v3.0.0: migrate to TypeScript, svgo 4, and ESM; require Node 22.18+ #26

Merged

corneliusio merged 5 commits from release/v3.0.0 into release/v2.3.0

2026-08-24 21:00:37 +00:00

corneliusio commented

2026-08-24 20:51:43 +00:00

(Migrated from github.com)

Summary

Major release, stacked on the v2.3.0 PR.

svgo ^4.1.0 — resolves all 41 known advisories in the old tree (fresh tree audits clean). Options now use the svgo v2+ config format (preset-default + overrides; cleanupIDs → cleanupIds); optimized output differs from svgo 1.x.
TypeScript 7 (strict, nodenext) compiled to dist/ with declarations; svgo is the exported identifier.
ESM package with CJS compatibility: require('gulp-svgo') keeps returning the plugin function directly via the 'module.exports' named export and require(esm). Both paths are covered by tests against the built artifact.
Error behavior: malformed SVGs and stream-backed contents now fail the stream with a proper Error (svgo error as cause) instead of passing through.
Engines >=22.18 (type stripping on by default; all EOL Node lines dropped).
Tooling: node:test (15 tests incl. dist interop, multi-file ordering, invalid-config), oxlint + oxfmt, CI on Node 22/24/26 Linux + Node 24 Windows, tag-triggered npm trusted publishing (OIDC, actions pinned to SHAs).

Before tagging

Configure a trusted publisher for gulp-svgo on npmjs.com (this repo, publish.yml) — the publish workflow has no token secret.
Revoke any surviving Travis-era npm token.

Testing

15/15 tests, strict typecheck, lint, and build pass locally; CJS/ESM interop verified against dist/. Reviewed by two GPT-5.6 Sol codex passes (implementation + test harness); all findings addressed.

## Summary Major release, stacked on the v2.3.0 PR. - **svgo ^4.1.0** — resolves all 41 known advisories in the old tree (fresh tree audits clean). Options now use the svgo v2+ config format (`preset-default` + `overrides`; `cleanupIDs` → `cleanupIds`); optimized output differs from svgo 1.x. - **TypeScript 7** (strict, `nodenext`) compiled to `dist/` with declarations; `svgo` is the exported identifier. - **ESM package with CJS compatibility**: `require('gulp-svgo')` keeps returning the plugin function directly via the `'module.exports'` named export and `require(esm)`. Both paths are covered by tests against the built artifact. - **Error behavior**: malformed SVGs and stream-backed contents now fail the stream with a proper `Error` (svgo error as `cause`) instead of passing through. - **Engines >=22.18** (type stripping on by default; all EOL Node lines dropped). - **Tooling**: `node:test` (15 tests incl. dist interop, multi-file ordering, invalid-config), oxlint + oxfmt, CI on Node 22/24/26 Linux + Node 24 Windows, tag-triggered npm **trusted publishing** (OIDC, actions pinned to SHAs). ## Before tagging - Configure a trusted publisher for `gulp-svgo` on npmjs.com (this repo, `publish.yml`) — the publish workflow has no token secret. - Revoke any surviving Travis-era npm token. ## Testing 15/15 tests, strict typecheck, lint, and build pass locally; CJS/ESM interop verified against `dist/`. Reviewed by two GPT-5.6 Sol codex passes (implementation + test harness); all findings addressed.