dart-sass 1.108.1-2

Package Information

Description	command line Sass compiler Sass is a stylesheet language that is compiled to CSS. It allows one to use variables, nested rules, mixins, functions and more, all with a fully CSS-compatible syntax. This package provides the generic command name /usr/bin/sass and its manual page. The compiler behind it is one of the two builds of Dart Sass, the reference implementation of the language: dart-sass, a self-contained native executable, or node-sass, the dart2js build that runs on Node.js. The wrapper runs the native compiler when it is installed and the JavaScript build otherwise. The native build exists only on the architectures the Dart SDK is ported to (amd64, arm64, armhf, riscv64). On the others this package pulls in node-sass, so the command works everywhere at the cost of a Node.js dependency and some speed. See README.Debian.
Maintainer	Emfox Zhou <emfox@debian.org>
Changed By	Emfox Zhou <emfox@debian.org>
Sponsor	emfox@debian.org
Distribution	unstable
Architecture	all amd64 arm64 armhf riscv64
VCS	git: https://salsa.debian.org/dart-team/dart-sass.git (browse)
Popcon Installs	4
Binary NEW	Yes (new binary packages of a source already in sid)
Tracker	https://tracker.debian.org/pkg/dart-sass
Uploaded	2 hours ago

New Package Report

.changes◂

Source	dart-sass
Version	1.108.1-2
Changed-By	Emfox Zhou <emfox@debian.org>
Architecture	source amd64 all
Distribution	unstable
Date	Sun, 15 Nov 2026 20:20:00 +0800

Changelog◂

dart-sass (1.108.1-2) unstable; urgency=medium
 .
   * Build the command line compiler for Node.js as well.  debian/sass_npm.dart
     stands in for the entry point cli_pkg generates, so node-sass now ships
     sass.js next to the module, as upstream's npm package does.
   * Add the architecture: all package sass, which owns /usr/bin/sass and runs
     dart-sass when it is installed and the JavaScript build otherwise.  The
     Dart SDK is ported to four architectures only, so this restores the
     coverage that was lost when ruby-sass dropped its command line tools.
   * Depend on node-chokidar in node-sass, for sass --watch in the JavaScript
     build.
   * Run the autopkgtests with the new package where they need the generic
     command name.

.dsc◂

Section	web
Priority	optional
Component	main
Package-List	dart-sass deb web optional arch=amd64,arm64,armhf,riscv64 node-sass deb javascript optional arch=all sass deb web optional arch=all

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: dart-sass
Source: https://github.com/sass/dart-sass

Files: *
Copyright: 2016, Google Inc.
License: Expat

Files: debian/*
Copyright: 2026 Emfox Zhou <emfox@debian.org>
License: Expat

Files: pkg/sass-parser/lib/src/stringifier.ts
Copyright: 2013 Andrey Sitnik <andrey@sitnik.ru>
           2024, Google Inc.
License: Expat

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the
 "Software"), to deal in the Software without restriction, including
 without limitation the rights to use, copy, modify, merge, publish,
 distribute, sublicense, and/or sell copies of the Software, and to
 permit persons to whom the Software is furnished to do so, subject to
 the following conditions:
 .
 The above copyright notice and this permission notice shall be
 included in all copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
 EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
 MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
 NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
 LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
 OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
 WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

DFSG Assistant LLM REVIEW 0 blocker, 1 important, 3 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 1 hour ago.

Report◂

DFSG NEW review for dart-sass version 1.108.1-2

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: No
Issues: 0 blocker, 1 important, 3 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

The tree is uniformly MIT/Expat, and debian/copyright is DEP-5 with the three stanzas it needs: Files: * (2016 Google Inc.), debian/* (2026 Emfox Zhou) and the PostCSS-derived pkg/sass-parser/lib/src/stringifier.ts (2013 Andrey Sitnik plus 2024 Google Inc.), with the full Expat text. The only third-party code in the tree (that PostCSS portion) is named there, both LICENSE files are Expat/Google 2016, and nothing non-free or unlicensed was found. Every file is matched by a stanza whose holder and licence agree with its own notice.

Packaging

The structure is sound: three packages split sensibly, compat 14, no patches, four autopkgtests, correct Breaks/Replaces against the old dart-sass and ruby-sass, and build dependencies that match the pubspec. But the native compiler it ships answers the embedded protocol's version handshake with empty strings, an arch-only build (dpkg-buildpackage -B) fails in override_dh_fixperms, and the new arch:all sass package is marked Multi-Arch: foreign although its behaviour differs by architecture; the dart-sass(1) page was not updated for the -2 split either.

Issues

important packaging 1. dart-sass --embedded reports an empty protocol version and compiler version ◂

Files: debian/rules:44, lib/src/embedded/isolate_dispatcher.dart:169-171, test/embedded/protocol_test.dart:110, tool/grind.dart:127-136
Basis: checked, in the package or with a reference tool
Evidence: debian/rules: dart compile exe -Dversion=$(DEB_VERSION_UPSTREAM) bin/sass.dart -o build/dart-sass; isolate_dispatcher.dart: ..protocolVersion = const String.fromEnvironment("protocol-version") ..compilerVersion = const String.fromEnvironment("compiler-version"); the package's own test expects a parsable version: Version.parse(response.protocolVersion); // shouldn't throw
Problem: Nothing in debian/rules defines the protocol-version or compiler-version environment constants; upstream's build supplies them from pkg.environmentConstants (tool/grind.dart:130-135, "protocol-version": File('build/language/spec/EMBEDDED_PROTOCOL_VERSION'), "compiler-version": pkg.pubspec.version). With no -D flag both compile to the empty string, so dart-sass --embedded --version and every VersionResponse carry protocolVersion="", compilerVersion="" and implementationVersion="" — a version host implementations parse to check protocol compatibility, as this package's own test does. README.Debian and sass(1) advertise the embedded protocol as the native build's distinguishing feature, so the shipped binary does not provide what the package documents.
Fix: Pass both constants on the dart compile exe line, as upstream does: -Dcompiler-version=$(DEB_VERSION_UPSTREAM) and -Dprotocol-version=<version of embedded_sass.proto that the checked-in .pb files were generated from> (that number is not in the tarball; take it from the EMBEDDED_PROTOCOL_VERSION of the sass/sass revision the protocol files match, or patch isolate_dispatcher.dart to a default).

minor packaging 2. dpkg-buildpackage -B fails: override_dh_fixperms chmods a file binary-arch never installs ◂

Files: debian/rules:69-71
Basis: checked, in the package or with a reference tool
Evidence: override_dh_fixperms:\n\tdh_fixperms\n\tchmod 755 debian/node-sass/usr/share/nodejs/sass/sass.js
Problem: dh runs the binary-arch sequence with -a (dh(1), INTERNALS: "commands in the ... binary-arch sequences are passed the -a option"), and the bare dh_install in override_dh_install inherits that through DH_INTERNAL_OPTIONS, so only debian/dart-sass is populated. debian/node-sass then does not exist and the unguarded chmod fails the build. Policy 4.9 requires the binary-arch target to succeed, and the loop in override_dh_install is already guarded with if [ -d ... ] for exactly this reason; the chmod was not.
Fix: Guard it, e.g. if [ -e debian/node-sass/usr/share/nodejs/sass/sass.js ]; then chmod 755 debian/node-sass/usr/share/nodejs/sass/sass.js; fi. The bit is already set by make-node-module.py (os.chmod(..., 0o755)) and preserved by dh_install, so the chmod is only belt and braces.

minor packaging 3. sass is Multi-Arch: foreign although /usr/bin/sass behaves differently on each architecture ◂

Files: debian/control:38-40, debian/README.Debian:60-75
Basis: checked, in the package or with a reference tool
Evidence: Architecture: all / Multi-Arch: foreign / Depends: dart-sass | node-sass; README.Debian: "sass --embedded is unavailable in pure JS mode"; control: "The native build exists only on the architectures the Dart SDK is ported to"
Problem: Policy 5.6.34.2 forbids Multi-Arch: foreign when the behaviour of the installed files or the package's dependencies exposes the architecture. The same /usr/bin/sass wrapper runs the native compiler (which supports --embedded) on amd64/arm64/armhf/riscv64 and the JavaScript build (which does not) elsewhere, and --version already says which build it is, so the command's interface is architecture-dependent. The declaration gains nothing for an Architecture: all package and misstates the interface.
Fix: Drop Multi-Arch: foreign from the sass binary package.

minor packaging 4. dart-sass(1) is stamped 1.105.0 and still says dart-sass installs sass(1) ◂

Files: debian/dart-sass.1:1, debian/dart-sass.1:21-23
Basis: checked, in the package or with a reference tool
Evidence: .TH DART-SASS 1 "2026-09-29" "dart-sass 1.105.0"; "It is installed under this name and, under the generic name, sass(1)."
Problem: Since 1.108.1-2 the dart-sass package no longer installs /usr/bin/sass or its manual page — they belong to the new sass package — and the page still documents the pre-split layout, carries a version three upstream releases old in its footer, and omits --embedded, which the package itself presents as the one feature of the native build. The page needs updating for the change the same upload makes.
Fix: Update the .TH version/date, rewrite the DESCRIPTION so it says /usr/bin/sass belongs to the sass package (pointing at sass(1)), and document --embedded.

Verified ◂

debian/copyright read in full: DEP-5, correct Format URL, three Files stanzas (* = 2016 Google Inc., Expat; debian/* = 2026 Emfox Zhou, Expat; pkg/sass-parser/lib/src/stringifier.ts = 2013 Andrey Sitnik andrey@sitnik.ru + 2024 Google Inc., Expat) and the stand-alone License: Expat text, which is the full Expat licence. No Files-Excluded.
Copyright evidence collected across the whole tree by grep: ~620 files carry the identical // Copyright 20xx Google Inc. ... MIT-style license header; the only other holder anywhere is Andrey Sitnik, in the PostCSS-derived block at pkg/sass-parser/lib/src/stringifier.ts:5-25, which the copyright file names in its own stanza.
Prescan group 1 (pkg/sass-parser/lib/src/statement/forward-rule.test.ts:1) reads Copyright 2024 Google Inc. Forward of this source code ... — "Forward" is a typo for "Use" in upstream's header; holder Google Inc., covered by Files: *.
Prescan group 2 (pkg/sass-parser/lib/src/import-list.ts:1 and pkg/sass-parser/lib/src/statement/import-rule.ts:1) reads Copyright 2025 Google Inc. Import of this source code ... — same typo for "Use"; holder Google Inc., covered by Files: *.
Prescan group 3 (Google LLC) occurs in CONTRIBUTING.md:221, lib/src/configuration.dart:1, lib/src/configured_value.dart:1, lib/src/deprecation.dart:1, lib/src/js/compiler.dart:1, lib/src/js/deprecations.dart:1, lib/src/util/lazy_file_span.dart:1, test/embedded/file_importer_test.dart:1 and tool/grind/generate_deprecations.dart:1. It is the same company as the "Google Inc." that upstream's LICENSE and the Files: * stanza name (renamed in 2017), so no holder is missing or misstated; no third party is involved.
AUTHORS is a contributor list ("Below is a list of people and organizations that have contributed"), not a copyright notice; its second entry (Marks and Spencer Plc. / John Harvey) carries no notice of its own and CONTRIBUTING.md states contributions are made under Google's CLA, so Files: * naming Google Inc. is accurate.
Both LICENSE files (root and pkg/sass_api/LICENSE) are Expat with Copyright (c) 2016, Google Inc.; pkg/sass-parser/package.json and pkg/sass-types/package.json both declare "license": "MIT"; the sass-api pubspec has no separate terms.
No images, fonts, sounds, PDFs, archives or minified JavaScript in the tree (extension glob over the whole source); no build/ or .dart_tool/ artifacts; grep for non-commercial, no-modification, field-of-use and "Good, not Evil" wording found only ordinary error messages and prose.
lib/src/embedded/embedded_sass.pb.dart, .pbenum.dart and .pbjson.dart say This is a generated file - do not edit. Generated from embedded_sass.proto; the .proto is not in the tarball (it lives in the sass/sass spec repository and tool/grind.dart regenerates with buf), but the generated Dart is what upstream maintains in git and what the build compiles, not a product of this build.
debian/ read completely except watch (reviewed separately): control, rules, changelog, copyright, both .install files, both .manpages files, both man pages, lintian overrides, gen-package-config.py, make-node-module.py, sass_npm.dart, sass-wrapper.sh, README.Debian, gbp.conf, upstream/metadata, source/format, tests/control and all four test scripts. No debian/patches directory; format 3.0 (quilt); compat 14; Standards-Version 4.7.4 against the reviewing system's 4.7.4.1.
Runtime requirements of the generated module match the package: sass.node.js requires immutable and sass.js additionally chokidar, both in node-sass's Depends, with node-immutable 5.1.9 satisfying ^5.1.5; @parcel/watcher is an optional lazy require wrapped in try/catch (make-node-module.py:196-205). nodejs is Multi-Arch: allowed, so nodejs:any is valid.
Build dependencies cover the imports compiled into both builds (dart-args, dart-cli-pkg, dart-cli-repl, dart-native-synchronization, dart-node-interop, dart-node-preamble, dart-protobuf, dart-watcher and the rest); package:http and package:typed_data appear only in tool/ and not at all, so they need not be build dependencies. dart-sdk 3.13.7 in the archive satisfies >= 3.13.4.
The four autopkgtests are coherent: cli is restricted to the four native architectures, sass exercises /usr/bin/sass on every architecture, node and sass-js test the module and the JS launcher.
uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 1.108.2, packaged 1.108.1), which is not a fault of the package.

Not confirmed ◂

The node_preamble JavaScript that debian/make-node-module.py inlines into the installed sass.dart.js comes from the dart-node-preamble build dependency, which is not installed on this system; whether that file carries its own licence notice into the shipped bundle could not be checked.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader was emailed about the review 1 hour ago.

Other Reviews of this Package

Version	Hash	Allocated	Completed	Reviewer	Status	Details
1.105.0-1	e7dbbaf2…	2026-09-27 04:55	2026-09-27 05:10	awm	accepted	VIEW

Back to Dashboard | View all reviews for this package