chore(deps): bump svgo from 3.3.2 to 4.0.0

[dependabot]

Bumps svgo from 3.3.2 to 4.0.0.

Release notes

Sourced from svgo's releases.

v4.0.0

Illustration by Vukory

It's been just over a year since our first release candidate, but I believe we can now release SVGO v4.0.0 with confidence! Thank you to all contributors who tested our RC builds and reported issues back up, this really smoothed out the process.

We actually wanted to do the release sooner, but it was a challenge to find the right time to publish a major release, since that means setting time aside to support users through migrations, helping downstream projects migrate, being available to fix or document things that users found to have an unexpected impact by this release, etc. I appreciate everyone's patience, and now that this is done, we can hopefully increase the pace of development again and tackle that backlog of old bugs. ^-^'

Breaking Changes

Please refer to the Migration Guide from v3 to v4 for a more concise version! This section is more verbose as it delves into the motivation of changes too.

Dropped Support for Node.js v14

Node.js v14 is no longer supported by the Node.js team, including security support, since 30 April 2023. Node.js v16 is no longer supported either, but as some are still using it, we'll save dropping support for Node.js v16 for the next major release.

This allows us to update our dependencies to more recent versions and to access more modern Node.js APIs.

Node.js v14 may still work at the time of this release, but we'll no longer be testing against v14 from now on.

Default Plugins

Both removeViewBox and removeTitle have been disabled by default. Both have been major pain points for users and don't make sense to enable in most cases. Other libraries wrapping SVGO have also been disabling these plugins by default, such as Docusaurus and SVGR.

• removeViewBox removes the scalability of SVGs.
• removeTitle reduces accessibility, which preserving accessibility is more important than optimization.

If you would like either of these plugins enabled, you can do so by configuring it in the SVGO config, see the README for more context, however please read the warnings described in the documentation of the plugins first:

  export default {
    plugins: [
      'preset-default', // built-in plugins enabled by default
+     'removeViewBox',
+     'removeTitle',
    ],
  };

removeScriptElement → removeScripts

The removeScriptElement plugin has been renamed to removeScripts, to more accurately reflect what the plugin does. It does not only remove the <script> tag, but also event handlers and script URIs from links.

To migrate, amend your SVGO config to refer to removeScripts instead if you use that plugin.

... (truncated)

Commits

• 71e1f05 chore: prepare v4 stable release (#2143)
• 4078c13 chore: increment version to v4.0.0-rc.5 (#2142)
• cb3eea8 fix(#2140): SVGO fails with ERR_UNSUPPORTED_ESM_URL_SCHEME on Windows (#2141)
• 2582096 chore(deps): bump streetsidesoftware/cspell-action from 6 to 7 (#2139)
• e1252fa deps: drop yarn/releases directory (#2138)
• feb9b5e fix(convertColors): use currentColor instead of currentcolor (#2137)
• e645d71 performance: small optimization when parsing svgs (#2133)
• 26d059f fix: invoke mapNodesToParents lazily (#2132)
• b761d1b feat: add editor namespace for Boxy SVG (#2008)
• 31328bc chore: add krita namespace to list of editor namespaces (#2131)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)