chore(deps): bump the patch-and-minor group with 34 updates

[dependabot]

Bumps the patch-and-minor group with 34 updates:

Package	From	To
playwright	1.62.1	1.63.0
tsx	4.23.12	4.23.13
@anthropic-ai/sdk	0.117.1	0.124.0
hono	4.13.2	4.13.7
zod	4.4.3	4.5.4
@types/node	26.2.0	26.4.1
@types/pg	8.21.0	8.23.1
@tiptap/core	3.30.4	3.31.3
@tiptap/extension-code-block-lowlight	3.30.4	3.31.3
@tiptap/extension-details	3.30.4	3.31.3
@tiptap/extension-document	3.30.4	3.31.3
@tiptap/extension-highlight	3.30.4	3.31.3
@tiptap/extension-image	3.30.4	3.31.3
@tiptap/extension-link	3.30.4	3.31.3
@tiptap/extension-paragraph	3.30.4	3.31.3
@tiptap/extension-placeholder	3.30.4	3.31.3
@tiptap/extension-table	3.30.4	3.31.3
@tiptap/extension-table-cell	3.30.4	3.31.3
@tiptap/extension-table-header	3.30.4	3.31.3
@tiptap/extension-table-row	3.30.4	3.31.3
@tiptap/extension-task-item	3.30.4	3.31.3
@tiptap/extension-task-list	3.30.4	3.31.3
@tiptap/extension-text	3.30.4	3.31.3
@tiptap/extension-underline	3.30.4	3.31.3
@tiptap/pm	3.30.4	3.31.3
@tiptap/react	3.30.4	3.31.3
@tiptap/starter-kit	3.30.4	3.31.3
@tiptap/suggestion	3.30.4	3.31.3
dompurify	3.4.13	3.4.14
lucide-react	1.31.0	1.41.0
next	16.3.1	16.3.4
postcss	8.5.26	8.5.28
@types/react-dom	19.2.4	19.2.7
eslint-config-next	16.3.1	16.3.4

Updates playwright from 1.62.1 to 1.63.0

Release notes

Sourced from playwright's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits

• 1b025d7 chore: mark v1.63.0 (#42569)
• 0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
• 13dbf10 cherry-pick(#42552): docs: release notes for v1.63
• e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
• 2b7a5f2 test: response.body() for content-encoding:identity (#42537)
• 648a67c fix(mcp): create parent directories for explicitly named files (#42540)
• 7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
• 52900a1 devops: restore npm publishing from GitHub Actions (#42550)
• 8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
• bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
• Additional commits viewable in compare view

Updates tsx from 4.23.12 to 4.23.13

Release notes

Sourced from tsx's releases.

v4.23.13

4.23.13 (2026-08-30)

Bug Fixes

• cache: bound shared transform cache memory (#835) (28e1f12)

---

This release is also available on:

• npm package (@​latest dist-tag)

Commits

• 28e1f12 fix(cache): bound shared transform cache memory (#835)
• See full diff in compare view

Updates @anthropic-ai/sdk from 0.117.1 to 0.124.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk: v0.124.0

0.124.0 (2026-09-04)

Full Changelog: sdk-v0.123.0...sdk-v0.124.0

Features

• api: add Claude Tag category and user breakdowns to usage reports (669ff22)
• api: add named types for organization compliance settings state (54be8da)
• api: add support for sending a workspace ID on more endpoints (a11e6f1)

Bug Fixes

• repair custom-code merge in messages resources (#455) (7ac43b9)
• tools: create agent-toolset files and directories owner-only (#485) (a9c2298)

Chores

• internal: bundle the mock server spec and update breaking-change detection (8752d02)
• internal: codegen related update (a63afbc)
• tests: reword the skip reason on the path-level query param tests (999bee5)

Documentation

• api: update a few doc strings (2ef3d59)

sdk: v0.123.0

0.123.0 (2026-09-01)

Full Changelog: sdk-v0.122.0...sdk-v0.123.0

Features

• api: beta user profiles: add external_user_onboarded_at, remove relationship in favor of access_type (3efb1a1)
• api: manual updates (c6f0bda)
• api: organization compliance settings, user-profile order_by, memory-store and toolset schema updates (8e2f0c2)

Bug Fixes

• keep credential file access out of non-Node bundles (ab6a4b2)

Chores

• internal: codegen related update (788ea8b)

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.124.0 (2026-09-04)

Full Changelog: sdk-v0.123.0...sdk-v0.124.0

Features

• api: add Claude Tag category and user breakdowns to usage reports (669ff22)
• api: add named types for organization compliance settings state (54be8da)
• api: add support for sending a workspace ID on more endpoints (a11e6f1)

Bug Fixes

• repair custom-code merge in messages resources (#455) (7ac43b9)
• tools: create agent-toolset files and directories owner-only (#485) (a9c2298)

Chores

• internal: bundle the mock server spec and update breaking-change detection (8752d02)
• internal: codegen related update (a63afbc)
• tests: reword the skip reason on the path-level query param tests (999bee5)

Documentation

• api: update a few doc strings (2ef3d59)

0.123.0 (2026-09-01)

Full Changelog: sdk-v0.122.0...sdk-v0.123.0

Features

• api: beta user profiles: add external_user_onboarded_at, remove relationship in favor of access_type (3efb1a1)
• api: manual updates (c6f0bda)
• api: organization compliance settings, user-profile order_by, memory-store and toolset schema updates (8e2f0c2)

Bug Fixes

• keep credential file access out of non-Node bundles (ab6a4b2)

Chores

• internal: codegen related update (788ea8b)

Documentation

... (truncated)

Commits

• ba14b1f Merge pull request #1177 from anthropics/release-please--branches--main--chan...
• f99c1a7 chore: release main
• 54be8da feat(api): add named types for organization compliance settings state
• 999bee5 chore(tests): reword the skip reason on the path-level query param tests
• a9c2298 fix(tools): create agent-toolset files and directories owner-only (#485)
• 2637d11 chore(examples): refresh platform model IDs (#376)
• 669ff22 feat(api): add Claude Tag category and user breakdowns to usage reports
• a9090af Build SDK
• 8752d02 chore(internal): bundle the mock server spec and update breaking-change detec...
• a63afbc chore(internal): codegen related update
• Additional commits viewable in compare view

Updates hono from 4.13.2 to 4.13.7

Release notes

Sourced from hono's releases.

v4.13.7

Security fixes

This release includes a fix for the following security issue:

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv

---

Users who render untrusted strings inside Suspense, ErrorBoundary, or Context.Provider, or pass them directly to hono/jsx/dom/server, are strongly encouraged to upgrade to this version.

v4.13.6

What's Changed

• fix(client): keep a param value of "index" in $url() and $path() in honojs/hono#5297
• fix(client): normalize root WebSocket URLs in honojs/hono#5291
• fix(types): allow symbol keys in Context get and set fallbacks in honojs/hono#5300
• chore: bump editorconfig-checker in honojs/hono#5336
• refactor(on-handler): use forEach for consistent handler iteration in honojs/hono#5326

Full Changelog: honojs/hono@v4.13.5...v4.13.6

v4.13.5

Security fixes

This release includes fixes for the following security issues:

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

Affects: parseBody() when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfc

---

Users who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use parseBody({ dot: true }) are strongly encouraged to upgrade to this version.

v4.13.4

What's Changed

• fix(request): handle params on unmatched requests in honojs/hono#5268
• fix(jsx/dom): execute previous ref cleanup when ref prop changes on re-render in honojs/hono#5264
• fix(reg-exp-router): associate wildcard middleware with matching routes in honojs/hono#5266
• perf(router): share null object creation in honojs/hono#5267

... (truncated)

Commits

• eebdf7b 4.13.7
• 2b8ed40 Merge commit from fork
• cac0c4d 4.13.6
• dac5d57 refactor(on-handler): use forEach for consistent handler iteration (#5326)
• ec648d6 chore: bump editorconfig-checker (#5336)
• e2740d5 fix(types): allow symbol keys in Context<any> get and set fallbacks (#5300)
• 499c35e fix(client): normalize root WebSocket URLs (#5291)
• 50b8788 fix(client): keep a param value of "index" in $url() and $path() (#5297)
• 06880c4 4.13.5
• 531e9c5 Merge commit from fork
• Additional commits viewable in compare view

Updates zod from 4.4.3 to 4.5.4

Release notes

Sourced from zod's releases.

v4.5.4

Commits:

• 84e416fbf4740527bbc8f319634f4e1b065bb42c fix(v4): stop the cycle walk from firing a default factory (#6500)
• e8e206fa33ac5fe7ce20a2beb12d57b1cb3df653 4.5.4

v4.5.3

Commits:

• e6b6ab347675cd2bd54b1bdbed16f98c59be82a9 docs(blog): widen the z.compile example to a 20-property schema
• 87d6464418582bb96fc665a01f852ca6da324ad0 fix(docs): drop the OG description when the title wraps past two lines
• 99fce394a026823e602b9c30d8d5d9f5f1932ce7 bench(v4): z.compile() against zod-compiler (#6499)
• e3a695b6bf3f0d591ea682816e3cdaea04b0f967 docs(v4): record the email regex and container output-shape findings under Open
• 7e24a24288183ce02554f1ded7775d0650a7b7e6 docs(blog): drop the reading time and put a GitHub link in the navbar
• eab51ff3592b2d11d863f4ee4d5452f31a3de1b6 fix(v4): emit record numeric keys as strings in toJSONSchema (#6497)

v4.5.2

Commits:

• a354314ac04fdd5484aa62dd5c3a4b553211a0e4 fix(docs): keep blog posts out of the docs collection (#6484)
• d378c42aff6869f0929058a7923cd775880f5c4c ci: drop canary publishing from the release workflow (#6487)
• 212b941791e7faae078e17645eb612824fd8f79a fix(v4): let a prototype method getter answer a bare call so vi.spyOn works (#6488)
• e7576f542a7bc7ef3cc5eeec237714fd0e6b6e98 docs(blog): let the page show through the navbar in dark mode (#6489)
• fedb06fafe33a66ce0b5c236ad2557e0a5a170fe fix(docs): match the blog TOC hover bar to the 2px active indicator
• 6c932fcb2eea6eb671710ea058ca9fdc382ada89 chore: bump devcontainer image to Node 24 (#6470)
• 6635d9dd367a664109de83c021995821f48efa29 docs(blog): soften the "method memoization" attribution
• 019ae299cc75daa132bf1acf59086a520abf6b85 fix(docs): drop ISR on the docs route so the home page hydrates
• 652bb438aa4c626c1cd7948c6849c4691239fca7 chore(docs): drop the scroll log from the route-change scroller
• 571c8e8a3d73b4305f4abfdd6977773cc12f2bf5 fix(docs): render blog tabs with the stock fumadocs tab card
• 9a193aa24b4efa3b315b91d4c56c8bc385b8513f 4.5.2

v4.5.1

Commits:

• 2e862dbf89da2835e5206a8fd3d3be61afe3cf7f ci: gate the GitHub release and JSR publish on the version being live on npm
• 8e03380510db36fa6fda979fc78a375fdea8021c 4.5.1

v4.5.0

Zod 4.5 is now available.

npm install zod@latest

At a glance:

• https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADmhttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADmhttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD — the flagship feature of Zod 4.5
• https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADChttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD — 12–19 digits plus Luhn checksum
• https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADshttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADshttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD — the multi-property counterpart to z.property()
• https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADPhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD/https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADxhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADPhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADxhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD

... (truncated)

Commits

• e8e206f 4.5.4
• 84e416f fix(v4): stop the cycle walk from firing a default factory (#6500)
• 1a16102 4.5.3
• eab51ff fix(v4): emit record numeric keys as strings in toJSONSchema (#6497)
• 7e24a24 docs(blog): drop the reading time and put a GitHub link in the navbar
• e3a695b docs(v4): record the email regex and container output-shape findings under Open
• 99fce39 bench(v4): z.compile() against zod-compiler (#6499)
• 87d6464 fix(docs): drop the OG description when the title wraps past two lines
• e6b6ab3 docs(blog): widen the z.compile example to a 20-property schema
• 9a193aa 4.5.2
• Additional commits viewable in compare view

Updates @types/node from 26.2.0 to 26.4.1

Commits

• See full diff in compare view

Updates @types/pg from 8.21.0 to 8.23.1

Commits

• See full diff in compare view

Updates @tiptap/core from 3.30.4 to 3.31.3

Release notes

Sourced from @​tiptap/core's releases.

v3.31.3

@​tiptap/extension-collaboration-caret

Patch Changes

• Fixed a bug which allowed potentially unsafe color values being sent by other clients. Those unsafe colors received from collaboration users are now ignored.

@​tiptap/react

Patch Changes

• Fix a TypeScript error (TS2694) in the shipped type declarations when skipLibCheck is turned off.

v3.31.2

@​tiptap/pm

Patch Changes

• Bump prosemirror-view to ^1.42.3, which fixes an XSS vulnerability where pasting crafted HTML could run arbitrary JavaScript (GHSA-c8x8-7fp4-3x9w).

v3.31.1

@​tiptap/core

Patch Changes

• Fix freezes in framework-based node views on iOS and Android

v3.31.0

@​tiptap/react

Minor Changes

• e7bf804: Align selected with ProseMirror node selections by default, expose text selections through selectionInside, and keep selectedOnTextSelection compatible.

v3.30.6

@​tiptap/core

Patch Changes

• Nested lists exported to Markdown now keep their hierarchy when the file is read back by other Markdown tools.

@​tiptap/extension-list

Patch Changes

• Nested lists exported to Markdown now keep their hierarchy when the file is read back by other Markdown tools.

@​tiptap/extension-youtube

Patch Changes

... (truncated)

Changelog

Sourced from @​tiptap/core's changelog.

3.31.3

Patch Changes

• @​tiptap/pm@​3.31.3

3.31.2

Patch Changes

• Updated dependencies [c56b4c9]
  • @​tiptap/pm@​3.31.2

3.31.1

Patch Changes

• cd32a2f: Fix freezes in framework-based node views on iOS and Android
  • @​tiptap/pm@​3.31.1

3.31.0

Patch Changes

• @​tiptap/pm@​3.31.0

3.30.6

Patch Changes

• 9f844ab: Nested lists exported to Markdown now keep their hierarchy when the file is read back by other Markdown tools.
  • @​tiptap/pm@​3.30.6

3.30.5

Patch Changes

• d0d499b: Fix a denial-of-service risk where crafted block or inline Markdown attributes could consume excessive CPU and block the browser or server event loop.
  • @​tiptap/pm@​3.30.5

Commits

• 35d2110 chore(release): release new stable release (#8311)
• f38fec0 chore(release): release new stable release (#8304)
• bd35333 chore(release): release new stable release (#8297)
• cd32a2f fix: ignore iOS chrome mutations outside contentDOM (#8221) (#8296)
• 0280f4a chore(release): release new stable release (#8292)
• e7bf804 fix: linting
• 5302fda chore(release): release new stable release (#8264)
• 9f844ab fix(markdown): indent nested list content to the parent marker (#8219) (#8274)
• b0c188b chore(release): release new stable release (#8261)
• d0d499b Merge commit from fork
• See full diff in compare view

Updates @tiptap/extension-code-block-lowlight from 3.30.4 to 3.31.3

Release notes

Sourced from @​tiptap/extension-code-block-lowlight's releases.

v3.31.3

@​tiptap/extension-collaboration-caret

Patch Changes

• Fixed a bug which allowed potentially unsafe color values being sent by other clients. Those unsafe colors received from collaboration users are now ignored.

@​tiptap/react

Patch Changes

• Fix a TypeScript error (TS2694) in the shipped type declarations when skipLibCheck is turned off.

v3.31.2

@​tiptap/pm

Patch Changes

• Bump prosemirror-view to ^1.42.3, which fixes an XSS vulnerability where pasting crafted HTML could run arbitrary JavaScript (GHSA-c8x8-7fp4-3x9w).

v3.31.1

@​tiptap/core

Patch Changes

• Fix freezes in framework-based node views on iOS and Android

v3.31.0

@​tiptap/react

Minor Changes

• e7bf804: Align selected with ProseMirror node selections by default, expose text selections through selectionInside, and keep selectedOnTextSelection compatible.

v3.30.6

@​tiptap/core

Patch Changes

• Nested lists exported to Markdown now keep their hierarchy when the file is read back by other Markdown tools.

@​tiptap/extension-list

Patch Changes

• Nested lists exported to Markdown now keep their hierarchy when the file is read back by other Markdown tools.

@​tiptap/extension-youtube

Patch Changes

... (truncated)

Changelog

Sourced from @​tiptap/extension-code-block-lowlight's changelog.

3.31.3

Patch Changes

• @​tiptap/core@​3.31.3
• @​tiptap/extension-code-block@​3.31.3
• @​tiptap/pm@​3.31.3

3.31.2

Patch Changes

• Updated dependencies [c56b4c9]
  • @​tiptap/pm@​3.31.2
  • @​tiptap/core@​3.31.2
  • @​tiptap/extension-code-block@​3.31.2

3.31.1

Patch Changes

• Updated dependencies [cd32a2f]
  • @​tiptap/core@​3.31.1
  • @​tiptap/extension-code-block@​3.31.1
  • @​tiptap/pm@​3.31.1

3.31.0

Patch Changes

• @​tiptap/core@​3.31.0
• @​tiptap/extension-code-block@​3.31.0
• @​tiptap/pm@​3.31.0

3.30.6

Patch Changes

• Updated dependencies [9f844ab]
  • @​tiptap/core@​3.30.6
  • @​tiptap/extension-code-block@​3.30.6
  • @​tiptap/pm@​3.30.6

3.30.5

Patch Changes

• Updated dependencies [d0d499b]
  • @​tiptap/core@​3.30.5
  • @​tiptap/extension-code-block@​3.30.5

... (truncated)

Commits

• 35d2110 chore(release): release new stable release (#8311)
• f38fec0 chore(release): release new stable release (#8304)
• bd35333 chore(release): release new stable release (#8297)
• 0280f4a chore(release): release new stable release (#8292)
• 5302fda chore(release): release new stable release (#8264)
• b0c188b chore(release): release new stable release (#8261)
• See full diff in compare view

Updates @tiptap/extension-details from 3.30.4 to 3.31.3

Release notes

Sourced from @​tiptap/extension-details's releases.

v3.31.3

@​tiptap/extension-collaboration-caret

Patch Changes

• Fixed a bug which allowed potentially unsafe color values being sent by other clients. Those unsafe colors received from collaboration users are now ignored.

@​tiptap/react

Patch Changes

• Fix a TypeScript error (TS2694) in the shipped type declarations when skipLibCheck is turned off.

v3.31.2

@​tiptap/pm

Patch Changes

• Bump prosemirror-view to ^1.42.3, which fixes an XSS vulnerability where pasting crafted HTML could run arbitrary JavaScript (GHSA-c8x8-7fp4-3x9w).

v3.31.1

@​tiptap/core

Patch Changes

• Fix freezes in framework-based node views on iOS and Android

v3.31.0

@​tiptap/react

Minor Changes

• e7bf804: Align selected with ProseMirror node selections by default, expose text selections through selectionInside, and keep selectedOnTextSelection compatible.

v3.30.6

@​tiptap/core

Patch Changes

• Nested lists exported to Markdown now keep their hierarchy when the file is read back by other Markdown tools.

@​tiptap/extension-list

Patch Changes

• Nested lists exported to Markdown now keep their hierarchy when the file is read back by other Markdown tools.

@​tiptap/extension-youtube

Patch Changes

... (truncated)

Changelog

Sourced from @​tiptap/extension-details's changelog.

3.31.3

Patch Changes

• @​tiptap/core@​3.31.3
• @​tiptap/extension-text-style@​3.31.3
• @​tiptap/pm@​3.31.3

3.31.2

Patch Changes

• Updated dependencies [c56b4c9]
  • @​tiptap/pm@​3.31.2
  • @​tiptap/core@​3.31.2
  • @​tiptap/extension-text-style@​3.31.2

3.31.1

Patch Changes

• Updated dependencies [cd32a2f]
  • @​tiptap/core@​3.31.1
  • @​tiptap/extension-text-style@​3.31.1
  • @​tiptap/pm@​3.31.1

3.31.0

Patch Changes

• @​tiptap/core@​3.31.0
• @​tiptap/extension-text-style@​3.31.0
• @​tiptap/pm@​3.31.0

3.30.6

Patch Changes

• Updated dependencies [9f844ab]
  • @​tiptap/core@​3.30.6
  • @​tiptap/extension-text-styleDescription has been truncated

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.