Bump code-infra:devDependencies - #49061
Open
code-infra-renovate[bot] wants to merge 1 commit into
Open
Conversation
Deploy previewBundle size
Check out the code infra dashboard for more information about this PR. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
0.35.3→0.35.44.0.2→4.1.0Release Notes
lovell/sharp (sharp)
v0.35.4Compare Source
https://github.com/lovell/sharp-libvips/releases/tag/v1.3.3
Bound resize dimensions to coordinate limit.
Bound composite left and top to coordinate limit.
#4564
@metsw24-max
Round palette bit depth up for png and gif colours.
#4569
@metsw24-max
Ensure tiff.subifd input option is used.
#4572
@metsw24-max
Ensure
info.pagesis correct when limiting input page range.#4578
@metsw24-max
Improve support for input Streams finishing before output is requested.
#4584
@Jaybhade
svg/svgo (svgo)
v4.1.0Compare Source
This minor release upgrades the SAX parser and introduces stricter XML validation. It also includes important security hardening for
removeScripts, dependency updates, and improvements to the test and regression infrastructure.Support SVGO
If SVGO is valuable to you or your organization, please consider supporting the project on OpenCollective. Your sponsorship helps fund ongoing maintenance and security work.
Stricter XML validation
SVGO now uses
sax1.6.1, upgraded from 1.5.0 (#2257).The new parser version validates numeric character references against the ranges permitted by XML. Invalid references are now rejected in both text and attributes, including:
&#​1;,, and;�;.Valid boundary values—including
U+0020,U+D7FF,U+E000,U+FFFD, and characters throughU+10FFFF—remain supported.Parser failures are consistently exposed as
SvgoParserErrorerrors with anInvalid character entityreason.This is an intentional behavior change: malformed SVGs that were previously accepted may now produce a parser error, while valid XML documents are unaffected.
Security
The
removeScriptsplugin has been hardened against several script-execution bypasses:data:URLs containing HTML, XHTML, or SVG documents while preserving inert data such as PNG images, and filters legacyvbscript:URLs (#2263).<foreignObject>elements by removing HTML event-handler attributes,srcdoc, and executable URLs fromaction,data,formaction,href, andsrc, while preserving non-executable HTML and visual content (#2264).<a>elements and removes ASCII tabs and newlines before checking URL schemes, preventing values such asjava&#​9;script:from bypassing detection while preserving elements in unrelated custom namespaces (#2268).These changes address:
Dependencies
css-selectto v6 andcss-whatto v7, and updated SVGO's custom selector adapter forcss-selectv6 (#2244).Project maintenance
@TrySound is back as an active SVGO maintainer.
Many thanks to @KTibow, @SethFalco, and @XhmikosR for maintaining and improving SVGO over the past several years.
Full Changelog: svg/svgo@v4.0.2...v4.1.0
Configuration
📅 Schedule: (in timezone UTC)
* 0-4 * * 7)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by self-hosted Renovate.