chore(deps): update dependency svgo to v4.1.0

renovate commented

2026-07-11 21:00:16 +02:00

Collaborator

This PR contains the following updates:

Package	Type	Update	Change
svgo (source)	devDependencies	minor	`4.0.1` → `4.1.0`

Release Notes

svg/svgo (svgo)

`v4.1.0`

Compare Source

This minor release upgrades the SAX parser and introduces stricter XML validation. It also includes important security hardening for removeScripts, dependency updates, and improvements to the test and regression infrastructure.

Support SVGO

If SVGO is valuable to you or your organization, please consider supporting the project on OpenCollective. Your sponsorship helps fund ongoing maintenance and security work.

Stricter XML validation

SVGO now uses sax 1.6.1, upgraded from 1.5.0 (#2257).

The new parser version validates numeric character references against the ranges permitted by XML. Invalid references are now rejected in both text and attributes, including:

disallowed control characters such as &#1;, , and ;
UTF-16 surrogate code points such as &#xD800;;
invalid XML code points such as .

Valid boundary values—including U+0020, U+D7FF, U+E000, U+FFFD, and characters through U+10FFFF—remain supported.

Parser failures are consistently exposed as SvgoParserError errors with an Invalid character entity reason.

This is an intentional behavior change: malformed SVGs that were previously accepted may now produce a parser error, while valid XML documents are unaffected.

Security

The removeScripts plugin has been hardened against several script-execution bypasses:

Filters executable data: URLs containing HTML, XHTML, or SVG documents while preserving inert data such as PNG images, and filters legacy vbscript: URLs (#2263).
Sanitizes content inside SVG <foreignObject> elements by removing HTML event-handler attributes, srcdoc, and executable URLs from action, data, formaction, href, and src, while preserving non-executable HTML and visual content (#2264).
Recognizes namespace-prefixed SVG <a> elements and removes ASCII tabs and newlines before checking URL schemes, preventing values such as java&#9;script: from bypassing detection while preserving elements in unrelated custom namespaces (#2268).

These changes address:

Dependencies

Upgraded css-select to v6 and css-what to v7, and updated SVGO's custom selector adapter for css-select v6 (#2244).

Project maintenance

@TrySound is back as an active SVGO maintainer.

Many thanks to @KTibow, @SethFalco, and @XhmikosR for maintaining and improving SVGO over the past several years.

Full Changelog: https://github.com/svg/svgo/compare/v4.0.2...v4.1.0

`v4.0.2`

Compare Source

What's Changed

Security

removeScripts, remove JavaScript URIs case-insensitively and make <script> handling namespace aware. By @SethFalco

Bug Fixes

convertColors, skip case-normalization for CSS custom properties. By @SethFalco in #2213
convertPathData, improve handling of consecutive t commands. By @KTibow in #2156
convertPathData, safer handling of paths. By @KTibow in #2158
Improve parsing of negative (or +) arc radii. By @KTibow in #2205
When converting to a data URI, only encode it as a data URI once. By @johnkenny54 in #2053

Performance

mergePaths, speed up child node removal. By @mozzie in #2216

Other Changes

removeAttributesBySelector, log warning and noop if missing parameters. By @KTibow in #2215

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [svgo](https://svgo.dev) ([source](https://github.com/svg/svgo)) | devDependencies | minor | [`4.0.1` → `4.1.0`](https://renovatebot.com/diffs/npm/svgo/4.0.1/4.1.0) | --- ### Release Notes <details> <summary>svg/svgo (svgo)</summary> ### [`v4.1.0`](https://github.com/svg/svgo/releases/tag/v4.1.0) [Compare Source](https://github.com/svg/svgo/compare/v4.0.2...v4.1.0) This minor release upgrades the SAX parser and introduces stricter XML validation. It also includes important security hardening for `removeScripts`, dependency updates, and improvements to the test and regression infrastructure. ##### Support SVGO If SVGO is valuable to you or your organization, please consider [supporting the project on OpenCollective](https://opencollective.com/svgo). Your sponsorship helps fund ongoing maintenance and security work. ##### Stricter XML validation SVGO now uses [`sax` 1.6.1](https://www.npmjs.com/package/sax), upgraded from 1.5.0 ([#2257](https://github.com/svg/svgo/pull/2257)). The new parser version validates numeric character references against the ranges permitted by XML. Invalid references are now rejected in both text and attributes, including: - disallowed control characters such as `&#1;`, ``, and ``; - UTF-16 surrogate code points such as `&#xD800;`; - invalid XML code points such as ``. Valid boundary values—including `U+0020`, `U+D7FF`, `U+E000`, `U+FFFD`, and characters through `U+10FFFF`—remain supported. Parser failures are consistently exposed as `SvgoParserError` errors with an `Invalid character entity` reason. This is an intentional behavior change: malformed SVGs that were previously accepted may now produce a parser error, while valid XML documents are unaffected. ##### Security The [`removeScripts`](https://svgo.dev/docs/plugins/removeScripts/) plugin has been hardened against several script-execution bypasses: - Filters executable `data:` URLs containing HTML, XHTML, or SVG documents while preserving inert data such as PNG images, and filters legacy `vbscript:` URLs ([#2263](https://github.com/svg/svgo/pull/2263)). - Sanitizes content inside SVG `<foreignObject>` elements by removing HTML event-handler attributes, `srcdoc`, and executable URLs from `action`, `data`, `formaction`, `href`, and `src`, while preserving non-executable HTML and visual content ([#2264](https://github.com/svg/svgo/pull/2264)). - Recognizes namespace-prefixed SVG `<a>` elements and removes ASCII tabs and newlines before checking URL schemes, preventing values such as `java&#9;script:` from bypassing detection while preserving elements in unrelated custom namespaces ([#2268](https://github.com/svg/svgo/pull/2268)). These changes address: - [GHSA-4vpr-x523-8j87](https://github.com/svg/svgo/security/advisories/GHSA-4vpr-x523-8j87) - [GHSA-w27v-7q3p-w38r](https://github.com/svg/svgo/security/advisories/GHSA-w27v-7q3p-w38r) ##### Dependencies - Upgraded `css-select` to v6 and `css-what` to v7, and updated SVGO's custom selector adapter for `css-select` v6 ([#2244](https://github.com/svg/svgo/pull/2244)). ##### Project maintenance [@TrySound](https://github.com/TrySound) is back as an active SVGO maintainer. Many thanks to [@KTibow](https://github.com/KTibow), [@SethFalco](https://github.com/SethFalco), and [@XhmikosR](https://github.com/XhmikosR) for maintaining and improving SVGO over the past several years. **Full Changelog:** <https://github.com/svg/svgo/compare/v4.0.2...v4.1.0> ### [`v4.0.2`](https://github.com/svg/svgo/releases/tag/v4.0.2) [Compare Source](https://github.com/svg/svgo/compare/v4.0.1...v4.0.2) #### What's Changed ##### Security - [removeScripts](https://svgo.dev/docs/plugins/removeScripts/), remove JavaScript URIs case-insensitively and make `<script>` handling namespace aware. By [@SethFalco](https://github.com/SethFalco) ##### Bug Fixes - [convertColors](https://svgo.dev/docs/plugins/convertColors/), skip case-normalization for CSS custom properties. By [@SethFalco](https://github.com/SethFalco) in [#2213](https://github.com/svg/svgo/pull/2213) - [convertPathData](https://svgo.dev/docs/plugins/convertPathData/), improve handling of consecutive `t` commands. By [@KTibow](https://github.com/KTibow) in [#2156](https://github.com/svg/svgo/pull/2156) - [convertPathData](https://svgo.dev/docs/plugins/convertPathData/), safer handling of paths. By [@KTibow](https://github.com/KTibow) in [#2158](https://github.com/svg/svgo/issues/2158) - Improve parsing of negative (or +) arc radii. By [@KTibow](https://github.com/KTibow) in [#2205](https://github.com/svg/svgo/pull/2205) - When converting to a data URI, only encode it as a data URI once. By [@johnkenny54](https://github.com/johnkenny54) in [#2053](https://github.com/svg/svgo/pull/2053) ##### Performance - [mergePaths](https://svgo.dev/docs/plugins/mergePaths/), speed up child node removal. By [@mozzie](https://github.com/mozzie) in [#2216](https://github.com/svg/svgo/pull/2216) ##### Other Changes - [removeAttributesBySelector](https://svgo.dev/docs/plugins/removeAttributesBySelector/), log warning and noop if missing parameters. By [@KTibow](https://github.com/KTibow) in [#2215](https://github.com/svg/svgo/pull/2215) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

renovate added the

dependencies

renovate

labels

2026-07-11 21:00:16 +02:00

renovate added 1 commit

2026-07-11 21:00:16 +02:00

chore(deps): update dependency svgo to v4.0.2

ci/woodpecker/pr/deploy Pipeline was successful

Details

f3647229fa

renovate force-pushed renovate/svgo-4-x-lockfile from f3647229fa