Skip to content

chore(deps): bump @tiptap/core from 3.29.0 to 3.30.5 - #6134

Open
dependabot[bot] wants to merge 1 commit into
unstablefrom
dependabot/npm_and_yarn/tiptap/core-3.30.5
Open

chore(deps): bump @tiptap/core from 3.29.0 to 3.30.5#6134
dependabot[bot] wants to merge 1 commit into
unstablefrom
dependabot/npm_and_yarn/tiptap/core-3.30.5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 9, 2026

Copy link
Copy Markdown
Contributor

Bumps @tiptap/core from 3.29.0 to 3.30.5.

Release notes

Sourced from @​tiptap/core's releases.

v3.30.5

@​tiptap/core

Patch Changes

  • Fix a denial-of-service risk where crafted block or inline Markdown attributes could consume excessive CPU and block the browser or server event loop.

v3.30.4

@​tiptap/core

Patch Changes

  • Prevent untrusted HTML attributes from changing an object's prototype when merged with mergeAttributes.

v3.30.3

@​tiptap/extension-text-style

Patch Changes

  • Unsetting one text style inside a blockquote no longer removes the other text styles in it.

@​tiptap/extension-youtube

Patch Changes

  • YouTube live URLs (/live/<id>) now embed the video.

@​tiptap/core

Patch Changes

  • Fix JSX runtime to properly render nested sibling elements by spreading children arrays into DOMOutputSpec

@​tiptap/react

Patch Changes

  • Fix ReactNodeViewRenderer crash when contentComponent is not available

@​tiptap/ai-toolkit

Minor Changes

  • Add the AiInsertReveal extension (@tiptap/ai-toolkit/streaming-reveal) to fade in text as the AI streams it into a collaborative document.

v3.30.2

@​tiptap/core

Patch Changes

... (truncated)

Changelog

Sourced from @​tiptap/core's changelog.

3.30.5

Patch Changes

  • d0d499b: Fix a denial-of-service risk where crafted block or inline Markdown attributes could consume excessive CPU and block the browser or server event loop.
    • @​tiptap/pm@​3.30.5

3.30.4

Patch Changes

  • 01d7af8: Prevent untrusted HTML attributes from changing an object's prototype when merged with mergeAttributes.
    • @​tiptap/pm@​3.30.4

3.30.3

Patch Changes

  • 965a880: Fix JSX runtime to properly render nested sibling elements by spreading children arrays into DOMOutputSpec
    • @​tiptap/pm@​3.30.3

3.30.2

Patch Changes

  • 3dffed5: Keep mixed JSX children as separate siblings in DOM output.
  • 214a140: Fixed a bug where editor.chain and editor.can can not be accessed on editor initialization
    • @​tiptap/pm@​3.30.2

3.30.1

Patch Changes

  • abc8828: Added new ProseMirror helpers that check whether a value is a specific ProseMirror type.
    • @​tiptap/pm@​3.30.1

3.30.0

Minor Changes

  • 0247d39: ListKeymap now registers a Tab shortcut that sinks a top-level textblock into the previous list's last item. Pressing Tab at the start of a paragraph right after a bullet/ordered/task list moves the paragraph inside the last list item. The handler does nothing when the cursor is already inside a list item (sinkListItem keeps working), when there is no list before the paragraph, when the caret is mid-textblock, or when the selection is not a text selection (for example a gap cursor).

    @tiptap/core also exposes a new getPreviousBlockSibling($pos) helper that returns the block-level sibling before the cursor's textblock, or null at the first child of the block parent.

  • 3099eef: New Decorations API

    Finally the decorations API is here! Even though Decorations itself are nothing new in ProseMirror, the new API makes it much easier to use them in Tiptap without leaving your extensions.

    Decorations change how the document looks without changing the document itself. Highlighting search results, marking spelling mistakes, showing collaborator cursors, putting a drag handle next to every block.

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump @tiptap/core from 3.29.0 to 3.30.5
98c77a4 
Bumps [@tiptap/core](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/core) from 3.29.0 to 3.30.5.
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.30.5/packages/core/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.30.5/packages/core)

---
updated-dependencies:
- dependency-name: "@tiptap/core"
  dependency-version: 3.30.5
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Sep 9, 2026
@dependabot dependabot Bot mentioned this pull request Sep 9, 2026
Closed
@rtibblesbot

rtibblesbot commented Sep 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🟡 Waiting for changes

Last updated: 2026-09-09 03:48 UTC

rtibblesbot
rtibblesbot reviewed Sep 9, 2026
View reviewed changes

@rtibblesbot rtibblesbot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PR #6134 — @tiptap/core 3.29.0 → 3.30.5 (production dependency, minor + patches within 3.x). Low semver risk, no breaking changes in range. CI passing (frontend tests, asset build, browser smoke test, linting).

Security fixes — the reason to merge:

  • GHSA-j95f-988m-3j2f (HIGH) — quadratic ReDoS in block/inline Markdown attribute parsing; affects >= 3.7.0, < 3.30.5.
  • GHSA-cp6q-959q-f8rh (MODERATE) — mergeAttributes() turns an own __proto__ key into inherited executable DOM attributes; affects >= 2.0.0-alpha.0, < 3.30.4. Studio calls mergeAttributes on attributes parsed from stored channel content (extensions/Image.js:42, extensions/Math.js:30, extensions/SmallTextExtension.js:29).

Both advisories list @tiptap/core as the only affected package, so the core-only bump is complete remediation.

Other changes in range: 3.30.0 adds a Decorations API and getPreviousBlockSibling($pos); 3.30.1 adds ProseMirror type guards; 3.30.2/3.30.3 fix editor.chain/editor.can on init and JSX-runtime sibling rendering. All additive — nothing Studio uses changes behaviour. The 3.30.0 ListKeymap Tab-sink change lives in @tiptap/extension-list-keymap, which stays at 3.29.0 and so does not land here.

suggestion — peer mismatch: tiptap pins peers exactly. @tiptap/extension-link@3.29.0 and @tiptap/vue-2@3.29.0 require '@tiptap/core': 3.29.0 (pnpm-lock.yaml:1712, :1788), and @tiptap/core@3.30.5 requires '@tiptap/pm': 3.30.5 (:1624) while the lockfile has only @tiptap/pm@3.29.0. Nothing breaks today (core is backward compatible within 3.x), but CI's silence is not evidence: install logs Lockfile is up to date, resolution step is skipped, and pnpm only reports peer issues during resolution. Merge for the fix, then follow with a bump of the whole @tiptap/* set to 3.30.5.

suggestion — .github/dependabot.yml: the existing tiptap group is why this arrived as a lone package — groups apply to version updates only unless a group sets applies-to: security-updates. Adding that entry would make future tiptap security bumps land as one coherent PR. Out of scope here.

@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly

How was this generated?

Ran a dependency-update review pipeline over the version bump:

  • Classified the bump by semver (patch / minor / major) and dependency type (production vs. development)
  • Extracted the changelog and release notes across the version range
  • Assessed compatibility with this project's usage and whether any code changes are required
  • Treated CI as the primary safety net
  • Scaled the review depth to the update's risk
  • Chose the verdict from semver risk, changelog findings, and CI status

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@rtibblesbot rtibblesbot rtibblesbot left review comments
Reviewers whose approvals may not affect merge requirements

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@rtibblesbot