svgo - npm Package Compare versions

Comparing version 3.3.2 to 3.3.3

lib/parser.js

@@ -16,4 +16,3 @@ 'use strict';
 
-// @ts-ignore sax will be replaced with something else later
-const SAX = require('@trysound/sax');
+const SAX = require('sax');
 const { textElems } = require('../plugins/_collections');
@@ -86,2 +85,3 @@
   position: true,
+  unparsedEntities: true,
 };
@@ -121,5 +121,2 @@
 
-  /**
-   * @type {(doctype: string) => void}
-   */
   sax.ondoctype = (doctype) => {
@@ -149,5 +146,2 @@ /**
 
-  /**
-   * @type {(data: { name: string, body: string }) => void}
-   */
   sax.onprocessinginstruction = (data) => {
@@ -165,5 +159,2 @@ /**
 
-  /**
-   * @type {(comment: string) => void}
-   */
   sax.oncomment = (comment) => {
@@ -180,5 +171,2 @@ /**
 
-  /**
-   * @type {(cdata: string) => void}
-   */
   sax.oncdata = (cdata) => {
@@ -195,5 +183,2 @@ /**
 
-  /**
-   * @type {(data: { name: string, attributes: Record<string, { value: string }>}) => void}
-   */
   sax.onopentag = (data) => {
@@ -217,5 +202,2 @@ /**
 
-  /**
-   * @type {(text: string) => void}
-   */
   sax.ontext = (text) => {
@@ -251,10 +233,8 @@ if (current.type === 'element') {
 
-  /**
-   * @type {(e: any) => void}
-   */
   sax.onerror = (e) => {
+    const reason = e.message.split('\n')[0];
     const error = new SvgoParserError(
-      e.reason,
-      e.line + 1,
-      e.column,
+      reason,
+      sax.line + 1,
+      sax.column,
       data,
@@ -261,0 +241,0 @@ from,

package.json

 {
   "packageManager": "yarn@2.4.3",
   "name": "svgo",
-  "version": "3.3.2",
+  "version": "3.3.3",
   "description": "Nodejs-based tool for optimizing SVG vector graphics files",
@@ -81,3 +81,2 @@ "license": "MIT",
   "dependencies": {
-    "@trysound/sax": "0.2.0",
     "commander": "^7.2.0",
@@ -88,3 +87,4 @@ "css-select": "^5.1.0",
     "csso": "^5.0.5",
-    "picocolors": "^1.0.0"
+    "picocolors": "^1.0.0",
+    "sax": "^1.5.0"
   },
@@ -97,2 +97,3 @@ "devDependencies": {
     "@types/jest": "^29.5.5",
+    "@types/sax": "^1.2.7",
     "del": "^6.0.0",
@@ -110,3 +111,6 @@ "eslint": "^8.55.0",
     "typescript": "^5.3.3"
+  },
+  "resolutions": {
+    "sax@^1.5.0": "patch:sax@npm%3A1.5.0#./.yarn/patches/sax-npm-1.5.0-d40bca2226.patch"
   }
 }

New alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Number of low supply chain risk alerts

12

-7.69%

Worsened metrics

Total package byte prevSize

1302553

-12.47%

Dev dependency count

18

5.88%

Number of package files

78

-1.27%

Lines of code

16884

-11.75%

Dependency changes

• + Added

  sax@^1.5.0

• + Added

  sax@1.6.0
  (transitive)

• - Removed

  @trysound/sax@0.2.0

• - Removed

  @trysound/sax@0.2.0
  (transitive)