Skip to content

build(deps): bump svgo from 2.8.2 to 2.8.3#3485

Merged
jamiehenson merged 1 commit into
mainfrom
dependabot/npm_and_yarn/svgo-2.8.3
Jul 23, 2026
Merged

build(deps): bump svgo from 2.8.2 to 2.8.3#3485
jamiehenson merged 1 commit into
mainfrom
dependabot/npm_and_yarn/svgo-2.8.3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 22, 2026

Copy link
Copy Markdown
Contributor

Bumps svgo from 2.8.2 to 2.8.3.

Release notes

Sourced from svgo's releases.

v2.8.3

What's Changed

Security

Support

SVGO v2 is not officially supported, please consider upgrading to SVGO v4 instead. We've backported this fix as there are security implications, but there is no commitment to do this for more complex changes in future.

Consider reading our Migration Guide from v2 to v3 and Migration Guide from v3 to v4 which should ease the process.

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jul 22, 2026
@jamiehenson

Copy link
Copy Markdown
Member

@dependabot rebase

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/svgo-2.8.3 branch from cea2cb6 to 3ce9f1f Compare July 23, 2026 12:06

@jamiehenson jamiehenson left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approving. Transitive via cssnano <- css-minimizer-webpack-plugin <- gatsby; runs at build-time CSS minify over our own authored SVGs. 2.8.3 is a security backport to removeScripts, which isn't in cssnano's default preset — no real exposure. In-range.

~ 𝒞𝓁𝒶𝓊𝒹𝑒

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/svgo-2.8.3 branch from 3ce9f1f to 43c2ba6 Compare July 23, 2026 13:11
@jamiehenson
jamiehenson enabled auto-merge July 23, 2026 13:11
Bumps [svgo](https://github.com/svg/svgo) from 2.8.2 to 2.8.3.
- [Release notes](https://github.com/svg/svgo/releases)
- [Commits](svg/svgo@v2.8.2...v2.8.3)

---
updated-dependencies:
- dependency-name: svgo
  dependency-version: 2.8.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/svgo-2.8.3 branch from 43c2ba6 to f39c964 Compare July 23, 2026 13:23
@jamiehenson
jamiehenson merged commit e83d2c7 into main Jul 23, 2026
7 checks passed
@jamiehenson
jamiehenson deleted the dependabot/npm_and_yarn/svgo-2.8.3 branch July 23, 2026 13:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Development

Successfully merging this pull request may close these issues.

1 participant