chore(deps): update dependency happy-dom to v21 by renovate[bot] · Pull Request #228 · InseeFr/lunatic-pdf-api

renovate · 2026-10-12T00:39:17Z

This PR contains the following updates:

Package	Change	Age	Confidence
happy-dom	`^20.11.6` → `^21.0.0`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

capricorn86/happy-dom (happy-dom)

`v21.0.4`

Compare Source

👷‍♂️ Patch fixes

Fixed a code injection vulnerability in the ESM compiler - By @capricorn86
Fixed cross-origin isolation so opaque-origin data: iframes cannot access their parent or top window - By @capricorn86

`v21.0.3`

Compare Source

👷‍♂️ Patch fixes

Fixes security vulnerability where authorization header was forwarded when redirecting - By @capricorn86

`v21.0.2`

Compare Source

👷‍♂️ Patch fixes

Fixes SSRF security vulnerability by doing a target-origin bypass in the proxy server in @happy-dom/server-renderer - By @capricorn86

`v21.0.1`

Compare Source

👷‍♂️ Patch fixes

Adds aliases --css and --iframe for enabling CSS and iframe loading to @happy-dom/server-renderer - By @capricorn86

`v21.0.0`

Compare Source

💣 Breaking Changes

Disables CSS and IFrame loading by default to prevent server-side request forgery (SSRF) - By @capricorn86
- An attacker could embed <iframe> or <link rel="stylesheet"> elements in untrusted HTML to make Happy DOM send HTTP requests from the server to attacker-chosen URLs, including internal services. This could allow access to otherwise unreachable endpoints or trigger unintended actions, depending on the application and its network access.
- The settings property disableCSSFileLoading has been deprecated
- Added the new settings properties enableCSSFileLoading and enableIframePageLoading
- If you don't believe that you are at risk, you can keep the same behavior as in <=v20.14.6 by sending in { enableCSSFileLoading: true, enableIframePageLoading: true } as broswer settings (e.g. new Window({ settings }));

`v20.14.6`

Compare Source

👷‍♂️ Patch fixes

Fixes cookie scope forgery vulnerability - By @capricorn86

`v20.14.5`

Compare Source

👷‍♂️ Patch fixes

Preserve character references in comment data - By @hampustagerud in task #2409

`v20.14.4`

Compare Source

👷‍♂️ Patch fixes

End comments at the first comment end tag when it overlaps a comment start tag - By @hampustagerud in task #2407

`v20.14.3`

Compare Source

👷‍♂️ Patch fixes

Avoids cloning all properties in CSSPropertyManager.toString - By @erictheswift in task #2363

`v20.14.2`

Compare Source

👷‍♂️ Patch fixes

Fixes regression where not all CSS variables where resolved in getComputedStyle() - By @klaesra in task #2344

`v20.14.1`

Compare Source

👷‍♂️ Patch fixes

Invalidate the computed style cache for the whole subtree - By @matmannion and @capricorn86 in task #2366

`v20.14.0`

Compare Source

🎨 Features

Improves computed style cache - By @capricorn86 in task #2357

`v20.13.2`

Compare Source

👷‍♂️ Patch fixes

Fix problem with getComputedStyle with :host and :host-context selectors - By @capricorn86 in task #2349

`v20.13.1`

Compare Source

👷‍♂️ Patch fixes

GetComputedStyle should return inherited value when it is set to inherit - By @capricorn86 in task #2347

`v20.13.0`

Compare Source

🎨 Features

Adds support for :host psuedo query selector - By @capricorn86 in task #2345

`v20.12.2`

Compare Source

👷‍♂️ Patch fixes

Custom elements should be upgraded when connected to DOM - By @capricorn86 in task #2342

`v20.12.1`

Compare Source

🎨 Features

Adds support for kebab-case properties on CSSStyleDeclaration - By @capricorn86 in task #2256
Adds support for all Chromium CSS properties to CSSStyleDeclaration - By @capricorn86 in task #2256
- Downloads a list from the Chromium project when compiling

👷‍♂️ Patch fixes

Fixes issue with parsing CSS fallback variables - By @capricorn86 in task #2256

`v20.12.0`

Compare Source

🎨 Features

Adds support for Animation, AnimationTimeline, DocumentTimeline and KeyframeEffect - By @capricorn86
Adds support for Element.animate() - By @capricorn86

`v20.11.15`

Compare Source

👷‍♂️ Patch fixes

Fixes issue with upgrading custom element caused by previous release - By @capricorn86 in task #2331

`v20.11.14`

Compare Source

👷‍♂️ Patch fixes

Change prototype of element to the custom element when upgraded to keep the reference - By @capricorn86 in task #2331
- The previous solution replaced the element with the custom element and copied it's properties, but this made any reference to the original element invalid