[dependabot]

Bumps jsdom from 29.1.1 to 30.1.2.

Release notes

Sourced from jsdom's releases.

v30.1.2

• Updated URLs to support Unicode v18.0.0 in internationalized domain names.
• Reduced package size and memory use for CSS property definitions. (@​scttcper)
• Fixed severe slowdowns when building large DOM trees, including SVG charts with D3, which regressed in v30.1.0. (@​cmdcolin)
• Fixed exponentially slow reads of empty inherited CSS custom properties in deeply nested documents, and custom properties incorrectly inheriting past an initial reset. (@​scttcper)
• Fixed getComputedStyle() returning stale results after editing stylesheet declarations, selectors, or media queries, including in imported stylesheets.
• Fixed selector matching and computed styles after changes to form control checkedness, indeterminacy, selection, values, and validity, including during form resets and canceled clicks.
• Fixed computed styles for :focus, :focus-visible, :focus-within, and selectors containing them after focus changes, including inside focus and blur listeners. (@​asamuzaK)
• Fixed element.focus() incorrectly focusing elements hidden by 'display', including through shadow hosts and slots, and elements excluded by shadow DOM slot assignment. (@​asamuzaK)
• Fixed getComputedStyle() throwing for elements without inline-style support, including XML and MathML elements.
• Fixed a memory leak where stylesheet parsing retained the last parsed stylesheet's window after window.close().
• Fixed memory growth from long-lived MutationObserver instances retaining bookkeeping for garbage-collected nodes. (@​scttcper)
• Fixed retained select.selectedOptions collections becoming stale after selection changes and form resets.
• Fixed rejection of negative CSS sizing values, including for 'min-width', 'min-height', 'max-width', and 'max-height', which regressed in v30.1.0.
• Fixed handling of deeply nested color-mix() expressions, including exceptions during color resolution. (@​asamuzaK)

v30.1.1

• Fixed spurious window blur and focusout events and incorrect event.relatedTarget values when focusing an element after removing the previously focused element, which regressed in v30.1.0. (@​asamuzaK)
• Fixed focus and blur behavior across frames, and focusing the document's viewport through document.documentElement.focus(). (@​asamuzaK)
• Fixed focus targets removed or disabled by blur listeners becoming active, and text selections made by focus and blur listeners being overwritten. (@​asamuzaK)
• Fixed element.focus() incorrectly focusing disabled form controls and <input type="hidden"> elements with tabindex="". (@​scttcper)
• Fixed invalid style.setProperty() calls changing existing !important priorities, serialized styles, or mutation records. (@​FedgeNo)
• Fixed !important handling when updating CSS longhands after shorthands, using variables or CSS-wide keywords, and assigning style properties directly. (@​FedgeNo)
• Fixed <noscript> parsing with includeNodeLocations: true or inside frames to honor the runScripts option.
• Fixed the storageQuota option being ignored by frames.
• Fixed encoding detection of HTML and XML byte input to honor XML encoding declarations and detect UTF-16 without a byte order mark.
• Fixed exceptions caused by truncated charset parameters in <meta> elements, and encoding detection incorrectly using incomplete <meta> tags. (@​FedgeNo)
• Fixed XML serialization errors for namespaces named constructor, toString, __proto__, or "null", and incorrect reuse of namespace prefixes declared on sibling elements.
• Fixed element.innerHTML and element.outerHTML in XML documents to reject invalid characters in attribute values and avoid stack overflows on large strings.
• Fixed selector matching for :lang(), :nth-child(... of ...) after mutations, and :has() with duplicate IDs or nested logical pseudo-classes. (@​asamuzaK)

v30.1.0

jsdom is feeling the AGI!

This release is dedicated to @​scttcper, who unleashed @​codex upon jsdom and found tons of performance improvements. Along the way, he found and fixed many correctness issues as well.

We really appreciate his thoughtful PRs, which did a great job following the project's contribution guidelines, and were clearly human-curated, with their PR descriptions edited to be brief and respectful of the maintainers' time.

Thanks to @​scttcper, as well as all the other contributors of this release (most of whom were AI-assisted).

• Added named access to elements on document, such as document.myForm for <form name="myForm">. (@​vojtisprime11)
• Added QuotaExceededError, including its use for storage quota errors and oversized crypto.getRandomValues() requests.
• Added support for the relaxed DOM naming rules when creating elements, attributes, and document types.
• Improved performance of DOM construction, tree mutations, range operations, and live collection access, especially on large documents. (@​scttcper, @​erezrokah)
• Improved performance of getComputedStyle(), style changes, and CSS serialization. (@​scttcper, @​jhult)
• Improved performance of event dispatch, form control and label lookups, and updates to <select> elements and radio button groups. (@​scttcper)
• Reduced memory use when creating and working with DOM nodes, attributes, event listeners, and mutation observers. (@​scttcper)
• Changed window.close() to preserve access to the document and its DOM through retained references.
• Fixed element.querySelectorAll() returning no matches when the first part of the selector matches the element itself, which regressed in v30.0.0. (@​asamuzaK)
• Fixed case sensitivity in CSS attribute selectors, including selectors matching data-state="", title="", and other case-sensitive values. (@​asamuzaK)

... (truncated)

Commits

• a23bfb7 30.1.2
• 64a75d2 Update dependencies and dev dependencies
• 7bf9653 Invalidate styles after CSSOM and control state changes
• fe9009c Update focused area handling
• a8d28b3 Release windows retained by stylesheet parsing
• 05a2c01 Deduplicate generated CSS property metadata
• 1efa190 Reduce generated CSS property data
• a372e12 Avoid Document named-property rebuilds after irrelevant tree mutations
• b2cd235 Update css-color
• 0542d2b Release idle MutationObserver bookkeeping
• Additional commits viewable in compare view

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clawhub	Ready	Preview	Oct 12, 2026 3:24am UTC

[clawsweeper]

Codex review: needs changes before merge.

What this changes

This PR upgrades the development-only jsdom dependency from 29.1.1 to 30.1.2 and refreshes its locked dependencies.

Example: A jsdom XMLHttpRequest sends GET data:text/plain,hello.

• Before: jsdom 29 adapts Undici 7 callbacks and completes the response with hello.
• After: jsdom 30 receives incompatible callbacks from the overridden Undici 7 dependency, leaving the request pending.

Review scores

Measure	Result	What it means
Overall readiness	🦪 silver shellfish (2/6)	The upgrade has clear maintenance value but contains a verified transport incompatibility.
Proof confidence	🌊 off-meta tidepool	Not applicable: This Dependabot maintenance PR is outside the ordinary contributor proof gate; the Vercel preview does not exercise the development-only jsdom transport, and CI does not disprove the source-verified callback mismatch.
Patch quality	🦪 silver shellfish (2/6)	1 actionable review finding remain.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Developers benefit from current browser-emulation fixes and performance improvements in the test environment.
Reason: Maintaining the existing test dependency is worthwhile once its transport remains compatible; the patch adds no product option or permission.

Merge readiness

⛔ Needs changes before merge - 1 item remains

Keep this PR open: main still uses jsdom 29.1.1, and the proposed upgrade retains the previously reported transport incompatibility.

Priority: P3
Reviewed head: 3bac790b62cea7850a87ed7df44e2c02c74fb1c8

Before merge

• Resolve jsdom 30 with its supported Undici dependency (P2) - The unchanged global override forces this new jsdom 30.1.2 dependency to use Undici 7.29.1 instead of its declared ^8.11.2. Undici 7 request() supplies onConnect/onHeaders callbacks, whereas jsdom 30 removed the adapter present in jsdom 29 and emits onRequestStart/onResponseStart. An XMLHttpRequest GET to data:text/plain,hello therefore remains pending rather than completing. Adjust dependency resolution while retaining the CLI's patched Undici 7 dependency. This previously reported finding remains present at the same reviewed head.

Findings

• [P2] Resolve jsdom 30 with its supported Undici dependency — package.json:179

Provenance

• jsdom transitive dependency refresh: original intent not found (unknown: The partial host provenance was extended with scoped dependency history and upstream versioned source; no separate ClawHub intent was found for the replaced transitive versions.)

Tests

• Missing end-to-end proof: No supplied scenario demonstrates XMLHttpRequest completion with jsdom 30 under the workspace's actual resolved transport.

Agent review details

How this fits together

Vitest uses jsdom as its default browser environment; jsdom delegates XMLHttpRequest operations to an Undici dispatcher, while workspace dependency overrides determine the installed transport version.

flowchart TD
  A[Workspace dependency pins] --> B[Bun dependency resolution]
  B --> C[Vitest browser environment]
  C --> D[jsdom XMLHttpRequest]
  D --> E[jsdom dispatcher]
  E --> F[Undici request callbacks]

Loading

Technical review

Best possible solution:

Resolve jsdom 30 with a supported Undici transport while preserving the CLI's patched Undici 7 dependency and Node compatibility.

Do we have a high-confidence way to reproduce the issue?

The transport failure is source-reproducible: XMLHttpRequest awaits Undici request(), but jsdom 30 emits callback names absent from the resolved Undici 7 handler; no target code was executed.

Is this the best way to solve the issue?

The dependency upgrade is useful, but its current resolution is incorrect; separating supported transport versions is safer than globally upgrading the CLI transport or adding an application-level workaround.

Full review comments:

• [P2] Resolve jsdom 30 with its supported Undici dependency — package.json:179
  The unchanged global override forces this new jsdom 30.1.2 dependency to use Undici 7.29.1 instead of its declared ^8.11.2. Undici 7 request() supplies onConnect/onHeaders callbacks, whereas jsdom 30 removed the adapter present in jsdom 29 and emits onRequestStart/onResponseStart. An XMLHttpRequest GET to data:text/plain,hello therefore remains pending rather than completing. Adjust dependency resolution while retaining the CLI's patched Undici 7 dependency. This previously reported finding remains present at the same reviewed head.
  Confidence: 0.99

Overall correctness: patch is incorrect
Overall confidence: 0.98

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 5e8aec56d146.

Provenance checked

• Exact jsdom dependency pin keeps the original intent (7e1e2f0: Fix local dev seeding, redirects, and package pinning #2169 deliberately pinned direct dependency specifications for repeatable resolution.)
• Undici compatibility boundary keeps the original intent (4f0abcd: The historical repair explicitly retained Undici's Node 20 compatible major; subsequent maintenance updated the patched 7.x pin.)

Testing

Proof path: none.

Security

None.

Evidence

Acceptance criteria:

• bun install --frozen-lockfile
• bunx vitest run src/tests/jsdom-transport.test.ts
• bun run ci:static
• bun run ci:unit
• bun run ci:types-build

What I checked:

• Introduced dependency mismatch: The pinned introduction diff upgrades jsdom to 30.1.2. Its lock entry requires Undici ^8.11.2, but the global override and only resolved Undici entry remain 7.29.1. (bun.lock:1451, 3bac790b62ce)
• Current-main behavior: Current main retains jsdom 29.1.1 and Undici 7.29.1; Vitest selects jsdom by default. The upgrade is not implemented on main. (package.json:180, 5e8aec56d146)
• Dependency contract and policy applicability: This PR installs jsdom, and its correctness depends on jsdom's transport contract. At v30.1.2, xhr-utils calls dispatcher.request; JSDOMDispatcher forwards handlers without the WrapHandler adapter present in v29.1.1, and stream-handler emits only the new callback names. The dependency's full root AGENTS.md was read; contribution and test-execution instructions do not require modifying or executing that repository during this review. (lib/jsdom/browser/resources/jsdom-dispatcher.js:72, a23bfb72b5a3)
• Resolved transport callback contract: jsdom imports and extends the overridden Undici Dispatcher. Undici 7.29.1 request() passes RequestHandler directly to dispatch; that handler implements onConnect/onHeaders/onData/onComplete/onError rather than jsdom 30's callback names. No root AGENTS.md exists at the inspected tag. (lib/api/api-request.js:201, d39a83e7b0d6)
• Intent behind retaining Undici 7: Feature history includes an explicit Node 20 compatibility repair retaining Undici 7, subsequent audited pin updates, and exact dependency pinning in Fix local dev seeding, redirects, and package pinning #2169; replacing every workspace transport with Undici 8 would disregard that compatibility boundary. (package.json, 4f0abcdac17a)
• Static failure is shared outside this diff: The static check reports identical Next.js, KaTeX, and DOMPurify audit annotations on chore(deps): bump mermaid from 11.16.1 to 12.1.0 #3863, whose static job is https://github.com/openclaw/clawhub/actions/runs/38199461473/job/114649397617. This PR changes none of those resolved packages, so the audit repair is not attributed to this upgrade. (bun.lock, 96c83947e7ff)

Review metrics

Metric	Value	Why it matters
Patch size	+22/-26 across 2 dependency files	The change is narrowly scoped to the manifest and lockfile, with no production-source or test additions.

Labels

Label changes:

No label changes.

Label justifications:

• P3: This is development dependency maintenance with no demonstrated production-user outage.
• merge-risk: 🚨 compatibility: The upgrade combines jsdom 30's new dispatcher callback contract with an overridden Undici 7 implementation.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🌊 off-meta tidepool and patch quality is 🦪 silver shellfish.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

History

Review history (34 earlier review cycles; latest 8 shown)

• reviewed 2026-10-08T12:51:37.603Z sha d0e5af6 :: blocked before merge. :: none
• reviewed 2026-10-08T19:35:30.289Z sha d0e5af6 :: blocked before merge. :: none
• reviewed 2026-10-09T01:17:05.883Z sha d0e5af6 :: blocked before merge. :: none
• reviewed 2026-10-09T06:57:33.201Z sha d0e5af6 :: blocked before merge. :: none
• reviewed 2026-10-10T13:34:09.724Z sha d0e5af6 :: blocked before merge. :: none
• reviewed 2026-10-12T03:28:05.656Z sha 3bac790 :: needs changes before merge. :: [P2] Resolve jsdom 30 with its supported Undici dependency
• reviewed 2026-10-12T05:06:58.433Z sha 3bac790 :: needs changes before merge. :: [P2] Resolve jsdom 30 with its supported Undici dependency
• reviewed 2026-10-13T05:44:06.629Z sha 3bac790 :: needs changes before merge. :: [P2] Resolve jsdom 30 with its supported Undici dependency

Reviewed October 13, 2026, 12:44 PM ET / 16:44 UTC (Revision 35).

[dependabot]

Superseded by #3943.