[dependabot]

Bumps happy-dom from 20.14.6 to 21.0.4.

Release notes

Sourced from happy-dom's releases.

v21.0.4

👷‍♂️ Patch fixes

• Fixed a code injection vulnerability in the ESM compiler - By @​capricorn86
• Fixed cross-origin isolation so opaque-origin data: iframes cannot access their parent or top window - By @​capricorn86

v21.0.3

👷‍♂️ Patch fixes

• Fixes security vulnerability where authorization header was forwarded when redirecting - By @​capricorn86

v21.0.2

👷‍♂️ Patch fixes

• Fixes SSRF security vulnerability by doing a target-origin bypass in the proxy server in @​happy-dom/server-renderer - By @​capricorn86

v21.0.1

👷‍♂️ Patch fixes

• Adds aliases --css and --iframe for enabling CSS and iframe loading to @​happy-dom/server-renderer - By @​capricorn86

v21.0.0

💣 Breaking Changes

• Disables CSS and IFrame loading by default to prevent server-side request forgery (SSRF) - By @​capricorn86
  • An attacker could embed <iframe> or <link rel="stylesheet"> elements in untrusted HTML to make Happy DOM send HTTP requests from the server to attacker-chosen URLs, including internal services. This could allow access to otherwise unreachable endpoints or trigger unintended actions, depending on the application and its network access.
  • The settings property disableCSSFileLoading has been deprecated
  • Added the new settings properties enableCSSFileLoading and enableIframePageLoading
  • If you don't believe that you are at risk, you can keep the same behavior as in <=v20.14.6 by sending in { enableCSSFileLoading: true, enableIframePageLoading: true } as broswer settings (e.g. new Window({ settings }));

Commits

• fd16352 fix: Fixed a code injection vulnerability in the ESM compiler (#2537)
• 75ab0fb fix: Fixed cross-origin isolation so opaque-origin data: iframes cannot acces...
• 875ef5c fix: Fixes security vulnerability where authorization header was forwarded wh...
• 1f3ffdf fix: Fixes SSRF security vulnerability by doing a target-origin bypass in the...
• f55c7e0 chore: Update security documentation (#2509)
• 2b91e68 fix: Adds alias for enabling CSS and iframe loading in server-renderer (#2503)
• 0a99c75 BREAKING CHANGE: Disables CSS and IFrame loading by default (#2502)
• See full diff in compare view

[atomantic]

@dependabot rebase

[atomantic]

Reviewed the major-version changes and both open happy-dom alerts (#92, GHSA-c8p4-j97h-3vg8 / CVE-2026-118660; #88, GHSA-834v-8h66-3h79 / CVE-2026-115895). Upstream 0a99c752 disables external stylesheet/iframe loading by default and guards those loading paths; fd163520 validates import binding identifiers and JSON-escapes imported property names, with a regression for alias code injection. SparseTree uses happy-dom only for client component tests, sets no loading opt-ins, and has no iframe/stylesheet-loading test dependency. Verified npm ci, the full workspace build, and all 15 client tests on this exact PR head. Local validation ran UNCONTAINED because the prescribed containment probe returned exit 2 (Docker containment disabled). Upstream evidence: capricorn86/happy-dom@0a99c75 and capricorn86/happy-dom@fd16352 . No source migration is required.