Skip to content

chore(deps-dev): Bump happy-dom from 20.14.5 to 21.0.1 - #326

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/happy-dom-21.0.1
Closed

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/happy-dom-21.0.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 17, 2026 •

Copy link
Copy Markdown
Contributor

Bumps happy-dom from 20.14.5 to 21.0.1.

Release notes

Sourced from happy-dom's releases.

v21.0.1

👷‍♂️ Patch fixes

v21.0.0

💣 Breaking Changes

  • Disables CSS and IFrame loading by default to prevent server-side request forgery (SSRF) - By @​capricorn86
    • An attacker could embed <iframe> or <link rel="stylesheet"> elements in untrusted HTML to make Happy DOM send HTTP requests from the server to attacker-chosen URLs, including internal services. This could allow access to otherwise unreachable endpoints or trigger unintended actions, depending on the application and its network access.
    • The settings property disableCSSFileLoading has been deprecated
    • Added the new settings properties enableCSSFileLoading and enableIframePageLoading

v20.14.6

👷‍♂️ Patch fixes

Commits
  • 2b91e68 fix: Adds alias for enabling CSS and iframe loading in server-renderer (#2503)
  • 0a99c75 BREAKING CHANGE: Disables CSS and IFrame loading by default (#2502)
  • f21dbd7 fix: Fixes cookie scope forgery vulnerability (#2477)
  • See full diff in compare view

@dependabot dependabot Bot added dependencies javascript Pull requests that update javascript code labels Oct 17, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/happy-dom-21.0.1 branch from a1b0e19 to e5e02be Compare October 17, 2026 01:13
Bumps [happy-dom](https://github.com/capricorn86/happy-dom) from 20.14.5 to 21.0.1.
- [Release notes](https://github.com/capricorn86/happy-dom/releases)
- [Commits](capricorn86/happy-dom@v20.14.5...v21.0.1)

---
updated-dependencies:
- dependency-name: happy-dom
  dependency-version: 21.0.1
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/happy-dom-21.0.1 branch from e5e02be to d6769f8 Compare October 17, 2026 01:22
@dependabot @github

dependabot Bot commented on behalf of github Oct 24, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #335.

@dependabot dependabot Bot closed this Oct 24, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/happy-dom-21.0.1 branch October 24, 2026 01:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants