chore(deps): bump sass-loader from ^16.0.8 to v17 (main)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
sass-loader	^16.0.8 → ^17.0.0

---

Release Notes

webpack/sass-loader (sass-loader)

v17.0.0

Compare Source

Major Changes

• Add "auto" to the api option and make it the default. When the Sass implementation supports the modern compiler, "auto" enables it and reuses a single long-running compiler across files, which significantly improves build performance; otherwise it falls back to the modern API. (by @​alexander-akait in #​1319)

• Remove node-sass support. (by @​alexander-akait in #​1316)

• Minimum supported NodeJS version is 22.11.0. (by @​alexander-akait in #​1318)

• Convert source to native ECMAScript modules. The package now declares "type": "module" and exposes both an ESM and a CommonJS build via the exports field. CommonJS consumers continue to work via require, and ESM consumers can now import the loader directly. (by @​alexander-akait in #​1322)

• Remove legacy Sass JS API support. (by @​alexander-akait in #​1316)

Minor Changes

• Added types. (by @​alexander-akait in #​1312)

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

16.0.8 (2026-05-08)

Bug Fixes

• normalize separators in getPossibleRequests for Windows (#​1308) (#​1309) (90e349d)

16.0.7 (2026-02-05)

Bug Fixes

• update peer dependency for @​rspack/core v2 (#​1291) (24d12ec)

16.0.6 (2025-10-23)

Bug Fixes

• cache fs calls for modern API

16.0.5 (2025-02-14)

Bug Fixes

• allow to import CSS using @use with css extension (#​1254) (3352e49)

16.0.4 (2024-12-04)

Bug Fixes

• include sources map сontent for modern api by default (#​1250) (70a10ff)

16.0.3 (2024-11-01)

Bug Fixes

• modern-compiler: dispose redundant compilers (#​1245) (004ed38)

16.0.2 (2024-09-20)

Bug Fixes

• error message from sass (#​1231) (c75c606)

---

Configuration

📅 Schedule: (in timezone Europe/Vienna)

• Branch creation
  • Between 12:00 AM and 03:59 AM, on day 1 of the month (* 0-3 1 * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[ChristophWurst]

@coderabbitai review and try to spot any relevant breaking changes in this major bump

[coderabbitai]

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Find sass-loader config usage
rg -n "sass-loader" --type=json -C2
echo "---webpack config---"
fd -e js -e ts webpack | xargs rg -n "sass-loader" -C5
echo "---package.json engines/node---"
cat package.json | jq '.engines, .devDependencies["sass-loader"], .dependencies["sass-loader"]'
echo "---node version in CI---"
fd -g '*.yml' .github/workflows | xargs rg -n "node-version" -C1
echo "---sass version---"
cat package.json | jq '.devDependencies.sass, .dependencies.sass'
echo "---package-lock sass-loader entry---"
rg -n '"sass-loader"' package-lock.json -A5 | head -50

Length of output: 1251

---

🏁 Script executed:

#!/bin/bash
set -x
rg -n "sass-loader" -C5
echo "----package.json----"
jq '.engines, .devDependencies["sass-loader"], .dependencies["sass-loader"], .devDependencies.sass, .dependencies.sass' package.json
echo "----node ci----"
grep -rn "node-version" .github/workflows/ 2>/dev/null
echo "----webpack config----"
fd -e js webpack.config.js webpack.config.ts webpack.common.js 2>/dev/null
cat webpack.config.js 2>/dev/null | grep -n -A5 -B5 "sass"

Length of output: 1025

---

🏁 Script executed:

#!/bin/bash
grep -n "sass-loader" package.json

Length of output: 219

---

🏁 Script executed:

#!/bin/bash
grep -n "\"node\"" package.json

Length of output: 209

---

🏁 Script executed:

#!/bin/bash
grep -n "\"sass\"" package.json
echo "---"
grep -rn "node-sass" package.json package-lock.json 2>/dev/null | head -20
echo "---webpack sass config---"
grep -rln "sass-loader" --include="*.js" --include="*.ts" --include="*.mjs" . 2>/dev/null | grep -v node_modules

Length of output: 492

---

🏁 Script executed:

#!/bin/bash
grep -n -A10 -B10 "sass" webpack.common.js

Length of output: 604

---

@ChristophWurst I reviewed this major bump and checked the repo's actual usage. Good news — this looks like a safe upgrade with no required code changes:

• node-sass removed: Not applicable — the repo uses sass (Dart Sass) ^1.101.0, and I found no node-sass references anywhere in package.json/package-lock.json.
• Legacy Sass JS API removed: The scss rule in webpack.common.js (Lines 59-62) uses sass-loader with no explicit options object (use: ['style-loader', 'css-loader', 'sass-loader']), so there's no legacy-API config that would be affected.
• New default api: "auto": Since Dart Sass supports the modern compiler, this should transparently improve build performance without any config changes needed.
• Minimum Node.js 22.11.0: The repo already requires "node": "^24.0.0" (package.json, Line 116), so this is well within range.
• Native ESM + dual exports: Since sass-loader is referenced only by name in the webpack rules array (resolved internally by webpack, not via a direct require()/import in the repo's own code), this packaging change should be transparent.

Overall, I don't see any breaking-change fallout for this codebase from the v16 → v17 bump. I'd still recommend running a local npm run build (or equivalent) to sanity-check the SCSS compilation output before merging, since CI/sandbox here can't execute builds.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d7d41c63-9484-4df1-b96d-013448089a62

📥 Commits

Reviewing files that changed from the base of the PR and between fc2c216 and 9f35e5d.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• package.json

---

📝 Walkthrough

Walkthrough

This change updates the sass-loader devDependency version in package.json from ^16.0.8 to ^17.0.0. No other files or exported entities are affected.

Changes

File	Change Summary
package.json	Bumped sass-loader devDependency from ^16.0.8 to ^17.0.0

Sequence Diagram(s)

Not applicable — this is a single-line dependency version bump with no observable code flow to diagram.

Compact Metadata

• Type: Dependency update
• Impact: Build tooling only
• Lines changed: +1/-1

Related Issues: None specified

Related PRs: None specified

Suggested Labels: dependencies, javascript

Suggested Reviewers: None specified

Poem
A rabbit hopped through package.json's field,
Found one small number that had to yield,
Sixteen to seventeen, sass-loader anew,
A single-line hop, but the build stays true. 🐇

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the sass-loader major version bump reflected in the changeset.
Description check	✅ Passed	The description matches the dependency upgrade and summarizes the relevant release notes and review context.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}