Bump svgo and @wordpress/scripts

[dependabot]

Bumps svgo to 2.8.3 and updates ancestor dependency @wordpress/scripts. These dependencies need to be updated together.

Updates svgo from 2.8.2 to 2.8.3

Release notes

Sourced from svgo's releases.

v2.8.3

What's Changed

Security

• removeScriptElement, make <script> handling namespace aware. By @​SethFalco

Support

SVGO v2 is not officially supported, please consider upgrading to SVGO v4 instead. We've backported this fix as there are security implications, but there is no commitment to do this for more complex changes in future.

Consider reading our Migration Guide from v2 to v3 and Migration Guide from v3 to v4 which should ease the process.

Commits

• 628e3bc Merge commit from fork
• See full diff in compare view

Updates @wordpress/scripts from 17.1.0 to 33.0.0

Release notes

Sourced from @​wordpress/scripts's releases.

23.6.0

Changelog

Features

Post Editor

• Allow setting viewport tablet and mobile values in theme.json. (79104)
• Experimental: Expand DataForm inspector to patterns. (79452)
• Notes: Add @​mention autocomplete. (79604)
• Notes: Inline (partial-text) notes via hybrid marker + strip-on-render approach. (78218)
• Show the admin bar in the Post and Site Editor by default. (79197)

Block Editor

• Share block-bindings context assembly between call sites. (79855)

Data Layer

• Blocks: Add innerContent support for static inner blocks, adopt it in the HTML block. (79115)

Components

• DataViews: Add a richtext control backed by a private RichTextControl shell in @​wordpress/components. (78471)

Block Library

• Icons: Add PHP method(s) for rendering inline SVG icons from the registry. (78332)

Enhancements

• CSS: Follow-up fixes to split_selector_list(). (79723)
• Document widget relevance, help. (80007)
• Expose widget category through the build pipeline and REST API. (79638)
• Omnibar: Move the 'site icon in admin bar' feature from experiment to 7.1 compat. (79807)
• Scripts: Make 'test-e2e' run Playwright and remove Puppeteer. (80058)
• Site Editor v2 experiment: Hide admin bar in distraction-free mode. (79937)
• Widget Dashboard: Remove layout-settings editing. (79903)
• Widget Dashboard: Reserve paint space for tile focus rings. (79990)
• Widget Primitives: Add WidgetAttributeField for typed attribute schemas. (79544)
• Widgets: Add a declarative help metadata field, surfaced as a header infotip. (79830)
• Widgets: Add attribute relevance and inline editing in the tile toolbar. (79735)
• Widgets: Translate title, description, and keywords server-side. (79701)

Block Library

• Accordion block: Add background gradient support. (79840)
• Add ariaLabel supports for Tab List Block. (79948)
• Add icon state classes to Accordion block. (74257)
• Add layout and block spacing support to Latest Posts block. (77989)
• Add option to exclude current post from query block. (64916)
• Animated GIF to video conversion (via mediabunny). (78410)
• Classic block: Remove migration notice and restore inserter availability. (79894)
• Cover: Allow restricting video embed providers. (80092)
• File Block: Deduplicate the file to audio/video/image transforms. (80158)

... (truncated)

Changelog

Sourced from @​wordpress/scripts's changelog.

33.0.0 (2026-07-14)

Breaking Changes

• The test-e2e command now runs the Playwright-based end-to-end test runner instead of Puppeteer (test-playwright remains available as an alias). Removed the Puppeteer test environment and configuration (jest-environment-puppeteer, jest-e2e.config.js, puppeteer.config.js) along with the puppeteer-core and expect-puppeteer dependencies. Puppeteer-specific options (e.g. --puppeteer-interactive, --puppeteer-devtools) are no longer supported (#60357).

Enhancements

• Widen React peer dependency ranges to ^18 || ^19 to support both React 18 and React 19 environments (#80024).
• Update stylelint to ^16.26.1 (#79648).
• Widen the @playwright/test peer dependency to >=1 and mark it optional, so consumers aren't forced to bump Playwright or satisfy it under strict peer deps (#78632).
• Update webpack-dev-server to ^5.2.1, resolving several Dependabot security alerts and migrating the internal dev-server proxy config to the v5 array format (#80347).

32.6.0 (2026-07-01)

32.5.0 (2026-06-24)

Enhancements

• lint-style: Detect .cjs and .mjs config files so the bundled default config is not used when one of these is present (#79226).

32.4.1 (2026-06-16)

32.4.0 (2026-06-10)

32.3.0 (2026-05-27)

32.2.0 (2026-05-14)

32.1.0 (2026-04-29)

32.0.0 (2026-04-15)

Breaking Changes

• The bundled eslint dependency has been upgraded from v8 to v10 (#76654).
• The lint-js script now uses flat config (eslint.config.*) by default. Legacy .eslintrc.* files are still detected as a fallback, but this support is deprecated and will be removed in a future version (#76654).
• The default config shipped with wp-scripts has changed from config/.eslintrc.js to config/eslint.config.cjs (#76654).

31.8.0 (2026-04-01)

31.7.0 (2026-03-18)

31.6.0 (2026-03-04)

31.5.0 (2026-02-18)

31.4.0 (2026-01-29)

31.3.0 (2026-01-16)

... (truncated)

Commits

• e9a74f9 chore(release): publish
• 2a0c375 Update changelog files
• e61c854 Merge changes published in the Gutenberg plugin "release/23.6" branch
• 1055a35 Update changelog files
• 8ca3e8e Merge changes published in the Gutenberg plugin "release/23.6" branch
• 66c8050 Fix wp/latest release metadata (#79821)
• d0d1bfc Update changelog files
• 66315f3 Merge changes published in the Gutenberg plugin "release/23.5" branch
• 74218a2 Update changelog files
• 504adfc Revert "Update changelog files"
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by desrosj, a new releaser for @​wordpress/scripts since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.