You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
chore(deps): update dependency sass-loader to v17 - #3959
Remove the byte order mark (BOM) from the compiled CSS. dart-sass prepends it when the compiled CSS contains non ASCII characters and the style option is compressed (the default for the production mode), but a BOM is only valid at the very beginning of a file - tools like css-loader move @import at-rules above it, so it ended up in the middle of the generated CSS and broke the rule after it. Source maps are shifted accordingly. (by @alexander-akait in #1337)
Add "auto" to the api option and make it the default. When the Sass implementation supports the modern compiler, "auto" enables it and reuses a single long-running compiler across files, which significantly improves build performance; otherwise it falls back to the modern API. (by @alexander-akait in #1319)
Convert source to native ECMAScript modules. The package now declares "type": "module" and exposes both an ESM and a CommonJS build via the exports field. CommonJS consumers continue to work via require, and ESM consumers can now import the loader directly. (by @alexander-akait in #1322)
added the modern-compiler value for API to reuse compiler process (#1195) (cef40a8)
support webpack built-in resolver for modern and modern-compiler API (#1197) (2265b72)
Notes:
Using the modern-compiler value for the api option together with sass-embedded reduces compilation time by 5-10 times, especially for projects using large files with a lot of @import/@use, for small files the build time reduction will not be significant.
added the modern-compiler value for API to reuse compiler process (#1195) (cef40a8)
support webpack built-in resolver for modern and modern-compiler API (#1197) (2265b72)
Notes:
Using the modern-compiler value for the api option together with sass-embedded reduces compilation time by 5-10 times, especially for projects using large files with a lot of @import/@use, for small files the build time reduction will not be significant.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review — no findings
Outcome: No medium, high, or critical vulnerabilities identified in this PR.
Scope reviewed
web/package.json — sass-loader bumped from ^13.0.0 to ^17.0.0
web/package-lock.json — lockfile refresh for sass-loader@17.0.0
Analysis
sass-loader is a devDependency used only at build time by Vue CLI/Webpack to compile .sass/.scss sources. It does not ship to production or process runtime user input, so there is no attacker-controlled input path to a security sink.
Supply chain:sass-loader@17.0.0 is published by the official webpack project, has no known CVEs, and drops its prior runtime dependency (neo-async), slightly reducing transitive surface.
Attack surface: Inputs are developer-controlled repository sources (Vue SFC styles, Vuetify SASS). Exploitation would require repository write access, which is outside the threat model for this dependency bump.
Compatibility note (non-security):sass-loader v17 removes legacy Sass JS API support and requires Node >=22.11.0. With the pinned sass@~1.32.12, npm run build fails (Unknown Sass implementation — ESM default-export mismatch with the legacy package). CI uses Node 24, so this is a build breakage risk, not a runtime security exposure.
Prior threads
No previous automation review threads were present on this PR.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review — no findings
Outcome: No medium, high, or critical vulnerabilities identified in this PR.
Scope reviewed
web/package.json — sass-loader bumped from ^13.0.0 to ^17.0.0
web/package-lock.json — lockfile refresh for sass-loader@17.0.0
Analysis
sass-loader is a devDependency used only at build time by Vue CLI/Webpack to compile .sass/.scss sources. It does not ship to production or process runtime user input, so there is no attacker-controlled input path to a security sink.
Supply chain:sass-loader@17.0.0 is published by the official webpack project, has no known CVEs, and drops its prior runtime dependency (neo-async), slightly reducing transitive surface.
Attack surface: Inputs are developer-controlled repository sources (Vue SFC styles, Vuetify SASS). Exploitation would require repository write access, which is outside the threat model for this dependency bump.
Compatibility note (non-security):sass-loader v17 removes legacy Sass JS API support and requires Node >=22.11.0. With the pinned sass@~1.32.12, builds may fail (Unknown Sass implementation — ESM default-export mismatch with the legacy package). This is a build breakage risk, not a runtime security exposure.
Prior threads
Previous automation review (no inline threads) re-validated; no findings remain.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review — no findings
Outcome: No medium, high, or critical vulnerabilities identified in this PR.
Scope reviewed
web/package.json — sass-loader bumped from ^13.0.0 to ^17.0.0
web/package-lock.json — lockfile refresh for sass-loader@17.0.0
Analysis
sass-loader is a devDependency used only at build time by Vue CLI/Webpack to compile .sass/.scss sources. It does not ship to production or process runtime user input, so there is no attacker-controlled input path to a security sink.
Supply chain:sass-loader@17.0.0 is published by the official webpack project, has no known CVEs, and drops its prior runtime dependency (neo-async), slightly reducing transitive surface.
Attack surface: Inputs are developer-controlled repository sources (Vue SFC styles, Vuetify SASS). Exploitation would require repository write access, which is outside the threat model for this dependency bump.
Compatibility note (non-security):sass-loader v17 removes legacy Sass JS API support and requires Node >=22.11.0. With the pinned sass@~1.32.12, builds may fail (Unknown Sass implementation — ESM default-export mismatch with the legacy package). This is a build breakage risk, not a runtime security exposure.
Prior threads
Previous automation reviews (no inline threads) re-validated; no findings remain.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review — no findings
Reviewed the full diff for PR #3959 (sass-loader ^13 → ^17). The change is limited to web/package.json and web/package-lock.json; no application, API, or runtime code is modified.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review — no findings
Reviewed the full diff for PR #3959 (sass-loader ^13 → ^17). The change is limited to web/package.json and web/package-lock.json; no application, API, or runtime code is modified.
Build-time webpack loader only; compiles developer-controlled SCSS during npm run build / serve
No new transitive runtime dependencies (sass-loader@17.0.0 ships with zero dependencies; prior neo-async direct dep removed)
Checks performed
Traced data flow: no attacker-controlled input reaches sass-loader; SCSS sources are static project/vendored files (Vue SFC <style lang="scss">, Vuetify imports, main.scss)
Verified existing controls: not applicable to this build-tool path; no production request handling involved
Supply-chain review: no known CVEs/advisories for sass-loader@17.0.0; lockfile includes integrity hash; Snyk/npm report no direct vulnerabilities
npm audit: sass-loader is not flagged among existing advisories
Prior automation threads
Re-validated earlier assessments against the current diff (6f15cde7…9ef99222); no unresolved medium+ findings remain applicable. No prior inline review threads were present.
Outcome: No medium, high, or critical vulnerabilities identified that are introduced or newly exposed by this PR.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review — no findings
Reviewed the full diff for PR #3959 (sass-loader ^13 → ^17). The change is limited to web/package.json and web/package-lock.json; no application, API, or runtime code is modified.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review — no findings
Reviewed PR diff (sass-loader ^13 → ^17 in web/package.json + lockfile refresh). This is a devDependency build-time webpack loader only; no application/runtime code changed.
Checks performed:
Traced attack surface: sass-loader compiles checked-in SCSS at build time; no attacker-controlled input path to a security sink in production.
npm audit vulnerability counts unchanged (31 total: 8 high, 20 moderate, 3 low, 0 critical) before vs after.
No known CVEs for sass-loader@17.0.0; upgrade removes the neo-async transitive dependency.
Prior threads: No unresolved automation findings to carry forward.
Verdict: No medium+ vulnerabilities introduced by this change.
To trigger a single review, invoke the @coderabbitai review command.
Run configuration
Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: defaults
Review profile: CHILL
Plan: Advanced
Run ID: e53528c5-963e-4509-8c10-1c47a6d189e2
You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.
Use the checkbox below for a quick retry:
🔍 Trigger review
Note
Reviews paused
It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.
Attack surface:sass-loader is a build-time webpack loader (devDependency). It is not bundled into the production runtime and does not process end-user input.
Input path: SCSS sources come from the repository and are compiled during vue-cli-service build; no attacker-controlled data reaches the loader without prior repo write access.
Known CVEs: No published vulnerabilities for sass-loader@17.0.0 (npm advisory DB / Snyk). npm audit reports no issues tied to this package.
Transitive deps: v17 removes the neo-async runtime dependency and drops deprecated node-sass peer support; no new vulnerable transitive packages introduced.
Application code: No changes to API handlers, auth, templates, or runtime frontend code.
Prior threads
No unresolved automation review threads on this PR; previous assessments reached the same conclusion.
The reason will be displayed to describe this comment to others. Learn more.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@web/package.json`:
- Line 56: Update the web package dependencies so the sass version is at least
1.45.0 and compatible with sass-loader 17, then regenerate web/package-lock.json
to resolve the upgraded version and its dependency metadata.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
Push a commit to this branch (recommended)
Create a new PR with the fixes
ℹ️ Review info⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 8a907c61-447b-4931-8cd2-ae6acb94a71d
📥 Commits
Reviewing files that changed from the base of the PR and between 9899b1a and 31151d8.
⛔ Files ignored due to path filters (1)
web/package-lock.json is excluded by !**/package-lock.json
sass-loader 17 peer dependency sass modern API compileStringAsync minimum supported sass version
💡 Result:
For sass-loader v17.0.0, the peer dependency requirement for the sass package is ^1.3.0 [1]. Regarding the use of the modern API and compileStringAsync: 1. API Support: sass-loader v17.0.0 has dropped support for the legacy Sass JS API entirely [2][3]. It now uses the modern API exclusively, with options for "modern" and "modern-compiler" modes [4][2][3]. 2. compileStringAsync: The compileStringAsync method is part of the Sass modern JS API, which was introduced in Dart Sass v1.45.0 [5]. Because sass-loader v17.0.0 enforces the modern API, it effectively requires a version of the sass package that supports these modern JS API methods (i.e., Dart Sass v1.45.0 or higher) [5][2]. 3. Performance Optimization: The loader's default API mode is "auto" [2][3]. In this mode, if your installed sass or sass-embedded package exposes initAsyncCompiler (a feature of recent versions), sass-loader will automatically use the "modern-compiler" API, which utilizes asynchronous compilation for improved performance [4][2][3]. It is recommended to use recent versions of the sass or sass-embedded packages to ensure full compatibility and performance benefits when using the modern API in sass-loader v17 [4][2][3].
Upgrade sass with sass-loader 17.web/package-lock.json still resolves sass to 1.32.13, which predates the modern Sass JS API. Bump sass to a modern Dart Sass release (>=1.45.0) and regenerate the lockfile.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@web/package.json` at line 56, Update the web package dependencies so the sass
version is at least 1.45.0 and compatible with sass-loader 17, then regenerate
web/package-lock.json to resolve the upgraded version and its dependency
metadata.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review — no findings
Outcome: No medium, high, or critical vulnerabilities identified in this PR.
Scope reviewed
web/package.json — sass-loader bumped from ^13.0.0 to ^17.0.0
web/package-lock.json — lockfile refresh; only substantive version change is sass-loader 13.3.3 → 17.0.0 (remaining diff is formatting)
Analysis
sass-loader is a devDependency used only at build time by webpack/vue-cli to compile SCSS. It is not bundled into the production Semaphore server and does not process runtime user input.
No application, API, auth, or runtime code is modified.
sass-loader@17.0.0 has no known CVEs (Snyk, npm advisory DB).
npm audit vulnerability counts are unchanged before vs. after this PR (29 total: 8 high, 18 moderate, 0 critical) — no new supply-chain risk introduced.
No plausible attacker-controlled input path to a security-sensitive sink was introduced by this change.
Prior threads
No unresolved security findings from earlier automation runs on this PR.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review — no findings
Outcome: No medium, high, or critical vulnerabilities identified in this PR.
Scope reviewed
web/package.json — sass-loader bumped from ^13.0.0 to ^17.0.0 (devDependency)
web/package-lock.json — lockfile refresh; only substantive version change is sass-loader 13.3.3 → 17.0.0 (remaining diff is formatting)
Checks performed
Attack surface:sass-loader is a build-time webpack loader (devDependency). It compiles checked-in SCSS during vue-cli-service build and is not bundled into the production Semaphore server. No runtime user input reaches this loader.
Input path: SCSS sources are developer-controlled repository files (Vue SFC styles, Vuetify). Exploitation would require prior repository write access, outside this dependency bump's threat model.
Known CVEs: No published vulnerabilities for sass-loader@17.0.0 (npm advisory DB, Snyk, ReversingLabs).
Supply chain: Official webpack/sass-loader package; v17.0.0 has zero runtime dependencies (removes prior neo-async transitive dep). Lockfile comparison confirms no other package versions changed.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review — no findings
Outcome: No medium, high, or critical vulnerabilities identified in this PR.
Scope reviewed
web/package.json — sass-loader bumped from ^13.0.0 to ^17.0.0 (devDependency)
web/package-lock.json — lockfile refresh; only substantive version change is sass-loader 13.3.3 → 17.0.0 (remaining diff is formatting)
Checks performed
Attack surface:sass-loader is a build-time webpack loader (devDependency). It compiles checked-in SCSS during vue-cli-service build and is not bundled into the production Semaphore server. No runtime user input reaches this loader.
Input path: SCSS sources are developer-controlled repository files (Vue SFC styles, Vuetify). Exploitation would require prior repository write access, outside this dependency bump's threat model.
Known CVEs: No published vulnerabilities for sass-loader@17.0.0 (npm advisory DB, Snyk, ReversingLabs).
Supply chain: Official webpack/sass-loader package; v17.0.0 has zero runtime dependencies (removes prior neo-async direct dep). Lockfile comparison confirms no other package versions changed.
Application code: No changes to API handlers, auth, templates, or runtime frontend code.
Prior threads
Re-validated all prior automation assessments against the current diff (c477f8d8…232dcb4c). No unresolved medium+ security findings; no prior automation inline threads to carry forward.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review — no findings
Outcome: No medium, high, or critical vulnerabilities identified in this PR.
Scope reviewed
web/package.json — sass-loader bumped from ^13.0.0 to ^17.0.0 (devDependency)
web/package-lock.json — lockfile refresh; only substantive version change is sass-loader 13.3.3 → 17.0.0 (remaining diff is CRLF/formatting)
Checks performed
Attack surface:sass-loader is a build-time webpack loader (devDependency). It compiles checked-in SCSS during vue-cli-service build and is not bundled into the production Semaphore server. No runtime user input reaches this loader.
Input path: SCSS sources are developer-controlled repository files (Vue SFC styles, Vuetify). Exploitation would require prior repository write access, outside this dependency bump's threat model.
Known CVEs: No published vulnerabilities for sass-loader@17.0.0 (npm advisory DB, Snyk, ReversingLabs).
Supply chain: Official webpack/sass-loader package; v17.0.0 has zero runtime dependencies (removes prior neo-async direct dep). Lockfile comparison confirms no other package versions changed.
npm audit: 29 total vulnerabilities (8 high, 18 moderate, 3 low, 0 critical); none tied to sass-loader — no new supply-chain risk introduced.
Application code: No changes to API handlers, auth, templates, or runtime frontend code.
Prior threads
Re-validated all prior automation assessments against the current diff (160347da…f4ec7c59). No unresolved medium+ security findings; no prior automation inline threads to carry forward.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review — no findings
Outcome: No medium, high, or critical vulnerabilities identified in this PR.
Scope reviewed
web/package.json — sass-loader bumped from ^13.0.0 to ^17.0.0 (devDependency)
web/package-lock.json — lockfile refresh; only substantive version change is sass-loader 13.3.3 → 17.0.0 (remaining diff is CRLF/formatting)
Checks performed
Attack surface:sass-loader is a build-time webpack loader (devDependency). It compiles checked-in SCSS during vue-cli-service build and is not bundled into the production Semaphore server. No runtime user input reaches this loader.
Input path: SCSS sources are developer-controlled repository files (Vue SFC styles, Vuetify). Exploitation would require prior repository write access, outside this dependency bump's threat model.
Known CVEs: No published vulnerabilities for sass-loader@17.0.0 (npm advisory DB, Snyk).
Supply chain: Official webpack/sass-loader package; v17.0.0 has zero runtime dependencies (removes prior neo-async direct dep). Lockfile comparison confirms no other package versions changed.
npm audit: 29 total vulnerabilities (8 high, 18 moderate, 3 low, 0 critical); none tied to sass-loader — no new supply-chain risk introduced.
Application code: No changes to API handlers, auth, templates, or runtime frontend code.
Prior threads
Re-validated all prior automation assessments against the current diff (333e71e9…2406d99d). No unresolved medium+ security findings; no prior automation inline threads to carry forward.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review — no findings
Outcome: No medium, high, or critical vulnerabilities identified in this PR.
Scope reviewed
web/package.json — sass-loader bumped from ^13.0.0 to ^17.0.0 (devDependency)
web/package-lock.json — lockfile refresh; only substantive version change is sass-loader 13.3.3 → 17.0.0
Checks performed
Attack surface:sass-loader is a build-time webpack loader (devDependency). It compiles checked-in SCSS during vue-cli-service build and is not bundled into the production Semaphore server. No runtime user input reaches this loader.
Input path: SCSS sources are developer-controlled repository files (main.scss, Vuetify imports). Exploitation would require prior repository write access, outside this dependency bump's threat model.
Known CVEs: No published vulnerabilities for sass-loader@17.0.0 (npm advisory DB, Snyk).
Supply chain: Official webpack/sass-loader package; v17.0.0 has zero runtime dependencies (peer-only). Lockfile diff confirms no other package versions changed.
npm audit: No findings tied to sass-loader or sass — no new supply-chain risk introduced.
Application code: No changes to API handlers, auth, templates, or runtime frontend code.
Prior threads
Re-validated all prior automation assessments against the current diff (ded97b5…32530ee). No unresolved medium+ security findings; no prior automation inline threads to carry forward.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review — no findings
Outcome: No medium, high, or critical vulnerabilities identified in this PR.
Scope reviewed
web/package.json — sass-loader bumped from ^13.0.0 to ^17.0.0 (devDependency)
web/package-lock.json — lockfile refresh; only substantive version change is sass-loader 13.3.3 → 17.0.1
Checks performed
Attack surface:sass-loader is a build-time webpack loader (devDependency). It compiles checked-in SCSS during npm run build / serve; it is not bundled into the production runtime and has no path for attacker-controlled input to reach a security sink.
Input tracing: SCSS sources are developer-controlled repository files (Vue SFC <style lang="scss">, Vuetify imports). Exploitation would require prior repository write access, outside this dependency bump's threat model.
Configuration:vue.config.js has no custom sass-loader options that would widen the attack surface.
Known CVEs: No published vulnerabilities for sass-loader@17.0.1 (npm advisory DB, Snyk, Sonatype). npm audit reports no issues tied to sass-loader.
Supply chain: Official webpack-contrib/sass-loader package; v17.0.1 has zero runtime dependencies (drops v13's neo-async direct dep). Lockfile includes integrity hash.
Application code: No changes to API handlers, auth, templates, or runtime frontend code.
Prior threads
Re-validated all prior automation assessments against the current diff (f0eed0b9…a9988bfd). No unresolved medium+ security findings; no automation-authored inline security threads to carry forward. The open CodeRabbit thread on sass/sass-loader compatibility is a functional/build concern, not a security vulnerability.
Verdict: Safe to merge from a security perspective.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review — no findings
Outcome: No medium, high, or critical vulnerabilities identified in this PR.
Scope reviewed
web/package.json — sass-loader bumped from ^13.0.0 to ^17.0.0 (devDependency)
web/package-lock.json — lockfile refresh; only substantive version change is sass-loader 13.3.3 → 17.0.1 (remaining diff is CRLF/formatting)
Checks performed
Attack surface:sass-loader is a build-time webpack loader (devDependency). It compiles checked-in SCSS during vue-cli-service build and is not bundled into the production Semaphore server. No runtime user input reaches this loader.
Input path: SCSS sources are developer-controlled repository files (Vue SFC <style lang="scss">, Vuetify imports). Exploitation would require prior repository write access, outside this dependency bump's threat model.
Known CVEs: No published vulnerabilities for sass-loader@17.0.1 (OSV, npm advisory DB, Snyk).
Supply chain: Official webpack/sass-loader package; v17.0.1 has zero runtime dependencies (removes prior neo-async direct dep). Lockfile includes integrity hash.
npm audit: No findings tied to sass-loader or sass — no new supply-chain risk introduced.
Application code: No changes to API handlers, auth, templates, or runtime frontend code. vue.config.js does not pass attacker-controlled options into the loader.
Prior threads
Re-validated all prior automation assessments against the current diff (6b740c2d…4355b20d). No unresolved medium+ security findings; no prior automation inline threads to carry forward.
Attack surface:sass-loader is a build-time webpack loader (devDependency). It compiles checked-in SCSS during npm run build / serve and is not bundled into the production runtime. vue.config.js has no custom sass-loader options.
Input tracing: SCSS sources are developer-controlled repository files (Vue SFC <style lang="scss">, Vuetify imports). No path from external/user-controlled input to the loader at runtime; exploitation would require prior repository write access.
Supply chain: Official webpack/sass-loader package; sass-loader@17.0.1 has no published CVEs (npm advisory DB, Snyk, Sonatype). v17.0.1 has zero runtime dependencies (drops v13's neo-async direct dep). Lockfile includes integrity hash.
npm audit: 38 total vulnerabilities (14 high, 20 moderate, 4 low, 0 critical); counts unchanged before vs. after — none tied to sass-loader or sass.
Application code: No changes to API handlers, auth, templates, or runtime frontend code.
Prior threads
Re-validated all prior automation assessments against the current diff (5b3e4f76…5074b976). No unresolved medium+ security findings from earlier automation runs; no automation-authored inline security threads to carry forward. The open CodeRabbit thread on web/package.json:56 flags a functionalsass peer-compatibility issue (sass@1.32.13 vs modern API required by sass-loader 17), not an exploitable security vulnerability.
Verdict: Safe to merge from a security perspective.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review — no findings
Outcome: No medium, high, or critical vulnerabilities identified in this PR.
Scope reviewed
web/package.json — sass-loader bumped from ^13.0.0 to ^17.0.0 (devDependency)
web/package-lock.json — lockfile refresh; only substantive change is sass-loader13.3.3 → 17.0.1 (removes neo-async transitive dep; no new packages added)
Checks performed
Attack surface:sass-loader is a build-time webpack loader only; it is not bundled into the production runtime. SCSS inputs are developer-controlled sources compiled during npm run build / CI (Node 24).
Code paths: No custom sass-loader options in vue.config.js; Vue CLI wires the loader internally.
Input → sink tracing: No attacker-controlled input reaches sass-loader at runtime. Exploitation would require commit access to SCSS sources or compromise of the build/CI environment — outside this dependency bump's threat model.
Supply chain:sass-loader@17.0.1 has no known CVEs (Snyk, npm audit). Lockfile diff adds no new transitive dependencies.
Prior findings: Validated all previous automation assessments; no unresolved security findings remain.
Note (non-security)
CodeRabbit flagged that sass@~1.32.12 may be incompatible with sass-loader v17's modern Sass JS API (requires Dart Sass ≥1.45.0). This is a build/compatibility concern, not a security vulnerability.
Attack surface:sass-loader is a build-time webpack loader (devDependency). It compiles checked-in SCSS during vue-cli-service build/serve and is not bundled into the production Semaphore server. No custom sass-loader options in vue.config.js.
Input tracing: SCSS sources are developer-controlled repository files (Vue SFC <style lang="scss">, Vuetify imports). No attacker-controlled input reaches this loader at runtime.
Supply chain:sass-loader@17.0.1 is published by the official webpack project (webpack/sass-loader), has no known CVEs, ships with zero runtime dependencies, and is pinned with an npm integrity hash in the lockfile.
Prior threads: No unresolved automation security findings to carry forward.
Verdict: No medium+ vulnerabilities introduced by this change.
Attack surface:sass-loader is a build-time webpack loader (devDependency). It compiles checked-in SCSS during vue-cli-service build and is not bundled into the production Semaphore server. No runtime user input reaches this loader.
Input path: SCSS sources are developer-controlled repository files (App.vue, Settings.vue, Vuetify imports). Exploitation would require prior repository write access, outside this dependency bump's threat model.
Config review:vue.config.js does not pass attacker-controlled options into the loader.
Known CVEs: No published vulnerabilities for sass-loader@17.0.1 (npm advisory DB). Package has zero bundled dependencies (peer-only: sass, webpack).
Supply chain: Official webpack/sass-loader package with lockfile integrity hash; no new vulnerable transitive packages introduced.
npm audit: No findings tied to sass-loader or sass.
Application code: No changes to API handlers, auth, templates, or runtime frontend code.
Prior threads
Re-validated all prior automation assessments against the current diff (81be693…5e55f27). No unresolved medium+ security findings; no prior automation inline threads to carry forward.
Attack surface:sass-loader is a build-time webpack loader (devDependency). It compiles checked-in SCSS during vue-cli-service build / serve and is not bundled into the production Semaphore server. No runtime user input reaches this loader.
Input tracing: SCSS sources are developer-controlled repository files (Vue SFC <style lang="scss">, Vuetify imports). Exploitation would require prior repository write access, outside this dependency bump's threat model.
Configuration:vue.config.js has no custom sass-loader options that would widen the attack surface.
Known CVEs: No published vulnerabilities for sass-loader@17.0.1 (npm advisory DB, Snyk). npm audit reports no issues tied to sass-loader or sass.
Supply chain: Official webpack-contrib/sass-loader package; v17.0.1 has zero runtime dependencies (removes prior neo-async direct dep from v13). Lockfile includes integrity hash.
Application code: No changes to API handlers, auth, templates, or runtime frontend code.
Prior threads
Re-validated all prior automation assessments against the current diff (5a16e607…51cfe81a). No unresolved medium+ security findings; no prior automation inline security threads to carry forward.
Attack surface:sass-loader is a build-time webpack loader only; it is not bundled into the production runtime. SCSS inputs are developer-controlled repository sources compiled during npm run build / serve.
Integration: No custom sass-loader options in vue.config.js; Vue CLI default wiring only.
Supply chain:sass-loader@17.0.1 has no known CVEs (Snyk/npm advisory databases). The upgrade removes the neo-async transitive dependency and drops deprecated node-sass/fibers peer support.
Runtime exposure: No application, API, or server code changes; no new attacker-controlled input path to a security sink.
CI compatibility:sass-loader v17 requires Node >=22.11.0; project CI uses Node 24.
Prior findings
Validated prior automation security reviews — no unresolved security findings. The open CodeRabbit thread about upgrading sass for modern API compatibility is a functional/build concern, not a demonstrated security vulnerability.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review — no findings
Outcome: No medium, high, or critical vulnerabilities identified in this PR.
Scope reviewed
web/package.json — sass-loader bumped from ^13.0.0 to ^17.0.0 (devDependencies)
web/package-lock.json — lockfile refresh resolving sass-loader@17.0.1; removes neo-async transitive dep from sass-loader; drops optional node-sass/fibers peer metadata in favor of Dart Sass / optional @rspack/core
Prior findings
No unresolved security inline threads from earlier automation runs on this PR (only unrelated CodeRabbit functional feedback on sass vs modern API compatibility).
Checks performed
Attack surface:sass-loader is a webpack build-time loader only; not bundled into the Semaphore server runtime. Inputs are repository-controlled .scss/.sass processed during npm run build / dev serve — no path from untrusted production HTTP/API input to this loader.
Integration:web/vue.config.js has no custom sass-loader options or dynamic loader configuration that would widen trust boundaries.
Supply chain: Version pinned via lockfile integrity hash; public scanners (Snyk/npm) report no known direct CVEs for sass-loader@17.x. Upgrade removes legacy node-sass optional peer chain (historical ReDoS advisories targeted scss-tokenizer via node-sass, not Dart Sass).
Auth / injection / SSRF / XSS / secrets: No application, API, or workflow code changed.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review — no findings
Outcome: No medium, high, or critical vulnerabilities identified in this PR.
Scope reviewed
web/package.json — sass-loader bumped from ^13.0.0 to ^17.0.0
web/package-lock.json — lockfile refresh for sass-loader@17.0.1
Analysis
sass-loader is a devDependency used only at build time by Vue CLI/Webpack to compile .sass/.scss sources. It is not bundled into the Semaphore runtime and does not process end-user HTTP input, so there is no plausible attacker-controlled input path to a security sink in application code.
Supply chain: Resolved package is sass-loader@17.0.1 from the official webpack project on npm, with lockfile integrity pinning. npm audit reports no vulnerabilities tied to sass-loader. The update removes the prior neo-async runtime dependency, slightly reducing transitive surface.
Attack surface: Compilation inputs are repository-controlled sources (Vue SFC styles, Vuetify SASS). Abusing the loader would require the ability to modify those sources or the build pipeline, which is outside the threat model for this Renovate bump.
Prior threads
Re-validated prior automation assessments (no inline security findings). No unresolved automation security threads remain.
Attack surface:sass-loader is a build-time webpack loader only; it is not bundled into the production runtime. Sources are repo-controlled .scss compiled during npm run build / serve via Vue CLI (no custom loader options in vue.config.js).
Input → sink: No path for external attacker-controlled input to reach this loader in deployed Semaphore; exploitation would require compromising the repo or build environment (out of scope for this dependency-only change).
Supply chain: Pinned tarball with integrity hash in the lockfile; Snyk/npm advisory data shows no known CVEs for sass-loader@17.0.x. npm audit reports no issues attributed to sass-loader.
Runtime deps: Upgrade removes neo-async from sass-loader's dependency tree; no new production dependencies introduced.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review — no findings
Outcome: No medium, high, or critical vulnerabilities identified in this PR.
Scope reviewed
web/package.json — sass-loader bumped from ^13.0.0 to ^17.0.0 (devDependencies)
web/package-lock.json — resolves sass-loader13.3.3 → 17.0.1; no other dependency version changes in the diff
Checks performed
Attack surface:sass-loader is a webpack loader used only at build time (Vue CLI / @vue/cli-service). It is not bundled into the Semaphore server binary or exposed to HTTP clients. No application, API, or runtime code paths changed.
Attacker-controlled input: SCSS inputs are repository-controlled sources compiled in CI/release builds, not user-supplied content at runtime. No new loader options or vue.config.js changes that would widen file resolution or remote import behavior.
Supply chain: Lockfile pins sass-loader@17.0.1 with an integrity hash from the public npm registry; the package ships with no runtime dependencies (dependencies: {}). No new advisories tied to sass-loader in npm audit for this bump.
Environment:sass-loader@17 requires Node >= 22.11.0; project CI already uses Node 24 (.github/workflows/dev.yml), so this does not weaken build isolation.
Prior threads
Validated earlier automation assessments: no unresolved security findings; this review supersedes prior runs (cleanup_previous).
Diff surface: Version/lockfile only; no application, API, or runtime code changes.
Exploitability:sass-loader runs at build time inside the webpack/Vue CLI pipeline (@vue/cli-service / vue-cli-plugin-vuetify). It is not shipped to end users and does not process untrusted HTTP input in the deployed Semaphore UI.
Supply chain: Lockfile pins sass-loader@17.0.1 with an integrity hash; no new runtime dependencies (v17 drops neo-async). npm audit reports no advisories targeting sass-loader for this tree.
Prior automation threads: No unresolved inline security findings from earlier runs; nothing to re-report.
Residual (out of scope)
Functional/CI compatibility (e.g. engines.node >= 22.11.0 on sass-loader vs local Node) is not a production security boundary for this app.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
This PR contains the following updates:
^13.0.0→^17.0.0Release Notes
webpack/sass-loader (sass-loader)
v17.1.0Compare Source
Minor Changes
data:resource from the loader's context, readingtext/x-sassas the indented syntax. (by @alexander-akait in #1352)v17.0.1Compare Source
Patch Changes
dart-sassprepends it when the compiled CSS contains non ASCII characters and thestyleoption iscompressed(the default for theproductionmode), but a BOM is only valid at the very beginning of a file - tools likecss-loadermove@importat-rules above it, so it ended up in the middle of the generated CSS and broke the rule after it. Source maps are shifted accordingly. (by @alexander-akait in #1337)v17.0.0Compare Source
Major Changes
Add
"auto"to theapioption and make it the default. When the Sass implementation supports the modern compiler,"auto"enables it and reuses a single long-running compiler across files, which significantly improves build performance; otherwise it falls back to themodernAPI. (by @alexander-akait in #1319)Remove
node-sasssupport. (by @alexander-akait in #1316)Minimum supported NodeJS version is
22.11.0. (by @alexander-akait in #1318)Convert source to native ECMAScript modules. The package now declares
"type": "module"and exposes both an ESM and a CommonJS build via theexportsfield. CommonJS consumers continue to work viarequire, and ESM consumers can nowimportthe loader directly. (by @alexander-akait in #1322)Remove legacy Sass JS API support. (by @alexander-akait in #1316)
Minor Changes
All notable changes to this project will be documented in this file. See standard-version for commit guidelines.
16.0.8 (2026-05-08)
Bug Fixes
16.0.7 (2026-02-05)
Bug Fixes
16.0.6 (2025-10-23)
Bug Fixes
16.0.5 (2025-02-14)
Bug Fixes
@usewithcssextension (#1254) (3352e49)16.0.4 (2024-12-04)
Bug Fixes
16.0.3 (2024-11-01)
Bug Fixes
16.0.2 (2024-09-20)
Bug Fixes
v16.0.8Compare Source
v16.0.7Compare Source
v16.0.6Compare Source
v16.0.5Compare Source
v16.0.4Compare Source
v16.0.3Compare Source
v16.0.2Compare Source
v16.0.1Compare Source
Bug Fixes
modern-compilerapi (#1228) (f862f7a)v16.0.0Compare Source
⚠ BREAKING CHANGES
sassandsass-embeddedTo return to the previous logic use:
Features
sassandsass-embedded(10be1ba)v15.0.0Compare Source
⚠ BREAKING CHANGES
sass-embeddedoversassby default (#1211)Features
sass-embeddedoversassby default (#1211) (83423ff)14.2.1 (2024-04-16)
Bug Fixes
v14.2.1Compare Source
⚠ BREAKING CHANGES
sass-embeddedoversassby default (#1211)Features
sass-embeddedoversassby default (#1211) (83423ff)14.2.1 (2024-04-16)
Bug Fixes
v14.2.0Compare Source
⚠ BREAKING CHANGES
sass-embeddedoversassby default (#1211)Features
sass-embeddedoversassby default (#1211) (83423ff)14.2.1 (2024-04-16)
Bug Fixes
v14.1.1Compare Source
Features
modern-compilervalue for API to reuse compiler process (#1195) (cef40a8)modernandmodern-compilerAPI (#1197) (2265b72)Notes:
Using the
modern-compilervalue for theapioption together withsass-embeddedreduces compilation time by 5-10 times, especially for projects using large files with a lot of@import/@use, for small files the build time reduction will not be significant.14.1.1 (2024-02-19)
Bug Fixes
pkg:scheme (#1191) (c34c8e3)v14.1.0Compare Source
Features
modern-compilervalue for API to reuse compiler process (#1195) (cef40a8)modernandmodern-compilerAPI (#1197) (2265b72)Notes:
Using the
modern-compilervalue for theapioption together withsass-embeddedreduces compilation time by 5-10 times, especially for projects using large files with a lot of@import/@use, for small files the build time reduction will not be significant.14.1.1 (2024-02-19)
Bug Fixes
pkg:scheme (#1191) (c34c8e3)v14.0.0Compare Source
⚠ BREAKING CHANGES
fiberssupport18.12.0(627f55d)13.3.3 (2023-12-25)
Bug Fixes
13.3.2 (2023-06-09)
Bug Fixes
klonaforsassoptions (#1145) (9e87b6b)13.3.1 (2023-05-28)
Bug Fixes
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.