chore(deps): bump happy-dom to 21, biome to 2.6, bun to 1.4.4

Merged
UG
3d ago
+44-36

Closes #26

Summary

Fixes two Socket alerts on happy-dom@20.14.6, which packages/react pulls in through @happy-dom/global-registrator (a dev dependency):

AdvisoryAffectedFixed in
SSRF via iframe and link stylesheet when parsing untrusted HTML<= 20.14.621.0.0
Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution17.0.0 to 21.0.321.0.4

No 20.x release has these fixes, so this takes the major bump to ^21.0.4.

Also bumps:

  • @biomejs/biome from 2.5.15 to 2.6.6
  • @types/bun to ^1.4.4
  • packageManager to bun@1.4.4 (root, packages/kirari, packages/compat)

Biome 2.6 follow-ups

Biome 2.6 adds rules that flagged existing code:

  • noComponentHookFactories (error): the Streamed test components in packages/react/test/hook.test.tsx and stream.test.tsx were defined inside functions and now live at module level. The hook test passes its handle in as a prop.
  • noDynamicNamespaceImportAccess (warning): the compat tests compare exports with Object.entries and Reflect.get instead of indexing the namespace.
  • useLiteralKeys (info): one fix in scripts/check-packages.ts.
  • The $schema URL in biome.json now points at 2.6.6. Only that line changed, since biome migrate reformats the whole file.

Testing

  • bun run typecheck, bun run test and bun run check all pass.
  • The react package tests pass on happy-dom 21.
  • These runs used bun 1.3.4 locally, not the newly pinned 1.4.4; CI covers 1.4.4.

Summary by cubic

Bumps happy-dom to 21.0.4 to fix two Socket security alerts in packages/react (SSRF via iframe and link stylesheet, and host code execution via unsanitized import alias), and bumps @biomejs/biome to 2.6.6, @types/bun to ^1.4.4, and the pinned bun to 1.4.4.

Biome 2.6 follow-ups

  • The Streamed test components move to module level for the new noComponentHookFactories rule; the hook test passes its handle as a prop instead.
  • The compat tests compare exports with Object.entries and Reflect.get instead of dynamic namespace access.
  • One useLiteralKeys fix in scripts/check-packages.ts and the biome.json schema URL now point at 2.6.6.

Summary by CodeRabbit

  • Chores
    • Updated Bun, Biome, and the browser-testing environment to newer versions.
    • Refreshed package manager version declarations across the relevant packages.
    • Adjusted package compatibility checks and test setup; no end-user functionality changes are noted.