Update dependency @tiptap/core to v3 [SECURITY] - autoclosed

[tryghost-renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@tiptap/core (source)	2.27.2 → 3.30.4

---

Tiptap: mergeAttributes() turns an own proto key into inherited executable DOM attributes

GHSA-cp6q-959q-f8rh

More information

Details

Summary

@tiptap/core's public mergeAttributes() helper uses ordinary bracket assignment on keys returned by Object.entries(). An own __proto__ key from JSON therefore invokes the legacy prototype setter on the fresh merged object. The function returns an object whose prototype is attacker-controlled, while Object.keys() and ordinary own-property checks show no attacker attributes.

When that result is used as a ProseMirror DOMOutputSpec attribute object, prosemirror-model's DOMSerializer.renderSpec() enumerates it with for...in and applies inherited values with setAttribute(). In a browser proof, inherited src and onerror values were copied to an <img> and the error handler executed once. This is per-object prototype manipulation; the proof does not modify global Object.prototype.

Root cause

The affected loop is conceptually:

const mergedAttributes = { ...items }
for (const [key, value] of Object.entries(item)) {
  const exists = mergedAttributes[key]
  // ...
  mergedAttributes[key] = value
}

Object.entries(JSON.parse('{"__proto__": {...}}')) includes __proto__. Reading mergedAttributes['__proto__'] resolves the inherited Object.prototype; assigning to the same key invokes Object.prototype.__proto__'s setter and replaces mergedAttributes' prototype.

Browser reproduction

The following shape was tested with exact @tiptap/core 3.29.2 and prosemirror-model 1.25.11:

const input = JSON.parse(`{
  "__proto__": {
    "data-inherited-canary": "present",
    "src": "x-invalid://canary",
    "onerror": "globalThis.__tiptapXss += 1"
  }
}`)

const attrs = mergeAttributes(input)
// Object.keys(attrs) === []
// Object.getPrototypeOf(attrs) === input.__proto__

const schema = new Schema({
  nodes: {
    doc: { content: 'image' },
    image: { toDOM: () => ['img', attrs] },
    text: {},
  },
})
const doc = schema.node('doc', null, [schema.node('image')])
const fragment = DOMSerializer.fromSchema(schema).serializeFragment(doc.content)
document.body.append(fragment)

Chromium produced an image with data-inherited-canary, src, and onerror; the handler executed exactly once. Object.prototype remained clean.

Impact and preconditions

Applications that merge untrusted imported document, plugin, CMS, API, tenant, or AI-derived attribute objects can receive a prototype-manipulated result. Consumers that enumerate inherited keys, including ProseMirror's DOM serializer, can turn the hidden properties into DOM attributes and execute JavaScript in the application's origin. Own-key validation, object spread, JSON serialization, and logging can miss the inherited values. Other component consumers can read inherited authorization or configuration fields.

Tiptap's standard fixed ProseMirror schemas discard unknown document attributes, so arbitrary Tiptap JSON is not automatically exploitable in every application. A vulnerable application needs an untrusted object boundary into mergeAttributes() or a dynamic/custom extension or schema that preserves the relevant attribute object.

Affected versions

The unsafe assignment was introduced in commit ecadf7ea0a7f8f39a8496a60edf0ac8f379e6eb3 and is present in the first package tag @tiptap/core@2.0.0-alpha.0, v2.0.0, v2.27.1, v3.0.0, and current v3.29.2 source. No fixed release was found.

Recommended remediation

Reject __proto__ before reading or assigning the key, or define copied keys as own data properties without invoking legacy setters. A minimal hardening is to skip key === '__proto__'. Add regression tests using an own JSON-origin __proto__ key and assert that the result keeps Object.prototype as its prototype, exposes no inherited attacker keys, and cannot create an event-handler attribute through DOMSerializer.

This was found during authorized dependency review and is being reported privately. No public zero-day issue has been opened.

Severity

• CVSS Score: 6.4 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

References

• https://github.com/ueberdosis/tiptap/security/advisories/GHSA-cp6q-959q-f8rh
• https://github.com/ueberdosis/tiptap/commit/01d7af8c983ee5954c63734f4fa46cb23ae3246d
• https://github.com/ueberdosis/tiptap/releases/tag/v3.30.4
• https://github.com/advisories/GHSA-cp6q-959q-f8rh

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

ueberdosis/tiptap (@​tiptap/core)

v3.30.4

Compare Source

@​tiptap/core

Patch Changes

• Prevent untrusted HTML attributes from changing an object's prototype when merged with mergeAttributes.

v3.30.3

Compare Source

Patch Changes

• 965a880: Fix JSX runtime to properly render nested sibling elements by spreading children arrays into DOMOutputSpec
  • @​tiptap/pm@​3.30.3

v3.30.2

Compare Source

Patch Changes

• 3dffed5: Keep mixed JSX children as separate siblings in DOM output.
• 214a140: Fixed a bug where editor.chain and editor.can can not be accessed on editor initialization
  • @​tiptap/pm@​3.30.2

v3.30.1

Compare Source

Patch Changes

• abc8828: Added new ProseMirror helpers that check whether a value is a specific ProseMirror type.
  • @​tiptap/pm@​3.30.1

v3.30.0

Compare Source

Minor Changes

• 0247d39: ListKeymap now registers a Tab shortcut that sinks a top-level textblock into the previous list's last item. Pressing Tab at the start of a paragraph right after a bullet/ordered/task list moves the paragraph inside the last list item. The handler does nothing when the cursor is already inside a list item (sinkListItem keeps working), when there is no list before the paragraph, when the caret is mid-textblock, or when the selection is not a text selection (for example a gap cursor).

  @tiptap/core also exposes a new getPreviousBlockSibling($pos) helper that returns the block-level sibling before the cursor's textblock, or null at the first child of the block parent.

• 3099eef: New Decorations API

  Finally the decorations API is here! Even though Decorations itself are nothing new in ProseMirror, the new API makes it much easier to use them in Tiptap without leaving your extensions.

  Decorations change how the document looks without changing the document itself. Highlighting search results, marking spelling mistakes, showing collaborator cursors, putting a drag handle next to every block.

  Until now you had to write a ProseMirror plugin by hand for this, keep the decoration set in plugin state, and map it forward on every transaction. Extensions can now declare decorations directly with a new addDecorations() hook.

  addDecorations() {
    return {
      create: ({ state }) =>
        // findMatches can be any function that returns an array of { from, to } ranges
        findMatches(state.doc).map(match =>
          Decoration.Inline(match.from, match.to, { class: 'highlight' }),
        ),
    }
  }

  There are three kinds. Decoration.Inline() styles a range of text. Decoration.Node() puts attributes on a block's DOM element. Decoration.Widget() renders your own element at a single position.

  Every extension that declares decorations is collected into one plugin, so several extensions can decorate the same document without fighting over it.

  Doing less work on every keystroke

  By default decorations are rebuilt whenever the document changes. That is fine for small documents and wasteful for large ones, so there are two ways to narrow it down.

  shouldUpdate() skips transactions you do not care about. If your decorations only depend on headings, ignore everything else.

  update: 'changedRanges' together with createInRange() only rescans the blocks that actually changed. On a long document this is the difference between scanning the whole thing on every keystroke and scanning one paragraph.

  For decorations driven by data outside the editor, like comments loaded from a server, use update: 'manual' and refresh them yourself with editor.commands.updateDecorations().

  React and Vue components as widgets

  ReactWidgetRenderer and VueWidgetRenderer render a real component into a widget decoration, inside your existing app context. Providers, context and stores work as usual.

  Widgets take a key. Reuse the same key and the component instance stays mounted while the document changes around it, so local state such as an open menu, a counter or a half-typed input survives editing. Use a stable id from your own data, not a position or a list index, otherwise the component remounts and loses that state.

  Widgets also accept the ProseMirror options side, relaxedSide, stopEvent and ignoreSelection.

  Documentation

  • Decorations
  • Decorations with React
  • Decorations with Vue
  • API Documentation

Patch Changes

• 51909d3: Fixed insertContent, insertContentAt and setContent failing when prosemirror-model is loaded more than once.
• Updated dependencies [58a8953]
  • @​tiptap/pm@​3.30.0

v3.29.2

Compare Source

Patch Changes

• @​tiptap/pm@​3.29.2

v3.29.1

Compare Source

Patch Changes

• @​tiptap/pm@​3.29.1

v3.29.0

Compare Source

Patch Changes

• d26840f: Fix a TypeScript build error in isAndroid() where comparing navigator.platform against the literal 'Android' with === could fail to compile under some lib.dom.d.ts typings ("types have no overlap"). Switched to the same .includes() pattern already used by isiOS(), which is not affected by this TypeScript narrowing issue. No runtime behavior change.
• 935e63f: Fixed a bug where deleting an AllSelection (for example right after Ctrl/Cmd+A) left a lingering "phantom" selection highlight over the emptied document instead of a text cursor. deleteSelection now collapses the selection to a cursor.
• b4c5a2d: Fix input rules crashing when the matched text spans an inline atom node like a mention.
• a963d48: Node view getPos() now returns undefined instead of throwing when the position cannot be resolved yet, for example when React 19 renders a node view component while the editor view is still updating.
• 51f45b6: Fixed onContentError throwing when calling editor.commands from inside the handler on initial load with invalid content. The editor now has a usable state (seeded from the stripped fallback document) before onContentError fires.
• 0f63969: Fix editor.$pos() returning the wrong node inside container nodes, for example the list item instead of the list.
• 9acaa65: Add insertDefaultBlock to insert the default textblock allowed at a position. It accepts an optional position, attributes, content, and selection-update option.
• Updated dependencies [e150ee0]
  • @​tiptap/pm@​3.29.0

v3.28.0

Compare Source

Patch Changes

• @​tiptap/pm@​3.28.0

v3.27.4

Compare Source

Patch Changes

• @​tiptap/pm@​3.27.4

v3.27.3

Compare Source

Patch Changes

• 023f98c: Fix deleteSelection to delete content across all selection ranges instead of only the first range. This restores multi-cell table selections and other custom selections with multiple ranges.
  • @​tiptap/pm@​3.27.3

v3.27.2

Compare Source

Patch Changes

• Updated dependencies [ceebb31]
  • @​tiptap/pm@​3.27.2

v3.27.1

Compare Source

Patch Changes

• @​tiptap/pm@​3.27.1

v3.27.0

Compare Source

Patch Changes

• 0d0094d: Ordered lists now support the type attribute (a, A, i, I).

  The <ol> type attribute is now fully preserved through the HTML round-trip:

  • type="a" → lowercase alphabetical markers
  • type="A" → uppercase alphabetical markers
  • type="i" → lowercase roman numeral markers
  • type="I" → uppercase roman numeral markers

  Paste from external editors (Google Docs, Word, LibreOffice) now correctly detects the list style — both from the HTML type attribute and from CSS list-style-type properties.

  Plain text paste of typed ordered list markers (e.g. a. Item, I) Item, i. Item\nii. Item) is detected and converted to the correct list type.

  Markdown round-trip preserves typed markers: parsing a. Item creates type: "a", and serializing a typed list back to markdown uses the correct prefix (e.g. I., ii.).

  Joining of adjacent lists now respects type — two lists with different types (e.g. default numeric and type="a") are not merged.

• 795033c: parseAttributes now supports any word characters at the start of classes or id attributes.

• 0e0c4f9: Fix marksEqual to compare mark arrays as multisets instead of index-by-index, so order of marks no longer affects the result. Broaden the type signature to accept ProseMirror Mark objects (where type is an object with a name property) alongside the existing JSON mark shape ({ type: string }).

• 6d12bb9: Fix a edge-case in rewriteUnknownContent to not fail on null-ish values inside marks or nodes.

  • @​tiptap/pm@​3.27.0

v3.26.1

Compare Source

Patch Changes

• @​tiptap/pm@​3.26.1

v3.26.0

Compare Source

Patch Changes

• @​tiptap/pm@​3.26.0

v3.25.0

Compare Source

Patch Changes

• ec291dd: Fix: dragging an inline/resizable image within the editor no longer creates a duplicate

  When the Image extension was configured with inline: true or resize enabled, dragging an image within the editor could insert a duplicate at the drop position instead of moving it. This happened because the browser's native image drag behavior could populate dataTransfer.files, causing the FileHandler extension to intercept the drop before ProseMirror's internal move logic could run.

• 454e9b8: Add clearable mark option (default true). unsetAllMarks now skips marks with clearable: false, so semantic marks like comments are not removed by "clear formatting".

• 9cf8db0: Add attrsEqual and marksEqual utility functions to @tiptap/core. attrsEqual compares two attribute objects for equality regardless of key ordering. marksEqual compares two arrays of mark objects by type and attributes using attrsEqual.

• 3d4f94c: Fix plain-text copy of table cell selections including content from unselected cells in between. Each selected range is now serialized independently and joined in document order, so dragging upward (reverse selection) also produces output in document order.

• Updated dependencies [c1a2ce8]

  • @​tiptap/pm@​3.25.0

v3.24.0

Compare Source

Patch Changes

• Updated dependencies [7c0499b]
  • @​tiptap/pm@​3.24.0

v3.23.6

Compare Source

Patch Changes

• d168376: Fix deleteSelection to properly handle inline nodes with text* content. The selection is now expanded to include the entire inline node boundaries when deleting, preventing incorrect collapse of inline text nodes.
  • @​tiptap/pm@​3.23.6

v3.23.5

Compare Source

Patch Changes

• 835caf5: Fix $pos() returning correct node for non-text atom nodes instead of doc node

• 95e138c: fix(nodeview): eliminate unnecessary re-renders, add opt-in position tracking

  NodeViews no longer re-render when decorations or position change without
  content changes. Added trackNodeViewPosition option — when enabled, the
  component re-renders on every position shift so calls to getPos() stay
  current in render output. Removed the internal nodeViewPositionRegistry.
  Added shallow prop comparison in ReactRenderer.updateProps().

  • @​tiptap/pm@​3.23.5

v3.23.4

Compare Source

Patch Changes

• @​tiptap/pm@​3.23.4

v3.23.2

Compare Source

Patch Changes

• f98eaaf: Fix " HTML entity encoding in getHTML() output for inline style attributes. Adds a getStyleProperty utility to @tiptap/core and migrates Color, BackgroundColor, FontFamily, FontSize, LineHeight, and Highlight extensions to use it (#​7016)
  • @​tiptap/pm@​3.23.2

v3.23.1

Compare Source

Patch Changes

• @​tiptap/pm@​3.23.1

v3.22.5

Compare Source

Patch Changes

• a375002: Add selectedOnTextSelection option to node view renderers. When enabled, the selected prop also becomes true when a TextSelection is fully inside the node's range, not only on NodeSelection.
  • @​tiptap/pm@​3.22.5

v3.22.4

Compare Source

Patch Changes

• 27ea931: Fix dependencies installation after packages updates producing peer dependency resolution conflicts
• 64f36b8: Fix text selection collapsing after toggling off a list with AllSelection
• Updated dependencies [27ea931]
• Updated dependencies [032f8f1]
  • @​tiptap/pm@​3.22.4

v3.22.3

Patch Changes

• cb28e7b: Fixed insertContentAt corrupting the document when inserting inline content with marks at the start of a paragraph. The from - 1 position adjustment now only applies to block-level content.
  • @​tiptap/pm@​3.22.3

v3.22.2

Patch Changes

• f1d504c: Fix incorrect selection placement when pasting at the end of a marked text node, ensuring inclusive marks are respected
• 404c683: Fixes list toggling when the entire document is selected
  • @​tiptap/pm@​3.22.2

v3.22.1

Compare Source

Patch Changes

• ee03ac0: Fix NodeView not re-rendering when a node's position changes without content or decoration changes (e.g. when a sibling node is moved within the same parent)
• b88f9ed: Don't stop dragover/dragenter events in NodeViews, to prevent spurious drag-copy cursors
  • @​tiptap/pm@​3.22.1

v3.22.0

Compare Source

Patch Changes

• 912a49b: Fix HTML character escaping in markdown roundtrip. HTML entities (<, >, &, ") are now decoded to literal characters when parsing markdown into the editor. <, >, and & are re-encoded when serializing back to markdown, while " is preserved as a literal character since double quotes are ordinary in markdown. Code detection for skipping encoding now uses the code: true extension spec instead of hardcoded type names. Literal characters inside code blocks and inline code are always preserved.
• 7d4fb9a: Fix ResizableNodeView ignoring node's inline setting by using inline-flex for inline nodes and flex for block nodes
• 0c1c112: extendMarkRange defaults to using the attributes of the first mark of the given type, instead of attributes = {}. In particular, extendMarkRange('link') no longer extends to adjacent links with different hrefs; restore the previous behavior with extendMarkRange('link', {}).
• 0c1c112: Fix getMarkRange attributes default to consider the first mark of the given type
• f99bdc2: Guard mark delete event handling when unsetMark removes a mark from inline content that starts at position 0, preventing a RangeError during the before-node lookup.
  • @​tiptap/pm@​3.22.0

v3.21.0

Compare Source

Patch Changes

• @​tiptap/pm@​3.21.0

v3.20.6

Compare Source

Patch Changes

• @​tiptap/pm@​3.20.6

v3.20.5

Patch Changes

• @​tiptap/pm@​3.20.5

v3.20.4

Patch Changes

• 0bcf3c2: Fixed Tiptap not publishing with build dist artifacts
  • @​tiptap/pm@​3.20.4

v3.20.3

Compare Source

Patch Changes

• c94fac4: Fixed isNodeEmpty() so multi-line text with non-whitespace content is no longer treated as empty when ignoreWhitespace is enabled.
• 6b9ea92: Fixed overlapping bold and italic markdown serialization and round-tripping.
  • @​tiptap/pm@​3.20.3

v3.20.2

Compare Source

Patch Changes

• 269823d: Improved markdown empty-paragraph roundtripping across top-level and nested block content. Empty paragraphs now serialize with natural blank-line spacing for the first paragraph in a run and   markers for subsequent empty paragraphs at the same level, while parsing preserves those empty paragraphs when converting markdown back to JSON.
  • @​tiptap/pm@​3.20.2

v3.20.1

Compare Source

Patch Changes

• 25f57e4: Fix inline style parsing in mergeAttributes for values containing : or ; (e.g. url(https://...) or url(data:...;charset=...,)) and skip incomplete declarations
  • @​tiptap/pm@​3.20.1

v3.20.0

Compare Source

Minor Changes

• 57624a1: Add transformPastedHTML extension API that allows extensions to transform pasted HTML content before it's parsed into the editor, enabling cleanup of styles, removal of dangerous content, and modification of pasted HTML through a chainable transform system.

Patch Changes

• 4b731e2: Fix checking if mark is active and toggling off marks when part of the selection does not allow the mark (e.g. a code block)
• 98546ac: Global attributes now support shorthand string values for types: use '*' to apply to all nodes and marks, 'nodes' for all nodes (excluding text), or 'marks' for all marks.
• 76ce47d: Fixed a typo in the documentation of editor.view
  • @​tiptap/pm@​3.20.0

v3.19.0

Compare Source

Patch Changes

• @​tiptap/pm@​3.19.0

v3.18.0

Compare Source

Patch Changes

• @​tiptap/pm@​3.18.0

v3.17.1

Compare Source

Patch Changes

• aa9709e: Fixed $nodes() method to correctly return inline nodes (like text, mention, etc.) by fixing the children getter in NodePos class
• b46e66a: Fixed ResizableNodeView contentDOM getter to return null instead of undefined for proper TypeScript compatibility
  • @​tiptap/pm@​3.17.1

v3.17.0

Compare Source

Patch Changes

• eecf1c9: Added isFirefox utility to core
  • @​tiptap/pm@​3.17.0

v3.16.0

Compare Source

Patch Changes

• @​tiptap/pm@​3.16.0

v3.15.3

Compare Source

Patch Changes

• 8f86f06: Fix Safari scrolling to top when using editor.chain().focus() commands
  • @​tiptap/pm@​3.15.3

v3.15.2

Compare Source

Patch Changes

• @​tiptap/pm@​3.15.2

v3.15.1

Compare Source

Patch Changes

• @​tiptap/pm@​3.15.1

v3.15.0

Compare Source

Minor Changes

• ac8361c: Add a new dispatchTransaction hook to extensions, allowing developers to intercept, modify, or block transactions before they are applied to the editor state.

Patch Changes

• @​tiptap/pm@​3.15.0

v3.14.0

Compare Source

Patch Changes

• @​tiptap/pm@​3.14.0

v3.13.0

Compare Source

Minor Changes

• e3b4f68: 1. Added an optional createCustomHandle callback to ResizableNodeView, allowing developers to fully customize resize handles. When provided, it replaces the default handle creation and bypasses the built-in positionHandle logic, giving complete control over markup, styling, and positioning while preserving backward compatibility. 2. Removed predefined inline styles from the wrapper element to better support dynamic alignment. This eliminates the need for !important overrides in user styles. 3. Added an editor update event listener to dynamically attach or remove resize handles based on the editor’s editable state. The implementation tracks the previous editable state to avoid unnecessary re-renders.

Patch Changes

• 526365a: Add 'mentionSuggestionChar' to allowedAttributes for Markdown serialization in multi-mention setups. The attribute is only serialized when it differs from the default '@​' character, keeping markdown output clean for single-mention users.
  • @​tiptap/pm@​3.13.0

v3.12.1

Compare Source

Patch Changes

• @​tiptap/pm@​3.12.1

v3.12.0

Compare Source

Minor Changes

• f232c5a: Implement position mapping using the MappablePosition class. This enables position mapping in collaborative editing scenarios.

  • Introduce MappablePosition class in core with position, fromJSON, and toJSON methods
  • Add editor.utils property with getUpdatedPosition(position, transaction) and createMappablePosition() methods
  • Create CollaborationMappablePosition subclass that extends MappablePosition with Y.js relative position support

Patch Changes

• @​tiptap/pm@​3.12.0

v3.11.1

Compare Source

Patch Changes

• d0c4264: Improve TypeScript generics for Node.extend

  The Node.extend method's TypeScript signature was updated so that ExtendedConfig can extend NodeConfig and MarkConfig,
  improving type inference when extending Node and Mark classes with additional config properties.

  This is a type-only change — there are no runtime behavior changes.

  • @​tiptap/pm@​3.11.1

v3.11.0

Compare Source

Minor Changes

• 541c93c: Add native text direction support for RTL and bidirectional content. The editor now includes a textDirection option that can be set to 'ltr', 'rtl', or 'auto' to control the direction of all content globally. Additionally, new setTextDirection and unsetTextDirection commands allow for granular control of text direction on specific nodes. This enables proper rendering of right-to-left languages like Arabic and Hebrew, as well as bidirectional text mixing multiple languages.

Patch Changes

• @​tiptap/pm@​3.11.0

v3.10.8

Compare Source

Patch Changes

• 8375241: Fixed a bug that caused extra characters to be inserted after a parsed, nestable content block by accounting for leading newlines
• b7ead7c: Add documentation comments to Tiptap JSON types
• 95d3e80: allow undefined as a value for the default attribute key
• fd479bd: Fix updateAttributes and resetAttributes commands to return accurate results when used with .can(). Previously, these commands would always return true even when they couldn't perform the operation. Now they correctly return false when no matching nodes or marks are found in the selection.
  • @​tiptap/pm@​3.10.8

v3.10.7

Compare Source

Patch Changes

• @​tiptap/pm@​3.10.7

v3.10.6

Compare Source

Patch Changes

• @​tiptap/pm@​3.10.6

v3.10.5

Compare Source

Patch Changes

• 92fae18: Fixed ProseMirror schema generation to properly respect isRequired attribute configuration. Previously, attributes marked with isRequired: true were incorrectly treated as optional because a default property was always included in the schema specification. ProseMirror determines attribute requirements by the absence of the default property, so now the default is only included when the attribute is not required and a default value is explicitly defined.
  • @​tiptap/pm@​3.10.5

v3.10.4

Compare Source

Patch Changes

• 64561c4: Fix autofocus behavior to prevent unwanted scrolling when disabled
  • @​tiptap/pm@​3.10.4

v3.10.3

Compare Source

Patch Changes

• @​tiptap/pm@​3.10.3

v3.10.2

Compare Source

Patch Changes

• @​tiptap/pm@​3.10.2

v3.10.1

Compare Source

Patch Changes

• 3564e7c: Use correct ResizableNodeView class name
  • @​tiptap/pm@​3.10.1

v3.10.0

Compare Source

Minor Changes

• 4aa9f57: Add a new ResizableNodeview NodeView to core that wraps elements (images, videos, iframes) with configurable resize handles. It provides live onResize/onCommit callbacks, min/max constraints, aspect-ratio support, and styling hooks (class names + data attributes) to improve UX when resizing media inside the editor.

• 4aa9f57: the addNodeView function can now return null to dynamically disable rendering of a node view

  While this should not directly cause any issues, it's noteworthy as it still could affect some behavior in some edge cases.

Patch Changes

• @​tiptap/pm@​3.10.0

v3.9.1

Compare Source

Patch Changes

• @​tiptap/pm@​3.9.1

v3.9.0

Compare Source

Patch Changes

• bbb8e16: Only remove injected CSS on unmount if no other editors are in the document (fixes #​6836)
  • @​tiptap/pm@​3.9.0

v3.8.0

Compare Source

Patch Changes

• @​tiptap/pm@​3.8.0

v3.7.2

Compare Source

Patch Changes

• @​tiptap/pm@​3.7.2

v3.7.1

Compare Source

Patch Changes

• @​tiptap/pm@​3.7.1

v3.7.0

Compare Source

Minor Changes

• 35645d9: All commands and their corresponding TypeScript types are now exported from @tiptap/core so they can be imported and referenced directly by consumers. This makes it easier to build typed helpers, extensions, and tests that depend on the command signatures.

  Why:

  • Previously some command option types were only available as internal types or scattered across files, which made it awkward for downstream users to import and reuse them.

  import { commands } from "@​tiptap/core";

  Notes:

  • This is a non-breaking, additive change. It improves ergonomics for TypeScript consumers.
  • If you rely on previously private/internal types, prefer the exported types from @tiptap/core going forward.

• 35645d9: Add comprehensive bidirectional markdown support to Tiptap through a new @tiptap/markdown package and Markdown utilities in @tiptap/core.

  New Package: @tiptap/markdown - A new official extension that provides full Markdown parsing and serialization capabilities using MarkedJS as the underlying Markdown parser.

  Core Features:

  Extension API

  • Markdown Extension: Main extension that adds Markdown support to your editor
  • MarkdownManager: Core engine for parsing and serializing Markdown
    • Parse Markdown strings to Tiptap JSON: editor.markdown.parse(markdown)
    • Serialize Tiptap JSON to Markdown: editor.markdown.serialize(json)
    • Access to underlying marked.js instance: editor.markdown.instance

Editor Methods

• editor.getMarkdown(): Serialize current editor content to Markdown string
• editor.markdown: Access to MarkdownManager instance for advanced operations

Editor Options:

• contentType: Control the type of content that is inserted into the editor. Can be json, html or markdown - defaults to json and will automatically detect invalid content types (like JSON when it is actually Markdown).

  new Editor({
    content: "# Hello World",
    contentType: "markdown",
  });

Command Options: All content commands now support an contentType option:

• setContent(markdown, { contentType: 'markdown' }): Replace editor content with markdown
• insertContent(markdown, { contentType: 'markdown' }): Insert markdown at cursor position
• insertContentAt(position, markdown, { contentType: 'markdown' }): Insert Markdown at specific position

For more, check the documentation.

Patch Changes

• 35645d9: The extension manager now provides a new property baseExtensions that contains an unflattened array of extensions
  • @​tiptap/pm@​3.7.0

v3.6.7

Compare Source

Patch Changes

• @​tiptap/pm@​3.6.7

v3.6.6

Compare Source

Patch Changes

• @​tiptap/pm@​3.6.6

v3.6.5

Compare Source

Patch Changes

• 1e4caea: Editors can now emit transaction and update events before being mounted.
  This means smoother state handling and instant feedback from editors, even when they're not in the DOM.
  • @​tiptap/pm@​3.6.5

v3.6.4

Compare Source

Patch Changes

• @​tiptap/pm@​3.6.4

v3.6.3

Compare Source

Patch Changes

• 67f7b4a: Refined the JSONContent.attrs definition to exactly mirror the structure returned by editor.getJSON(). This ensures strict type safety and consistency between the editor output and the expected type, eliminating errors caused by mismatched attribute signatures.
  • @​tiptap/pm@​3.6.3

v3.6.2

Compare Source

Patch Changes

• @​tiptap/pm@​3.6.2

v3.6.1

Compare Source

Patch Changes

• @​tiptap/pm@​3.6.1

v3.6.0

Compare Source

Patch Changes

• c0190bd: Improve typing and docs for EditorOptions.element to reflect all supported mounting modes and align behavior across adapters.

  • element now accepts:
    • Element: the editor is appended inside the given element.
    • { mount: HTMLElement }: the editor is mounted directly to mount (no extra wrapper).
    • (editorEl: HTMLElement) => void: a function that receives the editor element so you can place it anywhere in the DOM.
    • null: no automatic mounting.
  • @​tiptap/pm@​3.6.0

v3.5.3

Compare Source

Patch Changes

• @​tiptap/pm@​3.5.3

v3.5.2

Compare Source

Patch Changes

• @​tiptap/pm@​3.5.2

v3.5.1

Compare Source

Patch Changes

• @​tiptap/pm@​3.5.1

v3.5.0

Compare Source

Patch Changes

• @​tiptap/pm@​3.5.0

v3.4.6

Compare Source

Patc

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone Etc/UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • Only on Sunday and Saturday (* * * * 0,6)
  • Between 11:00 PM and 11:59 PM, Monday through Friday (* 23 * * 1-5)
  • Between 12:00 AM and 05:59 AM, Monday through Saturday (* 0-5 * * 1-6)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[tryghost-renovate]

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: undefined

Post-upgrade command 'pnpm install --no-frozen-lockfile --filter @internal/scripts --prod --ignore-scripts' has not been added to the allowed list in allowedCommands

File name: undefined

Post-upgrade command 'node scripts/generate-changeset.js' has not been added to the allowed list in allowedCommands