From a5da19e41b8fecc0eacc41e4f7bbbdf15fd5393b Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Fri, 16 Oct 2026 10:49:09 +0000
Subject: [PATCH] build(deps): update dependency happy-dom to v21 (#13485)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [happy-dom](https://redirect.github.com/capricorn86/happy-dom) |
[`20.14.6` →
`21.0.1`](https://renovatebot.com/diffs/npm/happy-dom/20.14.6/21.0.1) |
![age](https://developer.mend.io/api/mc/badges/age/npm/happy-dom/21.0.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/happy-dom/20.14.6/21.0.1?slim=true)
|

---

### Release Notes

<details>
<summary>capricorn86/happy-dom (happy-dom)</summary>

###
[`v21.0.1`](https://redirect.github.com/capricorn86/happy-dom/releases/tag/v21.0.1)

[Compare
Source](https://redirect.github.com/capricorn86/happy-dom/compare/v21.0.0...v21.0.1)

##### :construction_worker_man: Patch fixes

- Adds alias for enabling CSS and iframe loading to
[@&#8203;happy-dom/server-renderer](https://redirect.github.com/capricorn86/happy-dom/wiki/Server-Renderer)
- By **[@&#8203;capricorn86](https://redirect.github.com/capricorn86)**

###
[`v21.0.0`](https://redirect.github.com/capricorn86/happy-dom/releases/tag/v21.0.0)

[Compare
Source](https://redirect.github.com/capricorn86/happy-dom/compare/v20.14.6...v21.0.0)

##### :bomb: Breaking Changes

- Disables CSS and IFrame loading by default to prevent [server-side
request forgery
(SSRF)](https://en.wikipedia.org/wiki/Server-side_request_forgery) - By
**[@&#8203;capricorn86](https://redirect.github.com/capricorn86)**
- An attacker could embed `<iframe>` or `<link rel="stylesheet">`
elements in untrusted HTML to make Happy DOM send HTTP requests from the
server to attacker-chosen URLs, including internal services. This could
allow access to otherwise unreachable endpoints or trigger unintended
actions, depending on the application and its network access.
  - The settings property `disableCSSFileLoading` has been deprecated
- Added the new settings properties
[enableCSSFileLoading](https://redirect.github.com/capricorn86/happy-dom/wiki/IBrowserSettings#properties)
and
[enableIframePageLoading](https://redirect.github.com/capricorn86/happy-dom/wiki/IBrowserSettings#properties)

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/authelia/authelia).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 web/package.json   |  2 +-
 web/pnpm-lock.yaml | 22 +++++++++++-----------
 2 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/web/package.json b/web/package.json
index d1b898386..bc9f9c32d 100644
--- a/web/package.json
+++ b/web/package.json
@@ -79,7 +79,7 @@
     "eslint-plugin-import": "2.32.0",
     "eslint-plugin-perfectionist": "5.12.1",
     "eslint-plugin-prettier": "5.5.7",
-    "happy-dom": "20.14.6",
+    "happy-dom": "21.0.1",
     "lefthook": "2.2.2",
     "prettier": "3.9.10",
     "tailwindcss": "4.3.3",
diff --git a/web/pnpm-lock.yaml b/web/pnpm-lock.yaml
index a39b0c961..912eedf1e 100644
--- a/web/pnpm-lock.yaml
+++ b/web/pnpm-lock.yaml
@@ -141,8 +141,8 @@ importers:
         specifier: 5.5.7
         version: 5.5.7(eslint-config-prettier@10.1.8(eslint@10.12.0(jiti@2.7.0)))(eslint@10.12.0(jiti@2.7.0))(prettier@3.9.10)
       happy-dom:
-        specifier: 20.14.6
-        version: 20.14.6
+        specifier: 21.0.1
+        version: 21.0.1
       lefthook:
         specifier: 2.2.2
         version: 2.2.2
@@ -169,7 +169,7 @@ importers:
         version: 5.2.0(@typescript/typescript6@6.0.2)(vite@8.3.4(@types/node@26.6.4)(jiti@2.7.0))
       vitest:
         specifier: 5.0.4
-        version: 5.0.4(@types/node@26.6.4)(@vitest/coverage-istanbul@5.0.4)(@vitest/ui@5.0.4)(happy-dom@20.14.6)(jsdom@27.4.0)(vite@8.3.4(@types/node@26.6.4)(jiti@2.7.0))
+        version: 5.0.4(@types/node@26.6.4)(@vitest/coverage-istanbul@5.0.4)(@vitest/ui@5.0.4)(happy-dom@21.0.1)(jsdom@27.4.0)(vite@8.3.4(@types/node@26.6.4)(jiti@2.7.0))
       vitest-preview:
         specifier: 0.0.3
         version: 0.0.3(@types/node@26.6.4)(jiti@2.7.0)
@@ -2466,8 +2466,8 @@ packages:
   graceful-fs@4.2.11:
     resolution: {integrity: sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==}
 
-  happy-dom@20.14.6:
-    resolution: {integrity: sha512-5DDsf4QmEIlRL6NkCv/fxSjYHHkZceL/IaYQdJc2h3G7DRTEai++VTjbfL0LB9geW2VrA3+vrjF3Efx+OTtX0Q==}
+  happy-dom@21.0.1:
+    resolution: {integrity: sha512-pRBs/u9fhrncyByOl58DMex0R2uAj6ZPKWIjV5j5yNGZBqLw3P6BTRhlc0DD5b/Ht4/6JYTMuE2LJhUWRC6SGw==}
     engines: {node: '>=20.0.0'}
 
   has-bigints@1.1.0:
@@ -5012,7 +5012,7 @@ snapshots:
       picocolors: 1.1.1
       redent: 3.0.0
     optionalDependencies:
-      vitest: 5.0.4(@types/node@26.6.4)(@vitest/coverage-istanbul@5.0.4)(@vitest/ui@5.0.4)(happy-dom@20.14.6)(jsdom@27.4.0)(vite@8.3.4(@types/node@26.6.4)(jiti@2.7.0))
+      vitest: 5.0.4(@types/node@26.6.4)(@vitest/coverage-istanbul@5.0.4)(@vitest/ui@5.0.4)(happy-dom@21.0.1)(jsdom@27.4.0)(vite@8.3.4(@types/node@26.6.4)(jiti@2.7.0))
 
   '@testing-library/react@16.3.3(@testing-library/dom@10.4.2)(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.1(react@19.3.1))(react@19.3.1)':
     dependencies:
@@ -5364,7 +5364,7 @@ snapshots:
       magicast: 0.5.5
       obug: 3.0.0
       tinyrainbow: 3.2.0
-      vitest: 5.0.4(@types/node@26.6.4)(@vitest/coverage-istanbul@5.0.4)(@vitest/ui@5.0.4)(happy-dom@20.14.6)(jsdom@27.4.0)(vite@8.3.4(@types/node@26.6.4)(jiti@2.7.0))
+      vitest: 5.0.4(@types/node@26.6.4)(@vitest/coverage-istanbul@5.0.4)(@vitest/ui@5.0.4)(happy-dom@21.0.1)(jsdom@27.4.0)(vite@8.3.4(@types/node@26.6.4)(jiti@2.7.0))
 
   '@vitest/istanbul-lib-coverage@1.0.2': {}
 
@@ -5409,7 +5409,7 @@ snapshots:
       pathe: 2.0.3
       sirv: 3.0.2
       tinyrainbow: 3.2.0
-      vitest: 5.0.4(@types/node@26.6.4)(@vitest/coverage-istanbul@5.0.4)(@vitest/ui@5.0.4)(happy-dom@20.14.6)(jsdom@27.4.0)(vite@8.3.4(@types/node@26.6.4)(jiti@2.7.0))
+      vitest: 5.0.4(@types/node@26.6.4)(@vitest/coverage-istanbul@5.0.4)(@vitest/ui@5.0.4)(happy-dom@21.0.1)(jsdom@27.4.0)(vite@8.3.4(@types/node@26.6.4)(jiti@2.7.0))
 
   '@vitest/utils@5.0.4':
     dependencies:
@@ -6431,7 +6431,7 @@ snapshots:
 
   graceful-fs@4.2.11: {}
 
-  happy-dom@20.14.6:
+  happy-dom@21.0.1:
     dependencies:
       '@types/node': 26.6.4
       '@types/whatwg-mimetype': 3.0.2
@@ -7859,7 +7859,7 @@ snapshots:
       - utf-8-validate
       - yaml
 
-  vitest@5.0.4(@types/node@26.6.4)(@vitest/coverage-istanbul@5.0.4)(@vitest/ui@5.0.4)(happy-dom@20.14.6)(jsdom@27.4.0)(vite@8.3.4(@types/node@26.6.4)(jiti@2.7.0)):
+  vitest@5.0.4(@types/node@26.6.4)(@vitest/coverage-istanbul@5.0.4)(@vitest/ui@5.0.4)(happy-dom@21.0.1)(jsdom@27.4.0)(vite@8.3.4(@types/node@26.6.4)(jiti@2.7.0)):
     dependencies:
       '@types/chai': 5.2.3
       '@vitest/mocker': 5.0.4(vite@8.3.4(@types/node@26.6.4)(jiti@2.7.0))
@@ -7879,7 +7879,7 @@ snapshots:
       '@types/node': 26.6.4
       '@vitest/coverage-istanbul': 5.0.4(vitest@5.0.4)
       '@vitest/ui': 5.0.4(vitest@5.0.4)
-      happy-dom: 20.14.6
+      happy-dom: 21.0.1
       jsdom: 27.4.0
     transitivePeerDependencies:
       - msw