From 5eb032ab339009a6bebb77acc1b1dfe654945ba0 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 2 Nov 2026 22:28:07 +0000 Subject: [PATCH] chore(deps): clear the two high happy-dom advisories with the 21.0.4 patch happy-dom 20.14.6 -> 21.0.4, forced by a pnpm override because no direct dependency names happy-dom: it arrives via @payloadcms/richtext-lexical -> @lexical/headless (runtime tree) and via vitest (dev). Clears GHSA-834v-8h66-3h79 (CVE-2026-115895, 8.8, host code execution through an unvalidated ESM import alias; patched >=21.0.4) and GHSA-c8p4-j97h-3vg8 (CVE-2026-118660, 8.6, SSRF via iframe and link stylesheet; patched >=21.0.0). PR #196 proposed the same override on 2026-10-24 and was closed with "We'll wait for an official patch", when the advisory still read "No patched version is currently available". It now names 21.0.4, released 2026-10-20 and still npm latest. The SSRF advisory was published 2026-10-28, after that close. v21.0.0's one breaking change turns CSS file loading and iframe page loading off by default, deprecating disableCSSFileLoading for enableCSSFileLoading and enableIframePageLoading. Nothing here constructs a happy-dom Window or sets those settings, both vitest configs run environment 'node', and no file carries a @vitest-environment override. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01Mg9rjWnSTJ4GsZB9npQjpk --- package.json | 1 + pnpm-lock.yaml | 19 ++++++++++--------- 2 files changed, 11 insertions(+), 9 deletions(-) diff --git a/package.json b/package.json index 47a7e25..4018c3b 100644 --- a/package.json +++ b/package.json @@ -80,6 +80,7 @@ }, "pnpm": { "overrides": { + "happy-dom@<21.0.4": "21.0.4", "undici@>=7.18.0 <7.30.1": "7.30.1" } }, diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 565dc76..699b4ec 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -5,6 +5,7 @@ settings: excludeLinksFromLockfile: false overrides: + happy-dom@<21.0.4: 21.0.4 undici@>=7.18.0 <7.30.1: 7.30.1 importers: @@ -170,7 +171,7 @@ importers: version: 7.3.7(@types/node@22.20.5)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.15) vitest: specifier: ^4.1.12 - version: 4.1.12(@opentelemetry/api@1.10.0)(@types/node@22.20.5)(@vitest/ui@4.1.12)(happy-dom@20.14.6)(msw@2.15.0(@types/node@22.20.5)(typescript@5.9.3))(vite@7.3.7(@types/node@22.20.5)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.15)) + version: 4.1.12(@opentelemetry/api@1.10.0)(@types/node@22.20.5)(@vitest/ui@4.1.12)(happy-dom@21.0.4)(msw@2.15.0(@types/node@22.20.5)(typescript@5.9.3))(vite@7.3.7(@types/node@22.20.5)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.15)) wrangler: specifier: ^4.151.1 version: 4.151.1(@cloudflare/workers-types@5.20261019.1)(@types/node@22.20.5) @@ -3606,8 +3607,8 @@ packages: resolution: {integrity: sha512-Chq1s4CY7jmh8gO2qvLIJyfCDIN+EHLFW/9iShnp1z8FjBQMoodWP1kDC36VAMXXIvAjj4ARa7ntfAV2BrjsbA==} engines: {node: ^12.22.0 || ^14.16.0 || ^16.0.0 || >=17.0.0} - happy-dom@20.14.6: - resolution: {integrity: sha512-5DDsf4QmEIlRL6NkCv/fxSjYHHkZceL/IaYQdJc2h3G7DRTEai++VTjbfL0LB9geW2VrA3+vrjF3Efx+OTtX0Q==} + happy-dom@21.0.4: + resolution: {integrity: sha512-tFm+GaLBgo6o0awHnvHaNoraVo27qJ+2tZEtZ+cIa08hXbeitrxAJajLI05hsUy/2/YTKcUjQYzHe5mCcraLBw==} engines: {node: '>=20.0.0'} has-bigints@1.1.0: @@ -5567,7 +5568,7 @@ packages: '@vitest/coverage-istanbul': 4.1.12 '@vitest/coverage-v8': 4.1.12 '@vitest/ui': 4.1.12 - happy-dom: '*' + happy-dom: 21.0.4 jsdom: '*' vite: ^6.0.0 || ^7.0.0 || ^8.0.0 peerDependenciesMeta: @@ -6633,7 +6634,7 @@ snapshots: '@lexical/headless@0.50.0(typescript@5.9.3)': dependencies: '@lexical/internal': 0.50.0(typescript@5.9.3) - happy-dom: 20.14.6 + happy-dom: 21.0.4 lexical: 0.50.0(typescript@5.9.3) optionalDependencies: typescript: 5.9.3 @@ -8132,7 +8133,7 @@ snapshots: sirv: 3.0.2 tinyglobby: 0.2.17 tinyrainbow: 3.2.0 - vitest: 4.1.12(@opentelemetry/api@1.10.0)(@types/node@22.20.5)(@vitest/ui@4.1.12)(happy-dom@20.14.6)(msw@2.15.0(@types/node@22.20.5)(typescript@5.9.3))(vite@7.3.7(@types/node@22.20.5)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.15)) + vitest: 4.1.12(@opentelemetry/api@1.10.0)(@types/node@22.20.5)(@vitest/ui@4.1.12)(happy-dom@21.0.4)(msw@2.15.0(@types/node@22.20.5)(typescript@5.9.3))(vite@7.3.7(@types/node@22.20.5)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.15)) '@vitest/utils@4.1.12': dependencies: @@ -9197,7 +9198,7 @@ snapshots: graphql@16.14.2: {} - happy-dom@20.14.6: + happy-dom@21.0.4: dependencies: '@types/node': 22.20.5 '@types/whatwg-mimetype': 3.0.2 @@ -11764,7 +11765,7 @@ snapshots: lightningcss: 1.32.0 tsx: 4.23.15 - vitest@4.1.12(@opentelemetry/api@1.10.0)(@types/node@22.20.5)(@vitest/ui@4.1.12)(happy-dom@20.14.6)(msw@2.15.0(@types/node@22.20.5)(typescript@5.9.3))(vite@7.3.7(@types/node@22.20.5)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.15)): + vitest@4.1.12(@opentelemetry/api@1.10.0)(@types/node@22.20.5)(@vitest/ui@4.1.12)(happy-dom@21.0.4)(msw@2.15.0(@types/node@22.20.5)(typescript@5.9.3))(vite@7.3.7(@types/node@22.20.5)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.15)): dependencies: '@vitest/expect': 4.1.12 '@vitest/mocker': 4.1.12(msw@2.15.0(@types/node@22.20.5)(typescript@5.9.3))(vite@7.3.7(@types/node@22.20.5)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.15)) @@ -11790,7 +11791,7 @@ snapshots: '@opentelemetry/api': 1.10.0 '@types/node': 22.20.5 '@vitest/ui': 4.1.12(vitest@4.1.12) - happy-dom: 20.14.6 + happy-dom: 21.0.4 transitivePeerDependencies: - msw