From 507bfc8fa326b39a1345ce4a046b2e75c5b210dc Mon Sep 17 00:00:00 2001 From: hell Date: Sun, 25 Oct 2026 22:02:48 +0700 Subject: [PATCH] build(deps-dev): bump happy-dom to 21.0.4; run the lockfile fix in a fork happy-dom 20.14.6 -> 21.0.4 closes GHSA-834v-8h66-3h79 (code injection in the ESM compiler). It is the vitest DOM only, never shipped. The major turns CSS and iframe loading off by default; the suite does not rely on either, 318/318 pass. Supersedes Dependabot's #3, whose lockfile dropped the dev flags on 86 packages. That drop is what dependabot-lockfile-fix.yml exists to repair, but its `!head.repo.fork` guard is true for every branch of a repository that is itself a fork, so the job never ran here. Compare the head repository with the base repository instead, which is what the guard meant. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/dependabot-lockfile-fix.yml | 5 ++++- src/dispatch/static/dispatch/package-lock.json | 8 ++++---- src/dispatch/static/dispatch/package.json | 2 +- 3 files changed, 9 insertions(+), 6 deletions(-) diff --git a/.github/workflows/dependabot-lockfile-fix.yml b/.github/workflows/dependabot-lockfile-fix.yml index 9adae7655caf..dddad631e1ea 100644 --- a/.github/workflows/dependabot-lockfile-fix.yml +++ b/.github/workflows/dependabot-lockfile-fix.yml @@ -35,9 +35,12 @@ jobs: # GitHub's documented way out: it runs in the base repo's context with the # permissions above. That context is also why nothing below may execute # code from the PR -- see --ignore-scripts on the regenerate step. + # Compare repositories, not `head.repo.fork`: that flag is true for every + # branch of a repository that is itself a fork, which would skip this job + # on all of Dependabot's PRs there. if: >- github.event.pull_request.user.login == 'dependabot[bot]' && - !github.event.pull_request.head.repo.fork + github.event.pull_request.head.repo.full_name == github.repository runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 diff --git a/src/dispatch/static/dispatch/package-lock.json b/src/dispatch/static/dispatch/package-lock.json index fa377d907370..051a2fa32aaa 100644 --- a/src/dispatch/static/dispatch/package-lock.json +++ b/src/dispatch/static/dispatch/package-lock.json @@ -74,7 +74,7 @@ "eslint-plugin-vue": "^10.11.1", "eslint-plugin-vuetify": "^2.7.3", "globals": "^17.13.0", - "happy-dom": "^20.14.6", + "happy-dom": "^21.0.4", "husky": "^9.1.7", "lint-staged": "^17.6.0", "prettier": "^3.9.10", @@ -5649,9 +5649,9 @@ "license": "MIT" }, "node_modules/happy-dom": { - "version": "20.14.6", - "resolved": "https://registry.npmjs.org/happy-dom/-/happy-dom-20.14.6.tgz", - "integrity": "sha512-5DDsf4QmEIlRL6NkCv/fxSjYHHkZceL/IaYQdJc2h3G7DRTEai++VTjbfL0LB9geW2VrA3+vrjF3Efx+OTtX0Q==", + "version": "21.0.4", + "resolved": "https://registry.npmjs.org/happy-dom/-/happy-dom-21.0.4.tgz", + "integrity": "sha512-tFm+GaLBgo6o0awHnvHaNoraVo27qJ+2tZEtZ+cIa08hXbeitrxAJajLI05hsUy/2/YTKcUjQYzHe5mCcraLBw==", "dev": true, "license": "MIT", "dependencies": { diff --git a/src/dispatch/static/dispatch/package.json b/src/dispatch/static/dispatch/package.json index 8855bf6bf7ea..5ed8ca58ffc1 100644 --- a/src/dispatch/static/dispatch/package.json +++ b/src/dispatch/static/dispatch/package.json @@ -88,7 +88,7 @@ "eslint-plugin-vue": "^10.11.1", "eslint-plugin-vuetify": "^2.7.3", "globals": "^17.13.0", - "happy-dom": "^20.14.6", + "happy-dom": "^21.0.4", "husky": "^9.1.7", "lint-staged": "^17.6.0", "prettier": "^3.9.10",