build(deps-dev): bump jsdom from 29.0.2 to 29.1.1

[dependabot]

Bumps jsdom from 29.0.2 to 29.1.1.

Release notes

Sourced from jsdom's releases.

v29.1.1

• Fixed 'border-radius' computed style serialization. (@​asamuzaK)
• Fixed computed style computation when using 'background-origin' and 'background-clip' CSS properties. (@​asamuzaK)
• Significantly optimized initial calls to getComputedStyle(), before the cache warms up. (@​asamuzaK)

v29.1.0

• Added basic support for the ratio CSS type. (@​asamuzaK)
• Fixed getComputedStyle() sometimes returning outdated results after CSS was modified. (@​asamuzaK)

Commits

• 9b9ea7e 29.1.1
• 07efb78 Optimize computed style comparison
• 5f66329 Fix background-origin/background-clip in background shorthand
• ad8af77 Fix border shorthand handling
• 5a3e88e 29.1.0
• 73db204 Update dependencies and dev dependencies
• a7168a5 Support ratio CSS unit type
• 15346e0 Fix style cache invalidation
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Note

Low Risk
Dev-only dependency bump with no production or security-sensitive application code changes.

Overview
Bumps the dev dependency jsdom from 29.0.2 to 29.1.1 in injected/package.json, with the lockfile refreshed for jsdom and its transitive packages (e.g. parse5, lru-cache, undici, @csstools/css-syntax-patches-for-csstree).

This is a patch/minor tooling update only; runtime extension code is unchanged. Tests that use JSDOM (e.g. DOM metadata, page-context markdown, web-detection) may see improved getComputedStyle() behavior and CSS computed-style fixes from upstream jsdom releases.

^{Reviewed by Cursor Bugbot for commit 67bd5d1. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Suggested comment for Cursor review (copy and paste as a new comment):

@cursoragent can you review against the current code and outline potential impacts based on the changelogs of the update?

Can you check the test coverage and ensure that the new code is covered?
Can you think through if this dependency is still needed or if there's better practices used elsewhere.

Can you draft a separate PR with any fixes that might be needed?

Note: GitHub Actions bot cannot trigger Cursor agent directly. Please copy the above comment to invoke the review.

[cursor]

Web Compatibility Assessment

No web-compatibility findings. This PR only bumps the injected workspace devDependency jsdom from 29.0.2 to 29.1.1 and updates its lockfile transitive set; it does not change bundled injected source, wrapper utilities, API shims, messaging, config handling, DOM mutation logic, or platform entry points.

Release-note impact is limited to jsdom test behavior: v29.1.0 adds basic CSS ratio type support and fixes stale getComputedStyle() after CSS mutation; v29.1.1 fixes computed style serialization for border-radius/background-origin/background-clip and optimizes initial getComputedStyle() calls. Those can affect DOM/CSS unit-test expectations, but not page-world runtime behavior.

Security Assessment

No PR-introduced security findings. jsdom remains a devDependency used by injected unit tests only (web-detection, page-context-dom, and dom-metadata specs), so the bump does not add injected runtime code, captured-global usage, bridge/origin handling changes, or new data-exfiltration surface.

Risk Level

Low Risk: dependency-only dev/test change with no shipped injected runtime surface and no changes to security-sensitive modules.

Recommendations

• Keep the dependency: it is still directly used by injected unit tests that construct DOM fragments without a browser process.
• If reducing test dependency surface becomes a goal later, the alternative is moving those DOM-fragment assertions to a browser/Playwright-backed helper, but that is heavier and not needed for this bump.

Verification: npm ci, npm run build --workspace=injected, and npm run test-unit --workspace=injected all pass (929 specs, 0 failures, 16 pending).

  

_{Sent by Cursor Automation: Web compat and sec}

[cursor]

Dependency risk assessment for jsdom 29.0.2 -> 29.1.1: no blocking concerns found.

Evidence checked:

• Diff only changes injected/package.json and package-lock.json; jsdom remains an injected devDependency.
• Upstream release notes/compare show CSSOM-focused changes: style cache invalidation, ratio CSS units, background-origin/background-clip, border-radius serialization, and getComputedStyle() optimization.
• Local code search found jsdom only in injected unit tests: web-detection, page-context-dom, and dom-metadata. No production bundle/runtime dependency found.
• Focused local validation passed: npx jasmine --config=unit-test/config.json unit-test/dom-metadata.spec.js unit-test/page-context-dom.spec.js unit-test/web-detection.js => 118 specs, 0 failures.
• The full local npm run test-unit --workspace=injected failure was limited to missing generated build artifacts in this workspace; the PR CI has injected/special-pages unit and integration jobs green.
• Supply-chain pass: jsdom license/engine/maintainers are unchanged; lockfile includes registry integrities; no install lifecycle scripts found for jsdom or the newly introduced/changed transitive packages checked. npm audit still reports existing unrelated dev-tree issues, but none matched the changed jsdom/parse5/entities/undici/@asamuzakjp packages.

Residual risk:

• The update touches getComputedStyle() and selector/CSS parsing behavior, so regressions would most likely show up in DOM/CSS-dependent tests rather than production code. The direct consumers passed.
• The Build Release Branch check failure appears to be a git push/network failure (HTTP 408), not a dependency/build failure.

No separate fix PR opened because I did not find a required fix.

  

_{Sent by Cursor Automation: Review dependabot}