Bump js-yaml, svgo and imagemin-webpack-plugin

[dependabot]

Bumps js-yaml to 3.14.2 and updates ancestor dependencies js-yaml, svgo and imagemin-webpack-plugin. These dependencies need to be updated together.

Updates js-yaml from 3.9.1 to 3.14.2

Changelog

Sourced from js-yaml's changelog.

[3.14.2] - 2025-11-15

Security

• Backported v4.1.1 fix to v3

[4.1.1] - 2025-11-12

Security

• Fix prototype pollution issue in yaml merge (<<) operator.

[4.1.0] - 2021-04-15

Added

• Types are now exported as yaml.types.XXX.
• Every type now has options property with original arguments kept as they were (see yaml.types.int.options as an example).

Changed

• Schema.extend() now keeps old type order in case of conflicts (e.g. Schema.extend([ a, b, c ]).extend([ b, a, d ]) is now ordered as abcd instead of cbad).

[4.0.0] - 2021-01-03

Changed

• Check migration guide to see details for all breaking changes.
• Breaking: "unsafe" tags !!js/function, !!js/regexp, !!js/undefined are moved to js-yaml-js-types package.
• Breaking: removed safe* functions. Use load, loadAll, dump instead which are all now safe by default.
• yaml.DEFAULT_SAFE_SCHEMA and yaml.DEFAULT_FULL_SCHEMA are removed, use yaml.DEFAULT_SCHEMA instead.
• yaml.Schema.create(schema, tags) is removed, use schema.extend(tags) instead.
• !!binary now always mapped to Uint8Array on load.
• Reduced nesting of /lib folder.
• Parse numbers according to YAML 1.2 instead of YAML 1.1 (01234 is now decimal, 0o1234 is octal, 1:23 is parsed as string instead of base60).
• dump() no longer quotes :, [, ], (, ) except when necessary, #470, #557.
• Line and column in exceptions are now formatted as (X:Y) instead of at line X, column Y (also present in compact format), #332.
• Code snippet created in exceptions now contains multiple lines with line numbers.
• dump() now serializes undefined as null in collections and removes keys with undefined in mappings, #571.
• dump() with skipInvalid=true now serializes invalid items in collections as null.
• Custom tags starting with ! are now dumped as !tag instead of !<!tag>, #576.
• Custom tags starting with tag:yaml.org,2002: are now shorthanded using !!, #258.

Added

• Added .mjs (es modules) support.
• Added quotingType and forceQuotes options for dumper to configure string literal style, #290, #529.
• Added styles: { '!!null': 'empty' } option for dumper (serializes { foo: null } as "foo: "), #570.

... (truncated)

Commits

• 9963d36 3.14.2 released
• 10d3c8e dist rebuild
• 5278870 fix prototype pollution in merge (<<) (#731)
• 37caaad 3.14.1 released
• 094c0f7 dist rebuild
• 9586ebe Avoid calling hasOwnProperty of user-controlled objects
• 34e5072 3.14.0 released
• 7b25c83 Browser files rebuild
• 6f73473 Dev deps bump
• 0c29349 Travis-CI: drop old nodejs versions
• Additional commits viewable in compare view

Updates svgo from 0.7.2 to 4.0.0

Release notes

Sourced from svgo's releases.

v4.0.0

Illustration by Vukory

It's been just over a year since our first release candidate, but I believe we can now release SVGO v4.0.0 with confidence! Thank you to all contributors who tested our RC builds and reported issues back up, this really smoothed out the process.

We actually wanted to do the release sooner, but it was a challenge to find the right time to publish a major release, since that means setting time aside to support users through migrations, helping downstream projects migrate, being available to fix or document things that users found to have an unexpected impact by this release, etc. I appreciate everyone's patience, and now that this is done, we can hopefully increase the pace of development again and tackle that backlog of old bugs. ^-^'

Breaking Changes

Please refer to the Migration Guide from v3 to v4 for a more concise version! This section is more verbose as it delves into the motivation of changes too.

Dropped Support for Node.js v14

Node.js v14 is no longer supported by the Node.js team, including security support, since 30 April 2023. Node.js v16 is no longer supported either, but as some are still using it, we'll save dropping support for Node.js v16 for the next major release.

This allows us to update our dependencies to more recent versions and to access more modern Node.js APIs.

Node.js v14 may still work at the time of this release, but we'll no longer be testing against v14 from now on.

Default Plugins

Both removeViewBox and removeTitle have been disabled by default. Both have been major pain points for users and don't make sense to enable in most cases. Other libraries wrapping SVGO have also been disabling these plugins by default, such as Docusaurus and SVGR.

• removeViewBox removes the scalability of SVGs.
• removeTitle reduces accessibility, which preserving accessibility is more important than optimization.

If you would like either of these plugins enabled, you can do so by configuring it in the SVGO config, see the README for more context, however please read the warnings described in the documentation of the plugins first:

  export default {
    plugins: [
      'preset-default', // built-in plugins enabled by default
+     'removeViewBox',
+     'removeTitle',
    ],
  };

removeScriptElement → removeScripts

The removeScriptElement plugin has been renamed to removeScripts, to more accurately reflect what the plugin does. It does not only remove the <script> tag, but also event handlers and script URIs from links.

To migrate, amend your SVGO config to refer to removeScripts instead if you use that plugin.

... (truncated)

Commits

• 71e1f05 chore: prepare v4 stable release (#2143)
• 4078c13 chore: increment version to v4.0.0-rc.5 (#2142)
• cb3eea8 fix(#2140): SVGO fails with ERR_UNSUPPORTED_ESM_URL_SCHEME on Windows (#2141)
• 2582096 chore(deps): bump streetsidesoftware/cspell-action from 6 to 7 (#2139)
• e1252fa deps: drop yarn/releases directory (#2138)
• feb9b5e fix(convertColors): use currentColor instead of currentcolor (#2137)
• e645d71 performance: small optimization when parsing svgs (#2133)
• 26d059f fix: invoke mapNodesToParents lazily (#2132)
• b761d1b feat: add editor namespace for Boxy SVG (#2008)
• 31328bc chore: add krita namespace to list of editor namespaces (#2131)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by sethiii, a new releaser for svgo since your current version.

Updates imagemin-webpack-plugin from 1.4.4 to 1.6.1

Release notes

Sourced from imagemin-webpack-plugin's releases.

V1.6.1

Fixes a bug where setting the test option would cause all files to be skipped!

V1.6.0

New features:

• added a cacheFolder option which will cache any optimized images between runs of webpack. Not enabled by default.

Other changes:

• Significant refactoring of the plugin. Split into multiple files and functions to make it easier to introduce unit tests in the future (which has been a LONG time coming!)
• Optimized how the concurrency works, so now it should be "optimally concurrent" by the number of CPUs by default (you can always change this with the maxConcurrency option)
• Added the ability to use a function in the test option for a lot of customizability with which files the plugin runs on.

V1.6.0-beta.1

New features:

• added a cacheFolder option which will cache any optimized images between runs of webpack. Not enabled by default.

Other changes:

• Significant refactoring of the plugin. Split into multiple files and functions to make it easier to introduce unit tests in the future (which has been a LONG time coming!)
• Optimized how the concurrency works, so now it should be "optimally concurrent" by the number of CPUs by default (you can always change this with the maxConcurrency option)

V1.5.2

Small fix to relax version requirements in the package.json thanks to @​modosc

v1.5.1

Added minFileSize and maxFileSize options

V1.5.0

Changes of note:

• ExternalImages option added
• Internal rewrite to clean up the code and improve speed a bit
• Allow ExternalImages option to be thunked

1.5.0-beta.0

Beta release which includes #30 changes.

Commits

• 683fbe4 v1.6.1
• a17d396 fix bug where the test failed all files
• 616fc22 v1.6.0
• bdb77ac update copyright for new year
• a35bc9b make linter happy
• 2fba67c updated docs
• 90b589e move to new partial application method for testing files
• 91030e7 allow functions in the test option
• 332784c fix bug in cacheFolder option
• 7513074 bump dependencies
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.