Merge commit from fork

Author: SethFalco

.github/workflows/publish.yml

@@ -1,5 +1,3 @@
-name: Node.js Package
-
 on:
   release:
     types: [created]
@@ -12,17 +10,26 @@ permissions:
 jobs:
   publish-npm:
     runs-on: ubuntu-latest
+    env:
+      GH_TOKEN: ${{ github.token }}
     steps:
       - uses: actions/checkout@v6
       - run: corepack enable
       - uses: actions/setup-node@v6
         with:
-          node-version: 22
+          node-version: 24
           registry-url: https://registry.npmjs.org
       - run: yarn install
       - run: |
-          if jq -r .version <package.json | grep -q \\-rc.; then
+          VERSION=$(jq -r .version <package.json)
+          if [[ "$VERSION" = *"-rc."* ]]; then
             yarn npm publish --access public --tag rc
           else
-            yarn npm publish --access public
+            LATEST_VERSION="$(gh release view --json tagName -q '.tagName' --repo ${{ github.repository }})"
+            if [[ "${{ github.ref_name }}" = "$LATEST_VERSION" ]]; then
+              yarn npm publish --access public
+            else
+              MAJOR="$(awk -F '.' '{ print $1 }' <<< "$VERSION")"
+               npm publish --access public --tag "v$MAJOR"
+            fi
           fi

…n/patches/sax-npm-1.4.1-503b1923cb.patch …n/patches/sax-npm-1.5.0-d40bca2226.patch.yarn/patches/sax-npm-1.4.1-503b1923cb.patch renamed to .yarn/patches/sax-npm-1.5.0-d40bca2226.patch .yarn/patches/sax-npm-1.4.1-503b1923cb.patch renamed to .yarn/patches/sax-npm-1.5.0-d40bca2226.patch

@@ -1,18 +1,18 @@
 diff --git a/lib/sax.js b/lib/sax.js
-index 122ad8e5a478339d56fc86d00d21c5d142739f0e..2557c46482ff651026436cc6c7142ebfe68ddfc5 100644
+index d35adf1a319b7f064d7a7e43c46630ed5ef587ff..4c5a08844f3be4ddceb12285d3fd133213dcc7e0 100644
 --- a/lib/sax.js
 +++ b/lib/sax.js
-@@ -1,8 +1,6 @@
- ;(function (sax) { // wrapper for non-node envs
-   sax.parser = function (strict, opt) { return new SAXParser(strict, opt) }
+@@ -4,8 +4,6 @@
+     return new SAXParser(strict, opt)
+   }
    sax.SAXParser = SAXParser
 -  sax.SAXStream = SAXStream
 -  sax.createStream = createStream
 
    // When we pass the MAX_BUFFER_LENGTH position, start checking for buffer overruns.
    // When we check, schedule the next check for MAX_BUFFER_LENGTH - (max(buffer lengths)),
-@@ -164,111 +162,6 @@
-     flush: function () { flushBuffers(this) }
+@@ -191,123 +189,6 @@
+     },
    }
 
 -  var Stream
@@ -27,11 +27,11 @@ index 122ad8e5a478339d56fc86d00d21c5d142739f0e..2557c46482ff651026436cc6c7142ebf
 -    return ev !== 'error' && ev !== 'end'
 -  })
 -
--  function createStream (strict, opt) {
+-  function createStream(strict, opt) {
 -    return new SAXStream(strict, opt)
 -  }
 -
--  function SAXStream (strict, opt) {
+-  function SAXStream(strict, opt) {
 -    if (!(this instanceof SAXStream)) {
 -      return new SAXStream(strict, opt)
 -    }
@@ -72,26 +72,27 @@ index 122ad8e5a478339d56fc86d00d21c5d142739f0e..2557c46482ff651026436cc6c7142ebf
 -          me.on(ev, h)
 -        },
 -        enumerable: true,
--        configurable: false
+-        configurable: false,
 -      })
 -    })
 -  }
 -
 -  SAXStream.prototype = Object.create(Stream.prototype, {
 -    constructor: {
--      value: SAXStream
--    }
+-      value: SAXStream,
+-    },
 -  })
 -
 -  SAXStream.prototype.write = function (data) {
--    if (typeof Buffer === 'function' &&
+-    if (
+-      typeof Buffer === 'function' &&
 -      typeof Buffer.isBuffer === 'function' &&
--      Buffer.isBuffer(data)) {
+-      Buffer.isBuffer(data)
+-    ) {
 -      if (!this._decoder) {
--        var SD = require('string_decoder').StringDecoder
--        this._decoder = new SD('utf8')
+-        this._decoder = new TextDecoder('utf8')
 -      }
--      data = this._decoder.write(data)
+-      data = this._decoder.decode(data, { stream: true })
 -    }
 -
 -    this._parser.write(data.toString())
@@ -103,6 +104,14 @@ index 122ad8e5a478339d56fc86d00d21c5d142739f0e..2557c46482ff651026436cc6c7142ebf
 -    if (chunk && chunk.length) {
 -      this.write(chunk)
 -    }
+-    // Flush any remaining decoded data from the TextDecoder
+-    if (this._decoder) {
+-      var remaining = this._decoder.decode()
+-      if (remaining) {
+-        this._parser.write(remaining)
+-        this.emit('data', remaining)
+-      }
+-    }
 -    this._parser.end()
 -    return true
 -  }
@@ -111,7 +120,10 @@ index 122ad8e5a478339d56fc86d00d21c5d142739f0e..2557c46482ff651026436cc6c7142ebf
 -    var me = this
 -    if (!me._parser['on' + ev] && streamWraps.indexOf(ev) !== -1) {
 -      me._parser['on' + ev] = function () {
--        var args = arguments.length === 1 ? [arguments[0]] : Array.apply(null, arguments)
+-        var args =
+-          arguments.length === 1 ?
+-            [arguments[0]]
+-          : Array.apply(null, arguments)
 -        args.splice(0, 0, ev)
 -        me.emit.apply(me, args)
 -      }

lib/version.js

@@ -4,4 +4,4 @@
  * @type {string}
  * @since 4.0.0
  */
-export const VERSION = '4.0.0';
+export const VERSION = '4.0.1';

package.json

@@ -1,7 +1,7 @@
 {
   "packageManager": "yarn@3.8.7",
   "name": "svgo",
-  "version": "4.0.0",
+  "version": "4.0.1",
   "description": "SVGO is a Node.js library and command-line application for optimizing vector images.",
   "license": "MIT",
   "type": "module",
@@ -108,7 +108,7 @@
     "css-what": "^6.1.0",
     "csso": "^5.0.5",
     "picocolors": "^1.1.1",
-    "sax": "^1.4.1"
+    "sax": "^1.5.0"
   },
   "devDependencies": {
     "@eslint/js": "^9.25.1",
@@ -139,6 +139,6 @@
     "typescript": "^5.8.3"
   },
   "resolutions": {
-    "sax@^1.4.1": "patch:sax@npm%3A1.4.1#./.yarn/patches/sax-npm-1.4.1-503b1923cb.patch"
+    "sax@^1.5.0": "patch:sax@npm%3A1.5.0#./.yarn/patches/sax-npm-1.5.0-d40bca2226.patch"
   }
 }

test/svgo/billion-laughs-flat.svg

@@ -0,0 +1,30 @@
+import { readFile } from 'node:fs/promises';
+import path from 'path';
+import { fileURLToPath } from 'url';
+import { optimize } from '../../lib/svgo.js';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+describe('svgo', () => {
+  it('should throw on excessive expansion depth', async () => {
+    const original = await readFile(
+      path.join(__dirname, 'billion-laughs.svg'),
+      'utf-8',
+    );
+
+    expect(() => {
+      optimize(original);
+    }).toThrow('Parsed entity depth exceeds max entity depth');
+  });
+
+  it('should throw on excessive expansion count', async () => {
+    const original = await readFile(
+      path.join(__dirname, 'billion-laughs-flat.svg'),
+      'utf-8',
+    );
+
+    expect(() => {
+      optimize(original);
+    }).toThrow('Parsed entity count exceeds max entity count');
+  });
+});

test/svgo/billion-laughs.svg

@@ -5451,17 +5451,17 @@ __metadata:
   languageName: node
   linkType: hard
 
-"sax@npm:1.4.1":
-  version: 1.4.1
-  resolution: "sax@npm:1.4.1"
-  checksum: 3ad64df16b743f0f2eb7c38ced9692a6d924f1cd07bbe45c39576c2cf50de8290d9d04e7b2228f924c7d05fecc4ec5cf651423278e0c7b63d260c387ef3af84a
+"sax@npm:1.5.0":
+  version: 1.5.0
+  resolution: "sax@npm:1.5.0"
+  checksum: e143cbeb6ca59345db142d97d1bbb620553beb8b166eda36ffeaba4b01af47dcf0423cd8781d0805b75feea69462cf80d0db7bf0a7e6dd87b711fda51b9153df
   languageName: node
   linkType: hard
 
-"sax@patch:sax@npm%3A1.4.1#./.yarn/patches/sax-npm-1.4.1-503b1923cb.patch::locator=svgo%40workspace%3A.":
-  version: 1.4.1
-  resolution: "sax@patch:sax@npm%3A1.4.1#./.yarn/patches/sax-npm-1.4.1-503b1923cb.patch::version=1.4.1&hash=ad106d&locator=svgo%40workspace%3A."
-  checksum: 511be280ca9f1d474466aa165a7e6b50fc70e2de2f263462f60358a9f0661cf36c8f334234813e438d61676374e7aa551a6c81bcecb763e3d3914e2f627a8a51
+"sax@patch:sax@npm%3A1.5.0#./.yarn/patches/sax-npm-1.5.0-d40bca2226.patch::locator=svgo%40workspace%3A.":
+  version: 1.5.0
+  resolution: "sax@patch:sax@npm%3A1.5.0#./.yarn/patches/sax-npm-1.5.0-d40bca2226.patch::version=1.5.0&hash=76ff30&locator=svgo%40workspace%3A."
+  checksum: e284b1d2584a046258c323837a3c8d6e10d37468c5fbea9c092d3106761f57b8a5947e63bbf8b27b1930e7f9adb439f2a3c31d4c316495b8d7830fb03c8cb9e8
   languageName: node
   linkType: hard
 
@@ -5858,7 +5858,7 @@ __metadata:
     prettier: ^3.5.3
     rimraf: ^5.0.10
     rollup: ^4.22.4
-    sax: ^1.4.1
+    sax: ^1.5.0
     tar-stream: ^3.1.7
     tsd: ^0.32.0
     typescript: ^5.8.3