[helldweller]

What

• happy-dom 20.14.6 → 21.0.4 in the frontend devDependencies. Closes GHSA-834v-8h66-3h79 (high: code injection in happy-dom's ESM compiler). happy-dom is only the DOM behind vitest --dom; it is not part of the built UI or the image. The major disables CSS and iframe loading by default; nothing in the suite depends on either: vitest run --dom 318/318 locally with this lock.
• .github/workflows/dependabot-lockfile-fix.yml: the job guards against running with a write token on PRs from forks via !github.event.pull_request.head.repo.fork. In a repository that is itself a fork (this one is a fork of Netflix/dispatch) that flag is true for every branch, so the repair never ran here and every Dependabot frontend PR fails npm-lock-sync and lockfileDevFlags.spec.js. Compare head.repo.full_name with github.repository instead, which is what the guard meant.

Why not just merge Dependabot's #3

Its lockfile was written by Dependabot's own updater and drops "dev": true on 86 packages, so check-lock-dev-flags.mjs fails and so does the spec that wraps it. This PR carries the same bump with a lockfile regenerated by npm (npm install --ignore-scripts happy-dom@21.0.4): 8 lines change in package-lock.json, dev flags consistent, npm ci --dry-run in sync. #3 can be closed once this is in.

Also done outside git: the labels Jamyn's dependabot.yml and enforce-labels.yml expect (maintenance, security, ci, breaking-change, docker, github-actions, javascript, dependencies) now exist in this repository, so Dependabot PRs stop failing enforce-label.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

Although the change is correct and low-risk, it modifies a security-sensitive pull_request_target workflow holding a write token, which warrants human confirmation before approval.

No open issues 🎉

1 file not reviewed

• src/dispatch/static/dispatch/package-lock.json: Generated file

What changed in this PR

This PR bumps the frontend dev-dependency happy-dom from 20.14.6 to 21.0.4 to close GHSA-834v-8h66-3h79 (code injection in happy-dom's ESM compiler), and fixes the dependabot-lockfile-fix workflow guard so it actually runs in a repository that is itself a fork. happy-dom only backs vitest --dom, so it is not part of the shipped UI or image, and the major-version default changes (CSS/iframe loading off) don't affect the test suite.

Changes:

• Bump happy-dom to ^21.0.4 in package.json and regenerate the matching package-lock.json entry (npm-written lockfile with dev flags intact).
• Replace the !github.event.pull_request.head.repo.fork guard with head.repo.full_name == github.repository, since the fork flag is always true on branches of a fork repository and would wrongly skip every Dependabot PR.

File	Description
src/​dispatch/​static/​dispatch/​package.json	Updates the happy-dom devDependency range to ^21.0.4.
src/​dispatch/​static/​dispatch/​package-lock.json	Updates the resolved happy-dom version, URL, and integrity to 21.0.4; transitive deps already satisfy the new ranges and dev: true is retained.
.github/​workflows/​dependabot-lockfile-fix.yml	Switches the fork guard to a head.repo.full_name == github.repository comparison so the repair job runs on Dependabot PRs in a fork-of-upstream repo while still excluding external forks.

Verification notes:

• The new workflow guard is the canonical secure pattern for pull_request_target: same-repo (Dependabot) PRs run, external-fork PRs are excluded, and the job still checks out head.sha with persist-credentials: false and --ignore-scripts, so no PR code executes with the write token.
• The lockfile change is internally consistent: entities@7.0.1, @types/ws, buffer-image-size, whatwg-mimetype, and @types/whatwg-mimetype are all present and satisfy happy-dom 21's ranges, and the dev-flag gate (check-lock-dev-flags.mjs) expectations are preserved.
• No other references to the happy-dom version exist in the repo, and the test setup (src/tests/setup.js) does not rely on CSS/iframe loading disabled by the major bump.

_{Review effort: Balanced}