[dependabot]

Upgrade the test-only happy-dom dependency from 20.9.0 to 21.0.4, including the security fixes for ESM compilation, redirects and cross-origin isolation. Keep the hardened default that disables external CSS and iframe loading; no loading opt-ins are introduced.

Refresh the lockfile against current main, including the merged Undici security update #531.

The required full pre-push run exposed an existing Chromium source-edit test race unrelated to happy-dom: the periodic selection refresh could replace a transient save-error message before the assertion observed it. Assert the retained real iframe validation response with a changed field, the disabled Save control and its explanation instead. The checks for zero apply requests, unchanged source bytes and the runtime-mutated preview remain. No product behavior or source-edit authorization is changed.

Validation: full repository typecheck, lint and all 11 package test tasks passed through the normal pre-push hook. Desktop: 211 test files and 3,043 tests passed; 2 opt-in integration files / 12 tests skipped. UI tests passed with happy-dom 21.0.4. Current remote checks are attached to the latest head.

[github-actions]

Findings

• [Minor] Unrelated test change bundled into this dependency bump with no explanation in the PR body — apps/desktop/src/renderer/src/components/SourceEditPanel.browser.test.ts:1089-1102 rewrites the save-block assertions, but that test drives a real Chromium via puppeteer-core + Vite preview server (SourceEditPanel.browser.test.ts:1-8), so a happy-dom major bump cannot affect it. Dependabot does not edit test sources, so this change came from somewhere else and makes the dependency diff harder to audit/roll back.
  Suggested fix / next action: state in the PR body why the assertion rewrite is required here (e.g. unrelated flake fix), or move it to its own PR and keep #530 to packages/ui/package.json + pnpm-lock.yaml only.

Questions

• Does packages/ui (or the root Vitest config) rely on happy-dom's CSS/iframe file loading, or on the now-deprecated disableCSSFileLoading setting? happy-dom 21.0.0 disables CSS and iframe loading by default for SSRF hardening (per the release notes in the PR body) and deprecates disableCSSFileLoading. I could not locate the Vitest config for @open-codesign/ui in the reviewed context, so I could not verify whether any test depends on the old default.
• After this change, is the "source could not be verified" save-block path still covered by a test that asserts that specific reason text? The rewrite now asserts changed from its source plus a disabled save control instead of the previous could not be verified message.

Summary

Review mode: initial

Dev-only dependency bump (happy-dom ^20.9.0 → ^21.0.4 in packages/ui/package.json:32), MIT-licensed and not shipped, so it does not affect the ≤30 prod-dependency budget or the permissive-license constraint for distributed code. The lockfile update is internally consistent: packages/ui importer, all vitest snapshots, the new buffer-image-size@0.6.4 entry, and the transitive ws 8.20.0 → 8.22.2 dedupe all line up, and no release/packaging files are touched, so no changeset is needed.

Residual risk: happy-dom 21.0.0 is a breaking major that changes default CSS/iframe loading and deprecates disableCSSFileLoading; the package's own test suite is the only place that would notice, and CI results were not visible in this review. Non-blocking polish: split or explain the SourceEditPanel.browser.test.ts rewrite.

Testing

Not run (automation). Suggested: pnpm --filter @open-codesign/ui test and pnpm test to confirm the major bump does not change DOM/CSS behavior relied on by existing tests, plus pnpm lint && pnpm typecheck.

Open-CoDesign Bot