[dependabot]

Bumps svgo to 3.3.5 and updates ancestor dependency @wordpress/scripts. These dependencies need to be updated together.

Updates svgo from 1.3.2 to 3.3.5

Release notes

Sourced from svgo's releases.

v3.3.5

What's Changed

Security

• Backport the removeScriptElement hardening from SVGO v4 in #2269:
  • reject executable data: URLs and legacy vbscript: URLs
  • sanitize executable HTML inside <foreignObject> elements
  • handle namespace-prefixed SVG anchors and URL schemes containing ASCII tabs or newlines

This addresses GHSA-4vpr-x523-8j87 and GHSA-w27v-7q3p-w38r for the v3 release line.

Support

SVGO v3 is not officially supported; please consider upgrading to SVGO v4. This security fix has been backported, but there is no commitment to backport more complex changes in the future.

See the migration guide from v3 to v4.

v3.3.4

What's Changed

Security

• removeScriptElement, remove JavaScript URIs case-insensitively and make <script> handling namespace aware. By @​SethFalco

Support

SVGO v3 is not officially supported, please consider upgrading to SVGO v4 instead. We've backported this fix as there are security implications, but there is no commitment to do this for more complex changes in future.

Consider reading our Migration Guide from v3 to v4 which should ease the process.

v3.3.3

What's Changed

Dependencies

• Migrates from our unsupported fork of sax (@​trysound/sax) to the upstream version of sax (sax).

Bug Fixes

• No longer throws error when encountering comments in DTD.

Metrics

Before and after of the browser bundle of each respective version:

	v3.3.2	v3.3.3	Delta
svgo.browser.js	910.9 kB	912.9 kB	⬆️ 2 kB

... (truncated)

Commits

• 4380590 ci: configure v3 publish tag in package metadata (#2271)
• 4c84fe7 ci: publish v3 with npm trusted publishing (#2270)
• 994a9f0 fix(removeScriptElement): backport security hardening to v3 (#2269)
• 72a2388 Merge commit from fork
• bbab162 deps: upgrade to sax v1.5.0
• c4dc2be chore: increment version to v3.3.2
• 252b28c chore: increment version to 3.2.0 (#1919)
• 8644cf3 feat(convertPathData): convert c to q (#1892)
• 2661dac fix(convertTransform): fix scale and rotate on skew + refactors (#1916)
• f6a2ca2 chore: improve jest tests with more precise assertions (#1912)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for svgo since your current version.

Updates @wordpress/scripts from 16.1.5 to 35.0.0

Release notes

Sourced from @​wordpress/scripts's releases.

24.0.0 RC1

Changelog

Enhancements

Components

• Add defaultShown, onShownChange to ToolsPanelItem. (78010)
• Border Box Control: Try moving the unlink button to the label row, and rename the panel to Borders. (82163)
• Breadcrumb: Add UI component. (80425)
• DataForm: Add a showPlaceholderIfEmpty option to the panel layout. (82527)
• DataForm: Communicate the timezone in the datetime control. (82291)
• Editor: Migrate post-card-panel Badge to UI Badge. (82500)
• Global Styles UI: Migrate revisions Active Badge to UI Badge. (82560)
• Icons: Redraw 35 prominent icons with consistent stroke widths. (78808)
• Icons: Redraw 64 icons to be stroke-based. (78812)
• Menu: Stabilize portaled iframe unit test. (82092)
• Menu: Support multiple item descriptions. (81825)
• Menu: Use Text for item labels and descriptions. (82237)
• SearchableSelect: Add form primitive to @​wordpress/ui. (80961)
• Storybook: Persist sidebar theme in URL. (82111)
• Support isAny and isNone filter operators for numeric fields. (77942)
• Tab Panel: Show focus with outline instead of legacy box-shadow ring. (82421)
• Text: Use pretty wrapping by default. (82133)
• Theme: Build default ramps before token artifacts. (82525)
• Theme: Reduce repeated color ramp search work. (82545)
• UI: Add CheckboxControl. (82213)
• UI: Add Combobox and Autocomplete Status. (82195)
• UI: Add popupWidth prop to item popup components. (82087)
• UI: Add Radio form primitive. (82214)
• UI: Align overlay Trigger props with Base UI. (81824)
• UI: Put overflow on Select.List instead of a nested wrapper. (82470)
• UI: Rename Popup popupWidth prop to width. (82193)
• UI: Reset completed calendar ranges by default. (82612)
• UI: Support custom targets on Link and Menu.LinkItem. (82347)
• UI: Use root theme for portaled overlays. (82038)
• Validated form controls: Use design token for invalid focus rings. (82410)

Block Library

• Math: Declare clientNavigation interactivity support. (82248)
• Allow themes to override the padding added via background color. (82024)
• Audio: Update autoplay help text for clarity. (69978)
• Enable Gallery columns and crop controls in viewport states. (82003)
• Icons: Convert Search icon to strokes. (82338)
• List: Indent and outdent a fully selected list item with Tab. (82460)
• List: Indent and outdent multi-selected items with Tab. (82411)
• Query Loop: Rename the "Keyword" filter to "Search terms" and add help text. (82387)
• Query: Replace the "Reload full page enabled" modal with a snackbar notice. (82246)
• Site title: Add fit-text support. (82074)
• Try adding a Grid block variation to Gallery. (81909)
• Update navigation link block name, use a default variation for custom link. (82375)

... (truncated)

Changelog

Sourced from @​wordpress/scripts's changelog.

35.0.0 (2026-09-10)

Breaking Changes

• Require Node.js ^20.19.0 || >=22.13.0 and upgrade the bundled Stylelint to ^17.14.1 (#80738).

Bug Fixes

• test-playwright: Install browsers with the bundled @playwright/test CLI, so they match the Playwright that runs the tests. A bare npx playwright could resolve another version, or download one (#82331).
• build: Strip JavaScript and TypeScript source extensions from legacy positional entry names so generated output uses names such as index.js instead of index.tsx.js or index.jsx.js (#80990).

Enhancements

• Include .jsx unit tests in the default lint configuration (#80990).

Internal

• Update bundled Jest packages to 30.5.0 (#82181).
• Remove unused dependency jest-environment-node (#82103).

34.2.0 (2026-08-26)

34.1.0 (2026-08-12)

Bug Fixes

• Set Sass's charset option to false so production builds no longer emit a UTF-8 BOM in the middle of the extracted CSS (#81383).

34.0.0 (2026-07-29)

Breaking Changes

• Upgrade the bundled Jest packages from v29 to v30 (#80767).

Enhancements

• format: Detect prettier.config.mjs so the bundled default config is not used when one is present (#80422).

33.0.0 (2026-07-14)

Breaking Changes

• The test-e2e command now runs the Playwright-based end-to-end test runner instead of Puppeteer (test-playwright remains available as an alias). Removed the Puppeteer test environment and configuration (jest-environment-puppeteer, jest-e2e.config.js, puppeteer.config.js) along with the puppeteer-core and expect-puppeteer dependencies. Puppeteer-specific options (e.g. --puppeteer-interactive, --puppeteer-devtools) are no longer supported (#60357).

Enhancements

• Widen React peer dependency ranges to ^18 || ^19 to support both React 18 and React 19 environments (#80024).
• Update stylelint to ^16.26.1 (#79648).
• Widen the @playwright/test peer dependency to >=1 and mark it optional, so consumers aren't forced to bump Playwright or satisfy it under strict peer deps (#78632).
• Update webpack-dev-server to ^5.2.1, resolving several Dependabot security alerts and migrating the internal dev-server proxy config to the v5 array format (#80347).

... (truncated)

Commits

• 485f42a chore(release): publish
• c89dd70 Update changelog files
• a55a0d7 Merge changes published in the Gutenberg plugin "release/24.0" branch
• d06b010 chore(release): publish (#82084)
• 0790fa5 Update changelog files
• 098e3ba Merge changes published in the Gutenberg plugin "release/23.9" branch
• 989764d chore(release): publish
• e18aa00 Update changelog files
• dbb73c9 Merge changes published in the Gutenberg plugin "release/23.8" branch
• 7e8b17a chore(release): publish
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by gutenbergplugin, a new releaser for @​wordpress/scripts since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​wordpress/​scripts@​16.1.5 ⏵ 35.0.0	+1
	npm/​autoprefixer@​10.4.2 ⏵ 10.5.6	+1		-3	+2

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm csp_evaluator is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/@wordpress/scripts@35.0.0 → npm/csp_evaluator@1.1.8 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/csp_evaluator@1.1.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm data-urls is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/@wordpress/scripts@35.0.0 → npm/data-urls@5.0.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/data-urls@5.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm rrweb-cssom is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/@wordpress/scripts@35.0.0 → npm/rrweb-cssom@0.8.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/rrweb-cssom@0.8.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm yargs is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/@wordpress/scripts@35.0.0 → npm/browser-sync@2.29.3 → npm/yargs@17.7.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/yargs@17.7.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report