You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
chore(deps): bump happy-dom to 21, biome to 2.6, bun to 1.4.4 - #24
Fixes two Socket alerts on happy-dom@20.14.6, which packages/react pulls in through @happy-dom/global-registrator (a dev dependency):
Advisory
Affected
Fixed in
SSRF via iframe and link stylesheet when parsing untrusted HTML
<= 20.14.6
21.0.0
Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution
17.0.0 to 21.0.3
21.0.4
No 20.x release has these fixes, so this takes the major bump to ^21.0.4.
Also bumps:
@biomejs/biome from 2.5.15 to 2.6.6
@types/bun to ^1.4.4
packageManager to bun@1.4.4 (root, packages/kirari, packages/compat)
Biome 2.6 follow-ups
Biome 2.6 adds rules that flagged existing code:
noComponentHookFactories (error): the Streamed test components in packages/react/test/hook.test.tsx and stream.test.tsx were defined inside functions and now live at module level. The hook test passes its handle in as a prop.
noDynamicNamespaceImportAccess (warning): the compat tests compare exports with Object.entries and Reflect.get instead of indexing the namespace.
useLiteralKeys (info): one fix in scripts/check-packages.ts.
The $schema URL in biome.json now points at 2.6.6. Only that line changed, since biome migrate reformats the whole file.
Testing
bun run typecheck, bun run test and bun run check all pass.
The react package tests pass on happy-dom 21.
These runs used bun 1.3.4 locally, not the newly pinned 1.4.4; CI covers 1.4.4.
Summary by cubic
Bumps happy-dom to 21.0.4 to fix two Socket security alerts in packages/react (SSRF via iframe and link stylesheet, and host code execution via unsanitized import alias), and bumps @biomejs/biome to 2.6.6, @types/bun to ^1.4.4, and the pinned bun to 1.4.4.
Biome 2.6 follow-ups
The Streamed test components move to module level for the new noComponentHookFactories rule; the hook test passes its handle as a prop instead.
The compat tests compare exports with Object.entries and Reflect.get instead of dynamic namespace access.
One useLiteralKeys fix in scripts/check-packages.ts and the biome.json schema URL now point at 2.6.6.
Written for commit 969d807. Summary will update on new commits.
Summary by CodeRabbit
Chores
Updated Bun, Biome, and the browser-testing environment to newer versions.
Refreshed package manager version declarations across the relevant packages.
Adjusted package compatibility checks and test setup; no end-user functionality changes are noted.
Fixes two Socket alerts on happy-dom@20.14.6, pulled in through
@happy-dom/global-registrator in packages/react:
- SSRF via iframe and link stylesheet (<= 20.14.6, fixed in 21.0.0)
- Unsanitized import alias leads to host code execution, an incomplete
fix for CVE-2026-33943 (<= 21.0.3, fixed in 21.0.4)
Also bumps @biomejs/biome 2.5.15 -> 2.6.6, @types/bun to ^1.4.4 and
packageManager to bun@1.4.4. Biome 2.6 adds rules that flagged the
tests, so the Streamed test components move to module level
(noComponentHookFactories), the compat tests compare exports via
Object.entries instead of dynamic namespace access, and the biome.json
schema URL points at 2.6.6.
No actionable comments were generated in the recent review.
Walkthrough
The pull request updates Bun, Biome, and a React development dependency. It also changes compatibility export assertions and restructures React test components.
Changes
Toolchain and test maintenance
Layer / File(s)
Summary
Tool and package version updates biome.json, package.json, packages/compat/package.json, packages/kirari/package.json, packages/react/package.json
The repository updates Bun to 1.4.4, Biome to 2.6.6, Bun type definitions to ^1.4.4, and @happy-dom/global-registrator to ^21.0.4.
The compatibility tests retrieve scoped exports with Reflect.get. The package check uses dot notation for the kirari peer dependency property.
React test component setup packages/react/test/hook.test.tsx, packages/react/test/stream.test.tsx
The tests declare Streamed outside their test helpers. The hook test passes language and handle as props and retains a render function that accepts a language.
vortexkit/kirari#20: Introduces the compatibility packages and check script that this PR updates.
Merge Risk: Minimal · up to 969d8
No code-level merge risk was identified. The linked-issue check still needs a valid issue reference.
Pre-merge checks: 5
Check name
Status
Explanation
Description Check
Check skipped - CodeRabbit’s high-level summary is enabled.
Title check
The title names the dependency bumps that make up the changeset: happy-dom to 21, Biome to 2.6, and Bun to 1.4.4. The raw summary confirms each bump in package.json, the packageManager fields, and bio…
Docstring Coverage
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Full details: Title check
Explanation
The title names the dependency bumps that make up the changeset: happy-dom to 21, Biome to 2.6, and Bun to 1.4.4. The raw summary confirms each bump in package.json, the packageManager fields, and biome.json. The title does not mention the test-component and compat-test adjustments, but those follow from the Biome 2.6 upgrade and are secondary to the main change.
Full details: Docstring Coverage
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 5 files. (5 skipped: 5 unsupported.)
Finishing Touches
Generate docstrings
Commit to this branch
Create a new PR
Generate unit tests (beta)
Commit to this branch
Create a new PR
Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Reviewing files that changed from the base of the PR and between 0a74b3d and 969d807.
Files ignored due to path filters: 1
bun.lock is excluded by !**/*.lock
Files selected for processing: 10
biome.json
package.json
packages/compat-rehype/test/compat.test.ts
packages/compat/package.json
packages/compat/test/compat.test.ts
packages/kirari/package.json
packages/react/package.json
packages/react/test/hook.test.tsx
packages/react/test/stream.test.tsx
scripts/check-packages.ts
Included review availability: This review used your included allowance. 4 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Closes #26
Summary
Fixes two Socket alerts on
happy-dom@20.14.6, whichpackages/reactpulls in through@happy-dom/global-registrator(a dev dependency):No 20.x release has these fixes, so this takes the major bump to
^21.0.4.Also bumps:
@biomejs/biomefrom 2.5.15 to 2.6.6@types/bunto^1.4.4packageManagertobun@1.4.4(root,packages/kirari,packages/compat)Biome 2.6 follow-ups
Biome 2.6 adds rules that flagged existing code:
noComponentHookFactories(error): theStreamedtest components inpackages/react/test/hook.test.tsxandstream.test.tsxwere defined inside functions and now live at module level. The hook test passes itshandlein as a prop.noDynamicNamespaceImportAccess(warning): the compat tests compare exports withObject.entriesandReflect.getinstead of indexing the namespace.useLiteralKeys(info): one fix inscripts/check-packages.ts.$schemaURL inbiome.jsonnow points at 2.6.6. Only that line changed, sincebiome migratereformats the whole file.Testing
bun run typecheck,bun run testandbun run checkall pass.Summary by cubic
Bumps
happy-domto 21.0.4 to fix two Socket security alerts inpackages/react(SSRF via iframe and link stylesheet, and host code execution via unsanitized import alias), and bumps@biomejs/biometo 2.6.6,@types/bunto ^1.4.4, and the pinned bun to 1.4.4.Biome 2.6 follow-ups
Streamedtest components move to module level for the newnoComponentHookFactoriesrule; the hook test passes itshandleas a prop instead.Object.entriesandReflect.getinstead of dynamic namespace access.useLiteralKeysfix inscripts/check-packages.tsand thebiome.jsonschema URL now point at 2.6.6.Written for commit 969d807. Summary will update on new commits.
Summary by CodeRabbit