[dependabot]

Bumps happy-dom from 20.14.5 to 21.0.3.

Release notes

Sourced from happy-dom's releases.

v21.0.3

👷‍♂️ Patch fixes

• Fixes security vulnerability where authorization header was forwarded when redirecting - By @​capricorn86

v21.0.2

👷‍♂️ Patch fixes

• Fixes SSRF security vulnerability by doing a target-origin bypass in the proxy server in @​happy-dom/server-renderer - By @​capricorn86

v21.0.1

👷‍♂️ Patch fixes

• Adds aliases --css and --iframe for enabling CSS and iframe loading to @​happy-dom/server-renderer - By @​capricorn86

v21.0.0

💣 Breaking Changes

• Disables CSS and IFrame loading by default to prevent server-side request forgery (SSRF) - By @​capricorn86
  • An attacker could embed <iframe> or <link rel="stylesheet"> elements in untrusted HTML to make Happy DOM send HTTP requests from the server to attacker-chosen URLs, including internal services. This could allow access to otherwise unreachable endpoints or trigger unintended actions, depending on the application and its network access.
  • The settings property disableCSSFileLoading has been deprecated
  • Added the new settings properties enableCSSFileLoading and enableIframePageLoading
  • If you don't believe that you are at risk, you can keep the same behavior as in <=v20.14.6 by sending in { enableCSSFileLoading: true, enableIframePageLoading: true } as broswer settings (e.g. new Window({ settings }));

v20.14.6

👷‍♂️ Patch fixes

• Fixes cookie scope forgery vulnerability - By @​capricorn86

Commits

• 875ef5c fix: Fixes security vulnerability where authorization header was forwarded wh...
• 1f3ffdf fix: Fixes SSRF security vulnerability by doing a target-origin bypass in the...
• f55c7e0 chore: Update security documentation (#2509)
• 2b91e68 fix: Adds alias for enabling CSS and iframe loading in server-renderer (#2503)
• 0a99c75 BREAKING CHANGE: Disables CSS and IFrame loading by default (#2502)
• f21dbd7 fix: Fixes cookie scope forgery vulnerability (#2477)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

APPROVE — dev-only test DOM bump; the v21 breaking change (CSS/iframe loading off by default) hits nothing Splotch's tests use, and it ships three security fixes.

Package	Jump	CI	Risk
happy-dom (devDependency)	20.14.5 → 21.0.3 (major)	still running at review time	low

What changed

• v21.0.0 (breaking): CSS file loading and iframe page loading are disabled by default to prevent SSRF. They can be re-enabled with enableCSSFileLoading / enableIframePageLoading.
• v20.14.6, v21.0.2 and v21.0.3: fixes for cookie scope forgery, a server-renderer proxy SSRF bypass, and an Authorization header forwarded on redirects.
• Engines are still node >=20.

Blast radius

• happy-dom is used only as a Vitest environment, in web/vitest.config.ts, web/vitest-setup.ts, tools/vitest.config.mjs and the tools tests. It is in devDependencies, which is correct under ADR-0070, and the PR doesn't move it.
• I found no <iframe>, <link rel=stylesheet>, new Window or custom happy-dom settings in the Vitest config or the web unit tests. I didn't check the tools/**/tests files for iframe or stylesheet use.
• The lockfile also bumps legacy-javascript 0.0.1 → 0.0.3 (a Lighthouse transitive) and adds deprecated markers on two OpenTelemetry packages. This is unrelated lockfile drift and adds no install scripts.
• This is a pnpm lockfile resolution change, not an upstream change in happy-dom. Nothing here touches Capacitor or the native build.

[KyleMit]

MERGE

Merge 10 of 11, wave 2. Needs a Dependabot rebase after wave 1, because it conflicts with #3186 and #3198.

• happy-dom 20.14.5 → 21.0.3, major, devDependencies. It is the Vitest environment for web/ (web/vitest.config.ts) and is imported directly by the SSR render tests (PageIcon.ssr.test.ts and others).
• Tarball diff 20.14.5 → 21.0.3: the visible structural change is new cookie-domain handling (lib/cookie/PublicSuffixList and CookieDomainUtility, i.e. public-suffix checks on cookie domains). The engines field is unchanged (node >=20).
• CI on this head: Browserless (all Vitest tiers, with coverage) and every other job except Quality's audit step are green, so the suite does not depend on the old cookie behaviour.

Quality is red on every PR in the batch and on main (ef3d1eb) at its last step, Audit dependencies: vite 8.3.1 (high), handlebars 4.7.9 via @capacitor/assets (critical), source-map-js 1.2.1 (high), uuid 7.0.3 and postcss-selector-parser 7.1.5 (moderate). Every earlier Quality step (format, type check, lint, knip, production deps) passed on this PR. With the whole batch applied via npm pkg set, pnpm audit clears only @vitest/mocker (2 moderate, #3186) and cookie (1 low, #3187). Quality stays red after the batch and needs its own fix; it is not this PR's failure.

Batch — 15 open Dependabot PRs (npm 14 of its 30-PR limit, actions 1 of 10, so nothing is queued behind the limit). Wave 1, in this order, simulated with chained git merge-tree plus a unique-key pnpm-lock.yaml parse, clean at every step: #3186 → #3189 → #3192 → #3194 → #3197 → #3198. Wave 2, one Dependabot rebase each after wave 1 lands, because each conflicts in package.json/pnpm-lock.yaml with a wave-1 PR: #3188, #3190, #3191, #3193, #3195. HOLD: #3184, #3196. Recommended CLOSE: #3185, #3187.

🤖 Generated with Claude Code

---

Generated by Claude Code