[sydevs-bot]

Summary

• happy-dom 20.14.6 → 21.0.4 via a pnpm override, clearing both high Dependabot alerts.
• Re-files PR chore(deps): clear the high happy-dom code-execution advisory #196, closed pending "an official patch": the advisory now names 21.0.4.

Change outline

The override

package.json gains one pnpm.overrides entry, beside the existing undici one. No direct dependency names happy-dom; it arrives twice:

• @payloadcms/richtext-lexical → @lexical/headless → happy-dom — the runtime tree, which is why Dependabot scopes both alerts runtime
• vitest → happy-dom — dev

pnpm-lock.yaml follows: one resolved version, 20.14.6 → 21.0.4, on both paths.

Preview

No route, component or style changed, so no preview page shows this. The Cloudflare previews build from the branch as usual.

Test results

• Lean gate: ✓ lint (0 errors, 2137 warnings, unchanged), tsc --noEmit, vitest run — 921 tests in 91 files
• Targeted specs: none — no source file changed
• Build: ✓ pnpm build, which mirrors the Cloudflare preview deploy
• pnpm audit --audit-level=high: 2 high → 0. Moderate (9) and low (3) counts unchanged, so nothing new came in with 21.0.4.

Manual verification

1. Confirm both alerts close after merge: GHSA-834v-8h66-3h79 and GHSA-c8p4-j97h-3vg8.

Notes for reviewer

• This is PR chore(deps): clear the high happy-dom code-execution advisory #196 again. You closed it on 2026-10-26 with "We'll wait for an official patch". Two things changed since. GHSA-834v-8h66-3h79 now carries patched_versions: >=21.0.4 and recommendation: Upgrade to version 21.0.4 or later. And a second high advisory, GHSA-c8p4-j97h-3vg8 (SSRF, 8.6), was published 2026-10-28, after that close. happy-dom 21.0.4 shipped 2026-10-20 and is still npm latest, 13 days on.
• That advisory's prose still reads "No patched version is currently available". That is its original 2026-10-23 text; the structured fields and its own v21.0.4 reference link supersede it.
• The override forces 21.0.4 past @lexical/headless@0.50.0's declared happy-dom: ^20.9.0. Nothing we ship loads that package — evidence in Detail.
• A major and a security fix never share a PR. Here the patched version is the major, and this PR carries nothing else.

Detail

v21.0.0's one breaking change turns CSS file loading and iframe page loading off by default — that is the SSRF fix. disableCSSFileLoading is deprecated in favour of enableCSSFileLoading and enableIframePageLoading. Call sites checked: no file in the repo mentions happy-dom or any of those settings, both vitest.config.ts and vitest.smoke.config.ts set environment: 'node', and no file carries a @vitest-environment docblock. 21.0.1 through 21.0.4 are patches.

Reachability. Exposure is lower than the CVSS scores suggest. The override is one line, so this ships rather than being argued down:

• The site imports only @payloadcms/richtext-lexical/react. Walking that subpath's import graph reaches react and uuid, and nothing else — not @lexical/headless.
• grep over dist/ after pnpm build: 0 files match happy-dom, HappyDOM or lexical/headless. Neither the Worker nor the client bundle ships it.
• Both advisories need attacker-controlled HTML or module source fed to a happy-dom Window. Nothing here constructs one.

Why an override and not a bump. happy-dom is not a direct dependency, so there is nothing to bump. The alternative is waiting for @lexical/headless to widen its range, which leaves both alerts open for as long as that takes.

CI's dependency gate fails only on a newly added vulnerable dependency, so it has nothing to say about a PR that removes two.

Pipeline steps recorded rather than run. /simplify and /code-review read source; this branch changes one package.json line and a generated lockfile, so neither lens had anything to read. comment-lint.mjs --base origin/main ran and reported 0 changed files. The security review did not trigger: neither changed path matches securityReview.triggerPattern. Docs checked — nothing in docs/, the AGENTS.md guides or .env.example describes the overrides block.

---

Generated by Claude Code

[sydevs-bot]

🤖 no session running

_{Written by the sydevs dispatcher. Sessions never edit this comment.}

[sydevs-bot]

Adversarial review skipped: 2 file(s), 20 changed line(s), under review.skipWhen. Say @sydevs-bot review to force one.

_{🤖 sydevs dispatcher}

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	wemeditate-web	5eb032a	Commit Preview URL Branch Preview URL	Nov 02 2026, 10:30 PM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	wemeditate-design	5eb032a	Commit Preview URL Branch Preview URL	Nov 02 2026, 10:29 PM