chore(deps): update dependency happy-dom to v20.8.9 [security] (#298)

* chore(deps): update dependency happy-dom to v20.8.9 [security]

* Fix an error caused by no-downgrade policy

* Add more context on tinyexec@1.2.2

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: IzumiSy <beetle-noise@gmx.com>

Author: renovate[bot]

packages/core/package.json

@@ -76,7 +76,7 @@
     "@types/react": "catalog:",
     "@types/react-dom": "catalog:",
     "@vitejs/plugin-react": "catalog:",
-    "happy-dom": "^20.6.2",
+    "happy-dom": "^20.9.0",
     "postcss": "^8",
     "react": "catalog:",
     "react-dom": "catalog:",

pnpm-lock.yaml

@@ -61,6 +61,11 @@ trustPolicyExclude:
   # while 5.1.0 was published via GitHub Actions with provenance. Fixed in v5.2.0.
   # See: https://github.com/reduxjs/reselect/issues/752
   - "reselect@5.1.1"
+  # tinyexec@1.2.1+ was published via npm's staged publishing, which loses
+  # Trusted Publisher metadata due to an npm bug. pnpm sees this as a trust
+  # downgrade (trusted publisher → provenance only) even though provenance is present.
+  # See: https://github.com/tinylibs/tinyexec/issues/136
+  - "tinyexec@1.2.2"
 
 # Save exact versions when adding dependencies
 saveExact: true