victornpb
Bump node-sass from 6.0.1 to 9.0.0
Bumps node-sass from 6.0.1 to 9.0.0.
Release notes
Sourced from node-sass's releases.
v9.0.0
What's Changed
- Node 20 support by
@nschonniin sass/node-sass#3355Breaking changes
- Drop support for Node 14 (
@nschonni)Supported Environments
OS Architecture Node Windows x86 & x64 16, 18, 19, 20 OSX x64 16, 18, 19, 20 Linux* x64 16, 18, 19, 20 Alpine Linux x64 16, 18, 19, 20 *Linux support refers to major distributions like Ubuntu, and Debian
v8.0.0
What's Changed
- Fix binaries being partially downloaded by
@xzyferin sass/node-sass#3313- Bump node-gyp and nan for node 19 support by
@xzyferin sass/node-sass#3314- feat: Node 18 and 19 support and drop Node 17 by
@nschonniin sass/node-sass#3257Breaking changes
- Drop support for Node 12 (
@nschonni)- Drop support for Node 17 (
@nschonni)- Set
rejectUnauthorizedtotrueby default (@scott-ut, #3149)Features
- Add support for Node 18 (
@nschonni)- Add support for Node 19 (
@nschonni)- Replace
requestwithmake-fetch-happen(@CamilleDrapier@xzyfer, #3193, #3313)Dependencies
- Bump [email protected]
- Bump node-gyp
@9.0.0- Bump nan@^2.17.0
- Bump sass-graph@^4.0.1
Misc
- Bump various GitHub Actions dependencies (
@nschonni)
... (truncated)
Commits
87f3899feat: Node 20 support (#3355)06ae4c7build(deps): bump coverallsapp/github-action from 2.0.0 to 2.1.0 (#3350)e069f73build(deps): bump coverallsapp/github-action from 1.2.0 to 2.0.0c34837dbuild(deps): bump coverallsapp/github-action from 1.1.3 to 1.2.0ee13eb98.0.098e75b3feat: Node 18 and 19 support and drop Node 17 (#3257)e9bb866Bump node-gyp and nan for node 19 support (#3314)ab7840bFix binaries being partially downloaded (#3313)d595abf7.0.33b556c17.0.2- Additional commits viewable in compare view
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
-
@dependabot rebasewill rebase this PR -
@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it -
@dependabot mergewill merge this PR after your CI passes on it -
@dependabot squash and mergewill squash and merge this PR after your CI passes on it -
@dependabot cancel mergewill cancel a previously requested merge and block automerging -
@dependabot reopenwill reopen this PR if it is closed -
@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually -
@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) -
@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) -
@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
![dependabot[bot] avatar](https://avatars.githubusercontent.com/in/29110?v=4 "Published by a pub.dev verified publisher"){kind=small}
New dependency changes detected. Learn more about Socket for GitHub ↗︎
🚨 Potential security issues found in this pull request. To accept the risk, merge this PR and you will not be notified again.
Bot Commands
To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore [email protected] bar@* or ignore all packages with @SocketSecurity ignore-all
@SocketSecurity ignore [email protected]@SocketSecurity ignore [email protected]@SocketSecurity ignore [email protected]@SocketSecurity ignore [email protected]@SocketSecurity ignore [email protected]@SocketSecurity ignore [email protected]@SocketSecurity ignore [email protected]@SocketSecurity ignore [email protected]@SocketSecurity ignore [email protected]@SocketSecurity ignore [email protected]@SocketSecurity ignore [email protected]@SocketSecurity ignore [email protected]@SocketSecurity ignore [email protected]@SocketSecurity ignore [email protected]@SocketSecurity ignore [email protected]@SocketSecurity ignore [email protected]@SocketSecurity ignore [email protected]@SocketSecurity ignore [email protected]@SocketSecurity ignore [email protected]@SocketSecurity ignore @npmcli/[email protected]@SocketSecurity ignore [email protected]@SocketSecurity ignore [email protected]@SocketSecurity ignore [email protected]@SocketSecurity ignore [email protected]@SocketSecurity ignore [email protected]@SocketSecurity ignore @tootallnate/[email protected]@SocketSecurity ignore @tootallnate/[email protected]@SocketSecurity ignore [email protected]@SocketSecurity ignore [email protected]@SocketSecurity ignore [email protected]@SocketSecurity ignore [email protected]@SocketSecurity ignore [email protected]@SocketSecurity ignore [email protected]@SocketSecurity ignore [email protected]@SocketSecurity ignore [email protected]@SocketSecurity ignore [email protected]@SocketSecurity ignore @npmcli/[email protected]@SocketSecurity ignore [email protected]@SocketSecurity ignore [email protected]@SocketSecurity ignore [email protected]@SocketSecurity ignore [email protected]@SocketSecurity ignore @gar/[email protected]@SocketSecurity ignore [email protected]@SocketSecurity ignore [email protected]@SocketSecurity ignore [email protected]@SocketSecurity ignore [email protected]@SocketSecurity ignore [email protected]@SocketSecurity ignore [email protected]@SocketSecurity ignore [email protected]
⚠️ Uses eval
Package uses eval() which is a dangerous function. This prevents the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.
Avoid packages that use eval, since this could potentially execute any code.
| Package | Eval Type | Location | Source |
|---|---|---|---|
| [email protected] (added) | Function | index.js | package.json via [email protected] |
⚠️ Dynamic require
Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.
Packages should avoid dynamic imports when possible. Audit the use of dynamic require to ensure it is not executing malicious or vulnerable code.
| Package | Location | Source |
|---|---|---|
| [email protected] (added) | index.umd.js | package.json via [email protected] |
| [email protected] (added) | index.umd.js | package.json via [email protected] |
| [email protected] (added) | test/integration/test-forever.js | package.json via [email protected] |
| [email protected] (added) | test/integration/test-retry-operation.js | package.json via [email protected] |
| [email protected] (added) | test/integration/test-retry-wrap.js | package.json via [email protected] |
| [email protected] (added) | test/integration/test-timeouts.js | package.json via [email protected] |
| [email protected] (upgraded) | build/index.cjs | package.json via [email protected] |
| [email protected] (upgraded) | build/index.cjs | package.json via [email protected] |
⚠️ Obfuscated require
Package accesses dynamic properties of require and may be obfuscating code execution.
The package should not access dynamic properties of module. Instead use import or require directly.
| Package | Location | Source |
|---|---|---|
| [email protected] (added) | index.umd.js | package.json via [email protected] |
| [email protected] (added) | index.umd.js | package.json via [email protected] |
| [email protected] (upgraded) | build/index.cjs | package.json via [email protected] |
⚠️ Bidirectional unicode control characters
Source files contain bidirectional unicode control characters. This could indicate a Trojan source supply chain attack. See: trojansource.codes for more information.
Remove bidirectional unicode control characters, or clearly document what they are used for.
| Package | Location | Source |
|---|---|---|
| [email protected] (added) | encodings/sbcs-data-generated.js | package.json via [email protected] |
| [email protected] (added) | encodings/sbcs-data-generated.js | package.json via [email protected] |
| [email protected] (added) | encodings/sbcs-data-generated.js | package.json via [email protected] |
⚠️ Zero width unicode chars
Package files contain zero width unicode characters. This could indicate a supply chain attack.
Packages should remove unnecessary zero width unicode characters and use their visible counterparts.
| Package | Location | Source |
|---|---|---|
| [email protected] (added) | encodings/sbcs-data-generated.js | package.json via [email protected] |
⚠️ Suspicious strings
This package contains suspicious text patterns which are commonly associated with bad behavior
The package code should be reviewed before installing
⚠️ Trivial Package
Packages less than 10 lines of code are easily copied into your own project and may not warrant the additional supply chain risk of an external dependency.
Removing this package as a dependency and implementing its logic will reduce supply chain risk.
| Package | Location | Source |
|---|---|---|
| [email protected] (added) | index.js | package.json via [email protected] |
| [email protected] (added) | index.js | package.json via [email protected] |
| [email protected] (added) | lib/index.js | package.json via [email protected] |
| [email protected] (added) | lib/index.js | package.json via [email protected] |
Pull request alert summary
| Issue | Status |
|---|---|
| Critical CVE | ✅ 0 issues |
| Install scripts | ✅ 0 issues |
| Native code | ✅ 0 issues |
| Bin script confusion | ✅ 0 issues |
| Bin script shell injection | ✅ 0 issues |
| High entropy strings | ✅ 0 issues |
| Uses eval | ⚠️ 1 issue |
| Dynamic require | ⚠️ 8 issues |
| Unresolved require | ✅ 0 issues |
| Obfuscated require | ⚠️ 3 issues |
| Obfuscated code | ✅ 0 issues |
| Bidirectional unicode control characters | ⚠️ 3 issues |
| Zero width unicode chars | ⚠️ 1 issue |
| Invisible chars | ✅ 0 issues |
| Suspicious strings | ⚠️ 56 issues |
| Invalid package.json | ✅ 0 issues |
| HTTP dependency | ✅ 0 issues |
| Git dependency | ✅ 0 issues |
| Trivial Package | ⚠️ 4 issues |
| Non-existent author | ✅ 0 issues |
| Unpublished package | ✅ 0 issues |
| Potential typo squat | ✅ 0 issues |
| Known Malware | ✅ 0 issues |
| Telemetry | ✅ 0 issues |
| Protestware/Troll package | ✅ 0 issues |
| AI detected security risk | ✅ 0 issues |
| AI warning | ✅ 0 issues |
📊 Modified Dependency Overview:
| ⬆️ Updated Package | Version Diff | Added Capability Access | +/- Transitive Count |
Publisher |
|---|---|---|---|---|
| [email protected] | 6.0.1...9.0.0 | network | +85/-86 |
xzyfer |
![socket-security[bot] avatar](https://avatars.githubusercontent.com/in/156372?v=4 "Published by a pub.dev verified publisher"){kind=small}