[dependabot]

Bumps happy-dom from 20.10.6 to 21.0.4.

Release notes

Sourced from happy-dom's releases.

v21.0.4

👷‍♂️ Patch fixes

• Fixed a code injection vulnerability in the ESM compiler - By @​capricorn86
• Fixed cross-origin isolation so opaque-origin data: iframes cannot access their parent or top window - By @​capricorn86

v21.0.3

👷‍♂️ Patch fixes

• Fixes security vulnerability where authorization header was forwarded when redirecting - By @​capricorn86

v21.0.2

👷‍♂️ Patch fixes

• Fixes SSRF security vulnerability by doing a target-origin bypass in the proxy server in @​happy-dom/server-renderer - By @​capricorn86

v21.0.1

👷‍♂️ Patch fixes

• Adds aliases --css and --iframe for enabling CSS and iframe loading to @​happy-dom/server-renderer - By @​capricorn86

v21.0.0

💣 Breaking Changes

• Disables CSS and IFrame loading by default to prevent server-side request forgery (SSRF) - By @​capricorn86
  • An attacker could embed <iframe> or <link rel="stylesheet"> elements in untrusted HTML to make Happy DOM send HTTP requests from the server to attacker-chosen URLs, including internal services. This could allow access to otherwise unreachable endpoints or trigger unintended actions, depending on the application and its network access.
  • The settings property disableCSSFileLoading has been deprecated
  • Added the new settings properties enableCSSFileLoading and enableIframePageLoading
  • If you don't believe that you are at risk, you can keep the same behavior as in <=v20.14.6 by sending in { enableCSSFileLoading: true, enableIframePageLoading: true } as broswer settings (e.g. new Window({ settings }));

v20.14.6

👷‍♂️ Patch fixes

• Fixes cookie scope forgery vulnerability - By @​capricorn86

v20.14.5

👷‍♂️ Patch fixes

• Preserve character references in comment data - By @​hampustagerud in task #2409

v20.14.4

👷‍♂️ Patch fixes

• End comments at the first comment end tag when it overlaps a comment start tag - By @​hampustagerud in task #2407

v20.14.3

👷‍♂️ Patch fixes

• Avoids cloning all properties in CSSPropertyManager.toString - By @​erictheswift in task #2363

v20.14.2

👷‍♂️ Patch fixes

• Fixes regression where not all CSS variables where resolved in getComputedStyle() - By @​klaesra in task #2344

v20.14.1

👷‍♂️ Patch fixes

• Invalidate the computed style cache for the whole subtree - By @​matmannion and @​capricorn86 in task #2366

v20.14.0

... (truncated)

Commits

• fd16352 fix: Fixed a code injection vulnerability in the ESM compiler (#2537)
• 75ab0fb fix: Fixed cross-origin isolation so opaque-origin data: iframes cannot acces...
• 875ef5c fix: Fixes security vulnerability where authorization header was forwarded wh...
• 1f3ffdf fix: Fixes SSRF security vulnerability by doing a target-origin bypass in the...
• f55c7e0 chore: Update security documentation (#2509)
• 2b91e68 fix: Adds alias for enabling CSS and iframe loading in server-renderer (#2503)
• 0a99c75 BREAKING CHANGE: Disables CSS and IFrame loading by default (#2502)
• f21dbd7 fix: Fixes cookie scope forgery vulnerability (#2477)
• 0d4cdbe fix: #2409 Preserve character references in comment data (#2410)
• 9c920a4 fix: #2407 End comments at the first comment end tag when it overlaps a com...
• Additional commits viewable in compare view

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0e4a160d-edeb-4a78-ad58-623e427936d6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[dbmi-svc-checkmarx]

Checkmarx One – Scan Summary & Details – bde25d9f-e37f-475d-8112-11f6a3ae0eb8

---

New Issues (2 out of 2)

Checkmarx found the following issues in this Pull Request

Severity: 1 High · 1 Medium

#	Severity	Issue	Source File / Package	Checkmarx Insight
1		CVE-2026-93753	Npm-deepmerge-4.3.1	details Description: deepmerge 4.2.0 through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject() function that fails to properly validate keys being... Attack Vector: NETWORK Attack Complexity: LOW ID: 9sPViiE2KGtZUYID388MmeQSkHeq3%2FeiUQ27p7CdUt4%3D Vulnerable Package
2		CVE-2026-110910	Npm-qs-6.16.1	details Recommended version: 6.16.2 Description: ### Summary `qs.stringify` with `allowEmptyArrays: true` writes the key of an empty array without encoding it, even though keys are encoded by d... Attack Vector: NETWORK Attack Complexity: LOW ID: xHhrxwBMlAB2qbGbKNubO1sXHxECvc9GC2e5D5u%2FWGY%3D Vulnerable Package

---

Fixed Issues (1)

Great job! The following issues were fixed in this Pull Request

Severity: 1 High

Severity	Issue	Source File / Package
	CVE-2026-115895	Npm-happy-dom-20.10.6

---

Communicate with Checkmarx by submitting a PR comment with @Checkmarx followed by one of the supported commands. Learn about the supported commands here.