Change Request — dependency fix needing a real code change (patch duty 2026-09-09).
Problem
@tiptap/core and its ~35-package extension family are on 3.22.4–3.30.3 and carry GHSA-cp6q-959q-f8rh (medium — mergeAttributes() turns an own __proto__ key into inherited executable DOM attributes). It was not fixable in the lockfile-only patch-duty PR (#157) because:
- The fix needs
@tiptap/core ≥ 3.30.4 and @tiptap/extension-code-block-lowlight at 3.31.3, which npm audit flags as a breaking change.
- The whole
@tiptap/* set versions together, so this is a coordinated ~35-package bump that must be verified against the block editor UI, not force-pinned via overrides.
Ask
Bump the full @tiptap/* family to the patched line (≥3.30.4 core / 3.31.3 lowlight), then verify the editor renders + behaves (marks, lists, tables, code blocks, images) before merge.
Not in scope of this issue
image-size (high) — no upstream fix exists yet; tracked as accepted until a patched release ships.
Found during weekly patch duty. Docs PR: #157.
Change Request — dependency fix needing a real code change (patch duty 2026-09-09).
Problem
@tiptap/coreand its ~35-package extension family are on 3.22.4–3.30.3 and carry GHSA-cp6q-959q-f8rh (medium —mergeAttributes()turns an own__proto__key into inherited executable DOM attributes). It was not fixable in the lockfile-only patch-duty PR (#157) because:@tiptap/core≥ 3.30.4 and@tiptap/extension-code-block-lowlightat 3.31.3, whichnpm auditflags as a breaking change.@tiptap/*set versions together, so this is a coordinated ~35-package bump that must be verified against the block editor UI, not force-pinned viaoverrides.Ask
Bump the full
@tiptap/*family to the patched line (≥3.30.4 core / 3.31.3 lowlight), then verify the editor renders + behaves (marks, lists, tables, code blocks, images) before merge.Not in scope of this issue
image-size(high) — no upstream fix exists yet; tracked as accepted until a patched release ships.Found during weekly patch duty. Docs PR: #157.