Skip to content

chore(deps): bump the npm_and_yarn group across 1 directory with 10 updates - #1665

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-c181b110fd
Open

chore(deps): bump the npm_and_yarn group across 1 directory with 10 updates#1665
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-c181b110fd

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 20, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 10 updates in the / directory:

Package From To
hono 4.12.34 4.13.7
http-cache-semantics 4.2.0 4.3.0
astro 7.1.6 7.4.1
sharp 0.35.3 0.35.5
@vitest/mocker 4.1.10 4.1.12
baseline-browser-mapping 2.10.43 2.11.30
browserslist 4.28.6 4.29.4
devalue 5.9.0 6.0.3
smol-toml 1.7.1 1.9.1
svgo 4.0.2 4.1.0

Updates hono from 4.12.34 to 4.13.7

Release notes

Sourced from hono's releases.

v4.13.7

Security fixes

This release includes a fix for the following security issue:

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv

Users who render untrusted strings inside Suspense, ErrorBoundary, or Context.Provider, or pass them directly to hono/jsx/dom/server, are strongly encouraged to upgrade to this version.

v4.13.6

What's Changed

Full Changelog: honojs/hono@v4.13.5...v4.13.6

v4.13.5

Security fixes

This release includes fixes for the following security issues:

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

Affects: parseBody() when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfc

Users who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use parseBody({ dot: true }) are strongly encouraged to upgrade to this version.

v4.13.4

What's Changed

  • fix(request): handle params on unmatched requests in honojs/hono#5268
  • fix(jsx/dom): execute previous ref cleanup when ref prop changes on re-render in honojs/hono#5264
  • fix(reg-exp-router): associate wildcard middleware with matching routes in honojs/hono#5266
  • perf(router): share null object creation in honojs/hono#5267

... (truncated)

Commits

Updates http-cache-semantics from 4.2.0 to 4.3.0

Commits

Updates astro from 7.1.6 to 7.4.1

Release notes

Sourced from astro's releases.

astro@7.4.1

Patch Changes

  • #18425 6fdc36e Thanks @​astro-factory! - Preserves the last modified date of cached optimized images and incrementally restored build output when copying them into the build output on all platforms

  • #18419 395d195 Thanks @​astro-factory! - Fixes a typo in the error message shown when a font cssVariable is invalid

  • #18401 484822f Thanks @​danielmlr! - Fixes a bug where projects whose path contains an apostrophe (') failed to load sessions, middleware, a cache provider, or a src/fetch.ts handler

  • #18407 a6e00be Thanks @​astro-factory! - Fixes a TSCONFIG_ERROR during astro build when a parent directory contains a tsconfig.json that cannot be resolved, such as one extending astro/tsconfigs/strict without installed dependencies

  • #18427 908f167 Thanks @​astro-factory! - Fixes an Unterminated string build error when application code imports from astro/config (for example, fontProviders in a shared fonts module)

  • #18428 40e7d54 Thanks @​astro-factory! - Fixes missing styles in production builds for conditionally rendered framework components (e.g. Svelte components inside {#if} blocks) imported by a hydrated island

  • #18424 617ff59 Thanks @​astro-factory! - Fixes style-only HMR in .astro components falling back to a full page reload when a PostCSS plugin (such as @unocss/postcss) lists the component as a dependency of its own style

  • #18274 70834bb Thanks @​Princesseuh! - Fixes increasing memory usage when editing the Astro configuration while the dev server is running

astro@7.4.0

Minor Changes

  • #17894 b7a1bd9 Thanks @​Princesseuh! - Adds a new --timings flag to astro build to help you find what slows down your builds

    When a build takes longer than expected, it can be hard to tell whether the cause is an integration, a Markdown processor plugin, image processing, or even syntax highlighting. Add the --timings flag to your build command to print a summary once the build finishes:

    astro build --timings

    This is helpful to decide what to optimize first, or to compare build times before and after a change to your project.

  • #17830 a937b0d Thanks @​florian-lefebvre! - Adds a new optional getFontProperties() callback to font providers

    Font providers can now expose the weights, styles, subsets and formats a font family actually has. Astro uses it when resolving your font configuration to warn about values a provider cannot serve, for example a weight a font family does not offer.

    All built-in providers implement it. If you maintain a custom font provider, implementing this callback is optional for now but it will be required in Astro 8:

    import type { FontProvider } from 'astro';
const provider: FontProvider = {
name: 'my-provider',
resolveFont: ({ familyName }) => {
// ...
},
getFontProperties: ({ familyName }) => ({
weights: ['400', '700'],
styles: ['normal', 'italic'],
subsets: ['latin'],

... (truncated)

Changelog

Sourced from astro's changelog.

7.4.1

Patch Changes

  • #18425 6fdc36e Thanks @​astro-factory! - Preserves the last modified date of cached optimized images and incrementally restored build output when copying them into the build output on all platforms

  • #18419 395d195 Thanks @​astro-factory! - Fixes a typo in the error message shown when a font cssVariable is invalid

  • #18401 484822f Thanks @​danielmlr! - Fixes a bug where projects whose path contains an apostrophe (') failed to load sessions, middleware, a cache provider, or a src/fetch.ts handler

  • #18407 a6e00be Thanks @​astro-factory! - Fixes a TSCONFIG_ERROR during astro build when a parent directory contains a tsconfig.json that cannot be resolved, such as one extending astro/tsconfigs/strict without installed dependencies

  • #18427 908f167 Thanks @​astro-factory! - Fixes an Unterminated string build error when application code imports from astro/config (for example, fontProviders in a shared fonts module)

  • #18428 40e7d54 Thanks @​astro-factory! - Fixes missing styles in production builds for conditionally rendered framework components (e.g. Svelte components inside {#if} blocks) imported by a hydrated island

  • #18424 617ff59 Thanks @​astro-factory! - Fixes style-only HMR in .astro components falling back to a full page reload when a PostCSS plugin (such as @unocss/postcss) lists the component as a dependency of its own style

  • #18274 70834bb Thanks @​Princesseuh! - Fixes increasing memory usage when editing the Astro configuration while the dev server is running

7.4.0

Minor Changes

  • #17894 b7a1bd9 Thanks @​Princesseuh! - Adds a new --timings flag to astro build to help you find what slows down your builds

    When a build takes longer than expected, it can be hard to tell whether the cause is an integration, a Markdown processor plugin, image processing, or even syntax highlighting. Add the --timings flag to your build command to print a summary once the build finishes:

    astro build --timings

    This is helpful to decide what to optimize first, or to compare build times before and after a change to your project.

  • #17830 a937b0d Thanks @​florian-lefebvre! - Adds a new optional getFontProperties() callback to font providers

    Font providers can now expose the weights, styles, subsets and formats a font family actually has. Astro uses it when resolving your font configuration to warn about values a provider cannot serve, for example a weight a font family does not offer.

    All built-in providers implement it. If you maintain a custom font provider, implementing this callback is optional for now but it will be required in Astro 8:

    import type { FontProvider } from 'astro';
const provider: FontProvider = {
name: 'my-provider',
resolveFont: ({ familyName }) => {
// ...
},
getFontProperties: ({ familyName }) => ({
weights: ['400', '700'],

... (truncated)

Commits
  • e990df8 [ci] release (#18405)
  • 70834bb fix(astro): reduce memory retained across dev server restarts (#18274)
  • 40e7d54 fix(css): defer client CSS deletion so conditionally rendered component style...
  • 908f167 fix(server-islands): only replace island map placeholders in the manifest chu...
  • 6fdc36e fix(build): preserve last modified time when copying cached files to output (...
  • 617ff59 Fix style-only HMR full reload when a PostCSS plugin lists the component as i...
  • 395d195 fix(astro): correct "indent" typo to "ident" in fonts cssVariable error messa...
  • a6e00be fix(env): skip tsconfig loading in import.meta.env define replacement (#18407)
  • 484822f Fix virtual module imports when the project path contains an apostrophe (#18401)
  • c2c43a9 [ci] release (#18354)
  • Additional commits viewable in compare view

Updates sharp from 0.35.3 to 0.35.5

Release notes

Sourced from sharp's releases.

v0.35.5

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4

  • Add upper bounds check on length of linear and GIF delay arrays.

  • Improve error handing when WebAssembly fallback also fails. #4593 @​lazerg

  • TypeScript: Allow multi-frame options for JXL output. #4602 @​ramin-010

  • TypeScript: Remove non-existent named export. #4604

  • Increase accepted dimensions when extending an image. #4605

  • Improve gain map support for extract and rotate operations. #4606

  • Tests: Ensure composite tests pass on big endian platforms. #4609

v0.35.5-rc.1

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4-rc.1

  • Add upper bounds check on length of linear and GIF delay arrays.

  • Improve error handing when WebAssembly fallback also fails. #4593 @​lazerg

  • TypeScript: Allow multi-frame options for JXL output. #4602 @​ramin-010

  • TypeScript: Remove non-existent named export. #4604

  • Increase accepted dimensions when extending an image. #4605

  • Improve gain map support for extract operation. #4606

... (truncated)

Commits
  • 51a990f Release v0.35.5
  • 96de105 Upgrade to sharp-libvips v1.3.4
  • 3a61390 CI: Configure Dependabot with all package.json locations
  • 4940c50 Improve gain map support for rotate/flip/flop ops
  • 20654aa Prerelease v0.35.5-rc.1
  • ef4f934 CI: Upgrade to Ubuntu 26.04
  • 358df95 Upgrade to libvips v8.18.7
  • 49f4903 Improve gain map support for rotate-then-extract #4606
  • 0e2e55e Silence a couple of compiler/static analysis warnings
  • cef3b8c Improve gain map support for extract operation #4606
  • Additional commits viewable in compare view

Updates @vitest/mocker from 4.1.10 to 4.1.12

Release notes

Sourced from @​vitest/mocker's releases.

v4.1.12

   🐞 Bug Fixes

    View changes on GitHub

v4.1.11

   🐞 Bug Fixes

    View changes on GitHub
Commits

Updates baseline-browser-mapping from 2.10.43 to 2.11.30

Release notes

Sourced from baseline-browser-mapping's releases.

v2.11.0

What's Changed in 2.11.0

  • feat: Adds a new getTimeline() method for getting the series of minimum browser changes, either grouped by date or by browser.
  • refactor: Substantial refactoring of the data compression process that replaces the full list of browsers from @mdn/browser-compat-data and downstream-browsers.json and features from web-features (in their very pared down form) with a change-list timeline that reflects which versions supported Baseline (newly available) on a given date. Thanks to @​swwind for the idea!
  • refactor: Some common functions have been moved to a util.ts module for use in other scripts.
  • fix: Removes process.exit() calls when unsupported option combinations are passed to getCompatibleVersions() and getAllVersions() in favour of throwing an Error. There is a small security risk with process.exit() calls that sites accepting unsanitised inputs could be the subject of attacks. Unsupported config options now throw and Error which should allow for more graceful handling. Thanks to @​bnbdr for flagging this as vulnerability CVE-2026-45819 .

Fixes #134

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.10.44...v2.11.0

Commits
  • 65822d6 Patch to 2.11.30 because browser or feature data changed
  • c074f56 Browser or feature data changed
  • 4517bea Updating static site
  • 4352208 Updating static site
  • 091495e build(deps-dev): Bump @​humanfs/node from 0.16.6 to 0.16.8 (#152)
  • c69aaba build(deps-dev): Bump js-yaml from 4.3.1 to 4.3.2 (#151)
  • 3fa5618 build(deps-dev): Bump proxy-addr from 2.0.7 to 2.0.8 (#150)
  • 2856b7b build(deps): Bump brace-expansion (#149)
  • 5f73d33 fix: the api key is passed as a command-line argumen... in... (#140)
  • 279dab4 Bump tmp from 0.2.5 to 0.2.7 (#132)
  • Additional commits viewable in compare view

Updates browserslist from 4.28.6 to 4.29.4

Release notes

Sourced from browserslist's releases.

4.29.4

  • Fixed joined version bounds in version ray and range queries (by @​ybai08).
  • Fixed whitespaces processing (by @​abhu85).

4.29.3

  • Updated Firefox ESR.

4.29.2

  • Fixed ignoring null usage in cover X in Y query (by @​wahidrizka).

4.29.1

4.29.0

  • Added query continuations across lines and array entries (by @​fzlzjerry).

4.28.9

4.28.8

  • Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

Changelog

Sourced from browserslist's changelog.

4.29.4

  • Fixed joined version bounds in version ray and range queries (by @​ybai08).
  • Fixed whitespaces processing (by @​abhu85).

4.29.3

  • Updated Firefox ESR.

4.29.2

  • Fixed ignoring null usage in cover X in Y query (by @​wahidrizka).

4.29.1

4.29.0

  • Added query continuations across lines and array entries (by @​fzlzjerry).

4.28.9

4.28.8

  • Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

Commits
  • f7a99b9 Release 4.29.4 version
  • 03fc702 Update dependencies
  • efe07e1 Merge pull request #956 from ybai08/fix-joined-range-bounds
  • ef50f5b Fix joined version bounds in version ray and range queries
  • 8219dd7 Merge pull request #954 from abhu85/fix-since-extends-whitespace
  • 893120b Allow arbitrary whitespaces in since, extends, config and not queries
  • b4809dd Release 4.29.3 version
  • 9d844f8 Update Firefox ESR
  • 0033f34 Update dependencies
  • 906d329 Release 4.29.2 version
  • Additional commits viewable in compare view

Updates devalue from 5.9.0 to 6.0.3

Release notes

Sourced from devalue's releases.

v6.0.3

Patch Changes

  • 5cd712a: perf: use native JSON.stringify for strings that need escaping, instead of a per-character loop
  • b49ae34: chore: lower required node version to >=18
  • c411e5e: fix: use explicit .js extension in type imports for nodenext compatibility

v6.0.2

Patch Changes

  • 12ad9d6: chore: remove dts-buddy

v6.0.1

Patch Changes

  • c13cf6a: fix: populate error.path for values reached through a promise in stringifyAsync
  • 6156b2e: perf: stringify and uneval skip per-character escaping for strings with nothing to escape
  • e7a9a73: fix: throw Invalid input instead of a raw TypeError for malformed typed array and boxed primitive payloads
  • 6156b2e: perf: only format path when an error is raised
  • 6156b2e: perf: cache quoted property names
  • 9e44253: Fix uneval for typed array views whose backing buffer ends with a partial element

v6.0.0

Major Changes

  • afb3cb4: breaking: use tagged template js for uneval replacers instead of nested uneval
  • 3100507: breaking: require Node 22.17 or newer

Minor Changes

  • afb3cb4: feat: support cyclic custom objects

Patch Changes

  • ac295fb: fix: escape unpaired surrogates so uneval/stringify output survives UTF-8 transport

v5.9.4

Patch Changes

  • 067b125: perf: annotate module-level Object.freeze calls as pure so unused operation tables tree-shake

v5.9.3

Patch Changes

  • 6861dbb: fix: avoid scanning sparse array holes in uneval traversal and shared-array population
  • 9ec5130: fix: reject non-string null-prototype object keys in parse and unflatten to prevent bypassing the __proto__ check
  • dae8153: fix: prevent unhandled internal rejections in stringifyAsync when serializing multiple promises
  • 84f6f67: fix: prevent quadratic uneval output expansion for repeated strings and bigints
  • 6861dbb: fix: avoid eager allocation when evaluating sparse arrays emitted by uneval
  • 8f8d78e: fix: validate revived backing buffers before constructing typed arrays

... (truncated)

Changelog

Sourced from devalue's changelog.

6.0.3

Patch Changes

  • 5cd712a: perf: use native JSON.stringify for strings that need escaping, instead of a per-character loop
  • b49ae34: chore: lower required node version to >=18
  • c411e5e: fix: use explicit .js extension in type imports for nodenext compatibility

6.0.2

Patch Changes

  • 12ad9d6: chore: remove dts-buddy

6.0.1

Patch Changes

  • c13cf6a: fix: populate error.path for values reached through a promise in stringifyAsync
  • 6156b2e: perf: stringify and uneval skip per-character escaping for strings with nothing to escape
  • e7a9a73: fix: throw Invalid input instead of a raw TypeError for malformed typed array and boxed primitive payloads
  • 6156b2e: perf: only format path when an error is raised
  • 6156b2e: perf: cache quoted property names
  • 9e44253: Fix uneval for typed array views whose backing buffer ends with a partial element

6.0.0

Major Changes

  • afb3cb4: breaking: use tagged template js for uneval replacers instead of nested uneval
  • 3100507: breaking: require Node 22.17 or newer

Minor Changes

  • afb3cb4: feat: support cyclic custom objects

Patch Changes

  • ac295fb: fix: escape unpaired surrogates so uneval/stringify output survives UTF-8 transport

5.9.4

Patch Changes

  • 067b125: perf: annotate module-level Object.freeze calls as pure so unused operation tables tree-shake

5.9.3

Patch Changes

  • 6861dbb: fix: avoid scanning sparse array holes in uneval traversal and shared-array population
  • 9ec5130: fix: reject non-string null-prototype object keys in parse and unflatten to prevent bypassing the __proto__ check
  • dae8153: fix: prevent unhandled internal rejections in stringifyAsync when serializing multiple promises
  • 84f6f67: fix: prevent quadratic uneval output expansion for repeated strings and bigints
  • 6861dbb: fix: avoid eager allocation when evaluating sparse arrays emitted by uneval
  • 8f8d78e: fix: validate revived backing buffers before constructing typed arrays

... (truncated)

Commits

Updates smol-toml from 1.7.1 to 1.9.1

Release notes

Sourced from smol-toml's releases.

v1.9.1

What's Changed

Full Changelog: squirrelchat/smol-toml@v1.9.0...v1.9.1

v1.9.0

Huge update!!! This is most likely the largest update the library received since its release, with lots of new features and improvements.

Performance improvements

Significant parts of the internal parse logic have been rewritten, improving performance by 1.5x-2x. The library was already comfortably ahead of the others, but it is now faster than ever, sitting at 4x faster parse performance than the closest maintained implementation.

Problematic code paths have also been replaced by safer implementations, solving potential DoS vectors. See GHSA-r4xh-jqrq-34v2.

Note: the objects returned by the library now have a null prototype. This is a transparent change for 99.9% of users, and is one of the most significant contributors to the major performance gains in this version.

Full Temporal support

Version 1.8.0 brought support for Temporal in stringify; now the library is also able to emit Temporal objects instead of its own ad-hoc TomlDate object. It is not enabled by default, but it will become the default in v2. Enable by setting useLegacyDate: false in the parser's options.

Better Temporal support in stringify

Temporal support has been improved since it released: Temporal objects that cannot be represented (such as Temporal.PlainMonthDay) now throw an error (instead of silently emitting a bogus object).

A new option has been added to stringify to disallow Temporal objects that cannot be fully represented in TOML. This includes ZonedDateTime objects with a IANA timezone attached instead of a plain offset, and dates with a specific calendar value set. Enable by setting strictTemporal: true in the options.

Handling of unsafe keys

Since its release the library has been protected against prototype pollution attacks, setting properties like __proto__ using safe mechanisms that do not trigger prototype pollution. However, while the returned objects are safe on their own, they may become problematic if used carelessly.

Inspired by secure-json-parse, the library now offers a way to either drop unsafe properties from the returned object, or to throw an error and reject documents altogether. By default, these potentially unsafe keys are preserved and returned.

Miscellaneous updates

  • Unicode BOM is now gracefully accepted and ignored.
  • Table array headers are now properly checked again. Reported in #65.
  • Closed certain gaps where invalid whitespace would be accepted. Reported in #61.
  • Bogus local date and local time values with a UTC offset are no longer accepted.
  • Certain error messages are more accurate and handle errors at line boundaries better.
  • The default export of the lib is now formally deprecated; use a import * instead. Proposed in #50.
  • On Node 20+, strings that contain lone surrogates are now normalised to well-formed strings.
  • On Node 20+, keys that contain lone surrogates are now rejected.

Full Changelog: squirrelchat/smol-toml@v1.8.0...v1.9.0

v1.8.0

What's Changed

Full Changelog: squirrelchat/smol-toml@v1.7.2...v1.8.0

... (truncated)

Commits
  • 69aa050 fix: actually properly fix exponent issues
  • 7be7084 chore: version bump
  • be3290d chore: upgrade deps
  • 86c7613 fix: reject invalid extra exponent sign
  • 6f9739a fix: gate [is|to]WellFormed (Node 18 compat)
  • a73ca32 fix: no Temporal with toml-test when Node < 26
  • 7727890 chore: version bump
  • 641903d chore: rewrite README.md
  • 2df14c5 fix(types): make it work if Temporal doesn't exist
  • 3eaa44e chore: update benchmark harness
  • Additional commits viewable in compare view

Updates svgo from 4.0.2 to 4.1.0

Release notes

Sourced from svgo's releases.

v4.1.0

This minor release upgrades the SAX parser and introduces stricter XML validation. It also includes important security hardening for removeScripts, dependency updates, and improvements to the test and regression infrastructure.

Support SVGO

If SVGO is valuable to you or your organization, please consider supporting the project on OpenCollective. Your sponsorship helps fund ongoing maintenance and security work.

Stricter XML validation

SVGO now uses sax 1.6.1, upgraded from 1.5.0 (#2257).

The new parser version validates numeric character references against the ranges permitted by XML. Invalid references are now rejected in both text and attributes, including:

  • disallowed control characters such as &[#1](https://github.com/svg/svgo/issues/1);, &#xB;, and &#x1F;;
  • UTF-16 surrogate code points such as &#xD800;;
  • invalid XML code points such as &#xFFFF;.

Valid boundary values—including U+0020, U+D7FF, U+E000, U+FFFD, and characters through U+10FFFF—remain supported.

Parser failures are consistently exposed as SvgoParserError errors with an Invalid character entity reason.

This is an intentional behavior change: malformed SVGs that were previously accepted may now produce a parser error, while valid XML documents are unaffected.

Security

The removeScripts plugin has been hardened against several script-execution bypasses:

  • Filters executable data: URLs containing HTML, XHTML, or SVG documents while preserving inert data such as PNG images, and filters legacy vbscript: URLs (#2263).
  • Sanitizes content inside SVG <foreignObject> elements by removing HTML event-handler attributes, srcdoc, and executable URLs from action, data, formaction, href, and src, while preserving non-executable HTML and visual content (#2264).
  • Recognizes namespace-prefixed SVG <a> elements and removes ASCII tabs and newlines before checking URL schemes, preventing values such as java&[#9](https://github.com/svg/svgo/issues/9);script: from bypassing detection while preserving elements in unrelated custom namespaces (#2268).

These changes address:

Dependencies

  • Upgraded css-select to v6 and css-what to v7, and updated SVGO's custom selector adapter for css-select v6 (#2244).

Project maintenance

@​TrySound is back as an active SVGO maintainer.

Many thanks to @​KTibow, @​SethFalco, and @​XhmikosR for maintaining and improving SVGO over the past several years.

Full Changelog: svg/svgo@v4.0.2...v4.1.0

Commits
  • 5765cbe chore: prepare v4.1.0 release (#2275)
  • 3db3ef3 fix(removeScripts): handle anchor URL bypasses (#2268)
  • 4e9b9ae chore: cache regression screenshots (#2267)
  • d55270c chore(regression): migrate comparison workers to Tinypool (#2266)
  • fd51e47 fix(removeScripts): sanitize foreignObject content (#2264)
  • dcaf957 chore: optimize fixtures in a bounded worker pool (#2265)
  • a354293 fix(removeScripts): filter executable data URLs (#2263)
  • 4e0d2ac ci(typecheck): return typechecking on CI
  • 0b97fed test(typescript): drop tsd for vitest type testing API
  • f6e8ae1 chore(pnpm): drop package.json#pnpm.onlyBuiltDependencies
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for svgo since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • `@de...

Description has been truncated

@dependabot
chore(deps): bump the npm_and_yarn group across 1 directory with 10 u…
4a608c5 
…pdates

Bumps the npm_and_yarn group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [hono](https://github.com/honojs/hono) | `4.12.34` | `4.13.7` |
| [http-cache-semantics](https://github.com/kornelski/http-cache-semantics) | `4.2.0` | `4.3.0` |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `7.1.6` | `7.4.1` |
| [sharp](https://github.com/lovell/sharp) | `0.35.3` | `0.35.5` |
| [@vitest/mocker](https://github.com/vitest-dev/vitest/tree/HEAD/packages/mocker) | `4.1.10` | `4.1.12` |
| [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping) | `2.10.43` | `2.11.30` |
| [browserslist](https://github.com/browserslist/browserslist) | `4.28.6` | `4.29.4` |
| [devalue](https://github.com/sveltejs/devalue) | `5.9.0` | `6.0.3` |
| [smol-toml](https://github.com/squirrelchat/smol-toml) | `1.7.1` | `1.9.1` |
| [svgo](https://github.com/svg/svgo) | `4.0.2` | `4.1.0` |



Updates `hono` from 4.12.34 to 4.13.7
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.34...v4.13.7)

Updates `http-cache-semantics` from 4.2.0 to 4.3.0
- [Commits](https://github.com/kornelski/http-cache-semantics/commits)

Updates `astro` from 7.1.6 to 7.4.1
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.4.1/packages/astro)

Updates `sharp` from 0.35.3 to 0.35.5
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.35.3...v0.35.5)

Updates `@vitest/mocker` from 4.1.10 to 4.1.12
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.12/packages/mocker)

Updates `baseline-browser-mapping` from 2.10.43 to 2.11.30
- [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases)
- [Commits](web-platform-dx/baseline-browser-mapping@v2.10.43...v2.11.30)

Updates `browserslist` from 4.28.6 to 4.29.4
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](browserslist/browserslist@4.28.6...4.29.4)

Updates `devalue` from 5.9.0 to 6.0.3
- [Release notes](https://github.com/sveltejs/devalue/releases)
- [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md)
- [Commits](sveltejs/devalue@v5.9.0...v6.0.3)

Updates `smol-toml` from 1.7.1 to 1.9.1
- [Release notes](https://github.com/squirrelchat/smol-toml/releases)
- [Commits](squirrelchat/smol-toml@v1.7.1...v1.9.1)

Updates `svgo` from 4.0.2 to 4.1.0
- [Release notes](https://github.com/svg/svgo/releases)
- [Commits](svg/svgo@v4.0.2...v4.1.0)

---
updated-dependencies:
- dependency-name: hono
  dependency-version: 4.13.7
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: http-cache-semantics
  dependency-version: 4.3.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: astro
  dependency-version: 7.4.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: sharp
  dependency-version: 0.35.5
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@vitest/mocker"
  dependency-version: 4.1.12
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: baseline-browser-mapping
  dependency-version: 2.11.30
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: browserslist
  dependency-version: 4.29.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: devalue
  dependency-version: 6.0.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: smol-toml
  dependency-version: 1.9.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: svgo
  dependency-version: 4.1.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@vercel

vercel Bot commented Oct 20, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
cli Ready Ready Preview Oct 20, 2026 1:49am UTC

Request Review

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 20, 2026

This branch was successfully deployed

1 active deployment
Preview — 4a608c5d Deployed Oct 20, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants