[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
happy-dom	^20.10.6 → ^21.0.4

---

Release Notes

capricorn86/happy-dom (happy-dom)

v21.0.4

Compare Source

👷‍♂️ Patch fixes

• Fixed a code injection vulnerability in the ESM compiler - By @​capricorn86
• Fixed cross-origin isolation so opaque-origin data: iframes cannot access their parent or top window - By @​capricorn86

v21.0.3

Compare Source

👷‍♂️ Patch fixes

• Fixes security vulnerability where authorization header was forwarded when redirecting - By @​capricorn86

v21.0.2

Compare Source

👷‍♂️ Patch fixes

• Fixes SSRF security vulnerability by doing a target-origin bypass in the proxy server in @​happy-dom/server-renderer - By @​capricorn86

v21.0.1

Compare Source

👷‍♂️ Patch fixes

• Adds aliases --css and --iframe for enabling CSS and iframe loading to @​happy-dom/server-renderer - By @​capricorn86

v21.0.0

Compare Source

💣 Breaking Changes

• Disables CSS and IFrame loading by default to prevent server-side request forgery (SSRF) - By @​capricorn86
  • An attacker could embed <iframe> or <link rel="stylesheet"> elements in untrusted HTML to make Happy DOM send HTTP requests from the server to attacker-chosen URLs, including internal services. This could allow access to otherwise unreachable endpoints or trigger unintended actions, depending on the application and its network access.
  • The settings property disableCSSFileLoading has been deprecated
  • Added the new settings properties enableCSSFileLoading and enableIframePageLoading
  • If you don't believe that you are at risk, you can keep the same behavior as in <=v20.14.6 by sending in { enableCSSFileLoading: true, enableIframePageLoading: true } as broswer settings (e.g. new Window({ settings }));

v20.14.6

Compare Source

👷‍♂️ Patch fixes

• Fixes cookie scope forgery vulnerability - By @​capricorn86

v20.14.5

Compare Source

👷‍♂️ Patch fixes

• Preserve character references in comment data - By @​hampustagerud in task #​2409

v20.14.4

Compare Source

👷‍♂️ Patch fixes

• End comments at the first comment end tag when it overlaps a comment start tag - By @​hampustagerud in task #​2407

v20.14.3

Compare Source

👷‍♂️ Patch fixes

• Avoids cloning all properties in CSSPropertyManager.toString - By @​erictheswift in task #​2363

v20.14.2

Compare Source

👷‍♂️ Patch fixes

• Fixes regression where not all CSS variables where resolved in getComputedStyle() - By @​klaesra in task #​2344

v20.14.1

Compare Source

👷‍♂️ Patch fixes

• Invalidate the computed style cache for the whole subtree - By @​matmannion and @​capricorn86 in task #​2366

v20.14.0

Compare Source

🎨 Features

• Improves computed style cache - By @​capricorn86 in task #​2357

v20.13.2

Compare Source

👷‍♂️ Patch fixes

• Fix problem with getComputedStyle with :host and :host-context selectors - By @​capricorn86 in task #​2349

v20.13.1

Compare Source

👷‍♂️ Patch fixes

• GetComputedStyle should return inherited value when it is set to inherit - By @​capricorn86 in task #​2347

v20.13.0

Compare Source

🎨 Features

• Adds support for :host psuedo query selector - By @​capricorn86 in task #​2345

v20.12.2

Compare Source

👷‍♂️ Patch fixes

• Custom elements should be upgraded when connected to DOM - By @​capricorn86 in task #​2342

v20.12.1

Compare Source

🎨 Features

• Adds support for kebab-case properties on CSSStyleDeclaration - By @​capricorn86 in task #​2256
• Adds support for all Chromium CSS properties to CSSStyleDeclaration - By @​capricorn86 in task #​2256
  • Downloads a list from the Chromium project when compiling

👷‍♂️ Patch fixes

• Fixes issue with parsing CSS fallback variables - By @​capricorn86 in task #​2256

v20.12.0

Compare Source

🎨 Features

• Adds support for Animation, AnimationTimeline, DocumentTimeline and KeyframeEffect - By @​capricorn86
• Adds support for Element.animate() - By @​capricorn86

v20.11.15

Compare Source

👷‍♂️ Patch fixes

• Fixes issue with upgrading custom element caused by previous release - By @​capricorn86 in task #​2331

v20.11.14

Compare Source

👷‍♂️ Patch fixes

• Change prototype of element to the custom element when upgraded to keep the reference - By @​capricorn86 in task #​2331
  • The previous solution replaced the element with the custom element and copied it's properties, but this made any reference to the original element invalid

v20.11.13

Compare Source

👷‍♂️ Patch fixes

• Copy event listeners when upgrading a custom element - By @​capricorn86 in task #​2329

v20.11.12

Compare Source

👷‍♂️ Patch fixes

• Add check for if the node is still a parent during disconnect - By @​capricorn86 in task #​2322

v20.11.11

Compare Source

👷‍♂️ Patch fixes

• Use proxy as parent node in Node.connectedToNode - By @​diegohaz in task #​2253

v20.11.10

Compare Source

👷‍♂️ Patch fixes

• Return default validationMessage for built-in constraint violations - By @​mixelburg in task #​2187

v20.11.9

Compare Source

👷‍♂️ Patch fixes

• Make sure that the element has been upgraded before invoking reaction callback in custom elements - By @​capricorn86 in task #​2317

v20.11.8

Compare Source

👷‍♂️ Patch fixes

• Values pushed or assigned to the adoptedStyleSheet array should be validated - By @​capricorn86 in task #​2315

v20.11.7

Compare Source

👷‍♂️ Patch fixes

• The properties Document.adoptedStyleSheets and ShadowRoot.adoptedStyleSheets should validate it's value - By @​capricorn86 in task #​2313

v20.11.6

Compare Source

👷‍♂️ Patch fixes

• Updates docs for the global-registrator package - By @​capricorn86 in task #​2300

v20.11.5

Compare Source

👷‍♂️ Patch fixes

• Allow explicit element types for querySelector (e.g. querySelector<HTMLInputElement>(".my-input")) - By @​cyphercodes

v20.11.4

Compare Source

👷‍♂️ Patch fixes

• Fixes the CORS check fetch() to match origins instead of host and protocol - By @​rexxars in task #​1490

v20.11.3

Compare Source

👷‍♂️ Patch fixes

• Make document.links return a live HTMLCollection - By @​bangseongbeom in task #​2299
• Copy labels array to prevent mutation of cached querySelectorAll result - By @​mixelburg in task #​2226

v20.11.2

Compare Source

👷‍♂️ Patch fixes

• MutationObserver callback being GC'd due to orphaned WeakRef - By @​mixelburg in task #​2264

v20.11.1

Compare Source

👷‍♂️ Patch fixes

• Improve performance of query selectors by avoiding construction of DOMException when not needed - By @​@​cyfung1031 in task #​2228

v20.11.0

Compare Source

🎨 Features

• Adds support for CookieStore API - By @​TrevorBurnham in task #​1864
• Adds support for Element.checkVisibility() - By @​capricorn86 in task #​1506

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: fa78e964-0264-4392-ad4c-9d35e0b11d51

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[cloudflare-workers-and-pages]

Deploying mande with    Cloudflare Pages

Latest commit:	c0d3696
Status:	✅  Deploy successful!
Preview URL:	https://eb5c45cc.mande-9c7.pages.dev
Branch Preview URL:	https://renovate-major-happy-dom-mon.mande-9c7.pages.dev

View logs

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/mande@602

commit: c0d3696

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 76.78%. Comparing base (fd475e0) to head (c0d3696).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #602   +/-   ##
=======================================
  Coverage   76.78%   76.78%           
=======================================
  Files           1        1           
  Lines          56       56           
  Branches       19       19           
=======================================
  Hits           43       43           
  Misses         11       11           
  Partials        2        2           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.