chore(deps): update dependency happy-dom to v21 by renovate[bot] · Pull Request #1560 · privy-open-source/design-system

renovate · 2025-01-06T07:48:45Z

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
happy-dom	`8.9.0` → `21.0.4`

Release Notes

capricorn86/happy-dom (happy-dom)

`v21.0.4`

Compare Source

👷‍♂️ Patch fixes

Fixed a code injection vulnerability in the ESM compiler - By @capricorn86
Fixed cross-origin isolation so opaque-origin data: iframes cannot access their parent or top window - By @capricorn86

`v21.0.3`

Compare Source

👷‍♂️ Patch fixes

Fixes security vulnerability where authorization header was forwarded when redirecting - By @capricorn86

`v21.0.2`

Compare Source

👷‍♂️ Patch fixes

Fixes SSRF security vulnerability by doing a target-origin bypass in the proxy server in @happy-dom/server-renderer - By @capricorn86

`v21.0.1`

Compare Source

👷‍♂️ Patch fixes

Adds aliases --css and --iframe for enabling CSS and iframe loading to @happy-dom/server-renderer - By @capricorn86

`v21.0.0`

Compare Source

💣 Breaking Changes

Disables CSS and IFrame loading by default to prevent server-side request forgery (SSRF) - By @capricorn86
- An attacker could embed <iframe> or <link rel="stylesheet"> elements in untrusted HTML to make Happy DOM send HTTP requests from the server to attacker-chosen URLs, including internal services. This could allow access to otherwise unreachable endpoints or trigger unintended actions, depending on the application and its network access.
- The settings property disableCSSFileLoading has been deprecated
- Added the new settings properties enableCSSFileLoading and enableIframePageLoading
- If you don't believe that you are at risk, you can keep the same behavior as in <=v20.14.6 by sending in { enableCSSFileLoading: true, enableIframePageLoading: true } as broswer settings (e.g. new Window({ settings }));

`v20.14.6`

Compare Source

👷‍♂️ Patch fixes

Fixes cookie scope forgery vulnerability - By @capricorn86

`v20.14.5`

Compare Source

👷‍♂️ Patch fixes

Preserve character references in comment data - By @hampustagerud in task #2409

`v20.14.4`

Compare Source

👷‍♂️ Patch fixes

End comments at the first comment end tag when it overlaps a comment start tag - By @hampustagerud in task #2407

`v20.14.3`

Compare Source

👷‍♂️ Patch fixes

Avoids cloning all properties in CSSPropertyManager.toString - By @erictheswift in task #2363

`v20.14.2`

Compare Source

👷‍♂️ Patch fixes

Fixes regression where not all CSS variables where resolved in getComputedStyle() - By @klaesra in task #2344

`v20.14.1`

Compare Source

👷‍♂️ Patch fixes

Invalidate the computed style cache for the whole subtree - By @matmannion and @capricorn86 in task #2366

`v20.14.0`

Compare Source

🎨 Features

Improves computed style cache - By @capricorn86 in task #2357

`v20.13.2`

Compare Source

👷‍♂️ Patch fixes

Fix problem with getComputedStyle with :host and :host-context selectors - By @capricorn86 in task #2349

`v20.13.1`

Compare Source

👷‍♂️ Patch fixes

GetComputedStyle should return inherited value when it is set to inherit - By @capricorn86 in task #2347

`v20.13.0`

Compare Source

🎨 Features

Adds support for :host psuedo query selector - By @capricorn86 in task #2345

`v20.12.2`

Compare Source

👷‍♂️ Patch fixes

Custom elements should be upgraded when connected to DOM - By @capricorn86 in task #2342

`v20.12.1`

Compare Source

🎨 Features

Adds support for kebab-case properties on CSSStyleDeclaration - By @capricorn86 in task #2256
Adds support for all Chromium CSS properties to CSSStyleDeclaration - By @capricorn86 in task #2256
- Downloads a list from the Chromium project when compiling

👷‍♂️ Patch fixes

Fixes issue with parsing CSS fallback variables - By @capricorn86 in task #2256

`v20.12.0`

Compare Source

🎨 Features

Adds support for Animation, AnimationTimeline, DocumentTimeline and KeyframeEffect - By @capricorn86
Adds support for Element.animate() - By @capricorn86

`v20.11.15`

Compare Source

👷‍♂️ Patch fixes

Fixes issue with upgrading custom element caused by previous release - By @capricorn86 in task #2331

`v20.11.14`

Compare Source

👷‍♂️ Patch fixes

Change prototype of element to the custom element when upgraded to keep the reference - By @capricorn86 in task #2331
- The previous solution replaced the element with the custom element and copied it's properties, but this made any reference to the original element invalid

`v20.11.13`

Compare Source

👷‍♂️ Patch fixes

Copy event listeners when upgrading a custom element - By @capricorn86 in task #2329

`v20.11.12`

Compare Source

👷‍♂️ Patch fixes

Add check for if the node is still a parent during disconnect - By @capricorn86 in task #2322

`v20.11.11`

Compare Source

👷‍♂️ Patch fixes

Use proxy as parent node in Node.connectedToNode - By @diegohaz in task #2253

`v20.11.10`

Compare Source

👷‍♂️ Patch fixes

Return default validationMessage for built-in constraint violations - By @mixelburg in task #2187

`v20.11.9`

Compare Source

👷‍♂️ Patch fixes

Make sure that the element has been upgraded before invoking reaction callback in custom elements - By @capricorn86 in task #2317

`v20.11.8`

Compare Source

👷‍♂️ Patch fixes

Values pushed or assigned to the adoptedStyleSheet array should be validated - By @capricorn86 in task #2315

`v20.11.7`

Compare Source

👷‍♂️ Patch fixes

The properties Document.adoptedStyleSheets and ShadowRoot.adoptedStyleSheets should validate it's value - By @capricorn86 in task #2313

`v20.11.6`

Compare Source

👷‍♂️ Patch fixes

Updates docs for the global-registrator package - By @capricorn86 in task #2300

`v20.11.5`

Compare Source

👷‍♂️ Patch fixes

Allow explicit element types for querySelector (e.g. querySelector<HTMLInputElement>(".my-input")) - By @cyphercodes

`v20.11.4`

Compare Source

👷‍♂️ Patch fixes

Fixes the CORS check fetch() to match origins instead of host and protocol - By @rexxars in task #1490

`v20.11.3`

Compare Source

👷‍♂️ Patch fixes

Make document.links return a live HTMLCollection - By @bangseongbeom in task #2299
Copy labels array to prevent mutation of cached querySelectorAll result - By @mixelburg in task #2226

`v20.11.2`

Compare Source

👷‍♂️ Patch fixes

MutationObserver callback being GC'd due to orphaned WeakRef - By @mixelburg in task #2264

`v20.11.1`

Compare Source

👷‍♂️ Patch fixes

Improve performance of query selectors by avoiding construction of DOMException when not needed - By @@cyfung1031 in task #2228

👷‍♂️ Patch fixes

Await NodeJS internal ReadableStream promise during teardown - By @capricorn86 in task #2217

`v20.10.5`

Compare Source

👷‍♂️ Patch fixes

Adds cache to query selector parser - By @capricorn86 in task #2142
- The selector parser degraded in performance in v20.6.3 to solve more complex selectors
- Parsing is still a bit slower, but the cache will hopefully mitigate most of the problem

`v20.10.4`

Compare Source

👷‍♂️ Patch fixes

Coerce null qualifiedName to empty string in createDocument - By @Firer in task #2206

`v20.10.3`

Compare Source

👷‍♂️ Patch fixes

Fix "~=" attribute selector matching hyphenated substrings in CSS selectors - By @mixelburg in task #2194

`v20.10.2`

Compare Source

👷‍♂️ Patch fixes

Updates external dependencies - By @capricorn86 in task #2163

`v20.10.1`

Compare Source

`v20.10.0`

Compare Source

🎨 Features

Adds support for setting a canvas adapter for handling the canvas rendering using the browser setting canvasAdapter - By @RAprogramm and @capricorn86 in task #241
Adds new package @happy-dom/node-canvas-adapter - By @RAprogramm and @capricorn86 in task #241
- @happy-dom/node-canvas-adapter is a pluggable canvas adapter for Happy DOM using node-canvas.
Adds support for loading image files when enabling the browser setting enableImageFileLoading - By @capricorn86 in task #241
Adds support for loading image data URLs - By @capricorn86 in task #241
Adds support for ImageData - By @capricorn86 in task #241
Adds support for ImageBitmap - By @capricorn86 in task #241
Adds support for Window.createImageBitmap() - By @capricorn86 in task #241

`v20.9.0`

Compare Source

🎨 Features

Adds support for event listener properties on Window (e.g. Window.onkeydown) - By @capricorn86 in task #2131

`v20.8.9`

Compare Source

👷‍♂️ Patch fixes

Fixes issue where cookies from the current origin was being forwarded to the target origin in fetch requests - By @capricorn86 in task #2117
- A security advisory (GHSA-w4gp-fjgq-3q4g) was reported for this security vulnerability. Big thanks to @r74tech for reporting this!

`v20.8.8`

Compare Source

👷‍♂️ Patch fixes

Fixes issue where export names can be interpolated as executable code in ESM - By @capricorn86 in task #2113
- A security advisory (GHSA-6q6h-j7hj-3r64) has been reported that shows a security vulnerability where it may be possible to escape the VM context and get access to process level functionality in unsafe environments using CommonJS. Big thanks to @tndud042713 for reporting this!

`v20.8.7`

Compare Source

👷‍♂️ Patch fixes

Replace implementing Node.js Console with common IConsole interface to support latest version of Bun - By @YevheniiKotyrlo in task #1845

`v20.8.6`

Compare Source

👷‍♂️ Patch fixes

Request.formData() should honor "Content-Type" header - By @brianhelba in task #2106

`v20.8.5`

Compare Source

👷‍♂️ Patch fixes

Fixes error thrown when modifying DOM structure in connectedCallback() - By @capricorn86 in task #2110

`v20.8.4`

Compare Source

👷‍♂️ Patch fixes

Replace ConsoleConstructor import with indexed access type - By @YevheniiKotyrlo in task #1845

`v20.8.3`

Compare Source

👷‍♂️ Patch fixes

Throw error if event is not of type Event in EventTarget.dispatchEvent() - By @capricorn86 in task #2054

`v20.8.2`

Compare Source

👷‍♂️ Patch fixes

Resets Event.cancelBubble and Event.defaultPrevented when calling Event.initEvent() - By @capricorn86 in task #2090

`v20.8.1`

Compare Source

👷‍♂️ Patch fixes

Make "inert" attribute block focus interactions - By @coffeeandwork in task #1422

`v20.8.0`

Compare Source

🎨 Features

Adds support for setPointerCapture, hasPointerCapture, and releasePointerCapture to Element - By @coffeeandwork in task #1733

`v20.7.2`

Compare Source

👷‍♂️ Patch fixes

Properly decode CSS escape sequences in attribute selector values - By @silverwind

`v20.7.1`

Compare Source

👷‍♂️ Patch fixes

Fixes issue related to parsing direct descendants (>) and universal (*) query selectors - By @Cherry in task #2078

`v20.7.0`

Compare Source

🎨 Features

Adds support for Window.getScreenDetails() - By @TrevorBurnham in task #1923
Extends Screen from EventTarget - By @TrevorBurnham in task #1923

`v20.6.5`

Compare Source

👷‍♂️ Patch fixes

Add clearImmediate to Jest environment global scope - By @TrevorBurnham in task #1927

`v20.6.4`

Compare Source

👷‍♂️ Patch fixes

Normalize invalid input type attribute to "text" per HTML spec - By @atzzCokeK in task #2053

`v20.6.3`

Compare Source

👷‍♂️ Patch fixes

Refactors query selector parser to be able to handle complex rules - By @capricorn86 in task #1910
Fixes issue related to using query selector for attribute in XML document - By @capricorn86 in task #1912
Fixes issue with using quotes within quotes for attribute query selector (e.g. [data-value="it's a test"]) - By @capricorn86 in task #2034

`v20.6.2`

Compare Source

👷‍♂️ Patch fixes

Update entities package version to resolve missing export for vue and vue-compat v3.5 - By @acollins1991 in task #2066

`v20.6.1`

Compare Source

👷‍♂️ Patch fixes

Support CSS gradients with rgba() - By @atzzCokeK in task #2042
Support unicode characters in selectors per CSS spec - By @kaigritun in task #2057

`v20.6.0`

Compare Source

🎨 Features

Adds support for register on import to the @happy-dom/global-registrator package - By @capricorn86 in task #2060

`v20.5.5`

Compare Source

👷‍♂️ Patch fixes

Correct caption element content model to allow flow content - By @atzzCokeK in task #2052

`v20.5.4`

Compare Source

👷‍♂️ Patch fixes

Implement Text.wholeText property - By @aki05162525 in task #1959

`v20.5.3`

Compare Source

👷‍♂️ Patch fixes

Node.replaceWith does not throw w/o parent - By @lukeed

`v20.5.2`

Compare Source

👷‍♂️ Patch fixes

Use entities package for HTML/XML encoding and decoding - By @TrevorBurnham in task #1947

`v20.5.1`

Compare Source

👷‍♂️ Patch fixes

Fixes logic in HTMLInputElement.stepUp() and HTMLInputElement.stepDown() to work according to spec - By @stevematney in task #1955

`v20.5.0`

Compare Source

👷‍♂️ Patch fixes

Removes circular dependencies internally - By @capricorn86 in task #2055
- Compilers can handle simpler circular dependencies, but warnings may be outputted
Changes naming of types used internally to follow a consistent pattern - By @capricorn86 in task #2055
Enforces use of the "type" modifier internally in the source code (e.g. import type and export type) - By @capricorn86 in task #2055

`v20.4.0`

Compare Source

🎨 Features

Adds support for caching the compiled code of EcmaScript modules - By @capricorn86 in task #2049
Improves the way nodes are destroyed and garbage collected - By @capricorn86 in task #2049

`v20.3.9`

Compare Source

👷‍♂️ Patch fixes

Accept Document nodes as valid boundary points in Selection API - By @skoch13 in task #1952

`v20.3.8`

Compare Source

👷‍♂️ Patch fixes

The getters for the properties focusNode and focusOffset in the Selection API returned incorrect values - By @skoch13 in task #1850

`v20.3.7`

Compare Source

👷‍♂️ Patch fixes

Updates README.md for the "@happy-dom/server-renderer" package - By @capricorn86 in task #2035

`v20.3.6`

Compare Source

👷‍♂️ Patch fixes

Fixes issue where it wasn't possible to toggle the "open" attribute of <details> by clicking on a child of the <summary> element - By @Nxooah in task #1928

`v20.3.5`

Compare Source

👷‍♂️ Patch fixes

Use internal property for "location" in BrowserFrameURL to avoid mock interference - By @marchaos in task #1964
Add optional chaining to the "hostname" and pathname" properties to check if they are undefined in CookieURLUtility - By @marchaos in task #1968

`v20.3.4`

Compare Source

👷‍♂️ Patch fixes

Preserve attribute name case in CSS selectors for XML documents - By @TrevorBurnham in task #1912
Implement implicit closing of <p> elements per HTML spec - By @TrevorBurnham in task #1949
EventTarget should not call arbitrary on* properties - By @TrevorBurnham in task #1895

`v20.3.3`

Compare Source

👷‍♂️ Patch fixes

Add "which" property to KeyboardEvent - By @TrevorBurnham in task #1897
Node.getRootNode() returns correct root for detached shadow trees - By @TrevorBurnham in task #1941
Fixes issue that prevented Node.contains() to work for <select> and <form> elements - By @TrevorBurnham in task #1876
Replace setTimeout() with queueMicrotask() where appropriate - By @TrevorBurnham in task #1880
Optimize XMLEncodeUtility with pre-compiled RegExp and lookup tables - By @TrevorBurnham in task #1983
Use parseFloat() for "Cache-Control" header max-age parsing - By @TrevorBurnham in task #1985
Remove redundant RegExp flags in HTMLParser - By @TrevorBurnham in task #1981
Widen "types/node" version range to support Node 24+ - By @TrevorBurnham in task #1966

`v20.3.2`

Compare Source

👷‍♂️ Patch fixes

Use PropertySymbol.body to set body in cloneBodyStream - By @TrevorBurnham in task #1963
Optimize DOMTokenList add/remove with Set for O - By @TrevorBurnham in task #1989
Allow paths in WebSocket URLs - By @TrevorBurnham in task #1975
Decode named HTML entities correctly - By @TrevorBurnham in task #1951

`v20.3.1`

Compare Source

👷‍♂️ Patch fixes

Normalizes the "format" parameter according to the HTML specification in DataTransfer.getData() - By @marchaos in task #1965
Handle partial responses in XMLHttpRequest - By @rexxars in task #1890

`v20.3.0`

Compare Source

🎨 Features

Use RegExp to convert ASCII character casing to improve performance - By @TrevorBurnham in task #1886

`v20.2.0`

Compare Source

🎨 Features

Use Element.classList.contains() instead of splitting className in query selectors to improve performance as it's cached - By @TrevorBurnham in task #1884

`v20.1.1`

Compare Source

👷‍♂️ Patch fixes

Fixes caching in querySelector() - By @TrevorBurnham in task #1882
Avoid sort in querySelector() to improve performance - By @TrevorBurnham in task #1882

`v20.1.0`

Compare Source

🎨 Features

Adds support for BrowserPage.evaluateModule() and BrowserFrame.evaluateModule() - By @capricorn86 in task #1944
Adds support for module to the browser settings - By @capricorn86 in task #1944
- This makes it possible to add a custom resolver or a node module resolver
Adds support for dynamic import() to JavaScript evaluation - By @capricorn86 in task #1944
- It was previously only supported when using type="module" on script elements
Adds support for WebSocket - By @capricorn86 in task #1944
Adds support for CloseEvent - By @capricorn86 in task #1944
Adds support for render.setupScript and render.mode to the configuration in @happy-dom/server-renderer - By @capricorn86 in task #1944
Changes name from urls to renderItems in the configuration in @happy-dom/server-renderer - By @capricorn86 in task #1944
Adds support for rendering HTML strings to ServerRenderer in @happy-dom/server-renderer - By @capricorn86 in task #1944
- It previously only had support for rendering URLs
- This makes it easier to add server-rendering as a hook to frameworks
Makes JavaScript evaluation disabled by default in @happy-dom/server-renderer - By @capricorn86 in task #1944

👷‍♂️ Patch fixes

Several fixed to the EcmaScript module compiler (esm) - By @capricorn86 in task #1944
Fixes issue where rendering using Worker's didn't work in @happy-dom/server-renderer - By @capricorn86 in task #1944

`v20.0.11`

Compare Source

👷‍♂️ Patch fixes

Always include manually set authorization headers in requests - By @capricorn86 in task #1048'
- Authorization headers should only be omitted when automatically set by page context

`v20.0.10`

Compare Source

👷‍♂️ Patch fixes

Clears event listeners on all nodes when a Window is closed to prevent memory leaks - By @TrevorBurnham in task #1892

`v20.0.9`

Compare Source

👷‍♂️ Patch fixes

Elements should only be upgraded to a custom element (web component) when the element is in the document - By @capricorn86 in task #1945
- This will also improve the memory footprint as the listeners prevented nodes from being garbage collected until the document was closed

`v20.0.8`

Compare Source

👷‍♂️ Patch fixes

Fixes issue where previousSibling() and nextSibling() didn't work in HTMLSelectElement and HTMLFormElement - By @capricorn86 in task #1939
Fixes issue where parsing an item without a permitted parent (e.g. <tr>) should be valid inside a <template> element - By @capricorn86 in task #1939

`v20.0.7`

Compare Source

👷‍♂️ Patch fixes

Fix incorrect handling of >= operator in media query parser - By @lkritsimas in task #1869

`v20.0.6`

Compare Source

👷‍♂️ Patch fixes

Changes implementation for DOMTokenList.forEach(), Headers.forEach() and NodeList.forEach() to be spec compliant - By @ikeyan in task #1858

`v20.0.5`

Compare Source

👷‍♂️ Patch fixes

The setter TreeWalker.currentNode should validate if the value is a Node - By @capricorn86 in task #1935

`v20.0.4`

Compare Source

👷‍♂️ Patch fixes

Only adds buttons to FormData if they are the submitter - By @maxmil and @
karpiuMG in task #1859

`v20.0.3`

Compare Source

👷‍♂️ Patch fixes

Moves URL resolution to after checking if module preloading is enabled to prevent URL errors to be thrown when unresolvable - By @iam-medvedev in task #1851
Fixes issue where CSS variables aren't parsed correctly when inside CSS functions - By @fimion in task #1837

`v20.0.2`

Compare Source

👷‍♂️ Patch fixes

Adds frozen intrinsics flag to workers in @happy-dom/server-renderer - By @capricorn86 in task #1934

`v20.0.1`

Compare Source

👷‍♂️ Patch fixes

Adds warning for environment with unfrozen intrinsics (builtins) when JavaScript evaluation is enabled- By @capricorn86 in task #1932
- A security advisory has been reported showing that the recommended preventive measure of running Node.js with --disallow-code-generation-from-strings wasn't enough to protec

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

vercel · 2025-01-06T07:48:50Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
design-system	Error		Oct 20, 2026 10:40pm UTC

vercel · 2025-01-06T09:35:11Z