The dependency change also needed an API migration
The repository used SVGO 1.3.2 to optimize SVG icons. Moving to SVGO 2.8.4 also required changes in src/icons.js: the v1 constructor and instance method became the v2 optimize function. The fix kept the default plugin preset, retained the SVG viewBox, and removed fixed dimensions so the icons could still scale in CSS.
| 3 | 3 | const SVGO = require("svgo"); |
| 33 | const { optimize } = require("svgo"); | |
| 11 | 11 | const result = await svgo.optimize(svg); |
| 2121 | const result = optimize(svg, config); |
The complete change updates package.json, package-lock.json and src/icons.js. You can inspect the full pull request diff.
Three advisories were attached to the package
The pull request records two high-severity advisories and one moderate-severity advisory for SVGO. Each advisory below links to the GitHub Advisory Database.
SVGO removeScripts plugin leaves some executable scripts intact
SVGO: removeScripts allows executable links through namespace and control-character bypasses
- ModerateGHSA-4vpr-x523-8j87
SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements
The pull request carries its validation evidence
The fix ran in Mendr's sandbox with Node 20.20.2 and npm 10.8.2. The repository setting was “Agent decides”: the agent selected the checks. The pull request reports these results.
- BuildPassed
npm run build
Optimized 3 icons
- TestsPassed
npm test
9 of 9 tests
- npm auditPassed
npm audit --json --fetch-timeout=5000 --fetch-retries=0
4 → 0 findings
- Diff checkPassed
git diff --check
No whitespace errors
The audit result changed from four high findings at the base commit to zero findings after the update. That is the recorded result of this audit run; it is not a guarantee that the application has no vulnerabilities.
A separate read-only AI review accepted the migration and its validation evidence. After publication, the repository's GitHub Actions CI run also completed successfully. The pull request is merged. Mendr does not merge pull requests.
One validation gap remained visible
No dedicated regression test exercises the removeScripts bypass payloads.
The existing nine tests and the package audit supported the upgrade. They did not exercise the specific sanitizer bypass payloads in the advisories. A reviewer still needs to assess whether the available checks cover the application's use of SVGO.
Inspect the recorded inputs and output
- Base commit 6833c3d
- Reviewed commit 169fa9a
- Pull request #4, including the validation and AI review record
- GitHub Actions run for the reviewed commit
Raw sandbox command output is not retained in the public record. The pull request contains the recorded command results and review summary. This example does not include a comparison run of another product.
From a vulnerability backlog to reviewable fixes
Mendr gives teams a ranked dependency-vulnerability queue with due dates from their SLA policy. This fix shows the evidence a reviewer gets when a selected finding needs code changes as well as a dependency update. Your team reviews the pull request and decides what ships.