# What changed in svgo

> 24 changes in svgo 2 to 4 from its official release notes, upgrade guides and advisories: 2 breaking, 7 security. Each one cited. Sources checked 2026-10-17. HTML: https://unstale.sh/npm/svgo/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## svgo 4

### Breaking changes

- Invalid XML numeric character references in text and attributes are now rejected; valid XML documents remain unaffected. (4.1.0) — [release notes](https://github.com/svg/svgo/releases/tag/v4.1.0)
- Plugin and preset types now enforce that a preset name starts with `preset-`. (4.0.1) — [release notes](https://github.com/svg/svgo/releases/tag/v4.0.1)

### Security

- Filters executable data URLs containing HTML, XHTML, or SVG documents and legacy vbscript URLs, while preserving inert data such as PNG images. (4.1.0) — [release notes](https://github.com/svg/svgo/releases/tag/v4.1.0)
- Sanitizes SVG foreignObject content by removing HTML event-handler attributes, srcdoc, and executable URLs from specified URL-bearing attributes. (2.8.4, 3.3.5, 4.1.0) — [release notes](https://github.com/svg/svgo/releases/tag/v4.1.0), [security advisory](https://github.com/advisories/GHSA-4VPR-X523-8J87)
- Recognizes namespace-prefixed SVG a elements and removes ASCII tabs and newlines before checking URL schemes, preventing obfuscated script URLs from bypassing detection. (2.8.4, 3.3.5, 4.1.0) — [release notes](https://github.com/svg/svgo/releases/tag/v4.1.0), [security advisory](https://github.com/advisories/GHSA-W27V-7Q3P-W38R)
- SVGO removeScripts plugin leaves some executable scripts intact (2.8.3, 3.3.4, 4.0.2) — [security advisory](https://github.com/advisories/GHSA-2P49-HGCM-8545)
- SVGO DoS through entity expansion in DOCTYPE (Billion Laughs) (2.8.1, 3.3.3, 4.0.1) — [security advisory](https://github.com/advisories/GHSA-XPQW-6GX7-V673)

### Performance

- Speeds up child node removal. (4.0.2) — [release notes](https://github.com/svg/svgo/releases/tag/v4.0.2)
- Reduces redundant equality checks. (4.0.1) — [release notes](https://github.com/svg/svgo/releases/tag/v4.0.1)
- Computes styles lazily. (4.0.1) — [release notes](https://github.com/svg/svgo/releases/tag/v4.0.1)

### Behavior and default changes

- Plugin listings no longer include whether plugins are enabled or disabled by default; the argument appends each plugin's presets to the end of its line. (4.0.1) — [release notes](https://github.com/svg/svgo/releases/tag/v4.0.1)

### Fixes and other changes

- Parser failures are consistently exposed as SvgoParserError errors with an Invalid character entity reason. (4.1.0) — [release notes](https://github.com/svg/svgo/releases/tag/v4.1.0)
- Improves parsing of negative or positive arc radii. (4.0.2) — [release notes](https://github.com/svg/svgo/releases/tag/v4.0.2)
- Skips case-normalization for CSS custom properties. (4.0.2) — [release notes](https://github.com/svg/svgo/releases/tag/v4.0.2)
- Improves handling of consecutive `t` commands. (4.0.2) — [release notes](https://github.com/svg/svgo/releases/tag/v4.0.2)
- Handles paths more safely. (4.0.2) — [release notes](https://github.com/svg/svgo/releases/tag/v4.0.2)
- Encodes a value as a data URI only once when converting to a data URI. (4.0.2) — [release notes](https://github.com/svg/svgo/releases/tag/v4.0.2)
- Logs a warning and does nothing when parameters are missing. (4.0.2) — [release notes](https://github.com/svg/svgo/releases/tag/v4.0.2)
- Removes JavaScript URIs case-insensitively and handles <script> elements in a namespace-aware way. (3.3.4, 4.0.2) — [release notes](https://github.com/svg/svgo/releases/tag/v4.0.2), [release notes](https://github.com/svg/svgo/releases/tag/v3.3.4)
- Prevents leftover <use> elements from referencing an empty container that was removed. (4.0.1) — [release notes](https://github.com/svg/svgo/releases/tag/v4.0.1)
- Preserves attributes referenced in CSS attribute selectors. (4.0.1) — [release notes](https://github.com/svg/svgo/releases/tag/v4.0.1)

## svgo 3

### Security

- Hardens handling of executable data: and vbscript: URLs, executable HTML in <foreignObject>, namespace-prefixed SVG anchors, and URL schemes containing ASCII tabs or newlines. (3.3.5) — [release notes](https://github.com/svg/svgo/releases/tag/v3.3.5)

### Fixes and other changes

- SVGO no longer throws an error when encountering comments in DTD. (2.8.1, 3.3.3) — [release notes](https://github.com/svg/svgo/releases/tag/v3.3.3), [release notes](https://github.com/svg/svgo/releases/tag/v2.8.2), [release notes](https://github.com/svg/svgo/releases/tag/v2.8.1)

## svgo 2

### Security

- Hardens removal of script elements by removing known SVG event attributes, rejecting executable data: and vbscript: URLs, sanitizing executable HTML inside foreignObject elements, and handling namespace-prefixed anchors and URL schemes containing ASCII tabs or newlines. (2.8.4) — [release notes](https://github.com/svg/svgo/releases/tag/v2.8.4)