Skip to content

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Oct 14, 2025

Bumps @tiptap/starter-kit from 2.14.0 to 3.6.7.

Release notes

Sourced from @​tiptap/starter-kit's releases.

v3.6.7

Releases

v3.6.7

@​tiptap/html

Patch Changes

  • Fix CVE-2025-61927 by bumping happy-dom to 20.0.0

    Bumps the transitive/dev dependency happy-dom from ^18.0.1 → ^20.0.0 in @​tiptap/html to address CVE-2025-61927. This is a dependency/security-only change and does not modify any public APIs.

    Why:

    • happy-dom released a security fix for CVE-2025-61927; updating prevents the vulnerability being pulled into consumers that depend on @​tiptap/html.

v3.6.6

Releases

v3.6.6

@​tiptap/extension-floating-menu

Patch Changes

  • Fixed a problem where the position of a menu is not updated on creation when shouldShow is true

@​tiptap/extension-bubble-menu

Patch Changes

  • Fixed a problem where the position of a menu is not updated on creation when shouldShow is true

@​tiptap/vue-3

Patch Changes

  • Fixed a bug that caused conditionally rendered bubble menus not to be attached to the DOM correctly

v3.6.5

Releases

v3.6.5

@​tiptap/extension-horizontal-rule

Patch Changes

  • Added nextNodeType option to horizontal-rule extension, allowing users to specify which node type should be inserted after a horizontal rule

... (truncated)

Changelog

Sourced from @​tiptap/starter-kit's changelog.

3.6.7

Patch Changes

  • @​tiptap/extension-dropcursor@​3.6.7
  • @​tiptap/extension-gapcursor@​3.6.7
  • @​tiptap/extension-list-item@​3.6.7
  • @​tiptap/extension-list-keymap@​3.6.7
  • @​tiptap/core@​3.6.7
  • @​tiptap/extension-blockquote@​3.6.7
  • @​tiptap/extension-bold@​3.6.7
  • @​tiptap/extension-bullet-list@​3.6.7
  • @​tiptap/extension-code@​3.6.7
  • @​tiptap/extension-code-block@​3.6.7
  • @​tiptap/extension-document@​3.6.7
  • @​tiptap/extension-hard-break@​3.6.7
  • @​tiptap/extension-heading@​3.6.7
  • @​tiptap/extension-horizontal-rule@​3.6.7
  • @​tiptap/extension-italic@​3.6.7
  • @​tiptap/extension-link@​3.6.7
  • @​tiptap/extension-list@​3.6.7
  • @​tiptap/extension-ordered-list@​3.6.7
  • @​tiptap/extension-paragraph@​3.6.7
  • @​tiptap/extension-strike@​3.6.7
  • @​tiptap/extension-text@​3.6.7
  • @​tiptap/extension-underline@​3.6.7
  • @​tiptap/extensions@​3.6.7
  • @​tiptap/pm@​3.6.7

3.6.6

Patch Changes

  • @​tiptap/extension-dropcursor@​3.6.6
  • @​tiptap/extension-gapcursor@​3.6.6
  • @​tiptap/extension-list-item@​3.6.6
  • @​tiptap/extension-list-keymap@​3.6.6
  • @​tiptap/core@​3.6.6
  • @​tiptap/extension-blockquote@​3.6.6
  • @​tiptap/extension-bold@​3.6.6
  • @​tiptap/extension-bullet-list@​3.6.6
  • @​tiptap/extension-code@​3.6.6
  • @​tiptap/extension-code-block@​3.6.6
  • @​tiptap/extension-document@​3.6.6
  • @​tiptap/extension-hard-break@​3.6.6
  • @​tiptap/extension-heading@​3.6.6
  • @​tiptap/extension-horizontal-rule@​3.6.6
  • @​tiptap/extension-italic@​3.6.6
  • @​tiptap/extension-link@​3.6.6
  • @​tiptap/extension-list@​3.6.6

... (truncated)

Commits
  • ca8713b chore(release): publish a new release version (#7075)
  • 89ef4d2 chore(release): publish a new release version (#7061)
  • 82e03b5 chore(release): publish a new release version (#7042)
  • 6f06a69 chore(release): publish a new release version (#7041)
  • 857251a chore(release): publish a new release version (#7038)
  • 5a9580d chore(release): publish a new release version (#7027)
  • daf78ec chore(release): publish a new release version (#7014)
  • ec6a3a7 chore(release): publish a new release version (#7012)
  • 06d0bea chore(release): publish a new release version (#7009)
  • 97a00f8 chore(release): publish a new release version (#7007)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 14, 2025
Copy link

comp-ai-code-review bot commented Oct 14, 2025

🔒 Comp AI - Security Review

🟢 Risk Level: LOW

OSV npm scan found no known vulnerabilities. packages/ui/package.json contains no reported issues in the provided scan output.


📦 Dependency Vulnerabilities

✅ No known vulnerabilities detected in dependencies.


🛡️ Code Security Analysis

✅ No security issues detected in code changes.


💡 Recommendations

View 3 recommendation(s)
  1. Search packages/ui/package.json for plaintext credentials (look for keys like "password", "secret", "token", "apiKey") and remove or refactor any found into runtime configuration used by code, not stored in source JSON.
  2. If packages/ui/package.json defines npm scripts that invoke shell commands, avoid embedding secrets or untrusted input directly in those scripts—move sensitive logic into a validated Node script instead of inline shell concatenation.
  3. Perform a focused code review of packages/ui/* for patterns that could cause injection from concatenated inputs (e.g., building shell commands or eval with unescaped variables) and sanitize/validate inputs in the invoked code paths.

Powered by Comp AI - AI that handles compliance for you. Reviewed Oct 14, 2025

Copy link

vercel bot commented Oct 14, 2025

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Preview Comments Updated (UTC)
app Error Error Oct 14, 2025 5:24pm
portal Error Error Oct 14, 2025 5:24pm

Bumps [@tiptap/starter-kit](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/starter-kit) from 2.14.0 to 3.6.7.
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/develop/packages/starter-kit/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.6.7/packages/starter-kit)

---
updated-dependencies:
- dependency-name: "@tiptap/starter-kit"
  dependency-version: 3.6.7
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
Copy link
Contributor Author

dependabot bot commented on behalf of github Oct 15, 2025

Superseded by #1664.

@dependabot dependabot bot closed this Oct 15, 2025
@dependabot dependabot bot deleted the dependabot/npm_and_yarn/main/tiptap/starter-kit-3.6.7 branch October 15, 2025 11:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants