From 29bcfbd12b044bf04ddd2bd57f7d6849cc43d2ec Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Sat, 17 Oct 2026 13:37:23 +0000
Subject: [PATCH] =?UTF-8?q?=E2=AC=86=EF=B8=8F=20Update=20dependency=20happ?=
 =?UTF-8?q?y-dom=20to=20v21=20(#7454)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [happy-dom](https://redirect.github.com/capricorn86/happy-dom) |
[`^20.14.6` →
`^21.0.3`](https://renovatebot.com/diffs/npm/happy-dom/20.14.6/21.0.3) |
![age](https://developer.mend.io/api/mc/badges/age/npm/happy-dom/21.0.3?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/happy-dom/20.14.6/21.0.3?slim=true)
|

---

### Release Notes

<details>
<summary>capricorn86/happy-dom (happy-dom)</summary>

###
[`v21.0.3`](https://redirect.github.com/capricorn86/happy-dom/releases/tag/v21.0.3)

[Compare
Source](https://redirect.github.com/capricorn86/happy-dom/compare/v21.0.2...v21.0.3)

##### :construction_worker_man: Patch fixes

- Fixes security vulnerability where authorization header was forwarded
when redirecting - By
**[@&#8203;capricorn86](https://redirect.github.com/capricorn86)**

###
[`v21.0.2`](https://redirect.github.com/capricorn86/happy-dom/releases/tag/v21.0.2)

[Compare
Source](https://redirect.github.com/capricorn86/happy-dom/compare/v21.0.1...v21.0.2)

##### :construction_worker_man: Patch fixes

- Fixes SSRF security vulnerability by doing a target-origin bypass in
the proxy server in
[@&#8203;happy-dom/server-renderer](https://redirect.github.com/capricorn86/happy-dom/wiki/Server-Renderer)
- By **[@&#8203;capricorn86](https://redirect.github.com/capricorn86)**

###
[`v21.0.1`](https://redirect.github.com/capricorn86/happy-dom/releases/tag/v21.0.1)

[Compare
Source](https://redirect.github.com/capricorn86/happy-dom/compare/v21.0.0...v21.0.1)

##### :construction_worker_man: Patch fixes

- Adds alias for enabling CSS and iframe loading to
[@&#8203;happy-dom/server-renderer](https://redirect.github.com/capricorn86/happy-dom/wiki/Server-Renderer)
- By **[@&#8203;capricorn86](https://redirect.github.com/capricorn86)**

###
[`v21.0.0`](https://redirect.github.com/capricorn86/happy-dom/releases/tag/v21.0.0)

[Compare
Source](https://redirect.github.com/capricorn86/happy-dom/compare/v20.14.6...v21.0.0)

##### :bomb: Breaking Changes

- Disables CSS and IFrame loading by default to prevent [server-side
request forgery
(SSRF)](https://en.wikipedia.org/wiki/Server-side_request_forgery) - By
**[@&#8203;capricorn86](https://redirect.github.com/capricorn86)**
- An attacker could embed `<iframe>` or `<link rel="stylesheet">`
elements in untrusted HTML to make Happy DOM send HTTP requests from the
server to attacker-chosen URLs, including internal services. This could
allow access to otherwise unreachable endpoints or trigger unintended
actions, depending on the application and its network access.
  - The settings property `disableCSSFileLoading` has been deprecated
- Added the new settings properties
[enableCSSFileLoading](https://redirect.github.com/capricorn86/happy-dom/wiki/IBrowserSettings#properties)
and
[enableIframePageLoading](https://redirect.github.com/capricorn86/happy-dom/wiki/IBrowserSettings#properties)

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/dubzzz/fast-check).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 examples/package.json |  2 +-
 pnpm-lock.yaml        | 36 ++++++++++++++++++------------------
 2 files changed, 19 insertions(+), 19 deletions(-)

diff --git a/examples/package.json b/examples/package.json
index f6623c6b9..c394ac209 100644
--- a/examples/package.json
+++ b/examples/package.json
@@ -15,7 +15,7 @@
     "@types/node": "^24.19.2",
     "@types/react": "^19.3.0",
     "fast-check": "workspace:*",
-    "happy-dom": "^20.14.6",
+    "happy-dom": "^21.0.3",
     "lodash": "^4.18.1",
     "pure-rand": "^8.4.2",
     "react": "^19.3.1",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 9f6395dcb..24fd94a74 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -223,7 +223,7 @@ importers:
         version: 7.0.2
       vitest:
         specifier: ^5.0.3
-        version: 5.0.3(@types/node@24.19.2)(@vitest/coverage-v8@5.0.3)(happy-dom@20.14.6)(vite@8.3.1(@types/node@24.19.2)(jiti@1.21.7)(terser@5.46.2)(yaml@2.9.0))
+        version: 5.0.3(@types/node@24.19.2)(@vitest/coverage-v8@5.0.3)(happy-dom@21.0.3)(vite@8.3.1(@types/node@24.19.2)(jiti@1.21.7)(terser@5.46.2)(yaml@2.9.0))
 
   examples:
     devDependencies:
@@ -249,8 +249,8 @@ importers:
         specifier: workspace:*
         version: link:../packages/fast-check
       happy-dom:
-        specifier: ^20.14.6
-        version: 20.14.6
+        specifier: ^21.0.3
+        version: 21.0.3
       lodash:
         specifier: ^4.18.1
         version: 4.18.1
@@ -268,7 +268,7 @@ importers:
         version: 7.0.2
       vitest:
         specifier: ^5.0.3
-        version: 5.0.3(@types/node@24.19.2)(@vitest/coverage-v8@5.0.3)(happy-dom@20.14.6)(vite@8.3.1(@types/node@24.19.2)(jiti@1.21.7)(terser@5.46.2)(yaml@2.9.0))
+        version: 5.0.3(@types/node@24.19.2)(@vitest/coverage-v8@5.0.3)(happy-dom@21.0.3)(vite@8.3.1(@types/node@24.19.2)(jiti@1.21.7)(terser@5.46.2)(yaml@2.9.0))
 
   packages/ava:
     dependencies:
@@ -299,7 +299,7 @@ importers:
         version: 7.0.2
       vitest:
         specifier: ^5.0.3
-        version: 5.0.3(@types/node@24.19.2)(@vitest/coverage-v8@5.0.3)(happy-dom@20.14.6)(vite@8.3.1(@types/node@24.19.2)(jiti@1.21.7)(terser@5.46.2)(yaml@2.9.0))
+        version: 5.0.3(@types/node@24.19.2)(@vitest/coverage-v8@5.0.3)(happy-dom@21.0.3)(vite@8.3.1(@types/node@24.19.2)(jiti@1.21.7)(terser@5.46.2)(yaml@2.9.0))
 
   packages/fast-check:
     dependencies:
@@ -330,7 +330,7 @@ importers:
         version: 7.0.2
       vitest:
         specifier: ^5.0.3
-        version: 5.0.3(@types/node@24.19.2)(@vitest/coverage-v8@5.0.3)(happy-dom@20.14.6)(vite@8.3.1(@types/node@24.19.2)(jiti@1.21.7)(terser@5.46.2)(yaml@2.9.0))
+        version: 5.0.3(@types/node@24.19.2)(@vitest/coverage-v8@5.0.3)(happy-dom@21.0.3)(vite@8.3.1(@types/node@24.19.2)(jiti@1.21.7)(terser@5.46.2)(yaml@2.9.0))
 
   packages/jest:
     dependencies:
@@ -373,7 +373,7 @@ importers:
         version: 8.3.1(@types/node@24.19.2)(jiti@1.21.7)(terser@5.46.2)(yaml@2.9.0)
       vitest:
         specifier: ^5.0.3
-        version: 5.0.3(@types/node@24.19.2)(@vitest/coverage-v8@5.0.3)(happy-dom@20.14.6)(vite@8.3.1(@types/node@24.19.2)(jiti@1.21.7)(terser@5.46.2)(yaml@2.9.0))
+        version: 5.0.3(@types/node@24.19.2)(@vitest/coverage-v8@5.0.3)(happy-dom@21.0.3)(vite@8.3.1(@types/node@24.19.2)(jiti@1.21.7)(terser@5.46.2)(yaml@2.9.0))
 
   packages/packaged:
     dependencies:
@@ -398,7 +398,7 @@ importers:
         version: 7.0.2
       vitest:
         specifier: ^5.0.3
-        version: 5.0.3(@types/node@24.19.2)(@vitest/coverage-v8@5.0.3)(happy-dom@20.14.6)(vite@8.3.1(@types/node@24.19.2)(jiti@1.21.7)(terser@5.46.2)(yaml@2.9.0))
+        version: 5.0.3(@types/node@24.19.2)(@vitest/coverage-v8@5.0.3)(happy-dom@21.0.3)(vite@8.3.1(@types/node@24.19.2)(jiti@1.21.7)(terser@5.46.2)(yaml@2.9.0))
 
   packages/poisoning:
     devDependencies:
@@ -416,7 +416,7 @@ importers:
         version: 7.0.2
       vitest:
         specifier: ^5.0.3
-        version: 5.0.3(@types/node@24.19.2)(@vitest/coverage-v8@5.0.3)(happy-dom@20.14.6)(vite@8.3.1(@types/node@24.19.2)(jiti@1.21.7)(terser@5.46.2)(yaml@2.9.0))
+        version: 5.0.3(@types/node@24.19.2)(@vitest/coverage-v8@5.0.3)(happy-dom@21.0.3)(vite@8.3.1(@types/node@24.19.2)(jiti@1.21.7)(terser@5.46.2)(yaml@2.9.0))
 
   packages/vitest:
     dependencies:
@@ -441,7 +441,7 @@ importers:
         version: 8.3.1(@types/node@24.19.2)(jiti@1.21.7)(terser@5.46.2)(yaml@2.9.0)
       vitest:
         specifier: ^5.0.0
-        version: 5.0.3(@types/node@24.19.2)(@vitest/coverage-v8@5.0.3)(happy-dom@20.14.6)(vite@8.3.1(@types/node@24.19.2)(jiti@1.21.7)(terser@5.46.2)(yaml@2.9.0))
+        version: 5.0.3(@types/node@24.19.2)(@vitest/coverage-v8@5.0.3)(happy-dom@21.0.3)(vite@8.3.1(@types/node@24.19.2)(jiti@1.21.7)(terser@5.46.2)(yaml@2.9.0))
 
   packages/worker:
     dependencies:
@@ -463,7 +463,7 @@ importers:
         version: 7.0.2
       vitest:
         specifier: ^5.0.3
-        version: 5.0.3(@types/node@24.19.2)(@vitest/coverage-v8@5.0.3)(happy-dom@20.14.6)(vite@8.3.1(@types/node@24.19.2)(jiti@1.21.7)(terser@5.46.2)(yaml@2.9.0))
+        version: 5.0.3(@types/node@24.19.2)(@vitest/coverage-v8@5.0.3)(happy-dom@21.0.3)(vite@8.3.1(@types/node@24.19.2)(jiti@1.21.7)(terser@5.46.2)(yaml@2.9.0))
 
   website:
     dependencies:
@@ -551,7 +551,7 @@ importers:
         version: 7.0.2
       vitest:
         specifier: ^5.0.3
-        version: 5.0.3(@types/node@24.19.2)(@vitest/coverage-v8@5.0.3)(happy-dom@20.14.6)(vite@8.3.1(@types/node@24.19.2)(jiti@1.21.7)(terser@5.46.2)(yaml@2.9.0))
+        version: 5.0.3(@types/node@24.19.2)(@vitest/coverage-v8@5.0.3)(happy-dom@21.0.3)(vite@8.3.1(@types/node@24.19.2)(jiti@1.21.7)(terser@5.46.2)(yaml@2.9.0))
 
 packages:
 
@@ -6223,8 +6223,8 @@ packages:
   handle-thing@2.0.1:
     resolution: {integrity: sha512-9Qn4yBxelxoh2Ow62nP+Ka/kMnOXRi8BXnRaUwezLNhqelnN49xKz4F/dPP8OYLxLxq6JDtZb2i9XznUQbNPTg==}
 
-  happy-dom@20.14.6:
-    resolution: {integrity: sha512-5DDsf4QmEIlRL6NkCv/fxSjYHHkZceL/IaYQdJc2h3G7DRTEai++VTjbfL0LB9geW2VrA3+vrjF3Efx+OTtX0Q==}
+  happy-dom@21.0.3:
+    resolution: {integrity: sha512-PesNgu5BnIEmAwzKGewB3K1ORFeznFZJ4JrRz89ea1wkHnxskdpzX9sN/+zb4KO6k8oSMhyJSj/cwXAFrYBBNA==}
     engines: {node: '>=20.0.0'}
 
   has-bigints@1.1.0:
@@ -14896,7 +14896,7 @@ snapshots:
       obug: 2.2.1
       std-env: 4.2.0
       tinyrainbow: 3.1.1
-      vitest: 5.0.3(@types/node@24.19.2)(@vitest/coverage-v8@5.0.3)(happy-dom@20.14.6)(vite@8.3.1(@types/node@24.19.2)(jiti@1.21.7)(terser@5.46.2)(yaml@2.9.0))
+      vitest: 5.0.3(@types/node@24.19.2)(@vitest/coverage-v8@5.0.3)(happy-dom@21.0.3)(vite@8.3.1(@types/node@24.19.2)(jiti@1.21.7)(terser@5.46.2)(yaml@2.9.0))
 
   '@vitest/istanbul-lib-coverage@1.0.2': {}
 
@@ -17106,7 +17106,7 @@ snapshots:
 
   handle-thing@2.0.1: {}
 
-  happy-dom@20.14.6:
+  happy-dom@21.0.3:
     dependencies:
       '@types/node': 24.19.2
       '@types/whatwg-mimetype': 3.0.2
@@ -21441,7 +21441,7 @@ snapshots:
       terser: 5.46.2
       yaml: 2.9.0
 
-  vitest@5.0.3(@types/node@24.19.2)(@vitest/coverage-v8@5.0.3)(happy-dom@20.14.6)(vite@8.3.1(@types/node@24.19.2)(jiti@1.21.7)(terser@5.46.2)(yaml@2.9.0)):
+  vitest@5.0.3(@types/node@24.19.2)(@vitest/coverage-v8@5.0.3)(happy-dom@21.0.3)(vite@8.3.1(@types/node@24.19.2)(jiti@1.21.7)(terser@5.46.2)(yaml@2.9.0)):
     dependencies:
       '@types/chai': 5.2.3
       '@vitest/mocker': 5.0.3(vite@8.3.1(@types/node@24.19.2)(jiti@1.21.7)(terser@5.46.2)(yaml@2.9.0))
@@ -21460,7 +21460,7 @@ snapshots:
     optionalDependencies:
       '@types/node': 24.19.2
       '@vitest/coverage-v8': 5.0.3(vitest@5.0.3)
-      happy-dom: 20.14.6
+      happy-dom: 21.0.3
     transitivePeerDependencies:
       - msw
 
-- 
knotmirror 0.0.1