chore(deps): bump svgo from 4.0.1 to 4.0.2

[dependabot]

Bumps svgo from 4.0.1 to 4.0.2.

Release notes

Sourced from svgo's releases.

v4.0.2

What's Changed

Security

• removeScripts, remove JavaScript URIs case-insensitively and make <script> handling namespace aware. By @​SethFalco

Bug Fixes

• convertColors, skip case-normalization for CSS custom properties. By @​SethFalco in svg/svgo#2213
• convertPathData, improve handling of consecutive t commands. By @​KTibow in svg/svgo#2156
• convertPathData, safer handling of paths. By @​KTibow in svg/svgo#2158
• Improve parsing of negative (or +) arc radii. By @​KTibow in svg/svgo#2205
• When converting to a data URI, only encode it as a data URI once. By @​johnkenny54 in svg/svgo#2053

Performance

• mergePaths, speed up child node removal. By @​mozzie in svg/svgo#2216

Other Changes

• removeAttributesBySelector, log warning and noop if missing parameters. By @​KTibow in svg/svgo#2215

Commits

• b2309cf chore: sync version with api
• f529cfc Merge commit from fork
• 581fe68 performance: speed up mergePath child node removal (#2216)
• eb4c8b6 docs(removeAttributesBySelector): properly document and check types (#2215)
• 6fd5872 fix(convertColors): skip convertCase on css custom properties (#2213)
• 7414f73 fix: properly parse negative (or +) arc radii (#2205)
• a8c19aa fix: only call encodeSVGDatauri once and add test case (#2053)
• 65548f4 fix(convertPathData): properly handle consecutive t commands (#2156)
• a41a7c1 fix(convertPathData): introducing isSafeToRemove (#2164)
• 38625dd test: handle charm icons (#2203)
• See full diff in compare view

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
connection-docs	Ready	Preview	Aug 3, 2026 12:18pm

[Iamfle4ka]

Superseded by #1066, which batches the safe (patch/minor) security bumps into a single reviewable PR.

svgo on that branch resolves to 4.0.2 — verified against package-lock.json on chore/dependabot-safe-bumps, not inferred from the PR title. #1066 is a lockfile-only diff regenerated locally; none of Dependabot's lock diffs were pulled in.

Closing to keep the review surface small. If #1066 is rejected, reopen this one.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.