chore(deps): update dependency happy-dom to v21 - autoclosed

v21.0.4

Compare Source

:construction_worker_man: Patch fixes

• Fixed a code injection vulnerability in the ESM compiler - By @​capricorn86
• Fixed cross-origin isolation so opaque-origin data: iframes cannot access their parent or top window - By @​capricorn86

v21.0.3

Compare Source

:construction_worker_man: Patch fixes

• Fixes security vulnerability where authorization header was forwarded when redirecting - By @​capricorn86

v21.0.2

Compare Source

:construction_worker_man: Patch fixes

• Fixes SSRF security vulnerability by doing a target-origin bypass in the proxy server in @​happy-dom/server-renderer - By @​capricorn86

v21.0.1

Compare Source

:construction_worker_man: Patch fixes

• Adds aliases --css and --iframe for enabling CSS and iframe loading to @​happy-dom/server-renderer - By @​capricorn86

v21.0.0

Compare Source

:bomb: Breaking Changes

• Disables CSS and IFrame loading by default to prevent server-side request forgery (SSRF) - By @​capricorn86
  • An attacker could embed <iframe> or <link rel="stylesheet"> elements in untrusted HTML to make Happy DOM send HTTP requests from the server to attacker-chosen URLs, including internal services. This could allow access to otherwise unreachable endpoints or trigger unintended actions, depending on the application and its network access.
  • The settings property disableCSSFileLoading has been deprecated
  • Added the new settings properties enableCSSFileLoading and enableIframePageLoading
  • If you don't believe that you are at risk, you can keep the same behavior as in <=v20.14.6 by sending in { enableCSSFileLoading: true, enableIframePageLoading: true } as broswer settings (e.g. new Window({ settings }));

v20.14.6

Compare Source

:construction_worker_man: Patch fixes

• Fixes cookie scope forgery vulnerability - By @​capricorn86

v20.14.5

Compare Source

:construction_worker_man: Patch fixes

• Preserve character references in comment data - By @​hampustagerud in task #​2409

v20.14.4

Compare Source

:construction_worker_man: Patch fixes

• End comments at the first comment end tag when it overlaps a comment start tag - By @​hampustagerud in task #​2407

v20.14.3

Compare Source

:construction_worker_man: Patch fixes

• Avoids cloning all properties in CSSPropertyManager.toString - By @​erictheswift in task #​2363

v20.14.2

Compare Source

:construction_worker_man: Patch fixes

• Fixes regression where not all CSS variables where resolved in getComputedStyle() - By @​klaesra in task #​2344

v20.14.1

Compare Source

:construction_worker_man: Patch fixes

• Invalidate the computed style cache for the whole subtree - By @​matmannion and @​capricorn86 in task #​2366

v20.14.0

Compare Source

:art: Features

• Improves computed style cache - By @​capricorn86 in task #​2357

v20.13.2

Compare Source

:construction_worker_man: Patch fixes

• Fix problem with getComputedStyle with :host and :host-context selectors - By @​capricorn86 in task #​2349

v20.13.1

Compare Source

:construction_worker_man: Patch fixes

• GetComputedStyle should return inherited value when it is set to inherit - By @​capricorn86 in task #​2347

v20.13.0

Compare Source

:art: Features

• Adds support for :host psuedo query selector - By @​capricorn86 in task #​2345

v20.12.2

Compare Source

:construction_worker_man: Patch fixes

• Custom elements should be upgraded when connected to DOM - By @​capricorn86 in task #​2342

v20.12.1

Compare Source

:art: Features

• Adds support for kebab-case properties on CSSStyleDeclaration - By @​capricorn86 in task #​2256
• Adds support for all Chromium CSS properties to CSSStyleDeclaration - By @​capricorn86 in task #​2256
  • Downloads a list from the Chromium project when compiling

:construction_worker_man: Patch fixes

• Fixes issue with parsing CSS fallback variables - By @​capricorn86 in task #​2256

v20.12.0

Compare Source

:art: Features

• Adds support for Animation, AnimationTimeline, DocumentTimeline and KeyframeEffect - By @​capricorn86
• Adds support for Element.animate() - By @​capricorn86

v20.11.15

Compare Source

:construction_worker_man: Patch fixes

• Fixes issue with upgrading custom element caused by previous release - By @​capricorn86 in task #​2331

v20.11.14

Compare Source

:construction_worker_man: Patch fixes

• Change prototype of element to the custom element when upgraded to keep the reference - By @​capricorn86 in task #​2331
  • The previous solution replaced the element with the custom element and copied it's properties, but this made any reference to the original element invalid

v20.11.13

Compare Source

:construction_worker_man: Patch fixes

• Copy event listeners when upgrading a custom element - By @​capricorn86 in task #​2329

v20.11.12

Compare Source

:construction_worker_man: Patch fixes

• Add check for if the node is still a parent during disconnect - By @​capricorn86 in task #​2322

v20.11.11

Compare Source

:construction_worker_man: Patch fixes

• Use proxy as parent node in Node.connectedToNode - By @​diegohaz in task #​2253

v20.11.10

Compare Source

:construction_worker_man: Patch fixes

• Return default validationMessage for built-in constraint violations - By @​mixelburg in task #​2187

v20.11.9

Compare Source

:construction_worker_man: Patch fixes

• Make sure that the element has been upgraded before invoking reaction callback in custom elements - By @​capricorn86 in task #​2317

v20.11.8

Compare Source

:construction_worker_man: Patch fixes

• Values pushed or assigned to the adoptedStyleSheet array should be validated - By @​capricorn86 in task #​2315

v20.11.7

Compare Source

:construction_worker_man: Patch fixes

• The properties Document.adoptedStyleSheets and ShadowRoot.adoptedStyleSheets should validate it's value - By @​capricorn86 in task #​2313

v20.11.6

Compare Source

:construction_worker_man: Patch fixes

• Updates docs for the global-registrator package - By @​capricorn86 in task #​2300

v20.11.5

Compare Source

:construction_worker_man: Patch fixes

• Allow explicit element types for querySelector (e.g. querySelector<HTMLInputElement>(".my-input")) - By @​cyphercodes

v20.11.4

Compare Source

:construction_worker_man: Patch fixes

• Fixes the CORS check fetch() to match origins instead of host and protocol - By @​rexxars in task #​1490

v20.11.3

Compare Source

:construction_worker_man: Patch fixes

• Make document.links return a live HTMLCollection - By @​bangseongbeom in task #​2299
• Copy labels array to prevent mutation of cached querySelectorAll result - By @​mixelburg in task #​2226

v20.11.2

Compare Source

:construction_worker_man: Patch fixes

• MutationObserver callback being GC'd due to orphaned WeakRef - By @​mixelburg in task #​2264

v20.11.1

Compare Source

:construction_worker_man: Patch fixes

• Improve performance of query selectors by avoiding construction of DOMException when not needed - By @​@​cyfung1031 in task #​2228

v20.11.0

Compare Source

:art: Features

• Adds support for CookieStore API - By @​TrevorBurnham in task #​1864
• Adds support for Element.checkVisibility() - By @​capricorn86 in task #​1506

v20.10.6

Compare Source

:construction_worker_man: Patch fixes

• Await NodeJS internal ReadableStream promise during teardown - By @​capricorn86 in task #​2217

v20.10.5

Compare Source

:construction_worker_man: Patch fixes

• Adds cache to query selector parser - By @​capricorn86 in task #​2142
  • The selector parser degraded in performance in v20.6.3 to solve more complex selectors
  • Parsing is still a bit slower, but the cache will hopefully mitigate most of the problem

v20.10.4

Compare Source

:construction_worker_man: Patch fixes

• Coerce null qualifiedName to empty string in createDocument - By @​Firer in task #​2206

v20.10.3

Compare Source

:construction_worker_man: Patch fixes

• Fix "~=" attribute selector matching hyphenated substrings in CSS selectors - By @​mixelburg in task #​2194

v20.10.2

Compare Source

:construction_worker_man: Patch fixes

• Updates external dependencies - By @​capricorn86 in task #​2163

v20.10.1

Compare Source

v20.10.0

Compare Source

:art: Features

• Adds support for setting a canvas adapter for handling the canvas rendering using the browser setting canvasAdapter - By @​RAprogramm and @​capricorn86 in task #​241
• Adds new package @​happy-dom/node-canvas-adapter - By @​RAprogramm and @​capricorn86 in task #​241
  • @​happy-dom/node-canvas-adapter is a pluggable canvas adapter for Happy DOM using node-canvas.
• Adds support for loading image files when enabling the browser setting enableImageFileLoading - By @​capricorn86 in task #​241
• Adds support for loading image data URLs - By @​capricorn86 in task #​241
• Adds support for ImageData - By @​capricorn86 in task #​241
• Adds support for ImageBitmap - By @​capricorn86 in task #​241
• Adds support for Window.createImageBitmap() - By @​capricorn86 in task #​241

v20.9.0

Compare Source

:art: Features

• Adds support for event listener properties on Window (e.g. Window.onkeydown) - By @​capricorn86 in task #​2131

v20.8.9

Compare Source

:construction_worker_man: Patch fixes

• Fixes issue where cookies from the current origin was being forwarded to the target origin in fetch requests - By @​capricorn86 in task #​2117
  • A security advisory (GHSA-w4gp-fjgq-3q4g) was reported for this security vulnerability. Big thanks to @​r74tech for reporting this!

v20.8.8

Compare Source

:construction_worker_man: Patch fixes

• Fixes issue where export names can be interpolated as executable code in ESM - By @​capricorn86 in task #​2113
  • A security advisory (GHSA-6q6h-j7hj-3r64) has been reported that shows a security vulnerability where it may be possible to escape the VM context and get access to process level functionality in unsafe environments using CommonJS. Big thanks to @​tndud042713 for reporting this!

v20.8.7

Compare Source

:construction_worker_man: Patch fixes

• Replace implementing Node.js Console with common IConsole interface to support latest version of Bun - By @​YevheniiKotyrlo in task #​1845

v20.8.6

Compare Source

:construction_worker_man: Patch fixes

• Request.formData() should honor "Content-Type" header - By @​brianhelba in task #​2106

v20.8.5

Compare Source

:construction_worker_man: Patch fixes

• Fixes error thrown when modifying DOM structure in connectedCallback() - By @​capricorn86 in task #​2110

v20.8.4

Compare Source

:construction_worker_man: Patch fixes

• Replace ConsoleConstructor import with indexed access type - By @​YevheniiKotyrlo in task #​1845

v20.8.3

Compare Source

:construction_worker_man: Patch fixes

• Throw error if event is not of type Event in EventTarget.dispatchEvent() - By @​capricorn86 in task #​2054

v20.8.2

Compare Source

:construction_worker_man: Patch fixes

• Resets Event.cancelBubble and Event.defaultPrevented when calling Event.initEvent() - By @​capricorn86 in task #​2090

v20.8.1

Compare Source

:construction_worker_man: Patch fixes

• Make "inert" attribute block focus interactions - By @​coffeeandwork in task #​1422

v20.8.0

Compare Source

:art: Features

• Adds support for setPointerCapture, hasPointerCapture, and releasePointerCapture to Element - By @​coffeeandwork in task #​1733

v20.7.2

Compare Source

:construction_worker_man: Patch fixes

• Properly decode CSS escape sequences in attribute selector values - By @​silverwind

v20.7.1

Compare Source

:construction_worker_man: Patch fixes

• Fixes issue related to parsing direct descendants (>) and universal (*) query selectors - By @​Cherry in task #​2078

v20.7.0

Compare Source

:art: Features

• Adds support for Window.getScreenDetails() - By @​TrevorBurnham in task #​1923
• Extends Screen from EventTarget - By @​TrevorBurnham in task #​1923

v20.6.5

Compare Source

:construction_worker_man: Patch fixes

• Add clearImmediate to Jest environment global scope - By @​TrevorBurnham in task #​1927

v20.6.4

Compare Source

:construction_worker_man: Patch fixes

• Normalize invalid input type attribute to "text" per HTML spec - By @​atzzCokeK in task #​2053

v20.6.3

Compare Source

:construction_worker_man: Patch fixes

• Refactors query selector parser to be able to handle complex rules - By @​capricorn86 in task #​1910
• Fixes issue related to using query selector for attribute in XML document - By @​capricorn86 in task #​1912
• Fixes issue with using quotes within quotes for attribute query selector (e.g. [data-value="it's a test"]) - By @​capricorn86 in task #​2034