npm / svgo

svgo

What changed in svgo 2 to 4, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-17.

2 breaking7 security3 performance1 behavior and defaults11 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

svgo 421 changes

Invalid XML numeric character references in text and attributes are now rejected; valid XML documents remain unaffected.
4.1.0release notes
Plugin and preset types now enforce that a preset name starts with preset-.
4.0.1release notes

Filters executable data URLs containing HTML, XHTML, or SVG documents and legacy vbscript URLs, while preserving inert data such as PNG images.
4.1.0release notes
Sanitizes SVG foreignObject content by removing HTML event-handler attributes, srcdoc, and executable URLs from specified URL-bearing attributes.
2.8.4, 3.3.5, 4.1.0release notes security advisory
Recognizes namespace-prefixed SVG a elements and removes ASCII tabs and newlines before checking URL schemes, preventing obfuscated script URLs from bypassing detection.
2.8.4, 3.3.5, 4.1.0release notes security advisory
SVGO removeScripts plugin leaves some executable scripts intact
2.8.3, 3.3.4, 4.0.2security advisory
SVGO DoS through entity expansion in DOCTYPE (Billion Laughs)
2.8.1, 3.3.3, 4.0.1security advisory

Plugin listings no longer include whether plugins are enabled or disabled by default; the argument appends each plugin's presets to the end of its line.
4.0.1release notes

Parser failures are consistently exposed as SvgoParserError errors with an Invalid character entity reason.
4.1.0release notes
Improves parsing of negative or positive arc radii.
4.0.2release notes
Skips case-normalization for CSS custom properties.
4.0.2release notes
Improves handling of consecutive t commands.
4.0.2release notes
Handles paths more safely.
4.0.2release notes
Encodes a value as a data URI only once when converting to a data URI.
4.0.2release notes
Logs a warning and does nothing when parameters are missing.
4.0.2release notes
Removes JavaScript URIs case-insensitively and handles <script> elements in a namespace-aware way.
3.3.4, 4.0.2release notes release notes
Prevents leftover <use> elements from referencing an empty container that was removed.
4.0.1release notes
Preserves attributes referenced in CSS attribute selectors.
4.0.1release notes

Hardens handling of executable data: and vbscript: URLs, executable HTML in <foreignObject>, namespace-prefixed SVG anchors, and URL schemes containing ASCII tabs or newlines.
3.3.5release notes

SVGO no longer throws an error when encountering comments in DTD.
2.8.1, 3.3.3release notes release notes release notes

Hardens removal of script elements by removing known SVG event attributes, rejecting executable data: and vbscript: URLs, sanitizing executable HTML inside foreignObject elements, and handling namespace-prefixed anchors and URL schemes containing ASCII tabs or newlines.
2.8.4release notes