Bump happy-dom from 20.14.6 to 21.0.3

DE
9h ago
+5-5

Bumps happy-dom from 20.14.6 to 21.0.3.

Release notes

Sourced from happy-dom's releases.

v21.0.3

:construction_worker_man: Patch fixes

  • Fixes security vulnerability where authorization header was forwarded when redirecting - By @​capricorn86

v21.0.2

:construction_worker_man: Patch fixes

v21.0.1

:construction_worker_man: Patch fixes

v21.0.0

:bomb: Breaking Changes

  • Disables CSS and IFrame loading by default to prevent server-side request forgery (SSRF) - By @​capricorn86
    • An attacker could embed <iframe> or <link rel="stylesheet"> elements in untrusted HTML to make Happy DOM send HTTP requests from the server to attacker-chosen URLs, including internal services. This could allow access to otherwise unreachable endpoints or trigger unintended actions, depending on the application and its network access.
    • The settings property disableCSSFileLoading has been deprecated
    • Added the new settings properties enableCSSFileLoading and enableIframePageLoading
Commits
  • 875ef5c fix: Fixes security vulnerability where authorization header was forwarded wh...
  • 1f3ffdf fix: Fixes SSRF security vulnerability by doing a target-origin bypass in the...
  • f55c7e0 chore: Update security documentation (#2509)
  • 2b91e68 fix: Adds alias for enabling CSS and iframe loading in server-renderer (#2503)
  • 0a99c75 BREAKING CHANGE: Disables CSS and IFrame loading by default (#2502)
  • See full diff in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Summary by cubic

Updates happy-dom from 20.14.6 to 21.0.3. This major release disables CSS and iframe loading by default to fix a server-side request forgery (SSRF) vulnerability, and includes two additional server-renderer security fixes.

Migration

  • If stylesheet or iframe page loading is needed, set the new settings enableCSSFileLoading and enableIframePageLoading; disableCSSFileLoading is deprecated.