A test DOM that stopped loading by default
A grouped minor and patch update lands with a major version of the test DOM, which stops loading stylesheets and iframes unless it is told to.
Two dependency updates landed on the same day. The first is a grouped minor and patch update across twelve packages, from the error-reporting SDK and Playwright to Storybook and svelte-check. The second is a major version of happy-dom, the DOM the unit tests run in, and it changes a default that matters for anything that loads external resources.
Twelve packages, one review#
The grouped update keeps each package within its current major version. Its diff is limited to package.json and pnpm-lock.yaml, with no application code changed alongside it, the same shape as the earlier package refresh.
The default that changed#
happy-dom moves from 20 to 21 in the same review, and the major version is the one that matters:
happy-dom 20.14.6 → 21.0.3Version 21 turns off CSS and iframe loading by default. The upstream release notes give the reason as a general server-side request risk: when a library fetches resources referenced by HTML it did not write, it can be made to send requests it should not. Loading can be switched back on with the enableCSSFileLoading and enableIframePageLoading settings, and the notes list them as the way to keep the previous behaviour.
Nothing in the suite waits on it#
The repository’s tests and test configuration load neither stylesheets nor iframes. A search of the test files and the Vitest configuration matches only a code comment, so the changed default has nothing to act on in the suite. What reaches the game is the version range and the lockfile entry, the same kind of change as the refresh before it.
If a later test needs a stylesheet or an iframe, the setting to enable it is documented upstream, and that test would have to turn it on explicitly. Dependabot will keep opening grouped updates like this one, and a major version of a test DOM will get the same reading of its release notes before it merges.