Skip to content

chore(deps-dev): bump sass-loader from 13.3.3 to 17.0.0 in /modules/gutenberg#92

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/modules/gutenberg/sass-loader-17.0.0
Open

chore(deps-dev): bump sass-loader from 13.3.3 to 17.0.0 in /modules/gutenberg#92
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/modules/gutenberg/sass-loader-17.0.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 2, 2026

Copy link
Copy Markdown
Contributor

Bumps sass-loader from 13.3.3 to 17.0.0.

Release notes

Sourced from sass-loader's releases.

v17.0.0

Major Changes

  • Add "auto" to the api option and make it the default. When the Sass implementation supports the modern compiler, "auto" enables it and reuses a single long-running compiler across files, which significantly improves build performance; otherwise it falls back to the modern API. (by @​alexander-akait in #1319)

  • Remove node-sass support. (by @​alexander-akait in #1316)

  • Minimum supported NodeJS version is 22.11.0. (by @​alexander-akait in #1318)

  • Convert source to native ECMAScript modules. The package now declares "type": "module" and exposes both an ESM and a CommonJS build via the exports field. CommonJS consumers continue to work via require, and ESM consumers can now import the loader directly. (by @​alexander-akait in #1322)

  • Remove legacy Sass JS API support. (by @​alexander-akait in #1316)

Minor Changes

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

v16.0.8

16.0.8 (2026-05-08)

Bug Fixes

v16.0.7

16.0.7 (2026-02-05)

Bug Fixes

  • update peer dependency for @​rspack/core v2 (#1291) (24d12ec)

v16.0.6

Bug Fixes

  • cache fs calls for modern API

v16.0.5

16.0.5 (2025-02-14)

Bug Fixes

  • allow to import CSS using @use with css extension (#1254) (3352e49)

v16.0.4

16.0.4 (2024-12-04)

... (truncated)

Changelog

Sourced from sass-loader's changelog.

17.0.0

Major Changes

  • Add "auto" to the api option and make it the default. When the Sass implementation supports the modern compiler, "auto" enables it and reuses a single long-running compiler across files, which significantly improves build performance; otherwise it falls back to the modern API. (by @​alexander-akait in #1319)

  • Remove node-sass support. (by @​alexander-akait in #1316)

  • Minimum supported NodeJS version is 22.11.0. (by @​alexander-akait in #1318)

  • Convert source to native ECMAScript modules. The package now declares "type": "module" and exposes both an ESM and a CommonJS build via the exports field. CommonJS consumers continue to work via require, and ESM consumers can now import the loader directly. (by @​alexander-akait in #1322)

  • Remove legacy Sass JS API support. (by @​alexander-akait in #1316)

Minor Changes

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

16.0.8 (2026-05-08)

Bug Fixes

16.0.7 (2026-02-05)

Bug Fixes

  • update peer dependency for @​rspack/core v2 (#1291) (24d12ec)

16.0.6 (2025-10-23)

Bug Fixes

  • cache fs calls for modern API

16.0.5 (2025-02-14)

Bug Fixes

  • allow to import CSS using @use with css extension (#1254) (3352e49)

16.0.4 (2024-12-04)

Bug Fixes

  • include sources map сontent for modern api by default (#1250) (70a10ff)

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for sass-loader since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
chore(deps-dev): bump sass-loader in /modules/gutenberg
56ffc34 
Bumps [sass-loader](https://github.com/webpack/sass-loader) from 13.3.3 to 17.0.0.
- [Release notes](https://github.com/webpack/sass-loader/releases)
- [Changelog](https://github.com/webpack/sass-loader/blob/main/CHANGELOG.md)
- [Commits](webpack/sass-loader@v13.3.3...v17.0.0)

---
updated-dependencies:
- dependency-name: sass-loader
  dependency-version: 17.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 2, 2026
@socket-security

socket-security Bot commented Jun 2, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Added@​wordpress/​eslint-plugin@​7.4.0991009710070
Updated@​wordpress/​icons@​9.49.0 ⏵ 2.10.310010083 -2100 +270
Added@​dr-kobros/​react-webfont-loader@​8.0.0751007875100
Addedgrunt-wp-readme-to-markdown@​2.1.07510010076100
Addedgrunt-json2php@​0.1.4751009977100
Added@​fonticonpicker/​react-fonticonpicker@​1.2.07610010075100
Addedgrunt-bumpup@​0.6.38110010075100
Addedgrunt-contrib-compress@​2.0.09910010075100
Addedgrunt-contrib-copy@​1.0.010010010075100
Addedgrunt-rtlcss@​2.0.28910010075100
Addedgrunt-text-replace@​0.4.010010010075100
Updatedcaniuse-lite@​1.0.30001780 ⏵ 1.0.30001765100 +110076 +195100
Addedgrunt@​1.6.1991007987100
Addedgrunt-wp-i18n@​1.0.4821008181100
Added@​lottiefiles/​react-lottie-player@​3.6.09810010082100
Addedgrunt-contrib-clean@​2.0.110010010085100
Addedgrunt-contrib-cssmin@​4.0.010010010085100
Addedgrunt-contrib-uglify@​5.2.210010010086100

View full report

@socket-security

socket-security Bot commented Jun 2, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn Critical
Critical CVE: Prototype Pollution in npm lodash

CVE: GHSA-jf85-cpcp-j695 Prototype Pollution in lodash (CRITICAL)

Affected versions: < 4.17.12

Patched version: 4.17.12

From: modules/gutenberg/package-lock.json → npm/grunt-json2php@0.1.4 → npm/lodash@2.4.2

ℹ Read more on: This package | This alert | What is a critical CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lodash@2.4.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants