Node-sass: v4.11.0 and v4.12.0 binaries say using libsass 3.5.4 instead of 3.5.5

[narve]

What the title says... at least for me, after doing a clean install of node-sass:

> npx node-sass --version
node-sass       4.11.0  (Wrapper)       [JavaScript]
libsass         3.5.4   (Sass Compiler) [C/C++]
> npm --version 
6.4.1
> node --version
v11.2.0

Please release a new version with 3.5.5 (or later) due to security vulnerabilities.

And at a minimum the documentation should be updated to state the version it actually uses.

If needed I can try to submit a PR.

(Windows 10 Enterprise, vr 10.0.16299, 64bit)

[saifali96]

Thanks @narve same here, I just checked as well. My security vulnerability scanners are crying since yesterday under CVE-2018-11693.

[wesgro]

4.12 still references 3.5.4

[hoona]

Same here, 4.12 referencing libsass 3.5.4, triggering vulnerabilities and making our security folks unhappy.

[saper]

From what I see only the version number did not get updated. The code is really using libsass 3.5.5.