[baealex]

🎯 Goal

• Resolve all six open frontend Dependabot alerts without changing application contracts or database schema.
• Keep vulnerable direct and transitive packages on patched, peer-compatible versions.

🔧 Core Changes

• Raise the declared Tiptap package-family floor from ^3.27.3 to ^3.30.5; the lockfile resolves the aligned family to 3.31.3.
• Upgrade browserslist from 4.28.5 to 4.28.7 for GHSA-73wf-gq98-2v4g and GHSA-c83g-rgw3-j3cx (high).
• Upgrade baseline-browser-mapping from 2.10.42 to 2.11.0 for GHSA-w5vr-8v7q-w6rv (moderate).
• Upgrade js-yaml from 4.3.1 to 4.3.2 for GHSA-2883-xcg3-v3hh (high).
• Resolve the Tiptap advisories GHSA-j95f-988m-3j2f (high) and GHSA-cp6q-959q-f8rh (moderate).

🤔 Key Decisions

• Update the complete Tiptap family together because partially pinning @tiptap/core produced peer-dependency mismatches with bubble-menu and floating-menu extensions.
• Declare ^3.30.5 as the first safe Tiptap floor while retaining the peer-compatible 3.31.3 resolution in the lockfile.
• Use workspace overrides for vulnerable transitive build dependencies and avoid unrelated top-level dependency upgrades.
• Treat the Tiptap update as a small integration risk despite remaining within 3.x; perform a manual editor smoke test before deployment.

🧪 Verification Guide

How to verify

1. Run pnpm install --frozen-lockfile from backend/islands.
2. Run pnpm test, pnpm lint, pnpm type-check, and pnpm build.
3. Run pnpm peers check and pnpm audit --audit-level=moderate.
4. Manually smoke-test editor input, Markdown conversion, and bubble/floating menus before deployment.

Expected result

• All 24 Islands tests pass.
• Lint passes with eight pre-existing warnings and no errors.
• Type checking and the production build pass.
• Peer checking reports no dependency issues, and pnpm audit reports no known vulnerabilities.
• Editor input, Markdown conversion, and bubble/floating menus behave as before.

✅ Checklist

• Lint completed
• Type-check completed
• Tests completed
• Production build completed
• Dependency and peer audits completed
• Documentation updated (not needed: dependency-only patch)
• Manual editor smoke test before deployment