; prior assessments remain valid for this dependency-only change.
Assessment:
Attack surface:sass is a build-time devDependency (dev: true) used via Vue CLI / sass-loader on repository-controlled SCSS/Sass. There is no direct sass import in app code and no runtime path where remote users supply input to the compiler in production.
Lockfile boundary:0 production (dev: false) package version/integrity changes between base and head; churn is confined to the dev dependency graph.
Supply chain:sass and new transitives resolve from registry.npmjs.org with npm integrity hashes; npm audit reports 0 sass-related advisories; OSV has no known issues for sass@1.104.1.
Optional @parcel/watcher (hasInstallScript: true) only affects developer/CI install on supported platforms; it does not expand the deployed product attack surface.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (sass ~1.105.0)
Outcome: No medium, high, or critical findings.
Scope:web/package.json bumps sass devDependency ~1.32.12 → ~1.105.0; web/package-lock.json is regenerated (resolves sass@1.105.0, nested chokidar@5, immutable, optional @parcel/watcher platform packages). No application, API, auth, or server code changed.
Prior threads: No unresolved automation inline threads; prior runs reported the same no-finding conclusion for earlier sass bumps on this PR.
Assessment:
Attack surface:sass is a build-time SCSS compiler (dev: true) invoked via Vue CLI / sass-loader on repository-controlled static sources. There is no production runtime path from untrusted user input to the Sass compiler.
Supply chain: Packages resolve from registry.npmjs.org with lockfile integrity hashes; npm audit reports no advisories tied to sass / new transitive deps in this bump.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (sass ~1.105.0)
Outcome: No medium, high, or critical findings.
Scope:web/package.json bumps sass devDependency ~1.32.12 → ~1.105.0; web/package-lock.json is regenerated (resolves sass@1.105.0, optional @parcel/watcher, updated chokidar/immutable/source-map-js transitives). No application, API, auth, or server code changed.
Assessment:
sass remains under devDependencies and is consumed only via the Vue CLI build chain (sass-loader / vue-cli-service build|serve), not shipped to end users or invoked on attacker-controlled input at runtime.
Lockfile entries retain npm integrity hashes; no new runtime dependency surface in production bundles from this diff.
Prior automation threads reported no exploitable paths; re-validated on head 5f409810 — no unresolved inline security findings.
Supply chain note (informational, below reporting threshold): Sass 1.105.x raises the Node engine to >=20.19.0 and may install optional native @parcel/watcher during npm ci on developer/CI hosts. That affects build ergonomics, not Semaphore’s deployed attack surface, absent compromise of the npm registry or build pipeline.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (sass ~1.105.0)
Outcome: No medium, high, or critical findings.
Scope:web/package.json bumps sass devDependency ~1.32.12 → ~1.105.0; web/package-lock.json is regenerated (resolves sass@1.105.1, optional @parcel/watcher@2.6.0, nested chokidar@5, immutable@5.1.9, source-map-js). No application, API, auth, or server code changed.
Prior threads: No unresolved automation inline threads; prior no-finding assessments re-validated on head 486b3f1.
Assessment:
Runtime exposure:sass is a build-time devDependency (dev: true) used by Vue CLI / sass-loader on repository-controlled SCSS (static @import in .vue files, e.g. Vuetify). There is no production path from untrusted user input to the Sass compiler.
Production boundary: Lockfile comparison shows zero non-dev package version changes between base and head.
Advisories:npm audit on this branch reports 0 advisories for sass or its new transitive deps (39 total unrelated findings elsewhere).
Build config:vue.config.js has no custom Sass importers or remote loaders that would pull untrusted sources.
Supply chain: Tarballs resolve from registry.npmjs.org with integrity hashes; optional @parcel/watcher install scripts affect dev/CI hosts only, not the shipped UI bundle.
Inline findings: None.
Slack summary: PR #3787 (sass ~1.105.0): no medium+ security findings — dev-only compiler bump + lockfile; no auth/injection/runtime-sink changes in diff.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (sass ~1.105.0)
Outcome: No medium, high, or critical findings.
Scope:web/package.json bumps sass devDependency (~1.32.12 → ~1.105.0); web/package-lock.json is regenerated (resolved sass@1.105.1, optional @parcel/watcher native watcher, updated chokidar/immutable/source-map-js). No application, API, auth, or server code changed.
Prior threads: Earlier automation runs reported no actionable findings; re-validated against the current diff — nothing new to escalate.
Assessment:
sass is devDependencies-only and is consumed at build time by sass-loader / Vue CLI (vue-cli-service build); compiled CSS is what ships — there is no runtime path for untrusted users to supply Sass input to this package in production.
No attacker-controlled input reaches sass in the deployed Semaphore UI; exploitation would require compromising the repo or build pipeline (out of scope for this dependency-only diff).
Lockfile pins integrity for sass and new transitive packages; npm audit reports no sass-related advisories in this tree.
Optional @parcel/watcher (hasInstallScript) affects local/CI npm install only; same trusted-developer supply-chain posture as other native optional deps — not a new production attack surface.
Note: Sass now requires Node >=20.19.0 for direct CLI use; ensure CI/dev images meet that for frontend builds (operational, not a product vulnerability).
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (sass ~1.105.0)
Outcome: No medium, high, or critical findings.
Scope:web/package.json bumps sass devDependency ~1.32.12 → ~1.105.0; web/package-lock.json is regenerated (nested chokidar@5, optional @parcel/watcher native addons). No application, API, auth, or server code changed.
Assessment:
sass is devDependencies-only and is consumed at build time via sass-loader / Vue CLI (vue-cli-service build); the Go backend serves compiled static assets and does not compile SCSS from request input.
Traced usage: SCSS appears only in Vue SFC <style lang="scss"> blocks and Vuetify imports — trusted repo sources, not attacker-controlled runtime input.
Lockfile pins package integrity; npm audit reports no advisories targeting sass / @parcel/watcher in this tree.
Optional hasInstallScript on @parcel/watcher affects developer/CI install only; it does not expand production attack surface for deployed Semaphore users.
Prior automation threads: Re-validated; no unresolved medium+ issues from earlier runs apply to the current diff.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review (sass ~1.105.0)
Outcome: No medium, high, or critical findings.
Scope:web/package.json bumps sass devDependency ~1.32.12 → ~1.105.0; web/package-lock.json is regenerated (resolves sass@1.105.1, optional @parcel/watcher@2.6.0, nested chokidar@5, immutable@5.1.9, source-map-js). No application, API, auth, or server code changed.
Prior threads: No unresolved automation inline threads; prior no-finding assessments re-validated on head 112ff769.
Assessment:
Runtime exposure:sass is a build-time devDependency (dev: true) used by Vue CLI / sass-loader on repository-controlled SCSS (Vue <style lang="scss">, Vuetify imports). There is no production path from untrusted user input to the Sass compiler; vue.config.js has no custom Sass importers or remote loaders.
Production boundary: Lockfile comparison (base 0f07f813 → head 112ff769) shows 0 non-dev package version/integrity changes.
Advisories:npm audit on this lockfile has no advisories that apply to sass@1.105.x or its new transitive dev deps; existing chokidar audit noise comes from other dev tooling (webpack-dev-server, mocha, etc.), not a new production sink introduced here.
Supply chain: Tarballs resolve from registry.npmjs.org with integrity hashes. Optional @parcel/watcher (hasInstallScript) affects developer/CI npm install only, not the shipped UI bundle.
CI: Workflows use Node 24, satisfying sass’s engines.node >= 20.19.0.
Inline findings: None.
Slack summary: PR #3787 (sass ~1.105.0): no medium+ security findings — dev-only CSS compiler bump + lockfile; no auth/injection/runtime-sink changes in diff.
The reason will be displayed to describe this comment to others. Learn more.
Security review (sass ~1.105.0)
Scope: Diff is limited to web/package.json (sass devDependency ~1.32.12 → ~1.105.0) and web/package-lock.json regeneration (resolved sass@1.105.2, optional @parcel/watcher, nested chokidar@5). No application, API, auth, or runtime configuration code changed.
Findings: None rated medium or higher with a plausible attacker-controlled input path to an exploitable sink introduced by this PR.
Rationale:
sass remains a devDependency used at build time to compile stylesheets; the diff does not add server handlers, client logic, or new ways to process untrusted user input at runtime.
Lockfile entries resolve from registry.npmjs.org with integrity hashes; this is a routine mainline version bump, not a registry or source change.
npm audit on the updated tree reports no advisories targeting sass, @parcel/watcher, or immutable; the nested chokidar@5 under sass is outside the audited vulnerable range for the separate top-level chokidar finding (2.x–3.6.x via braces).
Optional native @parcel/watcher (hasInstallScript) affects install-time behavior in dev/CI only; it does not create a new production attack surface or auth boundary change in Semaphore itself.
Prior threads: No open automation inline threads; previous top-level assessments superseded by this run (cleanup_previous).
Slack-ready one-liner: PR #3787 (sass ~1.105.0): no medium+ security findings — dev-only compiler bump + lockfile; no auth/injection/runtime sink changes in diff.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
~1.32.12→~1.107.0Release Notes
sass/dart-sass (sass)
v1.107.0Compare Source
Command-Line Interface
The
--fatal-deprecationflag can now exclude deprecations that wouldotherwise be included by passing a version number. To exclude a deprecation,
add
-before its name. For example,--fatal-deprecation=1.107.0,-importincludes all deprecations that were present in Dart Sass 1.107.0 except for
the
@importdeprecation.The
--fatal-deprecationflag now takes the special valuedart-sass-2,which treats as fatal all deprecations that will become fatal in Dart Sass
2.0.0.
JavaScript API
Options.fatalDeprecationscan now take aDeprecationSelectorDifferenceobject of the form
{include: ..., except: ...}, where theincludefieldlists deprecations to mark fatal (which can be version numbers) and the
exceptfield lists deprecations not to mark fatal. Theexceptfieldtakes precedence over
include.Add a (non-enumerable)
sass.deprecations.dartSass2property which can bepassed to
Options.fatalDeprecationsto mark as fatal exactly thedeprecations that will become fatal in Dart Sass 2.0.0. This can be combined
with other deprecations or used in a
DeprecationSelectorDifferenceto modifyexactly which deprecations it covers.
Passing a version number beyond the current Dart Sass version to
Options.fatalDeprecationsis now deprecated. See the Sasswebsite for details.
Dart API
Add a
Deprecation.dartSass2property which returns exactly the set ofdeprecations that will become fatal in Dart Sass 2.0.0.
Passing a version number beyond the current Dart Sass version to
Deprecation.forVersionis now deprecated.Embedded Protocol
CompileRequest.fatal_deprecation_exceptfield which excludesdeprecations from being considered fatal if they would have been enabled by
CompileRequest.fatal_deprecation.v1.106.1Compare Source
Fix a bug where an attribute selector with an empty value (such as
[class=""]) would crash when serializing.Don't crash when serializing a number with an empty unit. This is only
possible through the JavaScript and Dart APIs or the embedded protocol.
Embedded Dart Sass
PARAMSerrors.v1.106.0Compare Source
Don't normalize CSS escapes in statement contexts that can contain
interpolation. For example,
@f\6Fois now emitted as written rather thannormalized to
@foo.Fix a bug where quotes would be removed from attribute selector values that
contained backslashes.
Fix invalid source spans that could cause crashes when encountering a syntax
error in selectors or media queries that also contain escape sequences.
Fix a bug where the indented syntax parser would crash when parsing a file
where the first statement was indented and appeared after the first line.
Fix a bug that could cause crashes when encountering errors or warnings in
interpolations that contain patterns like
// */.Potentially breaking compatibility fix: CSS escape codes whose values are
0, for Unicode surrogates, or greater than the maximum allowed code point are
now consistently normalized to U+FFFD REPLACEMENT CHARACTER in expression
contexts. Previously, in some cases these were instead normalized to the
normalized form of the original escape sequence, which violates the principle
that all escape sequences for identical values should be normalized the same
way. In other cases, these would simply throw errors.
As a special case,
\0on its own will continue to be normalized to\0tosupport historical CSS hacks.
Potentially breaking bug fix: Throw an error for mixins and functions that
have rest parameters which are the same as normal parameters. Previously, the
positional parameters wouldn't be accessible and calling such a mixin or
function with a named argument would crash the compiler.
Potentially breaking bug fix: Fix various cases where using a CSS escape
code at the beginning of an identifier would change parsing behavior versus
using the character directly.
Potentially breaking bug fix: When a number's unit is ambiguous with a
numeric exponent, the unit is now serialized as an escape code rather than a
literal
eto avoid being interpreted as an exponent by CSS.Potentially breaking bug fix: Don't parse a CSS escape code for U+45 LATIN
CAPITAL LETTER E or U+65 LATIN LOWERCASE LETTER E as an exponent in
@keyframespercentage selectors.Potentially breaking bug fix: Properly normalize underscores written as
CSS escape codes in variable, mixin, and function names.
v1.105.2Compare Source
Node.js Embedded Host
v1.105.1Compare Source
@extends across different media queries.v1.105.0Compare Source
Add support for first-class modules. These can be accessed using the new
meta.load()andmeta.get-module()functions, and may be passed as the$moduleargument to numerous eistingsass:metafunctions.Add the
meta.css()mixin, which includes CSS from a first-class module.JS API
SassModuleclass and a correspondingValue.assertModule()method.Dart API
SassModuleclass and a correspondingValue.assertModule()method.v1.104.1Compare Source
Fix a bug where loud comments before
@userules could be emitted multipletimes under certain circumstances.
Fix a bug in which an invalid selector at the end of an indented syntax
stylesheet would cause the parser to crash instead of emitting a useful error
message.
Command Line Interface
Many-to-many compilations no longer compile any files that appear in the
output directory if the output directory is also within the source directory.
This fixes a bug where
--watchmode could enter an infinite loop recompilingthe same CSS file over and over.
Sass now sets the modification time of output files to the time compilation
started rather than the time it ended. This ensures that, if a source file
is modified during compilation,
--watchand--updatemode will recompilethe outputs to include the new source file contents.
v1.104.0Compare Source
Potentially breaking compatibility fix: Colors now convert the special
values NaN and negative zero, as well as infinity and negative infinity for
polar-hue channels, to 0 as per the CSS spec.
The special value negative zero is now serialized as
-0instead of0forgreater compatibility when using it in CSS calculations.
v1.103.1Compare Source
v1.103.0Compare Source
sets" of missing channels during conversions, per the CSS spec. For example,
color.to-space(lch(50% none none), lab)now returnslab(50% none none)instead of
lab(50% 0 0).v1.102.0Compare Source
draft of CSS Color 4.
v1.101.7Compare Source
v1.101.6Compare Source
v1.101.5Compare Source
v1.101.4Compare Source
Avoid emitting
rgb()orrgba()functions with non-percent decimalchannels. Older browsers only support integer values or (potentially decimal)
percentages for these functions, so in order to preserve
backwards-compatibility while retaining full precision for modern browsers,
legacy colors that contain at least one non-integer channel will now use
percentages for their channels (for example,
rgb(0%, 100%, 50%)rather thanrgb(0, 255, 127.5)).Fix a bug where the values of plain-CSS
if()expressions were emitted usingtheir
meta.inspect()format rather than their CSS serialization format.v1.101.3Compare Source
v1.101.0Compare Source
supports resolving import-only variants of Sass files declared in the
exports,sass, andstylefields ofpackage.json. Previously, thesefiles were ignored even when loaded via
@import, so any code relying onloading module-system-only files this way may break.
v1.100.0Compare Source
Writing two compound selectors adjacent to one another without any whitespace
between them, such as
[class]a, is now deprecated. This was always an errorin CSS and Sass only supported it by mistake.
See the Sass website for
details.
v1.99.0Compare Source
Add support for parent selectors (
&) at the root of the document. These areemitted as-is in the CSS output, where they're interpreted as the scoping
root.
User-defined functions named
calcorclampare no longer forbidden. Ifsuch a function exists without a namespace in the current module, it will be
used instead of the built-in
calc()orclamp()function.User-defined functions whose names begin with
-and end with-expression,-url,-and,-or, or-notare no longer forbidden. These wereoriginally intended to match vendor prefixes, but in practice no vendor
prefixes for these functions ever existed in real browsers.
User-defined functions named
EXPRESSION,URL, andELEMENT, those thatbegin with
-and end with-ELEMENT, as well as the same names with somelowercase letters are now deprecated, These are names conflict with plain CSS
functions that have special syntax.
See the Sass website for details.
In a future release, calls to functions whose names begin with
-and endwith
-expressionand-urlwill no longer have special parsing. For now,these calls are deprecated if their behavior will change in the future.
See the Sass website for details.
Calls to functions whose names begin with
-and end with-progid:...aredeprecated.
See the Sass website for details.
v1.98.0Compare Source
Command-Line Interface
--watchmode.Dart API
const Logger.defaultLoggerfield. This provides a logger that emits tostandard error or the browser console, but automatically chooses whether to
use terminal colors.
JavaScript API
Fix a crash when manually constructing a
SassCalculationfor'calc'withan argument that can't be simplified.
Properly emit deprecation warnings as text rather than
StringBufferobjectswhen running in a browser.
Emit colored warnings and other messages on the console when running in a
browser.
v1.97.3Compare Source
could cause outer style rules to be omitted.
v1.97.2Compare Source
v1.97.1Compare Source
if()syntax where values would be evaluatedeven if their conditions didn't match.
v1.97.0Compare Source
display-p3-linearcolor space.v1.96.0Compare Source
zero denominator units) to be emitted to CSS. These are now emitted as
calc()expressions, which now support complex units in plain CSS.v1.95.1Compare Source
v1.95.0Compare Source
Add support for the CSS-style
if()function. In addition to supporting theplain CSS syntax, this also supports a
sass()query that takes a Sassexpression that evaluates to
trueorfalseat preprocessing time dependingon whether the Sass value is truthy. If there are no plain-CSS queries, the
function will return the first value whose query returns true during
preprocessing. For example,
if(sass(false): 1; sass(true): 2; else: 3)returns
2.The old Sass
if()syntax is now deprecated. Users are encouraged to migrateto the new CSS syntax.
if($condition, $if-true, $if-false)can be changed toif(sass($condition): $if-true; else: $if-false).See the Sass website for details.
Plain-CSS
if()functions are now considered "special numbers", meaning thatthey can be used in place of arguments to CSS color functions.
Plain-CSS
if()functions andattr()functions are now considered "specialvariable strings" (like
var()), meaning they can now be used in place ofmultiple arguments or syntax fragments in various CSS functions.
v1.94.3Compare Source
%expressions followed by whitespace.v1.94.2Compare Source
Command-Line Interface
--fatal-deprecation <version>no longer emits warnings aboutdeprecations that are obsolete.
Dart API
Deprecation.forVersionnow excludes obsolete deprecations from the set itreturns.
JS API
fatalDeprecationswhen aVersionispassed.
Node.js Embedded Host
async compilation.
v1.94.1Compare Source
v1.94.0Compare Source
Potentially breaking compatibility fix:
@functionrules whose namesbegin with
--are now parsed as unknown at-rules to support the plain CSS@functionrule. Within this rule, theresultproperty is parsed as rawCSS just like custom properties.
Potentially breaking compatibility fix:
@mixinrules whose names beginwith
--are now errors. These are not yet parsed as unknown at-rules becauseno browser currently supports CSS mixins.
v1.93.3Compare Source
v1.93.2Compare Source
JavaScript API
@sass/types.v1.93.1Compare Source
JavaScript API
@sass/types.v1.93.0Compare Source
@import, and the loaded file@uses a user-defined module as well as@includes a top-level mixin whichemits top-level declarations.
JavaScript API
@sass/typespackage which contains the type annotations used byboth the
sassandsass-embeddedpackage without any additional code ordependencies.
v1.92.1Compare Source
would not be passed as implicit configuration to a later imported, forwarded
module.
v1.92.0Compare Source
Breaking change: Emit declarations, childless at-rules, and comments in
the order they appear in the source even when they're interleaved with nested
rules. This obsoletes the
mixed-declsdeprecation.Breaking change: The function name
type()is now fully reserved for theplain CSS function. This means that
@functiondefinitions with the nametypewill produce errors, while function calls will be parsed as specialfunction strings.
Configuring private variables using
@use ... with,@forward ... with, andmeta.load-css(..., $with: ...)is now deprecated. Private variables werealways intended to be fully encapsulated within the module that defines them,
and this helps enforce that encapsulation.
Fix a bug where
@extendrules loaded through a mixture of@importand@userules could fail to apply correctly.Command-Line Interface
--watchmode, delete the source map when the associated source file isdeleted.
v1.91.0Compare Source
Potentially breaking change:
meta.inspect()(as well as other systemsthat use it such as
@debugand certain error messages) now emits numberswith as high precision as is available instead of rounding to the nearest
1e⁻¹⁰ as we do when serializing to CSS. This better fits the purpose of
meta.inspect(), which is to provide full information about the structure ofa Sass value.
Passing a rest argument (
$arg...) before a positional or named argument whencalling a function or mixin is now deprecated. This was always outside the
specified syntax, but it was historically treated the same as passing the rest
argument at the end of the argument list whether or not that matched the
visual order of the arguments.
v1.90.0Compare Source
@forwarded module to be loaded with a configuration when that modulehas already been loaded with a different configuration and the module
doesn't define any variables that would have been configured anyway.
v1.89.2Compare Source
Embedded Host
bufdependency.v1.89.1Compare Source
v1.89.0Compare Source
potential resolutions, as long as those resolutions all point to the same
file.
v1.88.0Compare Source
Allow custom properties with empty values (such as
--var:;).Fix a bug when calculating source spans for interpolations.
Dart and JS APIs
mixin object from one compilation to another.
Dart API
compileString()and related functions.v1.87.0Compare Source
nesting selector
&is loaded into a nested Sass context viameta.load-css()or@import, Sass now emits plain CSS nesting rather thanincorrectly combining it with the parent selector using a descendant
combinator.
v1.86.3Compare Source
a
..segment.v1.86.2Compare Source
v1.86.1Compare Source
file:URL case canonicalization on Windows andMac OS.
v1.86.0Compare Source
Add support for
%as an expression in its own right. It will still be parsedas the modulo operator when between two other expressions, but in any other
context it will be an expression whose value is the unquoted string
%.Consider
attr()to be a special number function that can be used as achannel in color functions.
Deprecate user-defined functions named
type()so that we can eventuallysupport the new CSS
type()function.Dart API
v1.85.1Compare Source
functions could incorrectly be treated as CSS math functions even though they
used Sass-only features, causing compilation failures. For example,
round(-$var / 2)previously threw an error but now works as intended.v1.85.0Compare Source
@extend. This causedunacceptable performance issues for certain heavy users of
@extend. We'lltry to find a more performant way to accomplish it in the future.
v1.84.0Compare Source
Allow newlines in whitespace in the indented syntax.
Potentially breaking bug fix: Selectors with unmatched brackets now always
produce a parser error. Previously, some edge cases like
[foo#{"]:is(bar"}) {a: b}would compile without error, but this was an unintentional bug.Fix a bug in which various Color Level 4 functions weren't allowed in plain
CSS.
Fix the error message for
@extendwithout a selector and possibly otherparsing edge-cases in contexts that allow interpolation.
Embedded Host
SassBooleantype to adhere to the spec,now using a class instead of an interface.
v1.83.4Compare Source
v1.83.3Compare Source
v1.83.2Compare Source
Properly display deprecation IDs for the JS Sass API.
Don't display deprecation IDs for user-defined deprecations.
v1.83.1Compare Source
Fix a bug where
--quiet-depswould get deactivated for@contentblocks,even when those blocks were entirely contained within dependencies.
Include deprecation IDs in deprecation warnings to make it easier to determine
what to pass to
--silence-deprecationor--fatal-deprecation.v1.83.0Compare Source
v1.82.0Compare Source
Command-Line Interface
Improve
--watchmode reliability when making multiple changes at once, suchas checking out a different Git branch.
Parse the
calc-size()function as a calculation now that it's supported insome browsers.
Dart API
SassCalculation.calcSize()function.v1.81.1Compare Source
v1.81.0Compare Source
Fix a few cases where deprecation warnings weren't being emitted for global
built-in functions whose names overlap with CSS calculations.
Add support for the CSS
round()calculation with a single argument, as longas that argument might be a unitless number.
v1.80.7Compare Source
Embedded Host
0asundefinedfor thegreenandbluechannels in theLegacyColorconstructor.v1.80.6Compare Source
Command-Line Interface
@parcel/watcheran optional dependency so this can still be installedon operating systems where it's unavailable.
v1.80.5Compare Source
Embedded Host
@importdeprecations when using an importer with thelegacy API.
v1.80.4Compare Source
v1.80.3Compare Source
Fix a bug where
@import url("...")would crash in plain CSS files.Improve consistency of how warnings are emitted by different parts of the
compiler. This should result in minimal user-visible changes, but different
types of warnings should now respond more reliably to flags like
--quiet,--verbose, and--silence-deprecation.v1.80.2Compare Source
plain-CSS
invert()function.v1.80.1Compare Source
v1.80.0Compare Source
@importis now officially deprecated, as are global built-in functions thatare available within built-in modules. See the Sass blog post for more
details on the deprecation process.
Embedded Host
emitted when using a custom importer with the legacy API.
v1.79.6Compare Source
Fix a bug where Sass would add an extra
*/after loud comments withwhitespace after an explicit
*/in the indented syntax.Potentially breaking bug fix: Adding text after an explicit
*/in theindented syntax is now an error, rather than silently generating invalid CSS.
Embedded Host
SassBooleantype.v1.79.5Compare Source
Changes to how
selector.unify()and@extendcombine selectors:The relative order of pseudo-classes (like
:hover) and pseudo-elements(like
::before) within each original selector is now preserved whenthey're combined.
Pseudo selectors are now consistently placed at the end of the combined
selector, regardless of which selector they came from. Previously, this
reordering only applied to pseudo-selectors in the second selector.
Tweak the color transformation matrices for OKLab and OKLCH to match the
newer, more accurate values in the CSS spec.
Fix a slight inaccuracy case when converting to
srgb-linearanddisplay-p3.Potentially breaking bug fix:
math.unit()now wraps multiple denominatorunits in parentheses. For example,
px/(em*em)instead ofpx/em*em.Command-Line Interface
@parcel/watcherto watch the filesystem when running from JavaScript andnot using
--poll. This should mitigate more frequent failures users havebeen seeing since version 4.0.0 of Chokidar, our previous watching tool, was
released.
JS API
SassColor.interpolate()to allow an undefinedoptionsparameter, asthe types indicate.
Embedded Sass
v1.79.4Compare Source
JS API
greenorbluetocolor.change()for legacycolors would fail.
v1.79.3Compare Source
$channelparameter in the suggested replacement forcolor.red(),color.green(),color.blue(),color.hue(),color.saturation(),color.lightness(),color.whiteness(), andcolor.blackness()to use a quoted string.v1.79.2Compare Source
Add a
$spaceparameter to the suggested replacement forcolor.red(),color.green(),color.blue(),color.hue(),color.saturation(),color.lightness(),color.whiteness(), andcolor.blackness().Update deprecation warnings for the legacy JS API to include a link to
relevant documentation.
v1.79.1Compare Source
v1.79.0Compare Source
Breaking change: Passing a number with unit
%to the$alphaparameterof
color.change(),color.adjust(),change-color(), andadjust-color()is now interpreted as a percentage, instead of ignoring the unit. For example,
color.change(red, $alpha: 50%)now returnsrgb(255 0 0 / 0.5).Potentially breaking compatibility fix: Sass no longer rounds RGB channels
to the nearest integer. This means that, for example,
rgb(0 0 1) != rgb(0 0 0.6). This matches the latest version of the CSS spec and browser behavior.Potentially breaking compatibility fix: Passing large positive or negative
values to
color.adjust()can now cause a color's channels to go outside thatcolor's gamut. In most cases this will currently be clipped by the browser and
end up showing the same color as before, but once browsers implement gamut
mapping it may produce a different result.
Add support for CSS Color Level 4 color spaces. Each color value now tracks
its color space along with the values of each channel in that color space.
There are two general principles to keep in mind when dealing with new color
spaces:
With the exception of legacy color spaces (
rgb,hsl, andhwb), colorswill always be emitted in the color space they were defined in unless
they're explicitly converted.
The
color.to-space()function is the only way to convert a color toanother color space. Some built-in functions may do operations in a
different color space, but they'll always convert back to the original space
afterwards.
rgbcolors can now have non-integer channels and channels outside the normalgamut of 0-255. These colors are always emitted using the
rgb()syntax sothat modern browsers that are being displayed on wide-gamut devices can
display the most accurate color possible.
Add support for all the new color syntax defined in Color Level 4, including:
oklab(),oklch(),lab(), andlch()functions;hwb()function that matches the space-separated CSS syntax;color()function that supports thesrgb,srgb-linear,display-p3,a98-rgb,prophoto-rgb,rec2020,xyz,xyz-d50, andxyz-d65color spaces.Add new functions for working with color spaces:
color.to-space($color, $space)converts$colorto the given$space. Inmost cases this conversion is lossless—the color may end up out-of-gamut for
the destination color space, but browsers will generally display it as best
they can regardless. However, the
hslandhwbspaces can't representout-of-gamut colors and so will be clamped.
color.channel($color, $channel, $space: null)returns the value of thegiven
$channelin$color, after converting it to$spaceif necessary.It should be used instead of the old channel-specific functions such as
color.red()andcolor.hue().color.same($color1, $color2)returns whether two colors represent the samecolor even across color spaces. It differs from
$color1 == $color2because==never consider colors in different (non-legacy) spaces as equal.color.is-in-gamut($color, $space: null)returns whether$colorisin-gamut for its color space (or
$spaceif it's passed).color.to-gamut($color, $space: null)returns$colorconstrained to itsspace's gamut (or to
$space's gamut, if passed). This is generally notrecommended since even older browsers will display out-of-gamut colors as
best they can, but it may be necessary in some cases.
color.space($color): Returns the name of$color's color space.color.is-legacy($color): Returns whether$coloris in a legacy colorspace (
rgb,hsl, orhwb).color.is-powerless($color, $channel, $space: null): Returns whether thegiven
$channelof$coloris powerless in$space(or its own colorspace). A channel is "powerless" if its value doesn't affect the way the
color is displayed, such as hue for a color with 0 chroma.
color.is-missing($color, $channel): Returns whether$channel's value ismissing in
$color. Missing channels can be explicitly specified using thespecial value
noneand can appear automatically whencolor.to-space()returns a color with a powerless channel. Missing channels are usually
treated as 0, except when interpolating between two colors and in
color.mix()where they're treated as the same value as the other color.Update existing functions to support color spaces:
hsl()andcolor.hwb()no longer forbid out-of-bounds values. Instead,they follow the CSS spec by clamping them to within the allowed range.
color.change(),color.adjust(), andcolor.scale()now support allchannels of all color spaces. However, if you want to modify a channel
that's not in
$color's own color space, you have to explicitly specify thespace with the
$spaceparameter. (For backwards-compatibility, thisdoesn't apply to legacy channels of legacy colors—for example, you can still
adjust an
rgbcolor's saturation without passing$space: hsl).color.mix()andcolor.invert()now support the standard CSS algorithmfor interpolating between two colors (the same one that's used for gradients
and animations). To use this, pass the color space to use for interpolation
to the
$methodparameter. For polar color spaces likehslandoklch,this parameter also allows you to specify how hue interpolation is handled.
color.complement()now supports a$spaceparameter that indicates whichcolor space should be used to take the complement.
color.grayscale()now operates in theoklchspace for non-legacy colors.color.ie-hex-str()now automatically converts its color to thergbspaceand gamut-maps it so that it can continue to take colors from any color
space.
The following functions are now deprecated, and uses should be replaced with
the new color-space-aware functions defined above:
The
color.red(),color.green(),color.blue(),color.hue(),color.saturation(),color.lightness(),color.whiteness(), andcolor.blackness()functions, as well as their global counterparts, shouldbe replaced with calls to
color.channel().The global
adjust-hue(),saturate(),desaturate(),lighten(),darken(),transaprentize(),fade-out(),opacify(), andfade-in()functions should be replaced by
color.adjust()orcolor.scale().Add a
global-builtinfuture deprecation, which can be opted-into with the--future-deprecationflag or thefutureDeprecationsoption in the JS orDart API. This emits warnings when any global built-in functions that are
now available in
sass:modules are called. It will become active by defaultin an upcoming release alongside the
@importdeprecation.Dart API
Added a
ColorSpaceclass which represents the various color spaces definedin the CSS spec.
Added
SassColor.spacewhich returns a color's color space.Added
SassColor.channelsand.channelsOrNullwhich returns a listof channel values, with missing channels converted to 0 or exposed as null,
respectively.
Added
SassColor.isLegacy,.isInGamut,.channel(),.isChannelMissing(),.isChannelPowerless(),.toSpace(),.toGamut(),.changeChannels(), and.interpolate()which do the same thing as the Sass functions of thecorresponding names.
SassColor.rgb()now allows out-of-bounds and non-integer arguments.SassColor.hsl()and.hwb()now allow out-of-bounds arguments.Added
SassColor.hwb(),.srgb(),.srgbLinear(),.displayP3(),.a98Rgb(),.prophotoRgb(),.rec2020(),.xyzD50(),.xyzD65(),.lab(),.lch(),.oklab(),.oklch(), and.forSpace()constructors.Deprecated
SassColor.red,.green,.blue,.hue,.saturation,.lightness,.whiteness, and.blacknessin favor ofSassColor.channel().Deprecated
SassColor.changeRgb(),.changeHsl(), and.changeHwb()infavor of
SassColor.changeChannels().Added
SassNumber.convertValueToUnit()as a shorthand forSassNumber.convertValue()with a single numerator.Added
InterpolationMethodandHueInterpolationMethodwhich collectivelyrepresent the method to use to interpolate two colors.
JS API
While the legacy API has been deprecated since we released the modern API, we
now emit warnings when the legacy API is used to make sure users are aware
that it will be removed in Dart Sass 2.0.0. In the meantime, you can silence
these warnings by passing
legacy-js-apiinsilenceDeprecationswhen usingthe legacy API.
Modify
SassColorto accept a newspaceoption, with support for all thenew color spaces defined in Color Level 4.
Add
SassColor.spacewhich returns a color's color space.Add
SassColor.channelsand.channelsOrNullwhich returns a list of channelvalues, with missing channels converted to 0 or exposed as null, respectively.
Add
SassColor.isLegacy,.isInGamut(),.channel(),.isChannelMissing(),.isChannelPowerless(),.toSpace(),.toGamut(),.change(), and.interpolate()which do the same thing as the Sass functions of thecorresponding names.
Deprecate
SassColor.red,.green,.blue,.hue,.saturation,.lightness,.whiteness, and.blacknessin favor ofSassColor.channel().Embedded Sass
Add
ColorSassScript value, with support for all the new color spacesdefined in Color Level 4.
Remove
RgbColor,HslColorandHwbColorSassScript values.v1.78.0Compare Source
The
meta.feature-existsfunction is now deprecated. This deprecation isnamed
feature-exists.Fix a crash when using
@at-rootwithout any queries or children in theindented syntax.
JS API
Backport the deprecation options (
fatalDeprecations,futureDeprecations,and
silenceDeprecations) to the legacy JS API. The legacy JS API is itselfdeprecated, and you should move off of it if possible, but this will allow
users of bundlers and other tools that are still using the legacy API to
still control deprecation warnings.
Fix a bug where accessing
SourceSpan.urlwould crash when a relative URL waspassed to the Sass API.
Embedded Sass
Explicitly expose a
sassexecutable from thesass-embeddednpm package.This was intended to be included in 1.63.0, but due to the way
platform-specific dependency executables are installed it did not work as
intended. Now users can run
npx sassfor local installs or justsasswhensass-embeddedis installed globally.Add linux-riscv64, linux-musl-riscv64, and android-riscv64 support for the
sass-embeddednpm package.Fix an edge case where the Dart VM could hang when shutting down when requests
were in flight.
Fix a race condition where the embedded host could fail to shut down if it was
closed around the same time a new compilation was started.
Fix a bug where parse-time deprecation warnings could not be controlled by
the deprecation options in some circumstances.
v1.77.8Compare Source
v1.77.7Compare Source
Declarations that appear after nested rules are deprecated, because the
semantics Sass has historically used are different from the semantics
specified by CSS. In the future, Sass will adopt the standard CSS semantics.
See the Sass website for details.
Potentially breaking bug fix:
//in certain places such as unknownat-rule values was being preserved in the CSS output, leading to potentially
invalid CSS. It's now properly parsed as a silent comment and omitted from the
CSS output.
v1.77.6Compare Source
between the end of Sass statements and the following semicolon.
v1.77.5Compare Source
@extend.v1.77.4Compare Source
Embedded Sass
Support passing
Versioninput forfatalDeprecationsas string overembedded protocol.
Fix a bug in the JS Embedded Host where
Versioncould be incorrectly acceptedas input for
silenceDeprecationsandfutureDeprecationsin pure JS.v1.77.3Compare Source
Dart API
Deprecation.duplicateVariableFlagshas been deprecated and replaced withDeprecation.duplicateVarFlagsto make it consistent with theduplicate-var-flagsname used on the command line and in the JS API.v1.77.2Compare Source
Don't emit deprecation warnings for functions and mixins beginning with
__.Allow user-defined functions whose names begin with
_and otherwise looklike vendor-prefixed functions with special CSS syntax.
Command-Line Interface
Properly handle the
--silence-deprecationflag.Handle the
--fatal-deprecationand--future-deprecationflags for--interactivemode.v1.77.1Compare Source
v1.77.0Compare Source
v1.76.0Compare Source
Throw errors for misplaced statements in keyframe blocks.
Mixins and functions whose names begin with
--are now deprecated forforwards-compatibility with the in-progress CSS functions and mixins spec.
This deprecation is named
css-function-mixin.v1.75.0Compare Source
when custom importers or the Node.js package importer made decisions based on
the URL of the containing stylesheet.
JS API
importerto be passed withouturlinStringOptionsWithImporter.v1.74.1Compare Source
v1.72.0Compare Source
Support adjacent
/s without whitespace in between when parsing plain CSSexpressions.
Allow the Node.js
pkg:importer to load Sass stylesheets forpackage.jsonexportsfield entries without extensions.When printing suggestions for variables, use underscores in variable names
when the original usage used underscores.
JavaScript API
pkg:imports with the Node.js package importer whenarguments are passed to the JavaScript process.
v1.71.1Compare Source
Command-Line Interface
JavaScript API
Export the
NodePackageImporterclass in ESM mode.Allow
NodePackageImporterto locate a default directory even when theentrypoint is an ESM module.
Dart API
NodePackageImporter()a static error ratherthan just a runtime error.
Embedded Sass
when running on musl Linux.
v1.71.0Compare Source
For more information about
pkg:importers, see theannouncement on the Sass blog.
Command-Line Interface
--pkg-importerflag to enable built-inpkg:importers. Currentlythis only supports the Node.js package resolution algorithm, via
--pkg-importer=node. For example,@use "pkg:bootstrap"will loadnode_modules/bootstrap/scss/bootstrap.scss.JavaScript API
NodePackageImporterimporter that can be passed to theimportersoption. This loads files using the
pkg:URL scheme according to the Node.jspackage resolution algorithm. For example,
@use "pkg:bootstrap"will loadnode_modules/bootstrap/scss/bootstrap.scss. The constructor takes a singleoptional argument, which indicates the base directory to use when locating
node_modulesdirectories. It defaults topath.dirname(require.main.filename).Dart API
NodePackageImporterimporter that can be passed to theimportersoption. This loads files using the
pkg:URL scheme according to the Node.jspackage resolution algorithm. For example,
@use "pkg:bootstrap"will loadnode_modules/bootstrap/scss/bootstrap.scss. The constructor takes a singleargument, which indicates the base directory to use when locating
node_modulesdirectories.v1.70.0Compare Source
JavaScript API
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.