Bump svgo and cssnano

[dependabot]

Bumps svgo to 4.1.0 and updates ancestor dependency cssnano. These dependencies need to be updated together.

Updates svgo from 1.3.2 to 4.1.0

Release notes

Sourced from svgo's releases.

v4.1.0

This minor release upgrades the SAX parser and introduces stricter XML validation. It also includes important security hardening for removeScripts, dependency updates, and improvements to the test and regression infrastructure.

Support SVGO

If SVGO is valuable to you or your organization, please consider supporting the project on OpenCollective. Your sponsorship helps fund ongoing maintenance and security work.

Stricter XML validation

SVGO now uses sax 1.6.1, upgraded from 1.5.0 (#2257).

The new parser version validates numeric character references against the ranges permitted by XML. Invalid references are now rejected in both text and attributes, including:

• disallowed control characters such as &[#1](https://github.com/svg/svgo/issues/1);, , and ;
• UTF-16 surrogate code points such as �;
• invalid XML code points such as .

Valid boundary values—including U+0020, U+D7FF, U+E000, U+FFFD, and characters through U+10FFFF—remain supported.

Parser failures are consistently exposed as SvgoParserError errors with an Invalid character entity reason.

This is an intentional behavior change: malformed SVGs that were previously accepted may now produce a parser error, while valid XML documents are unaffected.

Security

The removeScripts plugin has been hardened against several script-execution bypasses:

• Filters executable data: URLs containing HTML, XHTML, or SVG documents while preserving inert data such as PNG images, and filters legacy vbscript: URLs (#2263).
• Sanitizes content inside SVG <foreignObject> elements by removing HTML event-handler attributes, srcdoc, and executable URLs from action, data, formaction, href, and src, while preserving non-executable HTML and visual content (#2264).
• Recognizes namespace-prefixed SVG <a> elements and removes ASCII tabs and newlines before checking URL schemes, preventing values such as java&[#9](https://github.com/svg/svgo/issues/9);script: from bypassing detection while preserving elements in unrelated custom namespaces (#2268).

These changes address:

• GHSA-4vpr-x523-8j87
• GHSA-w27v-7q3p-w38r

Dependencies

• Upgraded css-select to v6 and css-what to v7, and updated SVGO's custom selector adapter for css-select v6 (#2244).

Project maintenance

@​TrySound is back as an active SVGO maintainer.

Many thanks to @​KTibow, @​SethFalco, and @​XhmikosR for maintaining and improving SVGO over the past several years.

Full Changelog: svg/svgo@v4.0.2...v4.1.0

v4.0.2

... (truncated)

Commits

• 5765cbe chore: prepare v4.1.0 release (#2275)
• 3db3ef3 fix(removeScripts): handle anchor URL bypasses (#2268)
• 4e9b9ae chore: cache regression screenshots (#2267)
• d55270c chore(regression): migrate comparison workers to Tinypool (#2266)
• fd51e47 fix(removeScripts): sanitize foreignObject content (#2264)
• dcaf957 chore: optimize fixtures in a bounded worker pool (#2265)
• a354293 fix(removeScripts): filter executable data URLs (#2263)
• 4e0d2ac ci(typecheck): return typechecking on CI
• 0b97fed test(typescript): drop tsd for vitest type testing API
• f6e8ae1 chore(pnpm): drop package.json#pnpm.onlyBuiltDependencies
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for svgo since your current version.

Updates cssnano from 4.1.10 to 9.0.4

Release notes

Sourced from cssnano's releases.

v9.0.4

What's Changed

• fix: update postcss-calc in cssnano/cssnano#1970

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@9.0.3...cssnano@9.0.4

v9.0.3

What's Changed

• fix: update color parsing library in cssnano/cssnano#1964

• fix: update PostCSS and selector parser

• fix: update conflict detection and color conversion CSS spec conformance

• fix: update PostCSS peer dependency

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@9.0.2...cssnano@9.0.3

v9.0.2

What's Changed

• fix: add main and types to package manifests in cssnano/cssnano#1958
• fix: update postcss-calc

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@9.0.1...cssnano@9.0.2

v9.0.1

What's Changed

• refactor: some small performance gains in cssnano/cssnano#1955

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@9.0.0...cssnano@9.0.1

v9.0.0

What's Changed

Breaking changes

• Migrate to ESM and simplify config loading in cssnano/cssnano#1948

Probably backward-compatible for most users. Some changes to configuration loading documented in migration guide.

Bug fixes

• Introduce new postcss-calc plugin in cssnano/cssnano@34aec91

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@8.0.10...cssnano@9.0.0

... (truncated)

Commits

• 88b2266 Publish cssnano 9.0.4
• 13b2373 chore: update pnpm
• 0dd1284 fix(cssnano-preset-default): update postcss-calc
• 7dd2a19 Publish cssnano 9.0.3
• 8a71cd2 fix: update PostCSS peer dependency
• 8ca8877 fix: update spec conformance in conflict detection and color conversion
• 8bb6018 fix: update autoprefixer
• c6190b4 fix: updated colordx and browserslist
• ce4082e docs: update outdated links
• b172f6b docs: update site dependencies
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for cssnano since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.