Absorb sass-graph 2.2.5 into node-sass

[kiskoza]

Hi.

The current version of node-sass depends on sass-graph v2.2.5. Unfortunately that package has a known vulnerability reported by various audit tools. I already tried to open a PR to fix it (see xzyfer/sass-graph#117), but apart from an initial comment stating that the package is in maintenance mode, I haven't got too much response. There's an open issue for this in node-sass' repo too: #3190

Some of the comments are saying you should change node-sass to dart-sass, but other comments are saying that they have a performance issue with dart-sass, so it's not an option for them. One of the comments suggested we should merge sass-graph into node-sass and fix the problem in this repo. I tried to follow this path.

If you check the report closely, you can see that the reported vulnerability is related to sass-graph's command line binary, which was never used in node-sass. That means it should be enough to copy over sass-graph without the CLI tool.

I had to make these changes:

• lib/sass-graph/*.js - copy over sass-graph's core
• lib/watcher.js - include the new file instead of a package
• package.json - remove sass-graph and include scss-tokenizer. this one was the only relevant diff between sass-graph's dependencies and the packages already required for node-sass
• test/sass-graph/*.* - copy over sass-graph's test. I changed require('chai').assert to require('assert').strict and fixed the path to find the right sass-graph files

I hope this PR will help expanding this project's lifetime and reduce the cost of maintenance in the future. Is there anything else I need to do?

[lgtm-com]

This pull request introduces 1 alert when merging 518afbb into e80d4af - view on LGTM.com

new alerts:

• 1 for Useless regular-expression character escape

[xzyfer]

Thanks but we maintain both packages so we're happy to keep them separate.