build(deps): bump image-size and svgdom

[dependabot]

Bumps image-size to 2.0.4 and updates ancestor dependency svgdom. These dependencies need to be updated together.

Updates image-size from 1.2.1 to 2.0.4

Release notes

Sourced from image-size's releases.

v2.0.2

Fixes

• fix potential Denial of Service via specially crafted payloads in image-size/image-size#436

Full Changelog: image-size/image-size@v2.0.1...v2.0.2

v2.0.1

Full Changelog: image-size/image-size@v2.0.0...v2.0.1

v2.0.0

The release

• Adds dual support for CJS and ESM, switches from Buffer to UInt8Array, uses DataView for reads, and can therefore now also be used in browsers
• Removes all dependencies
• Introduces some performance improvements
• Drops synchronous API.

Please see the Readme for the usage examples.

Full Changelog: image-size/image-size@v1.2.0...v2.0.0

Commits

• See full diff in compare view

Updates svgdom from 0.1.21 to 0.1.29

Release notes

Sourced from svgdom's releases.

0.1.29

Changed

• Moved CI to a working pnpm release, since 11.13.0 is refused as a broken release by the installer.

Fixed

• Serialized xmlns attributes created with setAttribute() as default namespace declarations instead of throwing, which broke svg() for svg.js canvases since 0.1.25 (#141).

Changelog

Sourced from svgdom's changelog.

0.1.29 - 2026-09-09

Changed

• Moved CI to a working pnpm release, since 11.13.0 is refused as a broken release by the installer.

Fixed

• Serialized xmlns attributes created with setAttribute() as default namespace declarations instead of throwing, which broke svg() for svg.js canvases since 0.1.25 (#141).

0.1.28 - 2026-07-20

Added

• Added CI coverage for supported Node.js versions, linting, formatting, and pinned svg.js integration.

Changed

• Composed DOM interfaces explicitly and removed the internal query() and matchWithScope() helpers from the public Element surface.
• Separated selector parsing from matching, bounded selector caching, and tightened combinator, pseudo-class, and attribute matching.
• Removed obsolete implementation scaffolding, legacy bundle code, and unused geometry helpers.
• Removed the obsolete Reify test hook and its dependencies.

Fixed

• Preserved DOM tree mutation invariants by validating edits atomically, adopting cross-document subtrees, and maintaining parent and owner links.
• Kept CharacterData.data and nodeValue synchronized and corrected range-based mutation methods.
• Corrected recursive node normalization and structural equality without mutating compared trees.
• Made document types safely assignable, reusable after failed document creation, and metadata-preserving.
• Preserved node subtype state, ownership, attributes, and namespace-unaware names when cloning.
• Made XML fragment and document parsing transactional while retaining namespaces, CDATA, and doctype metadata.
• Made outerHTML replacement atomic for attached elements and a no-op for detached elements.
• Corrected SVG absolute length conversion factors to use the 96 dpi CSS basis.
• Preserved zero-valued rotation centers in SVG matrix transformations.
• Made getElementsByClassName() handle missing and multiple classes consistently.
• Normalized all ParentNode and ChildNode variadic arguments and preserved insertion positions when nodes move.
• Made Document.head and Document.body return null for empty, partial, and non-HTML trees.
• Made Node.contains() include the node itself and handle detached nodes correctly.
• Serialized the complete HTML void-element set only under HTML serialization rules.

0.1.27 - 2026-07-18

Changed

• Documented common server-side, testing, and asset-pipeline use cases for svgdom.

Fixed

• Fixed getBoundingClientRect() for SVG elements embedded under plain HTML parents.
• Bounded arc-length approximation to prevent stack overflows and return finite lengths for difficult arcs.

... (truncated)

Commits

• 7cc22ab release 0.1.29
• 66f2393 Merge pull request #143 from svgdotjs/fix/plain-xmlns-attribute
• 4203a0f ci: replace the broken pnpm pin of the svg.js checkout
• c9eccbd ci: use the working pnpm release in the svg.js job too
• 47996e7 ci: pin a working pnpm release
• 93da461 fix: accept xmlns attributes set via setAttribute when serializing
• 5da64f8 release 0.1.28
• 46a8d96 ci: verify supported Node versions and invariants
• ebfb3ee chore: remove obsolete Reify test hook
• b99e385 chore: remove obsolete implementation scaffolding
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.