[deps]: Update sass to v1.89.2

[renovate[bot]]

trafficstars

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
sass	1.79.4 -> 1.89.2

---

Release Notes

sass/dart-sass (sass)

v1.89.2

Compare Source

Embedded Host

• Fixed a compilation error caused by an outdated buf dependency.

v1.89.1

Compare Source

• No user-visible changes.

v1.89.0

Compare Source

• Allow the Node package importer to load files even when there are multiple potential resolutions, as long as those resolutions all point to the same file.

v1.88.0

Compare Source

• Allow custom properties with empty values (such as --var:;).

• Fix a bug when calculating source spans for interpolations.

Dart and JS APIs

• Potentially breaking bug fix: Throw an error when passing a function or mixin object from one compilation to another.

Dart API

• Deprecate passing a relative URL to compileString() and related functions.

v1.87.0

Compare Source

• Potentially breaking bug fix: When a plain CSS file with a top-level nesting selector & is loaded into a nested Sass context via meta.load-css() or @import, Sass now emits plain CSS nesting rather than incorrectly combining it with the parent selector using a descendant combinator.

v1.86.3

Compare Source

• Fix a bug introduced in 1.86.1 where Sass fails to resolve paths starting with a .. segment.

v1.86.2

Compare Source

• No user-visible changes.

v1.86.1

Compare Source

• Improve the performance of file: URL case canonicalization on Windows and Mac OS.

v1.86.0

Compare Source

• Add support for % as an expression in its own right. It will still be parsed as the modulo operator when between two other expressions, but in any other context it will be an expression whose value is the unquoted string %.

• Consider attr() to be a special number function that can be used as a channel in color functions.

• Deprecate user-defined functions named type() so that we can eventually support the new CSS type() function.

Dart API

• Increase the minimum Dart SDK to 3.6.0.

v1.85.1

Compare Source

• Fix a bug where global Sass functions whose names overlap with CSS math functions could incorrectly be treated as CSS math functions even though they used Sass-only features, causing compilation failures. For example, round(-$var / 2) previously threw an error but now works as intended.

v1.85.0

Compare Source

• No longer fully trim redundant selectors generated by @extend. This caused unacceptable performance issues for certain heavy users of @extend. We'll try to find a more performant way to accomplish it in the future.

v1.84.0

Compare Source

• Allow newlines in whitespace in the indented syntax.

• Potentially breaking bug fix: Selectors with unmatched brackets now always produce a parser error. Previously, some edge cases like [foo#{"]:is(bar"}) {a: b} would compile without error, but this was an unintentional bug.

• Fix a bug in which various Color Level 4 functions weren't allowed in plain CSS.

• Fix the error message for @extend without a selector and possibly other parsing edge-cases in contexts that allow interpolation.

Embedded Host

• Fixed the implementation of the SassBoolean type to adhere to the spec, now using a class instead of an interface.

v1.83.4

Compare Source

• No user-visible changes.

v1.83.3

Compare Source

• No user-visible changes.

v1.83.2

Compare Source

• Properly display deprecation IDs for the JS Sass API.

• Don't display deprecation IDs for user-defined deprecations.

v1.83.1

Compare Source

• Fix a bug where --quiet-deps would get deactivated for @content blocks, even when those blocks were entirely contained within dependencies.

• Include deprecation IDs in deprecation warnings to make it easier to determine what to pass to --silence-deprecation or --fatal-deprecation.

v1.83.0

Compare Source

• Allow trailing commas in all argument and parameter lists.

v1.82.0

Compare Source

Command-Line Interface

• Improve --watch mode reliability when making multiple changes at once, such as checking out a different Git branch.

• Parse the calc-size() function as a calculation now that it's supported in some browsers.

Dart API

• Add a SassCalculation.calcSize() function.

v1.81.1

Compare Source

• No user-visible changes.

v1.81.0

Compare Source

• Fix a few cases where deprecation warnings weren't being emitted for global built-in functions whose names overlap with CSS calculations.

• Add support for the CSS round() calculation with a single argument, as long as that argument might be a unitless number.

v1.80.7

Compare Source

Embedded Host

• Don't treat 0 as undefined for the green and blue channels in the LegacyColor constructor.

v1.80.6

Compare Source

Command-Line Interface

• Make @parcel/watcher an optional dependency so this can still be installed on operating systems where it's unavailable.

v1.80.5

Compare Source

Embedded Host

• Don't produce phantom @import deprecations when using an importer with the legacy API.

v1.80.4

Compare Source

• No user-visible changes.

v1.80.3

Compare Source

• Fix a bug where @import url("...") would crash in plain CSS files.

• Improve consistency of how warnings are emitted by different parts of the compiler. This should result in minimal user-visible changes, but different types of warnings should now respond more reliably to flags like --quiet, --verbose, and --silence-deprecation.

v1.80.2

Compare Source

• Fix a bug where deprecation warnings were incorrectly emitted for the plain-CSS invert() function.

v1.80.1

Compare Source

• Fix a bug where repeated deprecation warnings were not automatically limited.

v1.80.0

Compare Source

• @import is now officially deprecated, as are global built-in functions that are available within built-in modules. See the Sass blog post for more details on the deprecation process.

Embedded Host

• Fix an error that would sometimes occur when deprecation warnings were emitted when using a custom importer with the legacy API.

v1.79.6

Compare Source

• Fix a bug where Sass would add an extra */ after loud comments with whitespace after an explicit */ in the indented syntax.

• Potentially breaking bug fix: Adding text after an explicit */ in the indented syntax is now an error, rather than silently generating invalid CSS.

Embedded Host

• Properly export the SassBoolean type.

v1.79.5

Compare Source

• Changes to how selector.unify() and @extend combine selectors:

  • The relative order of pseudo-classes (like :hover) and pseudo-elements (like ::before) within each original selector is now preserved when they're combined.

  • Pseudo selectors are now consistently placed at the end of the combined selector, regardless of which selector they came from. Previously, this reordering only applied to pseudo-selectors in the second selector.

• Tweak the color transformation matrices for OKLab and OKLCH to match the newer, more accurate values in the CSS spec.

• Fix a slight inaccuracy case when converting to srgb-linear and display-p3.

• Potentially breaking bug fix: math.unit() now wraps multiple denominator units in parentheses. For example, px/(em*em) instead of px/em*em.

Command-Line Interface

• Use @parcel/watcher to watch the filesystem when running from JavaScript and not using --poll. This should mitigate more frequent failures users have been seeing since version 4.0.0 of Chokidar, our previous watching tool, was released.

JS API

• Fix SassColor.interpolate() to allow an undefined options parameter, as the types indicate.

Embedded Sass

• Properly pass missing color channel values to and from custom functions.

---

Configuration

📅 Schedule: Branch creation - "every 2nd week starting on the 2 week of the year before 4am on Monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• [ ] If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[bitwarden-bot]

Internal tracking:

• ID: PM-13581
• Link: https://bitwarden.atlassian.net/browse/PM-13581

[codecov[bot]]

Codecov Report

All modified and coverable lines are covered by tests :white_check_mark:

Project coverage is 7.72%. Comparing base (3a46e17) to head (9bca4d5). Report is 1 commits behind head on main.

:white_check_mark: All tests successful. No failed tests found.

Additional details and impacted files

@@          Coverage Diff          @@
##            main    #646   +/-   ##
=====================================
  Coverage   7.72%   7.72%           
=====================================
  Files         68      68           
  Lines       2757    2757           
  Branches     475     475           
=====================================
  Hits         213     213           
  Misses      2529    2529           
  Partials      15      15           

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

:rocket: New features to boost your workflow:

• :package: JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[sonarqubecloud[bot]]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions[bot]]

Checkmarx One – Scan Summary & Details – 1288a370-a1d7-4fc7-bd4c-c93f79703366

New Issues (9)

Checkmarx found the following issues in this Pull Request

Severity	Issue	Source File / Package	Checkmarx Insight
	CVE-2025-1914	Npm-electron-34.1.1	Vulnerable Package
	CVE-2025-1917	Npm-electron-34.1.1	Vulnerable Package
	CVE-2025-1915	Npm-electron-34.1.1	Vulnerable Package
	CVE-2025-1916	Npm-electron-34.1.1	Vulnerable Package
	CVE-2025-1918	Npm-electron-34.1.1	Vulnerable Package
	CVE-2025-1919	Npm-electron-34.1.1	Vulnerable Package
	CVE-2025-1921	Npm-electron-34.1.1	Vulnerable Package
	CVE-2025-1922	Npm-electron-34.1.1	Vulnerable Package
	CVE-2025-1923	Npm-electron-34.1.1	Vulnerable Package