Bump svgo, imagemin-svgo and next in /website

[dependabot]

Bumps svgo to 4.1.0 and updates ancestor dependencies svgo, imagemin-svgo and next. These dependencies need to be updated together.

Updates svgo from 1.3.2 to 4.1.0

Release notes

Sourced from svgo's releases.

v4.1.0

This minor release upgrades the SAX parser and introduces stricter XML validation. It also includes important security hardening for removeScripts, dependency updates, and improvements to the test and regression infrastructure.

Support SVGO

If SVGO is valuable to you or your organization, please consider supporting the project on OpenCollective. Your sponsorship helps fund ongoing maintenance and security work.

Stricter XML validation

SVGO now uses sax 1.6.1, upgraded from 1.5.0 (#2257).

The new parser version validates numeric character references against the ranges permitted by XML. Invalid references are now rejected in both text and attributes, including:

• disallowed control characters such as &[#1](https://github.com/svg/svgo/issues/1);, , and ;
• UTF-16 surrogate code points such as �;
• invalid XML code points such as .

Valid boundary values—including U+0020, U+D7FF, U+E000, U+FFFD, and characters through U+10FFFF—remain supported.

Parser failures are consistently exposed as SvgoParserError errors with an Invalid character entity reason.

This is an intentional behavior change: malformed SVGs that were previously accepted may now produce a parser error, while valid XML documents are unaffected.

Security

The removeScripts plugin has been hardened against several script-execution bypasses:

• Filters executable data: URLs containing HTML, XHTML, or SVG documents while preserving inert data such as PNG images, and filters legacy vbscript: URLs (#2263).
• Sanitizes content inside SVG <foreignObject> elements by removing HTML event-handler attributes, srcdoc, and executable URLs from action, data, formaction, href, and src, while preserving non-executable HTML and visual content (#2264).
• Recognizes namespace-prefixed SVG <a> elements and removes ASCII tabs and newlines before checking URL schemes, preventing values such as java&[#9](https://github.com/svg/svgo/issues/9);script: from bypassing detection while preserving elements in unrelated custom namespaces (#2268).

These changes address:

• GHSA-4vpr-x523-8j87
• GHSA-w27v-7q3p-w38r

Dependencies

• Upgraded css-select to v6 and css-what to v7, and updated SVGO's custom selector adapter for css-select v6 (#2244).

Project maintenance

@​TrySound is back as an active SVGO maintainer.

Many thanks to @​KTibow, @​SethFalco, and @​XhmikosR for maintaining and improving SVGO over the past several years.

Full Changelog: svg/svgo@v4.0.2...v4.1.0

v4.0.2

... (truncated)

Commits

• 5765cbe chore: prepare v4.1.0 release (#2275)
• 3db3ef3 fix(removeScripts): handle anchor URL bypasses (#2268)
• 4e9b9ae chore: cache regression screenshots (#2267)
• d55270c chore(regression): migrate comparison workers to Tinypool (#2266)
• fd51e47 fix(removeScripts): sanitize foreignObject content (#2264)
• dcaf957 chore: optimize fixtures in a bounded worker pool (#2265)
• a354293 fix(removeScripts): filter executable data URLs (#2263)
• 4e0d2ac ci(typecheck): return typechecking on CI
• 0b97fed test(typescript): drop tsd for vitest type testing API
• f6e8ae1 chore(pnpm): drop package.json#pnpm.onlyBuiltDependencies
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for svgo since your current version.

Updates imagemin-svgo from 7.1.0 to 12.0.0

Release notes

Sourced from imagemin-svgo's releases.

v12.0.0

Breaking

• Require Node.js 20 8b8efb8

---

imagemin/imagemin-svgo@v11.0.1...v12.0.0

v11.0.1

• Fix broken SVG check (#64) 0c37309

imagemin/imagemin-svgo@v11.0.0...v11.0.1

v11.0.0

Breaking

• Require Node.js 18 69d8cea
• Update svgo from v2 to v3

imagemin/imagemin-svgo@v10.0.1...v11.0.0

v10.0.1

• Specify exports field ebd0041

imagemin/imagemin-svgo@v10.0.0...v10.0.1

v10.0.0

• Fix usage 836063c
• Use native ESM and update dependencies (#50) 35866f7

imagemin/imagemin-svgo@v9.0.0...v10.0.0

v9.0.0

• Use GitHub Action instead (#44) a42fbfe
• Upgrade svgo (#43) 43888a0
• Update API usage 11dac11

imagemin/imagemin-svgo@v8.0.0...v9.0.0

v8.0.0

• Require Node.js 10 (#40) fa899fc

imagemin/imagemin-svgo@v7.1.0...v8.0.0

Commits

• 911b98c 12.0.0
• 8b8efb8 Require Node.js 20
• 8bacbb7 11.0.1
• 0c37309 Fix broken SVG check (#64)
• 246ff6f 11.0.0
• 69d8cea Require Node.js 18
• f7dfc71 Several tweaks (#61)
• 925c911 10.0.1
• ebd0041 Specify exports field
• 949d697 10.0.0
• Additional commits viewable in compare view

Updates next from 9.3.5 to 9.5.5

Commits

• e334c4e v9.5.5
• 5e85709 v9.5.5-canary.1
• 2170dfd Update to generate auto static pages with all locales (#17730)
• 62b9183 v9.5.5-canary.0
• ec2ffb4 Handle css-loader file resolving change (#17724)
• c021662 Fix with-msw example (#17695)
• bbc1a21 Update to have default locale matched on root (#17669)
• a79bcfb Fix with-apollo example (#17686)
• b2d1d87 Add initial changes for i18n support (#17370)
• 6588108 v9.5.4
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.