Dependency on sass-convert (unmaintained + vulnerabilities)

[bulutfatih]

Hi SassDoc maintainers 👋

While integrating SassDoc into a modern build pipeline I noticed that the package still depends on sass-convert.

Unfortunately sass-convert (Ruby-based) has been unmaintained for ≈10 years and flagged with multiple vulnerabilities.

Because SassDoc ships sass-convert as a production dependency, every downstream consumer inherits these risks. Most security scanners now fail our builds by default.

Would it be possible to replace it with a maintained one alternative?

Thanks a lot 🙏

[pascalduez]

Hello @bulutfatih,

as far as I can tell nobody here will have time or interest in maintaining our own sass-convert. This has always been a sort of hack/workaround.
I'm not aware of any other alternatives, at least the last time I searched.
Furthermore Sass (at least dart Sass) does not offer a convertion tool anymore as well.

I guess one of the only thing we could do here is release a major version of sassdoc without sass-convert, and in such no indented syntax support. But even this is not trivial, as sassdoc core is also lagging very badly in term of maintenance and dependencies updates.

Help welcome.

[diqidoq]

Consider modern alternatives to SassDoc for generating SCSS/CSS documentation like Docco (not StyleDocco), Fractal or Styledown. These tools are generally better maintained and offer more comprehensive design system documentation (including color palettes and typography) compared to older tools like KSS or StyleDocco, or standard SassDoc. Tools with more use cases have more momentum and this is more satisfiyng for maintainers (I feel you) to work on. I assume user activity on sassdoc is quit low. I think that is one of the reasons why sassdoc is not actively maintained at the moment and has no resources to disable functionality depending on 10 years old packages. For those who care I would recommend to walk down the road and submit an issue on SASS/SCSS itself to bring them together with sassdoc to discuss if sassdoc should be further promoted on the sass documentation and websites or if SASS maintainers want to keep it and can bring in some resources to further maintaining the sassdoc project. Do not forget that most maintainers do this work in their spair free time.

[ryuran]

Hi @diqidoq can you give some links ?
I don't find a good alternative to document mixins, parameters, list, etc.