fix(deps): update dependency svgo to v4

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
svgo (source)	^3.3.3 → ^4.0.1

---

Release Notes

svg/svgo (svgo)

v4.0.1

Compare Source

What's Changed

Dependencies

• Sets minimum version of sax (XML parser) to v1.5.0, which improves built-in guards against entity expansion.

Bug Fixes

• removeEmptyContainers, removed leftover <use> elements referencing an empty container that were removed. By @​johnkenny54 in #​2051
• removeUnknownsAndDefaults, don't remove attributes if they're referenced in attribute selectors (CSS). By @​SethFalco in #​2144

Performance

• convertPathData, refactor to reduce redundant equality checks. By @​Lorfdail in #​1764 and #​2135
• removeHiddenElems, compute styles lazily. By @​Lorfdail in #​1764 and #​2135

Other Changes

• Plugins no longer include if they are enabled or disabled by default, as this was written inconsistently. The --show-plugins argument appends the presets a plugin is in to the end of the line. By @​viralcodex in #​2174
• Plugin/preset types to enforce the name start with preset- if it is a preset (collection of plugins). By @​SethFalco in #​2178

Metrics

Before and after of the browser bundle of each respective version:

	v4.0.0	v4.0.1	Delta
svgo.browser.js	780.2 kB	781.5 kB	⬆️ 1.3 kB

v4.0.0

Compare Source

Illustration by Vukory

It's been just over a year since our first release candidate, but I believe we can now release SVGO v4.0.0 with confidence! Thank you to all contributors who tested our RC builds and reported issues back up, this really smoothed out the process.

We actually wanted to do the release sooner, but it was a challenge to find the right time to publish a major release, since that means setting time aside to support users through migrations, helping downstream projects migrate, being available to fix or document things that users found to have an unexpected impact by this release, etc. I appreciate everyone's patience, and now that this is done, we can hopefully increase the pace of development again and tackle that backlog of old bugs. ^-^'

Breaking Changes

Please refer to the Migration Guide from v3 to v4 for a more concise version! This section is more verbose as it delves into the motivation of changes too.

Dropped Support for Node.js v14

Node.js v14 is no longer supported by the Node.js team, including security support, since 30 April 2023. Node.js v16 is no longer supported either, but as some are still using it, we'll save dropping support for Node.js v16 for the next major release.

This allows us to update our dependencies to more recent versions and to access more modern Node.js APIs.

Node.js v14 may still work at the time of this release, but we'll no longer be testing against v14 from now on.

Default Plugins

Both removeViewBox and removeTitle have been disabled by default. Both have been major pain points for users and don't make sense to enable in most cases. Other libraries wrapping SVGO have also been disabling these plugins by default, such as Docusaurus and SVGR.

• removeViewBox removes the scalability of SVGs.
• removeTitle reduces accessibility, which preserving accessibility is more important than optimization.

If you would like either of these plugins enabled, you can do so by configuring it in the SVGO config, see the README for more context, however please read the warnings described in the documentation of the plugins first:

  export default {
    plugins: [
      'preset-default', // built-in plugins enabled by default
+     'removeViewBox',
+     'removeTitle',
    ],
  };

removeScriptElement → removeScripts

The removeScriptElement plugin has been renamed to removeScripts, to more accurately reflect what the plugin does. It does not only remove the <script> tag, but also event handlers and script URIs from links.

To migrate, amend your SVGO config to refer to removeScripts instead if you use that plugin.

  export default {
    plugins: [
      'preset-default', // built-in plugins enabled by default
-     'removeScriptElement',
+     'removeScripts',
    ],
  };

Imports/Exports

We now enforce boundaries between the intended public API and any internal structures/helpers. This is the biggest change in SVGO's JavaScript API and will enable maintainers and users to have a mutual understanding of what is public API and what isn't.

There are two ways to import SVGO:

• svgo — for normal usage, such as scripts or server-side applications.
• svgo/browser — for browser usage.

If you use the browser bundle, you must amend how you import SVGO:

- import { optimize } from 'svgo/dist/svgo.browser.js';
+ import { optimize } from 'svgo/browser';

For ESM/browser, you must use named imports:

// ESM and Browser, named exports
import { VERSION } from 'svgo';
console.log(VERSION);  // 4.0.0-rc.0

// ESM and Browser, import all
import * as svgo from 'svgo/browser';
console.log(svgo.VERSION); // 4.0.0-rc.0

// Common JS, default export
const svgo = require('svgo');
console.log(svgo.VERSION);  // 4.0.0-rc.0

// CommonJS, named exports
const { VERSION } = require('svgo');
console.log(VERSION); // 4.0.0-rc.0

We support 3 environments, ESM, Common JS, and browser. The only functional difference is that the loadConfig function is not exported in the browser bundle.

If you depended on a helper that we haven't declared as public, then you are encouraged to implement it yourself, or dig into our source and copy it over to your project.

Importing Plugins

If you import/require the array of built-in plugins, or a single plugin during runtime, this is now a top-level export instead:

// builtin.mjs - get an array of all built-in plugins
- import { builtin } from 'svgo/lib/builtin';
+ import { builtinPlugins } from 'svgo'

// plugin.mjs - get a single plugin
- import presetDefault from 'svgo/plugins/preset-default';
+ import { builtinPlugins } from 'svgo';
+ const prefixDefault = builtinPlugins.find(plugin => plugin.name === 'preset-default');

// plugin-map.mjs - get all plugins as a map using the plugin name as a key
import { builtinPlugins } from 'svgo';
const pluginMap = builtinPlugins.reduce((acc, val) => acc.set(val.name, val), new Map());

Selector Helpers

The XastNode#parentNode property was declared legacy and pending removal for v4, but was still used internally. The remaining instances have now been removed, which required a refactor of the selector helpers.

This effects custom plugins that use any of the following functions, where the selector (2nd) argument could reference parent or sibling nodes (i.e. div > span):

• querySelectorAll
• querySelector
• matches

Previously, these functions had the context of the whole node tree, even if a child node was passed to it. It no longer has that context by default. The new API for these functions is as follows:

// applies `selector` with the context of the `childNode` and its descendants
const nodes = querySelectorAll(childNode, selector);

// applies `selector` with the context of the entire node tree relative from `childNode`
// the `rootNode` is required if the result of `selector` may depend on the parent or sibling of `childNode`
const nodes = querySelectorAll(childNode, selector, rootNode);

// this usage has the same behavior as v3, as `rootNode` is already the entire node tree 
const nodes = querySelectorAll(rootNode, selector);

A helper has been provided named #mapNodesToParents, which does this for you. This can be used to easily migrate to the new API. If you're not sure if you need it, then it's safer to take this approach. The third argument won't be necessary if selector does not traverse nodes, for example, querying using one or more attributes of a single node.

- import { querySelectorAll } from 'svgo';
+ import { querySelectorAll, mapNodesToParents } from 'svgo';

- const nodes = querySelectorAll(childNode, selector);
+ const nodes = querySelectorAll(childNode, selector, mapNodesToParents(rootNode));

---

What Else

ESM

SVGO is now a dual package, serving for both Common JS and ESM usage. To be more explicit, SVGO will continue to work on Common JS projects!

Thanks to @​jdufresne for doing the bulk of the work.

Default Behavior

• convertColors, now converts all references to colors excluding references to IDs to lowercase. This can be disabled by setting convertCase to false.

Bug Fixes

• cleanupIds, treat both URI encoded and non-URI encoded IDs as the same. By @​liuweifeng in #​1982
• collapseGroups, check styles as well as attributes. By @​johnkenny54 in #​1952
• collapseGroups, move attributes atomically. By @​johnkenny54 in #​1930
• convertPathData, fix q control point when item is removed. By @​KTibow in #​1927
• convertPathData, preserve vertex for markers only paths. By @​SethFalco in #​1967
• mergePaths, don't merge paths if attributes/styles depend on the node's bounding box. By @​johnkenny54 in #​1964
• moveElemsAttrsToGroups, no longer moves the transforms if group has the filter attribute. By @​johnkenny54 in #​1933
• prefixIds, fixed issue where some IDs were not prefixed when style tag contained XML comments. By @​john-neptune in #​1942
• removeEmptyContainers, fixed an issue where we removed empty containers with filters applied via CSS, when it should be skipped. By @​SethFalco in #​2089
• removeHiddenElems, don't remove node if child element has a referenced ID. By @​johnkenny54 in #​1925
• removeHiddenElems, treat path[opacity=0] as a non-rendering node. By @​johnkenny54 in #​1948
• removeUselessDefs, don't remove node if child element has an ID. By @​johnkenny54 in #​1923
• When stringifying path data, include a space before numbers represented in scientific notation. By @​johnkenny54 in #​1961
• No longer crashes when the output (-o argument) ends with a trailing slash to a location that didn't exist. By @​SethFalco in #​1954

Features

• Add VERSION export so get the version of SVGO during runtime. By @​SethFalco in #​2016
• Introduce an isPreset and plugins property to plugins, which are only defined for presets. This will indicate if the plugin is a preset, and return the plugins that are in the preset in the order they are invoked.

SVG Optimization

• convertColors, introduce parameter to convert colors to common casing (lowercase/uppercase). By @​JayLeininger in #​1692
• removeDeprecatedAttrs, new plugin that is disabled by default to remove SVG attributes that are deprecated. By @​jdufresne in #​1869
• removeEditorsNSData, include Boxy SVG namespace in the list of editor namespaces to remove. By @​sisp in #​2008
• removeEditorsNSData, include Krita namespace in the list of editor namespaces to remove. By @​SethFalco in #​2131

Performance

• Use string methods instead of a regular expression when parsing SVGs. By @​SethFalco in #​2133

Developer Experience

• We now generate our type declarations from JSDoc comments instead of maintaining them manually. Types will be much more accurate, include more documentation, and are guaranteed to be in sync with the implementation.

Metrics

Before and after using vectors from various sources, with the default preset of each respective version:

SVG	Original	v3.3.2	v4.0.0	Delta
Arch Linux Logo	9.529 KiB	4.115 KiB	4.097 KiB	⬇️ 0.018 KiB
Blobs	50.45 KiB	42.623 KiB	42.633 KiB	⬆️ 0.01 KiB
Isometric Madness	869.034 KiB	540.582 KiB	540.141 KiB	⬇️ 0.441 KiB
tldr-pages Banner	2.071 KiB	1.07 KiB	1.07 KiB
Wikipedia Logo	161.551 KiB	111.668 KiB	111.727 KiB	⬆️ 0.059 KiB

Note: The increase in size from previous versions is from disabling removeViewBox and removeTitle, with the benefit of preserving scalability and accessibility.

Before and after of the browser bundle of each respective version:

	v3.3.2	v4.0.0	Delta
svgo.browser.js	753.0 kB	780.2kB	⬆️ 27.2 kB

---

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

• Branch creation
  • Between 12:00 AM and 03:59 AM, on day 1 and 15 of the month (* 0-3 1,15 * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

📝 Walkthrough

Walkthrough

The pull request updates the svgo package dependency in package.json from version ^3.3.3 to ^4.0.1. This is a minor version bump in the package manifest with no changes to other dependencies, scripts, or metadata.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically describes the main change: updating the svgo dependency to v4, which matches the changeset perfectly.
Description check	✅ Passed	The description is directly related to the changeset, providing detailed release notes, migration guidance, and configuration information for the svgo v4 update.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch renovate/svgo-4.x

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@package.json`:
- Line 32: Change the SVGO v3-style default import and call to the v4 named API
in src/codecs.ts: replace the default import (import svgo from 'svgo') and uses
of svgo.optimize(...) with the named export (e.g., import { optimize } from
'svgo') and call optimize(svgString, options). Before passing merged opts into
optimize inside the svgCodec function, remove any test field from opts (or
explicitly set a plugins array with the desired plugins and options such as
preserving viewBox/title) so SVGO v4’s plugin defaults don’t alter output
unexpectedly. Add "engines": { "node": ">=16" } to package.json to reflect SVGO
v4’s Node requirement. Finally, add a unit/integration test covering the SVG
minimization path to assert key elements (like viewBox/title) are preserved and
prevent regressions.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 623be1a0-6b40-4fad-9d14-23fe13a2c1fd

📥 Commits

Reviewing files that changed from the base of the PR and between a90e56c and fc430d9.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

• package.json

[coderabbitai]

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Verify Node.js version requirements across the project

echo "=== Checking for Node.js version declarations ==="
# Check for .nvmrc, .node-version, or engines field
fd -H '^\.nvmrc$|^\.node-version$' . --exec cat {}
fd -H '^package\.json$' . --exec jq -r '.engines.node // "No engines.node field"' {}

echo -e "\n=== Checking CI/CD Node.js versions ==="
# Check GitHub Actions workflows
fd -e yml -e yaml . .github/workflows --exec rg -n "node-version" {}

echo -e "\n=== Checking if repository requires Node.js < 16 ==="
# Look for any documentation mentioning Node.js version requirements
rg -i "node\.?js.*\b(14|12|10|8)\b" README.md CONTRIBUTING.md docs/ -n -A2 -B2 || echo "No references to Node.js <16 found"

Repository: rstackjs/rsbuild-plugin-image-compress

Length of output: 496

---

🏁 Script executed:

#!/bin/bash
# Description: Verify svgo API usage and type imports for v4 compatibility

echo "=== Checking svgo imports and usage ==="
# Find all svgo imports
rg -n "from ['\"]svgo['\"]" --type=ts -A2 -B2

echo -e "\n=== Checking svgo.optimize() usage ==="
# Find optimize() calls to verify API compatibility
rg -n "svgo\.optimize" --type=ts -C5

echo -e "\n=== Checking for Config/SvgoConfig type usage ==="
# Find type imports from svgo
rg -n "(SvgoConfig|Config).*from ['\"]svgo['\"]" --type=ts -A2 -B2

Repository: rstackjs/rsbuild-plugin-image-compress

Length of output: 1240

---

🏁 Script executed:

#!/bin/bash
# Description: Verify test coverage for svgo functionality

echo "=== Checking for svgo-related tests ==="
# Find test files that mention svgo or svg codec
rg -l "svgo|svg.*codec|svg.*compress" --glob "*test*" --glob "*spec*" -n

echo -e "\n=== Checking test file content ==="
# Show test implementations
rg -n "svgo|svg.*codec" --glob "*test*" --glob "*spec*" -C5

Repository: rstackjs/rsbuild-plugin-image-compress

Length of output: 158

---

🌐 Web query:

What are the breaking changes in svgo v4.0.0 and v4.0.1 regarding the optimize() method API and Config type exports?

💡 Result:

In SVGO v4.0.0 and v4.0.1, the primary breaking changes regarding the API and configuration structure are as follows: 1. Removal of Default Exports: SVGO now exclusively uses named exports [1][2]. Any code previously using a default export must be updated to use named imports (e.g., import { optimize } from 'svgo';) [1][2]. 2. Enforced Public API Boundaries: SVGO now strictly enforces a boundary between public and internal APIs [1][2]. Users can no longer import internal structures or helpers (such as svgo/lib/builtin) [3]. If you previously imported from specific sub-paths, you must refactor to use the sanctioned public API [1][2]. 3. Browser Bundle Imports: If using the browser bundle, the import path has changed. You must update imports from svgo/dist/svgo.browser.js to svgo/browser [1][2][3]. 4. Configuration and Plugin Changes: - The removeScriptElement plugin was renamed to removeScripts [4][1]. You must update your configuration accordingly [1][3]. - removeViewBox and removeTitle are no longer enabled by default [4][3]. To maintain previous behavior, they must be explicitly added back to the plugins array in your svgo.config.mjs (or equivalent configuration file) [4][1][3]. 5. Type Declarations: Type definitions are now generated automatically from JSDoc comments [4]. This ensures higher accuracy and better synchronization with the implementation compared to manually maintained types [4]. 6. SVGO v4.0.1: This version contains no breaking changes to the optimize() method or Config type [5]. It focuses on dependency updates (minimum sax version to v1.5.0), bug fixes, performance improvements (lazy style computation, path data optimization), and minor type refinements to enforce naming conventions for presets [5]. These changes were introduced to improve API stability, security, and the maintainability of the project's type definitions [4][1][3][5].

Citations:

• 1: https://svgo.dev/docs/migrations/migration-from-v3-to-v4/
• 2: https://github.com/svg/svgo/blob/main/docs/06-migrations/01-migration-from-v3-to-v4.mdx
• 3: https://github.com/svg/svgo/releases/tag/v4.0.0-rc.0
• 4: https://github.com/svg/svgo/releases/tag/v4.0.0
• 5: https://github.com/svg/svgo/releases/tag/v4.0.1

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== Inspect root package.json (svgo dependency + type/module info) ==="
ls -la package.json tsconfig*.json 2>/dev/null || true
cat -n package.json | sed -n '1,120p'

echo -e "\n=== Find/inspect tsconfig(s) relevant to module interop ==="
fd -e tsconfig -t f . -d 4 || true
fd -t f 'tsconfig*.json' . -d 4 || true
for f in $(fd -t f 'tsconfig*.json' . -d 6); do
  echo -e "\n--- $f (head) ---"
  head -n 80 "$f" | cat -n
  echo -e "\n--- $f (compilerOptions) ---"
  rg -n "compilerOptions" -n "$f" -C2 || true
  rg -n "esModuleInterop|allowSyntheticDefaultImports|module|moduleResolution|target|typeRoots|types" "$f" -n || true
done

echo -e "\n=== Inspect SVGO usage/options code ==="
cat -n src/codecs.ts | sed -n '1,140p'
cat -n src/types.ts | sed -n '1,120p'

echo -e "\n=== Check all SVGO imports ==="
rg -n "from ['\"]svgo['\"]" --type=ts -S
rg -n "import svgo from ['\"]svgo['\"]" -S
rg -n "import\\s*\\{[^}]*\\}\\s*from ['\"]svgo['\"]" -S

echo -e "\n=== Check if plugins explicitly enable removeViewBox/removeTitle ==="
rg -n "removeViewBox|removeTitle|plugins" src --type=ts -S

Repository: rstackjs/rsbuild-plugin-image-compress

Length of output: 6992

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== Search for SVGO config/plugins usage in src ==="
rg -n "removeViewBox|removeTitle|removeScripts|removeScriptElement|plugins\\b|preset\\b|multipass\\b" src --type=ts -S

echo -e "\n=== Search for how svg codec options are provided/typed ==="
rg -n "svg\\s*:" src --type=ts -S
rg -n "codec.*svg|svgCodec|use:\\s*'svg'|use:\\s*\"svg\"" src --type=ts -S
rg -n "SvgoConfig|Config as SvgoConfig" src --type=ts -S

Repository: rstackjs/rsbuild-plugin-image-compress

Length of output: 134

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== Find where svgo.optimize is used (repo-wide) ==="
rg -n "svgo\\.optimize" -S .

echo -e "\n=== Find where svg codec is referenced/selected ==="
rg -n "svgCodec|use:\\s*['\"]svg['\"]|\\buse:\\s*['\"]svg['\"]" src --type=ts -S

echo -e "\n=== Find where handler gets called for codecs (svg options flow) ==="
rg -n "handler\\(" src --type=ts -S
rg -n "defaultOptions|FinalOptionCollection|CodecBaseOptions|Options\\b" src --type=ts -S

Repository: rstackjs/rsbuild-plugin-image-compress

Length of output: 3353

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== Read src/utils.ts ==="
cat -n src/utils.ts

echo -e "\n=== Read src/minimizer.ts (focus on handler invocation/options merging) ==="
sed -n '1,220p' src/minimizer.ts | cat -n

echo -e "\n=== Read src/index.ts (options normalization; how svg options are structured) ==="
sed -n '1,120p' src/index.ts | cat -n

echo -e "\n=== Check pnpm-lock.yaml for svgo metadata (engines/module/export hints) ==="
ls -ლა pnpm-lock.yaml 2>/dev/null || true
rg -n "svgo:" pnpm-lock.yaml 2>/dev/null || true
# Print the svgo section if present (keep small)
if [ -f pnpm-lock.yaml ]; then
  awk 'BEGIN{f=0} /svgo:/ {f=1} f{print; if(NR>1 && $0 ~ /^[^[:space:]].*:/) {exit}}' pnpm-lock.yaml | head -n 80
fi

Repository: rstackjs/rsbuild-plugin-image-compress

Length of output: 8527

---

Fix SVGO v4 integration (default import + SVG output changes + Node engines)

• src/codecs.ts uses import svgo from 'svgo' and svgo.optimize(...), but SVGO v4 removes default exports—switch to the v4 named export API and update the call accordingly.
• svgCodec passes the merged opts directly into svgo.optimize(...); since this repo doesn’t explicitly configure plugins (and default options only add test: /\.svg$/), SVGO v4’s default plugin behavior change (notably removeViewBox/removeTitle) can change optimized SVG output. Filter out the test field before calling svgo.optimize and/or explicitly set the desired plugins.
• package.json lacks an engines.node field; SVGO v4 requires Node.js >=16, so add:

  "engines": { "node": ">=16" }

• No SVGO-related tests were found in the repo; add coverage for the SVG minimization path to prevent regressions.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` at line 32, Change the SVGO v3-style default import and call to
the v4 named API in src/codecs.ts: replace the default import (import svgo from
'svgo') and uses of svgo.optimize(...) with the named export (e.g., import {
optimize } from 'svgo') and call optimize(svgString, options). Before passing
merged opts into optimize inside the svgCodec function, remove any test field
from opts (or explicitly set a plugins array with the desired plugins and
options such as preserving viewBox/title) so SVGO v4’s plugin defaults don’t
alter output unexpectedly. Add "engines": { "node": ">=16" } to package.json to
reflect SVGO v4’s Node requirement. Finally, add a unit/integration test
covering the SVG minimization path to assert key elements (like viewBox/title)
are preserved and prevent regressions.