v2.3.0: fix file-handling crashes and silent drops, modernize tooling #25

Merged

corneliusio merged 4 commits from release/v2.3.0 into master

2026-08-24 21:00:36 +00:00

corneliusio commented

2026-08-24 20:51:40 +00:00

(Migrated from github.com)

Summary

Minor release. Keeps Node.js >=8 and svgo ^1.0.0 — no breaking changes for consumers.

Fixes crashes on null-contents files (gulp.src(..., { read: false }), directories) and pathless Vinyl files — they now pass through untouched, as do empty and stream-backed files.
Stops silent data loss: malformed SVGs previously vanished from the stream after logging; they now log and pass through unchanged so gulp.dest still sees them.
Removes ava in favor of a dependency-free node test.js runner, eliminating every known advisory in the dev dependency tree (11 tests).
Replaces defunct Travis CI with a GitHub Actions matrix (Node 8–24, actions pinned to commit SHAs) and migrates yarn → pnpm.
Adds a files allowlist (npm tarball is now 4 files), fixes README typos and the dead build badge.

Known limitation

svgo 1.x's production tree still carries known advisories (nth-check ReDoS, js-yaml, minimist, GHSA-2p49-hgcm-8545). Unfixable without svgo >=2, which drops old Node support — resolved in the stacked v3.0.0 PR.

Testing

11/11 tests pass locally on Node 24 against the locked svgo 1.3.2; the CI matrix covers Node 8–24. Reviewed by two GPT-5.6 Sol codex passes (implementation + test harness); all findings addressed.

## Summary Minor release. Keeps Node.js >=8 and svgo ^1.0.0 — no breaking changes for consumers. - **Fixes crashes** on null-contents files (`gulp.src(..., { read: false })`, directories) and pathless Vinyl files — they now pass through untouched, as do empty and stream-backed files. - **Stops silent data loss**: malformed SVGs previously vanished from the stream after logging; they now log and pass through unchanged so `gulp.dest` still sees them. - **Removes ava** in favor of a dependency-free `node test.js` runner, eliminating every known advisory in the dev dependency tree (11 tests). - **Replaces defunct Travis CI** with a GitHub Actions matrix (Node 8–24, actions pinned to commit SHAs) and migrates yarn → pnpm. - Adds a `files` allowlist (npm tarball is now 4 files), fixes README typos and the dead build badge. ## Known limitation svgo 1.x's production tree still carries known advisories (nth-check ReDoS, js-yaml, minimist, GHSA-2p49-hgcm-8545). Unfixable without svgo >=2, which drops old Node support — resolved in the stacked v3.0.0 PR. ## Testing 11/11 tests pass locally on Node 24 against the locked svgo 1.3.2; the CI matrix covers Node 8–24. Reviewed by two GPT-5.6 Sol codex passes (implementation + test harness); all findings addressed.