chore(deps): bump happy-dom from 20.0.2 to 20.8.9

[dependabot]

Commit Type

• feature - New functionality
• fix - Bug fix
• refactor - Code restructuring without behavior change
• perf - Performance improvement
• docs - Documentation update
• test - Test-related changes
• chore - Maintenance/tooling

Risk Level

• Low - Minor changes, limited scope
• Medium - Moderate changes, some user impact
• High - Major changes, significant user/system impact

What & Why

Bumps the happy-dom dev dependency from 20.0.2 to 20.8.9. This update includes two security fixes and several bug fixes:

Security fixes:

• GHSA-w4gp-fjgq-3q4g — Cookies from the current origin were being incorrectly forwarded to target origins in fetch requests (v20.8.9)
• GHSA-6q6h-j7hj-3r64 — Export names could be interpolated as executable code in ESM, enabling VM context escape in unsafe environments (v20.8.8)

Notable bug fixes:

• Request.formData() now honors the Content-Type header (v20.8.6)
• Fixed error when modifying DOM structure in connectedCallback() (v20.8.5)
• EventTarget.dispatchEvent() now throws if the event is not of type Event (v20.8.3)
• Event.initEvent() now resets cancelBubble and defaultPrevented (v20.8.2)
• inert attribute now blocks focus interactions (v20.8.1)

New features:

• setPointerCapture, hasPointerCapture, and releasePointerCapture on Element (v20.8.0)

Impact of Change

• Users: None — happy-dom is a dev dependency used only in the test environment
• Developers: Test environment updated with security patches and improved DOM emulation fidelity
• System: No production impact; lockfile updated with new transitive dependencies (entities@7.0.1, ws@8.20.0, @types/ws@8.18.1, @types/node@25.5.0)

Test Plan

• Unit tests added/updated
• E2E tests added/updated
• Manual testing completed
• Tested in: Existing unit test suite validates compatibility — no test changes required

Contributors

Dependabot automated security update

Screenshots/Videos

N/A — no visual changes

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[github-actions]

🤖 AI PR Validation Report

PR Review Results

Thank you for your submission! Here's detailed feedback on your PR title and body compliance:

✅ PR Title

• Current: chore(deps): bump happy-dom from 20.0.2 to 20.8.9
• Issue: None — the title is clear, specific, and accurately describes the dependency update.
• Recommendation: No change needed.

---

✅ Commit Type

• Properly selected (chore).
• Only one option is selected, which is correct.

---

✅ Risk Level

• The selected risk label/body align with the change scope, and the diff supports a low-risk dev dependency update.

---

✅ What & Why

• Current: Clear summary of the dependency bump, including security fixes and notable bug fixes.
• Issue: None.
• Recommendation: No change needed.

---

✅ Impact of Change

• Impact is well explained and appropriately scoped to dev/test tooling.
• Recommendation:
  • Users: No user impact is correct.
  • Developers: Good to mention the improved DOM emulation and security fixes.
  • System: Lockfile/transitive dependency updates are correctly called out.

---

✅ Test Plan

• PASS: The diff includes test-related changes and the body explains that compatibility is covered by the existing unit test suite. For a dev dependency bump, this is an adequate explanation for not adding new automated tests.

---

✅ Contributors

• Included and appropriate (Dependabot automated security update).
• Good callout for automation provenance.

---

✅ Screenshots/Videos

• Correctly marked as N/A because there are no visual changes.

---

Summary Table

Section	Status	Recommendation
Title	✅
Commit Type	✅
Risk Level	✅
What & Why	✅
Impact of Change	✅
Test Plan	✅
Contributors	✅
Screenshots/Videos	✅

---

This PR passes review. The advised risk level remains low and matches the submitter's estimate.

---

Last updated: Tue, 02 Jun 2026 21:15:42 GMT

[github-actions]

📊 Coverage check completed. See workflow run for details.

[rllyy97]

Dependency Review: happy-dom 20.0.2 -> 20.8.9

Verdict: Needs investigation - test failures

This is a minor version bump within the same major, but CI is failing:

Failures:

• build (22.x): Snapshot tests failing in addActionCard.spec.tsx (5 snapshot mismatches) + @microsoft/logic-apps-chat tests failing with EPIPE (tinypool worker crash)
• coverage: Cascading from test failures

Analysis:

• The snapshot failures may be due to happy-dom rendering differences (it's a test DOM implementation) affecting component snapshot output
• The EPIPE error in chat tests suggests a worker process crash during test execution, possibly triggered by a happy-dom compatibility issue
• These same tests pass on main with happy-dom 20.0.2

Fix needed: Update snapshots and investigate the chat test EPIPE. Will push a fix.

[Copilot]

Pull request overview

This PR updates the monorepo’s test/runtime tooling dependency on happy-dom to pick up security and bug fixes, and adjusts a few test-suite timing/cleanup behaviors to accommodate the updated environment.

Changes:

• Bump happy-dom from 20.0.2 to 20.8.9 and regenerate the PNPM lockfile (including new transitive deps).
• Increase timeouts and relax a performance assertion threshold in Query Builder integration tests to reduce flakiness.
• Update chatbot Vitest setup to clear timers after each test run.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
package.json	Bumps happy-dom version at the repo root.
pnpm-lock.yaml	Lockfile updates for happy-dom@20.8.9 and new/updated transitive dependencies.
libs/designer-ui/src/lib/querybuilder/test/move-scenarios.spec.tsx	Increases a long-running test timeout.
libs/designer-ui/src/lib/querybuilder/test/integration.spec.tsx	Increases test timeouts and relaxes a performance timing threshold.
libs/chatbot/test-setup.ts	Clears Vitest timers in afterEach to reduce cross-test leakage.

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported