[Snyk] Security upgrade sass from 1.69.5 to 1.79.0#478
Conversation
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-BRACES-6838727
|
Important Review skippedIgnore keyword(s) in the title. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
Upgrades the sass npm dependency to remediate a Snyk-reported vulnerability (SNYK-JS-BRACES-6838727) in the production dependency tree.
Changes:
- Bump
sassdependency from^1.69.6to^1.79.0inpackage.json. - Update
package-lock.jsonto locksass@1.79.0and reflect the resulting dependency tree changes.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| package.json | Updates the declared sass dependency range to ^1.79.0. |
| package-lock.json | Locks sass@1.79.0 and updates transitive dependencies accordingly. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "dependencies": { | ||
| "node-gyp": "^10.0.1", | ||
| "sass": "^1.69.6" | ||
| "sass": "^1.79.0" | ||
| } |
There was a problem hiding this comment.
PR title/description says sass is upgraded from 1.69.5, but the repo was already at 1.69.6 (both package.json/package-lock). Consider adjusting the PR title/description to match the actual previous version to avoid confusion in audit trails.
Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.
Snyk changed the following file(s):
package.jsonpackage-lock.jsonVulnerabilities that will be fixed with an upgrade:
SNYK-JS-BRACES-6838727
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Uncontrolled resource consumption