[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
happy-dom	^20.10.6 → ^21.0.3

---

Release Notes

capricorn86/happy-dom (happy-dom)

v21.0.3

Compare Source

👷‍♂️ Patch fixes

• Fixes security vulnerability where authorization header was forwarded when redirecting - By @​capricorn86

v21.0.2

Compare Source

👷‍♂️ Patch fixes

• Fixes SSRF security vulnerability by doing a target-origin bypass in the proxy server in @​happy-dom/server-renderer - By @​capricorn86

v21.0.1

Compare Source

👷‍♂️ Patch fixes

• Adds alias for enabling CSS and iframe loading to @​happy-dom/server-renderer - By @​capricorn86

v21.0.0

Compare Source

💣 Breaking Changes

• Disables CSS and IFrame loading by default to prevent server-side request forgery (SSRF) - By @​capricorn86
  • An attacker could embed <iframe> or <link rel="stylesheet"> elements in untrusted HTML to make Happy DOM send HTTP requests from the server to attacker-chosen URLs, including internal services. This could allow access to otherwise unreachable endpoints or trigger unintended actions, depending on the application and its network access.
  • The settings property disableCSSFileLoading has been deprecated
  • Added the new settings properties enableCSSFileLoading and enableIframePageLoading

v20.14.6

Compare Source

👷‍♂️ Patch fixes

• Fixes cookie scope forgery vulnerability - By @​capricorn86

v20.14.5

Compare Source

👷‍♂️ Patch fixes

• Preserve character references in comment data - By @​hampustagerud in task #​2409

v20.14.4

Compare Source

👷‍♂️ Patch fixes

• End comments at the first comment end tag when it overlaps a comment start tag - By @​hampustagerud in task #​2407

v20.14.3

Compare Source

👷‍♂️ Patch fixes

• Avoids cloning all properties in CSSPropertyManager.toString - By @​erictheswift in task #​2363

v20.14.2

Compare Source

👷‍♂️ Patch fixes

• Fixes regression where not all CSS variables where resolved in getComputedStyle() - By @​klaesra in task #​2344

v20.14.1

Compare Source

👷‍♂️ Patch fixes

• Invalidate the computed style cache for the whole subtree - By @​matmannion and @​capricorn86 in task #​2366

v20.14.0

Compare Source

🎨 Features

• Improves computed style cache - By @​capricorn86 in task #​2357

v20.13.2

Compare Source

👷‍♂️ Patch fixes

• Fix problem with getComputedStyle with :host and :host-context selectors - By @​capricorn86 in task #​2349

v20.13.1

Compare Source

👷‍♂️ Patch fixes

• GetComputedStyle should return inherited value when it is set to inherit - By @​capricorn86 in task #​2347

v20.13.0

Compare Source

🎨 Features

• Adds support for :host psuedo query selector - By @​capricorn86 in task #​2345

v20.12.2

Compare Source

👷‍♂️ Patch fixes

• Custom elements should be upgraded when connected to DOM - By @​capricorn86 in task #​2342

v20.12.1

Compare Source

🎨 Features

• Adds support for kebab-case properties on CSSStyleDeclaration - By @​capricorn86 in task #​2256
• Adds support for all Chromium CSS properties to CSSStyleDeclaration - By @​capricorn86 in task #​2256
  • Downloads a list from the Chromium project when compiling

👷‍♂️ Patch fixes

• Fixes issue with parsing CSS fallback variables - By @​capricorn86 in task #​2256

v20.12.0

Compare Source

🎨 Features

• Adds support for Animation, AnimationTimeline, DocumentTimeline and KeyframeEffect - By @​capricorn86
• Adds support for Element.animate() - By @​capricorn86

v20.11.15

Compare Source

👷‍♂️ Patch fixes

• Fixes issue with upgrading custom element caused by previous release - By @​capricorn86 in task #​2331

v20.11.14

Compare Source

👷‍♂️ Patch fixes

• Change prototype of element to the custom element when upgraded to keep the reference - By @​capricorn86 in task #​2331
  • The previous solution replaced the element with the custom element and copied it's properties, but this made any reference to the original element invalid

v20.11.13

Compare Source

👷‍♂️ Patch fixes

• Copy event listeners when upgrading a custom element - By @​capricorn86 in task #​2329

v20.11.12

Compare Source

👷‍♂️ Patch fixes

• Add check for if the node is still a parent during disconnect - By @​capricorn86 in task #​2322

v20.11.11

Compare Source

👷‍♂️ Patch fixes

• Use proxy as parent node in Node.connectedToNode - By @​diegohaz in task #​2253

v20.11.10

Compare Source

👷‍♂️ Patch fixes

• Return default validationMessage for built-in constraint violations - By @​mixelburg in task #​2187

v20.11.9

Compare Source

👷‍♂️ Patch fixes

• Make sure that the element has been upgraded before invoking reaction callback in custom elements - By @​capricorn86 in task #​2317

v20.11.8

Compare Source

👷‍♂️ Patch fixes

• Values pushed or assigned to the adoptedStyleSheet array should be validated - By @​capricorn86 in task #​2315

v20.11.7

Compare Source

👷‍♂️ Patch fixes

• The properties Document.adoptedStyleSheets and ShadowRoot.adoptedStyleSheets should validate it's value - By @​capricorn86 in task #​2313

v20.11.6

Compare Source

👷‍♂️ Patch fixes

• Updates docs for the global-registrator package - By @​capricorn86 in task #​2300

v20.11.5

Compare Source

👷‍♂️ Patch fixes

• Allow explicit element types for querySelector (e.g. querySelector<HTMLInputElement>(".my-input")) - By @​cyphercodes

v20.11.4

Compare Source

👷‍♂️ Patch fixes

• Fixes the CORS check fetch() to match origins instead of host and protocol - By @​rexxars in task #​1490

v20.11.3

Compare Source

👷‍♂️ Patch fixes

• Make document.links return a live HTMLCollection - By @​bangseongbeom in task #​2299
• Copy labels array to prevent mutation of cached querySelectorAll result - By @​mixelburg in task #​2226

v20.11.2

Compare Source

👷‍♂️ Patch fixes

• MutationObserver callback being GC'd due to orphaned WeakRef - By @​mixelburg in task #​2264

v20.11.1

Compare Source

👷‍♂️ Patch fixes

• Improve performance of query selectors by avoiding construction of DOMException when not needed - By @​@​cyfung1031 in task #​2228

v20.11.0

Compare Source

🎨 Features

• Adds support for CookieStore API - By @​TrevorBurnham in task #​1864
• Adds support for Element.checkVisibility() - By @​capricorn86 in task #​1506

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	happy-dom@​20.10.6 ⏵ 21.0.3			+1	+1	-30

View full report

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@nuxt/bridge@1932

npm i https://pkg.pr.new/@nuxt/bridge-schema@1932

commit: 36740bd