Skip to content

Bump svgo and @wordpress/scripts in /web/wp-content/plugins/buttons-with-expiry - #1180

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/web/wp-content/plugins/buttons-with-expiry/multi-714f5fb11e
Open

Bump svgo and @wordpress/scripts in /web/wp-content/plugins/buttons-with-expiry#1180
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/web/wp-content/plugins/buttons-with-expiry/multi-714f5fb11e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 9, 2026

Copy link
Copy Markdown
Contributor

Bumps svgo to 3.3.5 and updates ancestor dependency @wordpress/scripts. These dependencies need to be updated together.

Updates svgo from 2.8.0 to 3.3.5

Release notes

Sourced from svgo's releases.

v3.3.5

What's Changed

Security

  • Backport the removeScriptElement hardening from SVGO v4 in #2269:
    • reject executable data: URLs and legacy vbscript: URLs
    • sanitize executable HTML inside <foreignObject> elements
    • handle namespace-prefixed SVG anchors and URL schemes containing ASCII tabs or newlines

This addresses GHSA-4vpr-x523-8j87 and GHSA-w27v-7q3p-w38r for the v3 release line.

Support

SVGO v3 is not officially supported; please consider upgrading to SVGO v4. This security fix has been backported, but there is no commitment to backport more complex changes in the future.

See the migration guide from v3 to v4.

v3.3.4

What's Changed

Security

Support

SVGO v3 is not officially supported, please consider upgrading to SVGO v4 instead. We've backported this fix as there are security implications, but there is no commitment to do this for more complex changes in future.

Consider reading our Migration Guide from v3 to v4 which should ease the process.

v3.3.3

What's Changed

Dependencies

  • Migrates from our unsupported fork of sax (@​trysound/sax) to the upstream version of sax (sax).

Bug Fixes

  • No longer throws error when encountering comments in DTD.

Metrics

Before and after of the browser bundle of each respective version:

v3.3.2 v3.3.3 Delta
svgo.browser.js 910.9 kB 912.9 kB ⬆️ 2 kB

... (truncated)

Commits
  • 4380590 ci: configure v3 publish tag in package metadata (#2271)
  • 4c84fe7 ci: publish v3 with npm trusted publishing (#2270)
  • 994a9f0 fix(removeScriptElement): backport security hardening to v3 (#2269)
  • 72a2388 Merge commit from fork
  • bbab162 deps: upgrade to sax v1.5.0
  • c4dc2be chore: increment version to v3.3.2
  • 252b28c chore: increment version to 3.2.0 (#1919)
  • 8644cf3 feat(convertPathData): convert c to q (#1892)
  • 2661dac fix(convertTransform): fix scale and rotate on skew + refactors (#1916)
  • f6a2ca2 chore: improve jest tests with more precise assertions (#1912)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for svgo since your current version.


Updates @wordpress/scripts from 20.0.2 to 34.2.0

Release notes

Sourced from @​wordpress/scripts's releases.

23.9.1

Changelog

Bug Fixes

  • Upgrade React 19 to 19.2.8, read version from package.json. (82439)

Contributors

The following contributors merged PRs in this release:

@​jsnajdr

23.9.0

Enhancements

Components

  • Admin UI: Add Navigation component and Page navigation slot. (79746)
  • Align legacy form control focus rings with WPDS. (80417)
  • Base Styles: Align input-control mixin to design system. (81357)
  • Base styles: Streamline focus ring override. (81242)
  • Calendar: Support custom root roles. (81443)
  • CollapsibleCard: Support multiple header descriptions. (81227)
  • DataViews: Pass the WordPress locale to the date/datetime calendar controls. (81592)
  • Global Styles: Allow editing duotone palettes. (81605)
  • Menu: Add UI component. (79560)
  • RadioControl: Allow individual options to be disabled. (82026)
  • SearchableChipSelect: Add grouped items support. (80989)
  • SearchableChipSelectControl: Add form control to @wordpress/ui. (80980)
  • Theme: Add color warning diagnostics workbench. (81817)
  • UI: Accept locale codes in Calendar components. (81814)
  • UI: Add Spinner component. (81358)
  • UI: Add TextareaControl component. (81359)
  • UI: Add tooltips to Calendar and RangeCalendar navigation buttons. (81983)
  • UI: Align Calendar styling with WPDS tokens. (81438)
  • UI: Collapse item-popup item sizing to default and small. (81354)
  • UI: Expose keyboard shortcut presentation utilities. (81826)
  • UI: Set Calendar text direction automatically. (81982)
  • UI: Use the default neutral border for Cards. (81746)

Block Library

  • Add transform to Row for Columns block. (81802)
  • Enable axial gap for Group and restrict to flex and grid layouts. (81476)
  • Global Styles: Register <label> as an element. (81160)
  • List: Add Align Support. (68002)
  • More block: Clarify description about excerpt vs full content. (80619)

... (truncated)

Changelog

Sourced from @​wordpress/scripts's changelog.

34.2.0 (2026-08-26)

34.1.0 (2026-08-12)

Bug Fixes

  • Set Sass's charset option to false so production builds no longer emit a UTF-8 BOM in the middle of the extracted CSS (#81383).

34.0.0 (2026-07-29)

Breaking Changes

  • Upgrade the bundled Jest packages from v29 to v30 (#80767).

Enhancements

  • format: Detect prettier.config.mjs so the bundled default config is not used when one is present (#80422).

33.0.0 (2026-07-14)

Breaking Changes

  • The test-e2e command now runs the Playwright-based end-to-end test runner instead of Puppeteer (test-playwright remains available as an alias). Removed the Puppeteer test environment and configuration (jest-environment-puppeteer, jest-e2e.config.js, puppeteer.config.js) along with the puppeteer-core and expect-puppeteer dependencies. Puppeteer-specific options (e.g. --puppeteer-interactive, --puppeteer-devtools) are no longer supported (#60357).

Enhancements

  • Widen React peer dependency ranges to ^18 || ^19 to support both React 18 and React 19 environments (#80024).
  • Update stylelint to ^16.26.1 (#79648).
  • Widen the @playwright/test peer dependency to >=1 and mark it optional, so consumers aren't forced to bump Playwright or satisfy it under strict peer deps (#78632).
  • Update webpack-dev-server to ^5.2.1, resolving several Dependabot security alerts and migrating the internal dev-server proxy config to the v5 array format (#80347).

32.6.0 (2026-07-01)

32.5.0 (2026-06-24)

Enhancements

  • lint-style: Detect .cjs and .mjs config files so the bundled default config is not used when one of these is present (#79226).

32.4.1 (2026-06-16)

32.4.0 (2026-06-10)

32.3.0 (2026-05-27)

32.2.0 (2026-05-14)

32.1.0 (2026-04-29)

32.0.0 (2026-04-15)

... (truncated)

Commits
  • d06b010 chore(release): publish (#82084)
  • 0790fa5 Update changelog files
  • 098e3ba Merge changes published in the Gutenberg plugin "release/23.9" branch
  • 989764d chore(release): publish
  • e18aa00 Update changelog files
  • dbb73c9 Merge changes published in the Gutenberg plugin "release/23.8" branch
  • 7e8b17a chore(release): publish
  • 42ad080 Update changelog files
  • edffa74 Merge changes published in the Gutenberg plugin "release/23.7" branch
  • e9a74f9 chore(release): publish
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by gutenbergplugin, a new releaser for @​wordpress/scripts since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [svgo](https://github.com/svg/svgo) to 3.3.5 and updates ancestor dependency [@wordpress/scripts](https://github.com/WordPress/gutenberg/tree/HEAD/packages/scripts). These dependencies need to be updated together.


Updates `svgo` from 2.8.0 to 3.3.5
- [Release notes](https://github.com/svg/svgo/releases)
- [Commits](svg/svgo@v2.8.0...v3.3.5)

Updates `@wordpress/scripts` from 20.0.2 to 34.2.0
- [Release notes](https://github.com/WordPress/gutenberg/releases)
- [Changelog](https://github.com/WordPress/gutenberg/blob/trunk/packages/scripts/CHANGELOG.md)
- [Commits](https://github.com/WordPress/gutenberg/commits/@wordpress/scripts@34.2.0/packages/scripts)

---
updated-dependencies:
- dependency-name: svgo
  dependency-version: 3.3.5
  dependency-type: indirect
- dependency-name: "@wordpress/scripts"
  dependency-version: 34.2.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Sep 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants