chore(deps): update dependency jsdom to v29

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
jsdom	^28.1.0 → ^29.0.0

---

Release Notes

jsdom/jsdom (jsdom)

v29.0.0

Compare Source

Breaking changes:

• Node.js v22.13.0+ is now the minimum supported v22 version (was v22.12.0+).

Other changes:

• Overhauled the CSSOM implementation, replacing the @acemir/cssom and cssstyle dependencies with fresh internal implementations built on webidl2js wrappers and the css-tree parser. Serialization, parsing, and API behavior is improved in various ways, especially around edge cases.
• Added CSSCounterStyleRule and CSSNamespaceRule to jsdom Windows.
• Added cssMediaRule.matches and cssSupportsRule.matches getters.
• Added proper media query parsing in MediaList, using css-tree instead of naive comma-splitting. Invalid queries become "not all" per spec.
• Added cssKeyframeRule.keyText getter/setter validation.
• Added cssStyleRule.selectorText setter validation: invalid selectors are now rejected.
• Added styleSheet.ownerNode, styleSheet.href, and styleSheet.title.
• Added bad port blocking per the fetch specification, preventing fetches to commonly-abused ports.
• Improved Document initialization performance by lazily initializing the CSS selector engine, avoiding ~0.5 ms of overhead per Document. (thypon)
• Fixed a memory leak when stylesheets were removed from the document.
• Fixed CSSStyleDeclaration modifications to properly trigger custom element reactions.
• Fixed nested @media rule parsing.
• Fixed CSSStyleSheet's "disallow modification" flag not being checked in all mutation methods.
• Fixed XMLHttpRequest's response getter returning parsed JSON during the LOADING state instead of null.
• Fixed getComputedStyle() crashing in XHTML documents when stylesheets contained at-rules such as @page or @font-face.
• Fixed a potential hang in synchronous XMLHttpRequest caused by a race condition with the worker thread's idle timeout.

---

Configuration

📅 Schedule: Branch creation - "before 5am" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate using a curated preset maintained by . View repository job log here

[claude]

Claude finished @renovate[bot]'s task in 1m 9s —— View job

---

jsdom v28 → v29 Upgrade Review

• Identify breaking changes in jsdom v29
• Search codebase for jsdom usages
• Verify compatibility of each usage
• Check peer dependencies and build tooling
• Post findings

---

Summary

All usages are compatible with jsdom v29. No code changes needed.

Breaking Changes in v29

Change	Impact on this repo
Node.js v22.13.0+ minimum (was v22.12.0+)	None — minor patch bump
CSSOM overhaul (replaced @acemir/cssom/cssstyle)	None — no CSS manipulation in this codebase
Bad port blocking per fetch spec	None — http://localhost:3333/ uses a safe port
XMLHttpRequest.response fix during LOADING state	None — no XHR usage in stubs
getComputedStyle() XHTML crash fix	None — not used

Codebase Usage (packages/@sanity/cli-core/src/util/environment/stubs.ts)

The sole jsdom consumer creates a JSDOM instance with two options:

const dom = new JSDOM(html, {
  pretendToBeVisual: true,       // unchanged in v29
  url: 'http://localhost:3333/', // port 3333 is not a bad port
})

APIs accessed from dom.window — EventTarget, AbortSignal, document, requestIdleCallback, cancelIdleCallback, ResizeObserver, IntersectionObserver, matchMedia — all remain unchanged in v29.

The collectBrowserStubs() function dynamically enumerates all window properties, so new globals added by v29 (CSSCounterStyleRule, CSSNamespaceRule, etc.) are automatically included — a benefit, not a concern.

Verdict

Safe to merge. ✓

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​jsdom@​29.0.0

View full report

[github-actions]

Coverage Delta

No covered files changed in this PR.

Overall Coverage

Metric	Coverage
Statements	83.0% (±0%)
Branches	72.7% (±0%)
Functions	83.2% (±0%)
Lines	83.5% (±0%)

[rexxars]

Node.js v22.13.0+ is now the minimum supported v22 version (was v22.12.0+).

I wasn't aware that it was previously v22.12.0 - we should probably make sure to raise our range to match :/