Bump svgo from 3.3.4 to 3.3.5

[dependabot]

Bumps svgo from 3.3.4 to 3.3.5.

Release notes

Sourced from svgo's releases.

v3.3.5

What's Changed

Security

• Backport the removeScriptElement hardening from SVGO v4 in #2269:
  • reject executable data: URLs and legacy vbscript: URLs
  • sanitize executable HTML inside <foreignObject> elements
  • handle namespace-prefixed SVG anchors and URL schemes containing ASCII tabs or newlines

This addresses GHSA-4vpr-x523-8j87 and GHSA-w27v-7q3p-w38r for the v3 release line.

Support

SVGO v3 is not officially supported; please consider upgrading to SVGO v4. This security fix has been backported, but there is no commitment to backport more complex changes in the future.

See the migration guide from v3 to v4.

Commits

• 4380590 ci: configure v3 publish tag in package metadata (#2271)
• 4c84fe7 ci: publish v3 with npm trusted publishing (#2270)
• 994a9f0 fix(removeScriptElement): backport security hardening to v3 (#2269)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for svgo since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Note

Low Risk
Lockfile-only dependency patch with no application code changes; reduces SVG-processing security exposure at build time.

Overview
Bumps transitive svgo from 3.3.4 to 3.3.5 via package-lock.json only (pulled in by @svgr/plugin-svgo and postcss-svgo in the Docusaurus build chain).

The new patch backports removeScriptElement security hardening from SVGO v4: stricter handling of executable data: / vbscript: URLs, sanitization inside <foreignObject>, and fixes for namespace-prefixed anchors and malformed URL schemes—addressing GHSA-4vpr-x523-8j87 and GHSA-w27v-7q3p-w38r on the v3 line.

^{Reviewed by Cursor Bugbot for commit a6203da. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

🤖 Cursor Dependency Analysis

Supply-Chain Malware Review

I'll review the svgo 3.3.4 → 3.3.5 update against the malware checklist, starting with upstream diffs, package metadata, and the scanner findings.Verdict: benign

This is a patch-level security backport (3.3.4 → 3.3.5) for GHSA-4vpr-x523-8j87 and GHSA-w27v-7q3p-w38r. Upstream changes match the release notes: isExecutableUrl() hardening in lib/svgo/tools.js, removeScriptElement updates for data:/vbscript:, foreignObject, and namespaced anchors, plus tests. No new runtime dependencies, no install/preinstall/postinstall scripts, no unexpected hosts, and no Unicode/IOC hits.

Scanner vs interpretation: status warn is false positives. regexp.exec(...) was tagged as process spawn; SVG data:/base64 helpers were tagged as obfuscation (normal for this package); .github/workflows/publish.yml is a real path-touch, but it is the documented npm trusted-publishing switch (npm publish --ignore-scripts, publishConfig.tag: v3). That also explains the new npm publisher “GitHub Actions.” Not a supply-chain implant.

Compatibility Analysis

I'll inspect how svgo is used in this repo and what actually changed in 3.3.5 so we can judge compatibility.Recommendation: merge

Patch-level security backport (3.3.4 → 3.3.5). No public API change. This repo never calls SVGO directly.

Where it is used

svgo is transitive only (not in package.json). Two Docusaurus build-time paths:

Path	Why
@docusaurus/plugin-svgr → @svgr/webpack → @svgr/plugin-svgo (svgo: ^3.0.2)	Webpack SVG → React component
cssnano / @docusaurus/cssnano-preset → postcss-svgo (svgo: ^3.2.0)	Minify inline SVG in CSS

There is no svgo.config, no require('svgo') / import … from 'svgo', and no CLI usage. Site logos (static/img/*.svg, docusaurus.config.js src: 'img/logo.svg') are static files, not first-party SVGO calls. 3.3.5 satisfies both ^3.x ranges.

Intersection with changed APIs

Upstream v3.3.5 is a behavior change inside the default removeScripts / removeScriptElement plugin, plus publish-pipeline CI. Public optimize() / plugin list / Node engine (>=14) stay the same.

Hardening: strip executable javascript: / vbscript: / some data: URLs, sanitize foreignObject HTML, handle namespaced <a> and tab/newline in schemes. Implementation mutates the AST (drop nodes/attrs); it does not throw on those URLs.

This site’s SVGs have no foreignObject, scripts, or javascript: / data: URLs, so those code paths should not fire for first-party assets.

Risks / unknowns

• Low: If webpack-imported SVGs or CSS url() SVGs contained executable URLs, output would now drop those bits. That is the intended fix, not a typical break for this docs site.
• Low: Confirm CI docusaurus build (standard lockfile check).
• Not this PR: SVGO v3 is unmaintained except this backport. Moving to v4 is a separate, breaking Docusaurus/cssnano upgrade.

Action: Merge PR 566. Treat a later SVGO v4 bump as follow-up, not a blocker.

---

Malware Scan Summary

• Status: warn
• Warn only mode: true
• Changed upstream files scanned: 3
• Resolution strategy: tag_range
• Changed node/vendor paths: 0
• Changed lockfiles: 0
• Resolved upstream range: 72a23886b4698b27624b936f3a15a80afd36d75f..438059032950dde2c2d36ce45f912085947e60d0
• Resolved refs: from=72a23886b4698b27624b936f3a15a80afd36d75f to=438059032950dde2c2d36ce45f912085947e60d0
• Unicode findings (post-allowlist): 0
• Confusable findings (post-allowlist): 0
• IOC findings (post-allowlist): 0
• Heuristic findings (post-allowlist): 12

Top findings

• lib/svgo/tools.js:45 shell_process_spawn :: const match = regexp.exec(str);
• lib/svgo/tools.js:275 shell_process_spawn :: const match = regReferencesHref.exec(value);
• lib/svgo/tools.js:282 shell_process_spawn :: const match = regReferencesBegin.exec(value);
• lib/svgo/tools.js:23 obfuscation_indicator :: if (!type || type === 'base64') {
• lib/svgo/tools.js:24 obfuscation_indicator :: // base64
• lib/svgo/tools.js:25 obfuscation_indicator :: prefix += ';base64,';
• lib/svgo/tools.js:26 obfuscation_indicator :: str = prefix + Buffer.from(str).toString('base64');
• lib/svgo/tools.js:44 obfuscation_indicator :: const regexp = /data:image\/svg\+xml(;charset=[^;,]*)?(;base64)?,(.*)/;
• lib/svgo/tools.js:55 obfuscation_indicator :: // base64
• lib/svgo/tools.js:56 obfuscation_indicator :: str = Buffer.from(data, 'base64').toString('utf8');
• lib/svgo/tools.js:59 obfuscation_indicator :: str = decodeURIComponent(data);
• .github/workflows/publish.yml:0 workflow_path_touch :: path-touch