You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@nx/webpack uses sass-loader@^12.2.0 which is 3 years old. It includes node-sass as a peerDependency and since some npm 7+ installs peerDependencies by default, this leads to some pretty old software with several vulnerabilities getting auto-installed.
node-sass has the following vulnerabilities reported:
The fix would be to update sass-loader to a recent version (14.2.1), and while the breaking changes are pretty small, I'm not sure how NX wants to handle them which is why I haven't opened a PR. That said, here is a cumulative list of breaking changes between v12 and v14:
removed fibers support
minimum supported Node.js version is 18.12.0 (627f55d)
@nx/webpack uses
sass-loader@^12.2.0
which is 3 years old. It includesnode-sass
as a peerDependency and since some npm 7+ installs peerDependencies by default, this leads to some pretty old software with several vulnerabilities getting auto-installed.node-sass
has the following vulnerabilities reported:request
: Server-side Request Forgery (SSRF) – medium severity, https://snyk.io/vuln/SNYK-JS-REQUEST-3361831The fix would be to update sass-loader to a recent version (14.2.1), and while the breaking changes are pretty small, I'm not sure how NX wants to handle them which is why I haven't opened a PR. That said, here is a cumulative list of breaking changes between v12 and v14:
@warning
as webpack warning webpack-contrib/sass-loader#1054) (58ffb68)The text was updated successfully, but these errors were encountered: