chore(deps-dev): bump happy-dom from 14.12.3 to 15.10.2

[dependabot]

Bumps happy-dom from 14.12.3 to 15.10.2.

Release notes

Sourced from happy-dom's releases.

v15.10.2

👷‍♂️ Patch fixes

• Fixes a security vulnerability that allowed for server side code to be executed by a <script> tag - By @​capricorn86 in task #1585
  • There was a case that was missed with the first patch

v15.10.1

👷‍♂️ Patch fixes

• Fixes a security vulnerability that allowed for server side code to be executed by a <script> tag - By @​capricorn86 in task #1585

v15.10.0

🎨 Features

• Adds a new setting called disableSameOriginPolicy that makes it possible to bypass the same-origin policy in fetch requests - By @​OlaviSau in task #1553

v15.9.0

🎨 Features

• Adds support for "aspect-ratio" to CSSStyleDeclaration - By @​yinm in task #1147

v15.8.5

👷‍♂️ Patch fixes

• Fixes bug where Node.getRootNode() returned null when it was within a ShadowRoot that previously been disconnected from the Document - By @​capricorn86 in task #1581

v15.8.4

👷‍♂️ Patch fixes

• Fixes bug where child nodes of HTMLSelectElement and HTMLFormElement had the wrong reference to the parent - By @​capricorn86 in task #1578

Commits

• d23834c fix: #1585 Fixes a security vulnerability that allowed for server side code...
• 5ee0b16 fix: #1585 Fixes security vulnerability that allowed for server side code t...
• a20dba9 chore: #1542 Adds SECURITY.md file (#1584)
• 1625d40 feat: #1553 Adds setting disableSameOriginPolicy, to make it possible to by...
• a78cd8f feat: #1147 Adds support for aspect-ratio to CSSStyleDeclaration (#1537)
• e6f8b13 fix: #1581 Fixes bug where Node.getRootNode() returned null when it was wi...
• 38ab960 fix: #1578 Fixes bug where child nodes of HTMLSelectElement and HTMLFormEle...
• 8f74989 fix: #1534 Toggle open attribute on HTMLDetailsElement when dispatching a c...
• 7f57469 fix: #1546 Use globalThis instead of global to make Happy DOM work in o...
• 759b4fb fix: #1538 Always return Promise<Blob> from ClipboardItem.getType() (#1539)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Important

Bumps happy-dom from 14.12.3 to 15.10.2 with security fixes and new features.

• Dependency Update:
  • Bumps happy-dom from 14.12.3 to 15.10.2 in package.json.
• Security Fixes:
  • Fixes security vulnerability allowing server-side code execution via <script> tag.
• New Features:
  • Adds disableSameOriginPolicy setting to bypass same-origin policy in fetch requests.
  • Supports aspect-ratio in CSSStyleDeclaration.

^{This description was created by for a475415. You can customize this summary. It will automatically update as commits are pushed.}

Disclaimer: Experimental PR review

Greptile Summary

This PR updates the happy-dom dependency from version 14.12.3 to 15.10.2 in the root package.json file. Happy DOM is a lightweight DOM implementation used as the test environment for Vitest in this monorepo, providing browser-like APIs for unit testing without requiring an actual browser.

The update includes critical security patches that fix vulnerabilities allowing server-side code execution through <script> tags (versions 15.10.1 and 15.10.2). Additionally, it introduces new features like a disableSameOriginPolicy setting for bypassing same-origin policy in fetch requests during testing, and support for the aspect-ratio CSS property in CSSStyleDeclaration.

Since happy-dom is listed in devDependencies, this change only affects the development and testing environment. The Langfuse JS SDK monorepo uses this package to provide DOM APIs during test execution, particularly for the various packages (langfuse-core, langfuse-node, langfuse, etc.) that may need to simulate browser behavior in their test suites.

Confidence score: 4/5

• This PR is safe to merge with minimal risk as it only updates a development dependency used for testing
• Score reflects the security-focused nature of the update and the fact that it's a testing-only dependency
• Pay attention to test execution to ensure the major version bump doesn't introduce breaking changes in the test environment

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Updated (UTC)
langfuse-js	✅ Ready (Inspect)	Visit Preview	Aug 8, 2025 3:58pm

[greptile-apps]

_{1 file reviewed, no comments}

_{Edit Code Review Bot Settings | Greptile}