Skip to content

chore(deps-dev): bump sass from 1.99.0 to 1.101.3 in the npm-minor-patch group - #12

Closed
dependabot[bot] wants to merge 5 commits into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-61faa3407c
Closed

chore(deps-dev): bump sass from 1.99.0 to 1.101.3 in the npm-minor-patch group#12
dependabot[bot] wants to merge 5 commits into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-61faa3407c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 21, 2026

Copy link
Copy Markdown

Bumps the npm-minor-patch group with 1 update: sass.

Updates sass from 1.99.0 to 1.101.3

Release notes

Sourced from sass's releases.

Dart Sass 1.101.3

To install Sass 1.101.3, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

  • No user-visible changes.

See the full changelog for changes in earlier releases.

Dart Sass 1.101.0

To install Sass 1.101.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

  • Potentially breaking bug fix: The Node package importer now properly supports resolving import-only variants of Sass files declared in the exports, sass, and style fields of package.json. Previously, these files were ignored even when loaded via @import, so any code relying on loading module-system-only files this way may break.

See the full changelog for changes in earlier releases.

Dart Sass 1.100.0

To install Sass 1.100.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

  • Writing two compound selectors adjacent to one another without any whitespace between them, such as [class]a, is now deprecated. This was always an error in CSS and Sass only supported it by mistake.

    See the Sass website for details.

See the full changelog for changes in earlier releases.

Changelog

Sourced from sass's changelog.

1.101.3

  • No user-visible changes.

1.101.2

  • Fix a bug where the deprecation warning for vendor-prefixed expression() functions would incorrectly indicate whether or not the function would be invalid Sass in Dart Sass 2.0.0.

1.101.1

  • Sass stack trace entries are now always either absolute URLs, absolute paths, or paths relative to the current working directory. Previously, if a stylesheet was loaded using a relative URL (as from a load path), that relative URL was listed even if it couldn't be resolved relative to the current working directory. However, this created potential ambiguities, so this behavior has been removed.

Command Line Interface

  • --watch mode now handles atomically-written files more gracefully.

1.101.0

  • Potentially breaking bug fix: The Node package importer now properly supports resolving import-only variants of Sass files declared in the exports, sass, and style fields of package.json. Previously, these files were ignored even when loaded via @import, so any code relying on loading module-system-only files this way may break.

1.100.0

  • Writing two compound selectors adjacent to one another without any whitespace between them, such as [class]a, is now deprecated. This was always an error in CSS and Sass only supported it by mistake.

    See the Sass website for details.

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

vickym1010 and others added 5 commits July 21, 2026 23:56
@vickym1010
chore(deps): refresh dependencies to clear security advisories
83b1c8c 
Refresh backend (Composer) and frontend (npm) lockfiles within their
existing version constraints to pull in security patches.

- laravel/framework 13.6.0 -> 13.21.1 (fixes high-severity advisories)
- symfony/* and guzzlehttp/* patched
- axios 1.15.2 -> 1.18.1 plus transitive npm fixes

composer audit and npm audit now report no known vulnerabilities.
@vickym1010
chore(tooling): add static analysis, code style, and Dependabot
f33399f 
- Add Larastan/PHPStan (level 5) via phpstan.neon and `composer analyse`.
- Add explicit pint.json (Laravel preset) plus `composer lint`/`lint:test`.
- Enforce Pint style check and PHPStan analysis in the CI pipeline.
- Add Dependabot config (Composer, npm, GitHub Actions; weekly).
- Add a pull request template and un-ignore both new .github files.
- Resolve all PHPStan level 5 findings: guard ReflectionNamedType before
  getName(), correct model factory return types, and use list<string>
  for the User $fillable/$hidden annotations.
@vickym1010
refactor(auth): enforce granular permissions and route-model binding
d5f36e0 
- Gate admin routes with role_or_permission:superadmin|<permission> so
  non-superadmin roles can be granted specific capabilities. Superadmin
  behaviour is unchanged (it retains all permissions).
- Adopt route-model binding for user, activity-log, and file routes. The
  {file} binding is scoped to the authenticated user, so foreign files
  resolve to a 404 (existence is never leaked across accounts).
- Restrict the file manager show endpoint to an explicit safe field
  subset (no storage path or owner id in the JSON response).
- Enforce authorization in the settings, notification, and role Form
  Requests instead of returning true.
- Add feature tests for the permission gates and the hardened show response.
@vickym1010
docs: document tooling, security, and permission updates
eb51b1c 
Update README (Testing & Quality, CI Pipeline) and add a 4.2.0
CHANGELOG entry covering the dependency/security refresh, static
analysis, granular permissions, and file manager hardening.
@dependabot
chore(deps-dev): bump sass in the npm-minor-patch group
bd6fa5c 
Bumps the npm-minor-patch group with 1 update: [sass](https://github.com/sass/dart-sass).


Updates `sass` from 1.99.0 to 1.101.3
- [Release notes](https://github.com/sass/dart-sass/releases)
- [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md)
- [Commits](sass/dart-sass@1.99.0...1.101.3)

---
updated-dependencies:
- dependency-name: sass
  dependency-version: 1.101.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 21, 2026
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Jul 21, 2026

Copy link
Copy Markdown

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

@dependabot @github

dependabot Bot commented on behalf of github Jul 22, 2026

Copy link
Copy Markdown
Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm-minor-patch-61faa3407c branch July 22, 2026 00:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@vickymaulana @vickym1010