chore(deps): update dependency svgo to v4.1.0

[thomhurst]

This PR contains the following updates:

Package	Type	Update	Change
svgo (source)	resolutions	minor	4.0.2 → 4.1.0

---

Release Notes

svg/svgo (svgo)

v4.1.0

Compare Source

This minor release upgrades the SAX parser and introduces stricter XML validation. It also includes important security hardening for removeScripts, dependency updates, and improvements to the test and regression infrastructure.

Support SVGO

If SVGO is valuable to you or your organization, please consider supporting the project on OpenCollective. Your sponsorship helps fund ongoing maintenance and security work.

Stricter XML validation

SVGO now uses sax 1.6.1, upgraded from 1.5.0 (#​2257).

The new parser version validates numeric character references against the ranges permitted by XML. Invalid references are now rejected in both text and attributes, including:

• disallowed control characters such as &#​1;, , and ;
• UTF-16 surrogate code points such as �;
• invalid XML code points such as .

Valid boundary values—including U+0020, U+D7FF, U+E000, U+FFFD, and characters through U+10FFFF—remain supported.

Parser failures are consistently exposed as SvgoParserError errors with an Invalid character entity reason.

This is an intentional behavior change: malformed SVGs that were previously accepted may now produce a parser error, while valid XML documents are unaffected.

Security

The removeScripts plugin has been hardened against several script-execution bypasses:

• Filters executable data: URLs containing HTML, XHTML, or SVG documents while preserving inert data such as PNG images, and filters legacy vbscript: URLs (#​2263).
• Sanitizes content inside SVG <foreignObject> elements by removing HTML event-handler attributes, srcdoc, and executable URLs from action, data, formaction, href, and src, while preserving non-executable HTML and visual content (#​2264).
• Recognizes namespace-prefixed SVG <a> elements and removes ASCII tabs and newlines before checking URL schemes, preventing values such as java&#​9;script: from bypassing detection while preserving elements in unrelated custom namespaces (#​2268).

These changes address:

• GHSA-4vpr-x523-8j87
• GHSA-w27v-7q3p-w38r

Dependencies

• Upgraded css-select to v6 and css-what to v7, and updated SVGO's custom selector adapter for css-select v6 (#​2244).

Project maintenance

@​TrySound is back as an active SVGO maintainer.

Many thanks to @​KTibow, @​SethFalco, and @​XhmikosR for maintaining and improving SVGO over the past several years.

Full Changelog: svg/svgo@v4.0.2...v4.1.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

Summary by CodeRabbit

• Chores
  • Updated the documentation tooling to use the latest SVGO release, improving compatibility and asset optimization.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 6be160e9-380d-4c49-a84a-f26324a8ca67

📥 Commits

Reviewing files that changed from the base of the PR and between 14cb696 and 717ce53.

⛔ Files ignored due to path filters (1)

• docs/yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (1)

• docs/package.json

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

The documentation package updates the pinned svgo resolution from 4.0.2 to 4.1.0.

Changes

Documentation dependency update

Layer / File(s)	Summary
Update the pinned svgo resolution docs/package.json	The pinned svgo resolution changes from 4.0.2 to 4.1.0.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 717ce

This is a localized documentation dependency update with no actionable merge-blocking risk remaining after normal checks and review.

Poem

A rabbit checks the package with care,
Finds svgo waiting there.
From four-oh-two to four-one-zero,
A tiny hop makes docs glow.
Nibble, update, done!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the update of the svgo dependency to version 4.1.0.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch renovate/svgo-4.x

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

Updates the docs dependency resolution from SVGO 4.0.2 to 4.1.0 and refreshes the Yarn lockfile.

• Adds the updated CSS selector dependencies used by SVGO 4.1.0.
• Updates SAX to 1.6.1 for stricter XML validation and incorporates the release’s SVG sanitization hardening.

Confidence Score: 5/5

The dependency update appears safe to merge, with no concrete changed-code-triggered failure identified in the current documentation build inputs.

The lockfile matches the requested SVGO update, current repository SVG assets do not contain the newly rejected character references, and no specific incompatibility introduced by the minor upgrade was established.

Important Files Changed

Filename	Overview
docs/package.json	Updates the explicit SVGO resolution from 4.0.2 to 4.1.0 with no repository-local API or configuration changes.
docs/yarn.lock	Consistently refreshes SVGO and its css-select, css-what, and SAX dependency graph for version 4.1.0.

_{Reviews (1): Last reviewed commit: "chore(deps): update dependency svgo to v..." | Re-trigger Greptile}