Update dependency node-sass to v7 [SECURITY] by renovate[bot] · Pull Request #55 · veritone/veritone-app-boilerplate-react

renovate · 2025-01-27T21:07:18Z

This PR contains the following updates:

Package	Change	Age	Confidence
node-sass	`^4.9.0` → `^7.0.0`

Denial of Service in node-sass

GHSA-9v62-24cr-58cx

More information

Details

Affected versions of node-sass are vulnerable to Denial of Service (DoS). Crafted objects passed to the renderSync function may trigger C++ assertions in CustomImporterBridge::get_importer_entry and CustomImporterBridge::post_process_return_value that crash the Node process. This may allow attackers to crash the system's running Node process and lead to Denial of Service.

Recommendation

Upgrade to version 4.13.1 or later

Severity

CVSS Score: 5.9 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Improper Certificate Validation in node-sass

CVE-2020-24025 / GHSA-r8f7-9pfq-mjmv

More information

Details

Certificate validation in node-sass 2.0.0 to 6.0.1 is disabled when requesting binaries even if the user is not specifying an alternative download path.

Severity

CVSS Score: 5.3 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

sass/node-sass (node-sass)

`v7.0.0`

Compare Source

Breaking changes

Drop support for Node 15 (@nschonni)
Set rejectUnauthorized to true by default (@scott-ut, #3149)

Features

Add support for Node 17 (@nschonni)

Dependencies

Bump eslint from 7.32.0 to 8.0.0 (@nschonni, #3191)
Bump fs-extra from 0.30.0 to 10.0.0 (@nschonni, #3102)
Bump npmlog from 4.1.2 to 5.0.0 (@nschonni, #3156)
Bump chalk from 1.1.3 to 4.1.2 (@nschonni, #3161)

Community

Remove double word "support" from documentation (@pzrq, #3159)

Misc

Bump various GitHub Actions dependencies (@nschonni)

Supported Environments

OS	Architecture	Node
Windows	x86 & x64	12, 14, 16, 17
OSX	x64	12, 14, 16, 17
Linux*	x64	12, 14, 16, 17
Alpine Linux	x64	12, 14, 16, 17
FreeBSD	i386 amd64	12, 14

*Linux support refers to major distributions like Ubuntu, and Debian

`v6.0.1`

Compare Source

Dependencies

Remove mkdirp (@jimmywarting, #3108)
Bump meow to 9.0.0 (@ykolbin, #3125)
Bump mocha to 9.0.1 (@xzyfer, #3134)

Misc

Use default Apline version from docker-node (@nschonni, #3121)

Supported Environments

OS	Architecture	Node
Windows	x86 & x64	12, 14, 15, 16
OSX	x64	12, 14, 15, 16
Linux*	x64	12, 14, 15, 16
Alpine Linux	x64	12, 14, 15, 16
FreeBSD	i386 amd64	12, 14, 15

*Linux support refers to major distributions like Ubuntu, and Debian

`v6.0.0`

Compare Source

Breaking changes

Drop support for Node 10 (@nschonni)
Remove deprecated process.sass API (@xzyfer, #2986)

Features

Add support for Node 16

Community

Fix typos in Troubleshooting guide (@independencyinjection, #3051)
Improve dependabot configuration (@nschonni)

Supported Environments

OS	Architecture	Node
Windows	x86 & x64	12, 14, 15, 16
OSX	x64	12, 14, 15, 16
Linux*	x64	12, 14, 15, 16
Alpine Linux	x64	12, 14, 15, 16
FreeBSD	i386 amd64	12, 14, 15

*Linux support refers to major distributions like Ubuntu, and Debian

`v5.0.0`

Compare Source

Breaking changes

Only support LTS and current Node versions (@nschonni)
Remove deprecated process.sass API (@xzyfer, #2986)

Features

Add support for Node 15
New node-gyp version that supports building with Python 3

Community

More inclusive documentation (@rgeerts, #2944)
Enabled dependabot (@nschonni)
Improve release automation (@nschonni)

Fixes

Bumped many dependencies (@nschonni)

Supported Environments

OS	Architecture	Node
Windows	x86 & x64	10, 12, 14, 15
OSX	x64	10, 12, 14, 15
Linux*	x64	10, 12, 14, 15
Alpine Linux	x64	10, 12, 14, 15
FreeBSD	i386 amd64	10, 12, 14, 15

*Linux support refers to major distributions like Ubuntu, and Debian

`v4.14.1`

Compare Source

Community

Add GitHub Actions for Alpine CI (@nschonni, #2823)

Fixes

Bump sass-graph@2.2.5 (@xzyfer, #2912)

Supported Environments

OS	Architecture	Node
Windows	x86 & x64	0.10, 0.12, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14
OSX	x64	0.10, 0.12, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14
Linux*	x86 & x64	0.10, 0.12, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10^, 11^, 12^, 13^, 14**^
Alpine Linux	x64	6, 8, 10, 11, 12, 13, 14
FreeBSD	i386 amd64	10, 12, 13

*Linux support refers to Ubuntu, Debian, and CentOS 5+
** Not available on CentOS 5
^ Only available on x64

Configuration

📅 Schedule: (UTC)

Branch creation
- ""
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

orca-security-us

Orca Security Scan Summary

Status	Check	Issues by priority
Passed	Infrastructure as Code	0 0 0 0	View in Orca
Passed	Secrets	0 0 0 0	View in Orca
Passed	Vulnerabilities	0 0 0 0	View in Orca

orca-security-us

Orca Security Scan Summary

Status	Check	Issues by priority
Passed	Infrastructure as Code	0 0 0 0	View in Orca
Passed	Secrets	0 0 0 0	View in Orca
Passed	Vulnerabilities	0 0 0 0	View in Orca

cycode-security · 2026-02-13T19:26:57Z

GHSA-fjxv-7rqg-78g4

@@ -4337,6 +4558,15 @@ form-data@~2.3.1:
    combined-stream "1.0.6"
    mime-types "^2.1.12"

+form-data@~2.3.2:


❗Cycode: Security vulnerabilities found in newly introduced dependency.

Ecosystem NPM

Dependency form-data

Dependency Paths node-sass 7.0.3 -> request 2.88.2 -> form-data 2.3.3

Direct Dependency No

Development Dependency Yes

The following vulnerabilities were introduced:

GHSA CVE Severity Fixed Version

GHSA-fjxv-7rqg-78g4 CVE-2025-7783 CRITICAL 2.5.4

Highest fixed version: 2.5.4

Description

Detects when new vulnerabilities affect your dependencies.

Tell us how you wish to proceed using one of the following commands:

Tag Short Description

#cycode_ignore_package_here <reason> Applies to this manifest for this package in this request only

⚠️ When commenting on Github, you may need to refresh the page to see the latest updates.

orca-security-us Bot reviewed Jan 27, 2025

View reviewed changes

renovate Bot force-pushed the renovate/npm-node-sass-vulnerability branch from ea33fba to 6662825 Compare August 14, 2025 16:13

orca-security-us Bot reviewed Aug 14, 2025

View reviewed changes

renovate Bot force-pushed the renovate/npm-node-sass-vulnerability branch from 6662825 to 4c22807 Compare September 26, 2025 07:46

renovate Bot force-pushed the renovate/npm-node-sass-vulnerability branch from 4c22807 to 7f04e0e Compare October 25, 2025 20:03

renovate Bot force-pushed the renovate/npm-node-sass-vulnerability branch from 7f04e0e to f3ad197 Compare November 15, 2025 16:15

renovate Bot force-pushed the renovate/npm-node-sass-vulnerability branch from f3ad197 to 0f457fb Compare December 5, 2025 11:13

renovate Bot force-pushed the renovate/npm-node-sass-vulnerability branch from 0f457fb to 8b072da Compare January 19, 2026 23:28

renovate Bot force-pushed the renovate/npm-node-sass-vulnerability branch from 8b072da to e07be52 Compare February 3, 2026 23:32

renovate Bot force-pushed the renovate/npm-node-sass-vulnerability branch from e07be52 to 1eb8ca7 Compare February 13, 2026 19:26

cycode-security Bot reviewed Feb 13, 2026

View reviewed changes

renovate Bot force-pushed the renovate/npm-node-sass-vulnerability branch from 1eb8ca7 to 02fafe9 Compare March 8, 2026 11:04

renovate Bot force-pushed the renovate/npm-node-sass-vulnerability branch from 02fafe9 to 2850a46 Compare April 15, 2026 17:04

renovate Bot force-pushed the renovate/npm-node-sass-vulnerability branch from 2850a46 to c6e4429 Compare May 1, 2026 11:15

renovate Bot force-pushed the renovate/npm-node-sass-vulnerability branch from c6e4429 to c60b43a Compare May 14, 2026 00:17

renovate Bot force-pushed the renovate/npm-node-sass-vulnerability branch from c60b43a to 3133d52 Compare May 23, 2026 08:13

Update dependency node-sass to v7 [SECURITY]

90b90f0

renovate Bot force-pushed the renovate/npm-node-sass-vulnerability branch from 3133d52 to 90b90f0 Compare May 30, 2026 15:43

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update dependency node-sass to v7 [SECURITY]#55

Update dependency node-sass to v7 [SECURITY]#55
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/npm-node-sass-vulnerability

renovate Bot commented Jan 27, 2025 •

edited

Loading

Uh oh!

orca-security-us Bot left a comment

Uh oh!

orca-security-us Bot left a comment •

edited

Loading

Uh oh!

cycode-security Bot Feb 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants


Ecosystem	NPM
Dependency	`form-data`
Dependency Paths	`node-sass 7.0.3 -> request 2.88.2 -> form-data 2.3.3`
Direct Dependency	No
Development Dependency	Yes

Conversation

renovate Bot commented Jan 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Denial of Service in node-sass

Details

Recommendation

Severity

References

Improper Certificate Validation in node-sass

Details

Severity

References

Release Notes

Breaking changes

Features

Dependencies

Community

Misc

Supported Environments

Dependencies

Misc

Supported Environments

Breaking changes

Features

Community

Supported Environments

Breaking changes

Features

Community

Fixes

Supported Environments

Community

Fixes

Supported Environments

Configuration

Uh oh!

orca-security-us Bot left a comment

Choose a reason for hiding this comment

Orca Security Scan Summary

Uh oh!

orca-security-us Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Orca Security Scan Summary

Uh oh!

cycode-security Bot Feb 13, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Jan 27, 2025 •

edited

Loading

orca-security-us Bot left a comment •

edited

Loading