WARNING: MAJOR (BREAKING) CHANGE: Update dependency node-sass to v7 [SECURITY] (master)

[renovatebot-confluentinc]

For any questions/concerns about this PR, please review the Renovate Bot wiki/FAQs, or the #renovatebot Slack channel.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
node-sass	^4.12.0 -> ^7.0.0

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Denial of Service in node-sass

GHSA-9v62-24cr-58cx

More information

Details

Affected versions of node-sass are vulnerable to Denial of Service (DoS). Crafted objects passed to the renderSync function may trigger C++ assertions in CustomImporterBridge::get_importer_entry and CustomImporterBridge::post_process_return_value that crash the Node process. This may allow attackers to crash the system's running Node process and lead to Denial of Service.

Recommendation

Upgrade to version 4.13.1 or later

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/sass/node-sass/commit/338fd7a14d3b8bd374a382336df16f9c6792b884
• https://github.com/sass/node-sass
• https://www.npmjs.com/advisories/961

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Improper Certificate Validation in node-sass

CVE-2020-24025 / GHSA-r8f7-9pfq-mjmv

More information

Details

Certificate validation in node-sass 2.0.0 to 6.0.1 is disabled when requesting binaries even if the user is not specifying an alternative download path.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-24025
• https://github.com/sass/node-sass/issues/3067
• https://github.com/sass/node-sass/pull/3149
• https://github.com/sass/node-sass/pull/567#issuecomment-656609236
• https://github.com/sass/node-sass/commit/0a21792803639851b480fbd8cbcb5540ef974387
• https://github.com/sass/node-sass
• https://github.com/sass/node-sass/releases/tag/v7.0.0

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[service-bot-app]

Could not automerge PR: Version change not allowed. See your service.yml and default values.