🤖 tests: pin happy-dom to 20.0.11 so its MutationObserver patch keeps applying

[ThomasK33]

Summary

This PR pins happy-dom to 20.0.11, the version that patches/happy-dom@20.0.11.patch (#6344) names. It also adds a Bun test that fails when happy-dom's MutationObserver stops reporting after a garbage collection. If a later version bump drops the patch, CI fails instead of the #5989 flake coming back silently. Fixes #6348.

Background

package.json allowed ^20.0.10. bun applies a patchedDependencies entry only while the installed version matches its key, and it says nothing when the key no longer matches. I checked this in a scratch project with the repo's patch, under bun 1.3.12, and again under bun 1.4.3 (main's pin since #6319), with the same result:

happy-dom in package.json	Installed	bun install	Patch applied
20.0.11	20.0.11	exit 0	yes
20.1.0 (key still happy-dom@20.0.11)	20.1.0	exit 0, no warning	no: the WeakRef bug is back

So a lockfile update inside the old range brought back the GC flake without any signal.

Implementation

• Pin, not upgrade. Upstream holds the callback strongly from 20.11.15 on (20.11.0 does not). But every version after 20.0.11 also changes MutationObserver delivery: since 20.4.0 it is a microtask instead of a debounced setTimeout. The 20.x and 21.x releases bring many other DOM changes. happy-dom is also a runtime dependency (src/node/services/tools/web_fetch.ts). Upgrading is the larger and riskier change, so I left it out of this PR.
• Guard test, src/browser/happyDomMutationObserver.test.ts (Bun unit lane): it observes a node, runs a full GC, appends a child, and expects one batch of records. It checks behavior, not a version string, so an upgrade to a fixed upstream version passes it without the patch.

Validation

The guard test, run against each MutationObserverListener.js:

File	Result
unpatched 20.0.11	fails: 0 batches (0/5 runs passed in a scratch prototype)
patched 20.0.11 (this PR)	passes (3/3 runs)
upstream 20.14.6	passes

• After the rebase onto main with bun 1.4.3: bun install --frozen-lockfile applies the patch (the installed file matches the 1.3.12 result byte for byte), the guard test passes 3/3 and fails on the unpatched file.
• make static-check passed.
• bun test ./src/node/services/tools/web_fetch.test.ts ./src/browser/happyDomMutationObserver.test.ts passed.

Risks

Low. The installed version does not change (bun.lock already resolved 20.0.11). Only the range in package.json and the workspace entry in bun.lock change.

---

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-13T19:58:25.934177Z	0591a75	New commits
🔒 Security Review	✅ Completed 2026-10-13T20:00:28.202719Z	0591a75	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[ThomasK33]

Perf clearance (perf owner): cleared at 74c2c9de4b.

• The head matches git ls-remote. The merge base is ed2b16a12f.
• Changed files: bun.lock 1/1, package.json 1/1, src/browser/happyDomMutationObserver.test.ts 29/0.
• bun.lock resolves happy-dom@20.0.11 with the same integrity hash on main and on this head, so the installed package does not change. The new file is a Bun test outside the renderer bundle.

A new head needs a new clearance.

---

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high

[ThomasK33]

Readiness record for head 74c2c9d:

• CI: all required checks passed on this head.
• Reviews: one Codex normal review and one Codex security review, both on this head with no findings. No review threads.
• Final independent check (clean-context sub-agent): READY. It listed three follow-ups. My dispositions:
  1. "The test waits a fixed 10 ms." Rejected: happy-dom 20.0.11 delivers records from a 0 ms timer that it schedules at the append. Node fires an earlier-expiring timer first, so the 10 ms timer cannot fire before the delivery, whatever the load. Upstream 20.4.0+ delivers in a microtask, which is earlier still.
  2. "Confirm CI installs with --frozen-lockfile." Confirmed: .github/actions/setup-xum/action.yml runs bun install --frozen-lockfile.
  3. "Drop the patch and the pin on a later upgrade to 20.11.15+." This needs no tracking: the test comment says it, and the test passes without the patch on such a version.

---

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high

[ThomasK33]

Perf clearance (perf owner): cleared at the new head 0591a75dc1. It replaces my clearance of 74c2c9de4b.

• The head matches git ls-remote. The merge base is bf7f0c8dc3.
• Changed files: bun.lock 1/1, package.json 1/1, src/browser/happyDomMutationObserver.test.ts 29/0. Same content as before.
• bun.lock resolves happy-dom@20.0.11 with the same integrity hash on the merge base and on this head, so the installed package does not change.

A new head needs a new clearance.

---

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high