build(deps): bump the npm-dependencies group with 17 updates by dependabot[bot] · Pull Request #35 · joelborch/flow

dependabot · 2026-08-31T10:32:57Z

Bumps the npm-dependencies group with 17 updates:

Package	From	To
@cloudflare/workers-types	`5.20260814.1`	`5.20260828.1`
vitest	`4.1.10`	`4.1.11`
hono	`4.13.2`	`4.13.5`
wrangler	`4.123.0`	`4.127.0`
@types/node	`26.2.0`	`26.4.0`
@tiptap/core	`3.30.1`	`3.30.5`
@tiptap/extension-image	`3.30.1`	`3.30.5`
@tiptap/extension-placeholder	`3.30.1`	`3.30.5`
@tiptap/extension-table	`3.30.1`	`3.30.5`
@tiptap/extension-table-cell	`3.30.1`	`3.30.5`
@tiptap/extension-table-header	`3.30.1`	`3.30.5`
@tiptap/extension-table-row	`3.30.1`	`3.30.5`
@tiptap/extension-task-item	`3.30.1`	`3.30.5`
@tiptap/extension-task-list	`3.30.1`	`3.30.5`
@tiptap/starter-kit	`3.30.1`	`3.30.5`
happy-dom	`20.11.2`	`20.11.12`
vite	`8.2.1`	`8.2.2`

Updates @cloudflare/workers-types from 5.20260814.1 to 5.20260828.1

Commits

See full diff in compare view

Updates vitest from 4.1.10 to 4.1.11

Release notes

Sourced from vitest's releases.

v4.1.11

🐞 Bug Fixes

Revive global concurrency limit for test lifecycle [backport to v4] - by @sheremet-va and @hi-ogawa in vitest-dev/vitest#10992 (5146d)

browser:

Encode iframeId in tester iframe URL [backport to v4] - by @sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)

Trigger playwright/chromium gc on lower disk availability [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)

mocker:

Restrict redirect mocks to the fs allowlist [backport to v4] - by @sheremet-va in vitest-dev/vitest#10974 (fe5a1)

View changes on GitHub

Commits

9bd8d46 chore: release v4.1.11 (#10995)
9851dbc fix(browser): trigger playwright/chromium gc on lower disk availability [back...
See full diff in compare view

Updates hono from 4.13.2 to 4.13.5

Release notes

Sourced from hono's releases.

v4.13.5

Security fixes

This release includes fixes for the following security issues:

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

Affects: parseBody() when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfc

Users who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use parseBody({ dot: true }) are strongly encouraged to upgrade to this version.

v4.13.4

What's Changed

fix(request): handle params on unmatched requests in honojs/hono#5268

fix(jsx/dom): execute previous ref cleanup when ref prop changes on re-render in honojs/hono#5264

fix(reg-exp-router): associate wildcard middleware with matching routes in honojs/hono#5266

perf(router): share null object creation in honojs/hono#5267

fix(etag): match If-None-Match tags with optional whitespace before the comma in honojs/hono#5222

fix(client): skip undefined header and cookie values in honojs/hono#5244

fix(client): skip an undefined entry inside a query array in honojs/hono#5272

fix(client): skip an undefined entry inside a form array in honojs/hono#5280

fix(client): support custom buildSearchParams and filter undefined query in $ws() bin honojs/hono#5256

fix(accepts): support wildcard media types and specificity ordering in defaultMatch in honojs/hono#5255

fix(client): omit empty query delimiter in honojs/hono#5283

fix(request): drop stale content length for cloned FormData in honojs/hono#5282

fix(request): serialize cached JSON body in cloneRawRequest in honojs/hono#5288

fix(cookie): allow parsing signed cookies with empty string values in honojs/hono#5246

fix(utils/stream): do not let abort listeners crash abort() in honojs/hono#5274

Full Changelog: honojs/hono@v4.13.3...v4.13.4

v4.13.3

What's Changed

fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in honojs/hono#5227

fix(etag): copy pending stream bytes in honojs/hono#5239

fix(etag): avoid skipping headers when filtering 304 response headers in honojs/hono#5234

fix(cors): append Origin to Vary header on OPTIONS preflight in honojs/hono#5235

docs(context): add custom headers append option example to Context JSDoc in honojs/hono#5248

fix(trie-router): match suffix wildcard routes in honojs/hono#5236

... (truncated)

Commits

06880c4 4.13.5
531e9c5 Merge commit from fork
3a67f7f Merge commit from fork
9c28d72 Merge commit from fork
017000d 4.13.4
5e5b83d fix(utils/stream): do not let abort listeners crash abort() (#5274)
241ae4c fix(cookie): allow parsing signed cookies with empty string values (#5246)
c409d85 fix(request): serialize cached JSON body in cloneRawRequest (#5288)
612b59c fix(request): drop stale content length for cloned FormData (#5282)
73794bd fix(client): omit empty query delimiter (#5283)
Additional commits viewable in compare view

Updates wrangler from 4.123.0 to 4.127.0

Release notes

Sourced from wrangler's releases.

wrangler@4.127.0

Minor Changes
#15356 fe265f8 Thanks @rubuy-74! - Add support for configuring a per-workflow max concurrency limit via workflows[].concurrency.limit in your Wrangler config.

The limit is the maximum number of Workflow instances that can run concurrently. It is validated as a positive integer and persisted on deploy; the ceiling is enforced server-side. Concurrency is ignored in local development.
{
  "workflows": [
    {
      "binding": "MY_WORKFLOW",
      "name": "my-workflow",
      "class_name": "MyWorkflow",
      "concurrency": { "limit": 10 }
    }
  ]
}
Patch Changes

#15367 412c79e Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

@cloudflare/workers-types ^5.20260825.1 ^5.20260826.1

workerd 1.20260825.1 1.20260826.1

#15375 92874f6 Thanks @WillTaylorDev! - Upload wrangler preview modules as multipart form data

wrangler preview used to base64 the bundle, its modules, and any sourcemaps into a single JSON request body. Base64 inflates content by a third, so a Worker with a large sourcemap could exceed the API request size limit and fail to deploy.

The preview deployment request is now multipart/form-data. The deployment settings travel in a metadata part and each module follows as its own part carrying raw bytes, matching how wrangler deploy already uploads a Worker.

Updated dependencies [412c79e]:

miniflare@5.20260826.0-alpha

wrangler@4.126.0

Minor Changes
#15332 d1cc3af Thanks @pombosilva! - Add default_retention to Workflow bindings for configuring how long instances are retained

Workflow instances are retained for an account-wide default period after they finish. You can now set a per-Workflow default in your Wrangler configuration, applied to instances that do not specify their own retention:
{
  "workflows": [

... (truncated)

Commits

a831498 Version Packages (#15372)
fe265f8 [wrangler] Add per-workflow concurrency limit config (#15356)
92874f6 WC-5857 [wrangler] Upload preview deployments as multipart form data (#15375)
e9df120 Support multiple named Workers in the build output (#15371)
5377aae Version Packages (#15354)
e56d2e6 Revert "Version Packages" (#15355)
d765e10 Version Packages (#15291)
433fa98 [wrangler] Add pull request title to preview deployment annotations (#15307)
ad89456 [wrangler] Add hyperdrive planetscale signature command (#15065)
d589d30 [wrangler] Pause automatic skills installation offers (#15296)
Additional commits viewable in compare view

Updates @types/node from 26.2.0 to 26.4.0

Commits

See full diff in compare view

Updates @tiptap/core from 3.30.1 to 3.30.5

Release notes

Sourced from @tiptap/core's releases.

v3.30.5

@tiptap/core

Patch Changes

Fix a denial-of-service risk where crafted block or inline Markdown attributes could consume excessive CPU and block the browser or server event loop.

v3.30.4

@tiptap/core

Patch Changes

Prevent untrusted HTML attributes from changing an object's prototype when merged with mergeAttributes.

v3.30.3

@tiptap/extension-text-style

Patch Changes

Unsetting one text style inside a blockquote no longer removes the other text styles in it.

@tiptap/extension-youtube

Patch Changes

YouTube live URLs (/live/<id>) now embed the video.

@tiptap/core

Patch Changes

Fix JSX runtime to properly render nested sibling elements by spreading children arrays into DOMOutputSpec

@tiptap/react

Patch Changes

Fix ReactNodeViewRenderer crash when contentComponent is not available

@tiptap/ai-toolkit

Minor Changes

Add the AiInsertReveal extension (@tiptap/ai-toolkit/streaming-reveal) to fade in text as the AI streams it into a collaborative document.

v3.30.2

@tiptap/core

Patch Changes

... (truncated)

Changelog

Sourced from @tiptap/core's changelog.

3.30.5

Patch Changes

d0d499b: Fix a denial-of-service risk where crafted block or inline Markdown attributes could consume excessive CPU and block the browser or server event loop.

@tiptap/pm@3.30.5

3.30.4

Patch Changes

01d7af8: Prevent untrusted HTML attributes from changing an object's prototype when merged with mergeAttributes.

@tiptap/pm@3.30.4

3.30.3

Patch Changes

965a880: Fix JSX runtime to properly render nested sibling elements by spreading children arrays into DOMOutputSpec

@tiptap/pm@3.30.3

3.30.2

Patch Changes

3dffed5: Keep mixed JSX children as separate siblings in DOM output.

214a140: Fixed a bug where editor.chain and editor.can can not be accessed on editor initialization

@tiptap/pm@3.30.2

Commits

b0c188b chore(release): release new stable release (#8261)
d0d499b Merge commit from fork
55f59e4 chore(release): release new stable release (#8260)
01d7af8 Merge commit from fork
98b469d chore: complete Vite+ migration (#8258)
db790a7 chore(release): release new stable release (#8216)
f434577 chore: migrate over to vite+ for tooling (#8151)
965a880 fix(core): preserve JSX child boundaries (#7491)
cef2c9a chore(release): release new stable release (#8190)
214a140 fixed editor.can and editor.chain to not be accessible on editor … (#8210)
Additional commits viewable in compare view

Updates @tiptap/extension-image from 3.30.1 to 3.30.5

Release notes

Sourced from @tiptap/extension-image's releases.

v3.30.5

@tiptap/core

Patch Changes

Fix a denial-of-service risk where crafted block or inline Markdown attributes could consume excessive CPU and block the browser or server event loop.

v3.30.4

@tiptap/core

Patch Changes

Prevent untrusted HTML attributes from changing an object's prototype when merged with mergeAttributes.

v3.30.3

@tiptap/extension-text-style

Patch Changes

Unsetting one text style inside a blockquote no longer removes the other text styles in it.

@tiptap/extension-youtube

Patch Changes

YouTube live URLs (/live/<id>) now embed the video.

@tiptap/core

Patch Changes

Fix JSX runtime to properly render nested sibling elements by spreading children arrays into DOMOutputSpec

@tiptap/react

Patch Changes

Fix ReactNodeViewRenderer crash when contentComponent is not available

@tiptap/ai-toolkit

Minor Changes

Add the AiInsertReveal extension (@tiptap/ai-toolkit/streaming-reveal) to fade in text as the AI streams it into a collaborative document.

v3.30.2

@tiptap/core

Patch Changes

... (truncated)

Changelog

Sourced from @tiptap/extension-image's changelog.

3.30.5

Patch Changes

Updated dependencies [d0d499b]

@tiptap/core@3.30.5

3.30.4

Patch Changes

Updated dependencies [01d7af8]

@tiptap/core@3.30.4

3.30.3

Patch Changes

Updated dependencies [965a880]

@tiptap/core@3.30.3

3.30.2

Patch Changes

546b655: Fix resizable images staying hidden when the image is cached or fails to load.

Updated dependencies [3dffed5]

Updated dependencies [214a140]

@tiptap/core@3.30.2

Commits

b0c188b chore(release): release new stable release (#8261)
55f59e4 chore(release): release new stable release (#8260)
db790a7 chore(release): release new stable release (#8216)
f434577 chore: migrate over to vite+ for tooling (#8151)
cef2c9a chore(release): release new stable release (#8190)
546b655 fix(extension-image): reveal resizable node view when the image is already ca...
See full diff in compare view

Updates @tiptap/extension-placeholder from 3.30.1 to 3.30.5

Release notes

Sourced from @tiptap/extension-placeholder's releases.

v3.30.5

@tiptap/core

Patch Changes

Fix a denial-of-service risk where crafted block or inline Markdown attributes could consume excessive CPU and block the browser or server event loop.

v3.30.4

@tiptap/core

Patch Changes

Prevent untrusted HTML attributes from changing an object's prototype when merged with mergeAttributes.

v3.30.3

@tiptap/extension-text-style

Patch Changes

Unsetting one text style inside a blockquote no longer removes the other text styles in it.

@tiptap/extension-youtube

Patch Changes

YouTube live URLs (/live/<id>) now embed the video.

@tiptap/core

Patch Changes

Fix JSX runtime to properly render nested sibling elements by spreading children arrays into DOMOutputSpec

@tiptap/react

Patch Changes

Fix ReactNodeViewRenderer crash when contentComponent is not available

@tiptap/ai-toolkit

Minor Changes

Add the AiInsertReveal extension (@tiptap/ai-toolkit/streaming-reveal) to fade in text as the AI streams it into a collaborative document.

v3.30.2

@tiptap/core

Patch Changes

... (truncated)

Changelog

Sourced from @tiptap/extension-placeholder's changelog.

3.30.5

Patch Changes

@tiptap/extensions@3.30.5

3.30.4

Patch Changes

@tiptap/extensions@3.30.4

3.30.3

Patch Changes

@tiptap/extensions@3.30.3

3.30.2

Patch Changes

@tiptap/extensions@3.30.2

Commits

b0c188b chore(release): release new stable release (#8261)
55f59e4 chore(release): release new stable release (#8260)
db790a7 chore(release): release new stable release (#8216)
f434577 chore: migrate over to vite+ for tooling (#8151)
cef2c9a chore(release): release new stable release (#8190)
See full diff in compare view

Updates @tiptap/extension-table from 3.30.1 to 3.30.5

Release notes

Sourced from @tiptap/extension-table's releases.

v3.30.5

@tiptap/core

Patch Changes

Fix a denial-of-service risk where crafted block or inline Markdown attributes could consume excessive CPU and block the browser or server event loop.

v3.30.4

@tiptap/core

Patch Changes

Prevent untrusted HTML attributes from changing an object's prototype when merged with mergeAttributes.

v3.30.3

@tiptap/extension-text-style

Patch Changes

Unsetting one text style inside a blockquote no longer removes the other text styles in it.

@tiptap/extension-youtube

Patch Changes

YouTube live URLs (/live/<id>) now embed the video.

@tiptap/core

Patch Changes

Fix JSX runtime to properly render nested sibling elements by spreading children arrays into DOMOutputSpec

@tiptap/react

Patch Changes

Fix ReactNodeViewRenderer crash when contentComponent is not available

@tiptap/ai-toolkit

Minor Changes

Add the AiInsertReveal extension (@tiptap/ai-toolkit/streaming-reveal) to fade in text as the AI streams it into a collaborative document.

v3.30.2

@tiptap/core

Patch Changes

... (truncated)

Changelog

Sourced from @tiptap/extension-table's changelog.

3.30.5

Patch Changes

Updated dependencies [d0d499b]

@tiptap/core@3.30.5

@tiptap/pm@3.30.5

3.30.4

Patch Changes

Updated dependencies [01d7af8]

@tiptap/core@3.30.4

@tiptap/pm@3.30.4

3.30.3

Patch Changes

Updated dependencies [965a880]

@tiptap/core@3.30.3

@tiptap/pm@3.30.3

3.30.2

Patch Changes

Updated dependencies [3dffed5]

Updated dependencies [214a140]

@tiptap/core@3.30.2

@tiptap/pm@3.30.2

Commits

b0c188b chore(release): release new stable release (#8261)
55f59e4 chore(release): release new stable release (#8260)
db790a7 chore(release): release new stable release (#8216)
f434577 chore: migrate over to vite+ for tooling (#8151)
cef2c9a chore(release): release new stable release (#8190)
See full diff in compare view

Updates @tiptap/extension-table-cell from 3.30.1 to 3.30.5

Release notes

Sourced from @tiptap/extension-table-cell's releases.

v3.30.5

@tiptap/core

Patch Changes

Fix a denial-of-service risk where crafted block or inline Markdown attributes could consume excessive CPU and block the browser or server event loop.

v3.30.4

@tiptap/core

Patch Changes

Prevent untrusted HTML attributes from changing an object's prototype when merged with mergeAttributes.

v3.30.3

@tiptap/extension-text-style

Patch Changes

Unsetting one text style inside a blockquote no longer removes the other text styles in it.

@tiptap/extension-youtube

Patch Changes

YouTube live URLs (/live/<id>) now embed the video.

@tiptap/core

Patch Changes

Fix JSX runtime to properly render nested sibling elements by spreading children arrays into DOMOutputSpec

@tiptap/react

Patch Changes

Fix ReactNodeViewRenderer crash when contentComponent is not available

@tiptap/ai-toolkit

Minor Changes

Add the AiInsertReveal extension (@tiptap/ai-toolkit/streaming-reveal) to fade in text as the AI streams it into a collaborative document.

v3.30.2

@tiptap/core

Patch Changes

... (truncated)

Commits

See full diff in compare view

Updates @tiptap/extension-table-header from 3.30.1 to 3.30.5

Release notes

Sourced from @tiptap/extension-table-header's releases.

v3.30.5

@tiptap/core

Patch Changes

Fix a denial-of-service risk where crafted block or inline Markdown attributes could consume excessive CPU and block the browser or server event loop.

v3.30.4

@tiptap/core

Patch Changes

Prevent untrusted HTML attributes from changing an object's prototype when merged with mergeAttributes.

v3.30.3

@tiptap/extension-text-style

Patch Changes

Unsetting one text style inside a blockquote no longer removes the other text styles in it.

@tiptap/extension-youtube

Patch Changes

YouTube live URLs (/live/<id>) now embed the video.

@tiptap/core

Patch Changes

Fix JSX runtime to properly render nested sibling elements by spreading children arrays into DOMOutputSpec

@tiptap/react

Patch Changes

Fix ReactNodeViewRenderer crash when contentComponent is not available

@tiptap/ai-toolkit

Minor Changes

Add the AiInsertReveal extension (@tiptap/ai-toolkit/streaming-reveal) to fade in text as the AI streams it into a collaborative document.

v3.30.2

@tiptap/core

Patch Changes

... (truncated)

Commits

See full diff in compare view

Updates @tiptap/extension-table-row from 3.30.1 to 3.30.5

Release notes

Sourced from @tiptap/extension-table-row's releases.

v3.30.5

@tiptap/core

Patch Changes

Fix a denial-of-service risk where crafted block or inline Markdown attributes could consume excessive CPU and block the browser or server event loop.

v3.30.4

@tiptap/core

Patch Changes

Prevent untrusted HTML attributes from changing an object's prototype when merged with mergeAttributes.

v3.30.3

@tiptap/extension-text-style

Patch Changes

Unsetting one text style inside a blockquote no longer removes the other text styles in it.

@tiptap/extension-youtube

Patch Changes

YouTube live URLs (/live/<id>) now embed the video.

@tiptap/core

Patch Changes

Fix JSX runtime to properly render nested sibling elements by spreading children arrays into DOMOutputSpec

@tiptap/react

Patch Changes

Fix ReactNodeViewRenderer crash when contentComponent is not available

@tiptap/ai-toolkit

Minor Changes

Add the AiInsertReveal extension (@tiptap/ai-toolkit/streaming-reveal) to fade in text as the AI streams it into a collaborative document.

v3.30.2

@tiptap/core

Patch Changes

... (truncated)

Commits

See full diff in compare view

Updates @tiptap/extension-task-item from 3.30.1 to 3.30.5

Release notes

Sourced from @tiptap/extension-task-item's releases.

v3.30.5

@tiptap/core

Patch Changes

Fix a denial-of-service risk where crafted block or inline Markdown attributes could consume excessive CPU and block the browser or server event loop.

v3.30.4

@tiptap/core

Patch Changes

Prevent untrusted HTML attributes from changing an object's prototype when merged with mergeAttributes.

v3.30.3

@tiptap/extension-text-style

Patch Changes

Unsetting one text style inside a blockquote no longer removes the other text styles in it.

@tiptap/extension-youtube

Patch Changes

YouTube live URLs (/live/<id>) now embed the video.

@tiptap/core

Patch Changes

Fix JSX runtime to properly render nested sibling elements by spreading children arrays into DOMOutputSpec

@tiptap/react

Patch Changes

Fix ReactNodeViewRenderer crash when contentComponent is not available

@tiptap/ai-toolkit

Minor Changes

Add the AiInsertReveal extension (@tiptap/ai-toolkit/streaming-reveal) to fade in text as the AI streams it into a collaborative document.

v3.30.2

@tiptap/core

Patch Changes

... (truncated)

Commits

See full diff in compare view

Updates @tiptap/extension-task-list from 3.30.1 to 3.30.5

Release notes

Sourced from @tiptap/extension-task-list's releases.

v3.30.5

@tiptap/core

Patch Changes

Fix a denial-of-service risk where crafted block or inline Markdown attributes could consume excessive CPU and block the browser or server event loop.

v3.30.4

@tiptap/core

Patch Changes

Prevent untrusted HTML attributes from changing an object's prototype when merged with mergeAttributes.

v3.30.3

@tiptap/extension-text-style

Patch Changes

Unsetting one text style inside a blockquote no longer removes the other text styles in it.

@tiptap/extension-youtube

Patch Changes

YouTube live URLs (/live/<id>) now embed the video.

@tiptap/core

Patch Changes

Fix JSX runtime to properly render nested sibling elements by spreading children arrays into DOMOutputSpec

@tiptap/react

Patch Changes

Fix ReactNodeViewRenderer crash when contentComponent is not available

@tiptap/ai-toolkit

Minor Changes

Add the AiInsertReveal extension (@tiptap/ai-toolkit/streaming-reveal) to fade in text as the AI streams it into a collaborative document.

v3.30.2

@tiptap/core

Patch Changes

... (truncated)

Commits

See full diff in compare view

Updates @tiptap/starter-kit from 3.30.1 to 3.30.5

Release notes

Sourced from @tiptap/starter-kit's releases.

v3.30.5

@tiptap/core

Patch Changes

Fix a denial-of-service risk where crafted block or inline Markdown attributes could consume excessive CPU and block the browser or server event loop.

v3.30.4

@tiptap/core

Patch Changes

Prevent untrusted HTML attributes from changing an object's prototype when merged with mergeAttributes.

v3.30.3

@tiptap/extension-text-style

Patch Changes

Unsetting one text style inside a blockquote no longer removes the other text styles in it.

@tiptap/extension-youtube

Patch Changes

YouTube live URLs (/live/<id>) now embed the video.

@tiptap/core

Patch Changes

Fix JSX runtime to properly render nested sibling elements by spreading children arrays into DOMOutputSpec

@tiptap/react

Patch Changes

Fix ReactNodeViewRenderer crash when contentComponent is not available

@tiptap/ai-toolkit

Minor Changes

Add the AiInsertReveal extension (@tiptap/ai-toolkit/streaming-reveal) to fade in text as the AI streams it into a collaborative document.

v3.30.2

@tiptap/core

Patch Changes

... (truncated)

Changelog

Sourced from @tiptap/starter-kit's changelog.

3.30.5

Patch Changes

Updated dependencies [d0d499b]

@tiptap/core@3.30.5

@tiptap/extension-blockquote@3.30.5

@tiptap/extension-bold@3.30.5

@tiptap/extension-code@3.30.5

@tiptap/extension-code-block@3.30.5

@tiptap/extension-document@3.30.5

@tiptap/extension-hard-break@3.30.5

@tiptap/extension-heading@3.30.5

@tiptap/extension-horizontal-rule@3.30.5

@tiptap/extension-italic@3.30.5

@tiptap/extension-link@3.30.5

@tiptap/extension-list@3.30.5

@tiptap/extension-paragraph@3.30.5

@tiptap/extension-strike@3.30.5

@tiptap/extension-text@3.30.5

@tiptap/extension-underline@3.30.5

@tiptap/extensions@3.30.5

@tiptap/extension-list-item@3.30.5

@tiptap/extension-list-keymap@3.30.5

@tiptap/extension-bullet-list@3.30.5

@tiptap/extension-ordered-list@3.30.5

@tiptap/extension-dropcursor@3.30.5

@tiptap/extension-gapcursor@3.30.5

@tiptap/pm@3.30.5

3.30.4

Patch Changes

Updated dependencies [01d7af8]

@tiptap/core@3.30.4

@tiptap/extension-blockquote@3.30.4

@tiptap/extension-bold@3.30.4

@tiptap/extension-code@3.30.4

@tiptap/extension-code-block@3.30.4

@tiptap/extension-document@3.30.4

@tiptap/extension-hard-break@3.30.4

@tiptap/extension-heading@3.30.4

@tiptap/extension-horizontal-rule@3.30.4

@tiptap/extension-italic@3.30.4

@tiptap/extension-link@3.30.4

@tiptap/extension-list@3.30.4

@tiptap/extension-paragraph@3.30.4

@tiptap/extension-strike@3.30.4

@tiptap/extension-text@3.30.4

... (truncated)

Commits

b0c188b chore(release): release new stable release (#8261)
55f59e4 chore(release): release new stable release (#8260)
db790a7 chore(release): release new stable release (#8216)
f434577 chore: migrate over to vite+ for tooling (#8151)
cef2c9a chore(release): release new stable release (#8190)
See full diff in compare view

Updates happy-dom from 20.11.2 to 20.11.12

Release notes

Sourced from happy-dom's releases.

v20.11.12

👷‍♂️ Patch fixes

Add check for if the node is still a parent during disconnect - By @capricorn86 in task #2322

v20.11.11

👷‍♂️ Patch fixes

Use proxy as parent node in Node.connectedToNode - By @diegohaz in task #2253

v20.11.10

👷‍♂️ Patch fixes

Return default validationMessage for built-in constraint violations - By @mixelburg in task #2187

v20.11.9

👷‍♂️ Patch fixes

Make sure that the element has been upgraded before invoking reaction callback in custom elements - By @capricorn86 in task #2317

v20.11.8

👷‍♂️ Patch fixes

Values pushed or assigned to the adoptedStyleSheet array should be validated - By @capricorn86 in task #2315

v20.11.7

👷‍♂️ Patch fixes

The properties Document.adoptedStyleSheets and ShadowRoot.adoptedStyleSheets should validate it's value - By @capricorn86 in task #2313

v20.11.6

👷‍♂️ Patch fixes

Updates docs for the global-registrator package - By @capricorn86 in task #2300

v20.11.5

👷‍♂️ Patch fixes

Allow explicit element types for querySelector (e.g. querySelector<HTMLInputElement>(".my-input")) - By @cyphercodes

v20.11.4

👷‍♂️ Patch fixes

Fixes the CORS check fetch() to match origins instead of host and protocol - By @rexxars in task #1490

v20.11.3

👷‍♂️ Patch fixes

Make document.links return a live HTMLCollection - By @bangseongbeom in task #2299

Copy labels array to prevent mutation of cached querySelectorAll result - By @mixelburg in task #2226

Commits

3d282e5 fix: #2322 Add check for if the node is still a parent during disconnect (#...
64e2c77 fix: #2253 Use proxy as parent node in Node.connectedToNode() (#2254)
a00ec69 fix: #2319 Removing a child incorrectly calls flow for connecting node (#2321)
152b5d8 fix: #2319 Removing a child incorrectly calls flow for connecting node (#2320)
1100b9c fix: #2187 Return default validationMessage for built-in constraint violati...
1893795 fix: #2317 Make sure that the element has been upgraded before invoking rea...
00fcf21 fix: #2315 Values pushed or assigned to the adoptedStyleSheet array should ...
9a9e615 fix: #2313 The properties Document.adoptedStyleSheets and ShadowRoot.adopte...
d43c106 fix: #2300 Updates docs for the global-registrator package (#2301)
e978bc8 fix: Allow explicit element types for querySelector (#2283)
Additional commits viewable in compare view

Updates vite from 8.2.1 to 8.2.2

Release notes

Sourced from vite's releases.

plugin-legacy@8.2.2

Please refer to CHANGELOG.md for details.

v8.2.2

Please refer t...
Description has been truncated

Bumps the npm-dependencies group with 17 updates: | Package | From | To | | --- | --- | --- | | [@cloudflare/workers-types](https://github.com/cloudflare/workerd) | `5.20260814.1` | `5.20260828.1` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.10` | `4.1.11` | | [hono](https://github.com/honojs/hono) | `4.13.2` | `4.13.5` | | [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.123.0` | `4.127.0` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.2.0` | `26.4.0` | | [@tiptap/core](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/core) | `3.30.1` | `3.30.5` | | [@tiptap/extension-image](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-image) | `3.30.1` | `3.30.5` | | [@tiptap/extension-placeholder](https://github.com/ueberdosis/tiptap/tree/HEAD/packages-deprecated/extension-placeholder) | `3.30.1` | `3.30.5` | | [@tiptap/extension-table](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-table) | `3.30.1` | `3.30.5` | | [@tiptap/extension-table-cell](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-table-cell) | `3.30.1` | `3.30.5` | | [@tiptap/extension-table-header](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-table-header) | `3.30.1` | `3.30.5` | | [@tiptap/extension-table-row](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-table-row) | `3.30.1` | `3.30.5` | | [@tiptap/extension-task-item](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-task-item) | `3.30.1` | `3.30.5` | | [@tiptap/extension-task-list](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-task-list) | `3.30.1` | `3.30.5` | | [@tiptap/starter-kit](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/starter-kit) | `3.30.1` | `3.30.5` | | [happy-dom](https://github.com/capricorn86/happy-dom) | `20.11.2` | `20.11.12` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.1` | `8.2.2` | Updates `@cloudflare/workers-types` from 5.20260814.1 to 5.20260828.1 - [Release notes](https://github.com/cloudflare/workerd/releases) - [Changelog](https://github.com/cloudflare/workerd/blob/main/RELEASE.md) - [Commits](https://github.com/cloudflare/workerd/commits) Updates `vitest` from 4.1.10 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest) Updates `hono` from 4.13.2 to 4.13.5 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.13.2...v4.13.5) Updates `wrangler` from 4.123.0 to 4.127.0 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.127.0/packages/wrangler) Updates `@types/node` from 26.2.0 to 26.4.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@tiptap/core` from 3.30.1 to 3.30.5 - [Release notes](https://github.com/ueberdosis/tiptap/releases) - [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.30.5/packages/core/CHANGELOG.md) - [Commits](https://github.com/ueberdosis/tiptap/commits/v3.30.5/packages/core) Updates `@tiptap/extension-image` from 3.30.1 to 3.30.5 - [Release notes](https://github.com/ueberdosis/tiptap/releases) - [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.30.5/packages/extension-image/CHANGELOG.md) - [Commits](https://github.com/ueberdosis/tiptap/commits/v3.30.5/packages/extension-image) Updates `@tiptap/extension-placeholder` from 3.30.1 to 3.30.5 - [Release notes](https://github.com/ueberdosis/tiptap/releases) - [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.30.5/packages-deprecated/extension-placeholder/CHANGELOG.md) - [Commits](https://github.com/ueberdosis/tiptap/commits/v3.30.5/packages-deprecated/extension-placeholder) Updates `@tiptap/extension-table` from 3.30.1 to 3.30.5 - [Release notes](https://github.com/ueberdosis/tiptap/releases) - [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.30.5/packages/extension-table/CHANGELOG.md) - [Commits](https://github.com/ueberdosis/tiptap/commits/v3.30.5/packages/extension-table) Updates `@tiptap/extension-table-cell` from 3.30.1 to 3.30.5 - [Release notes](https://github.com/ueberdosis/tiptap/releases) - [Commits](https://github.com/ueberdosis/tiptap/commits/v3.30.5/packages/extension-table-cell) Updates `@tiptap/extension-table-header` from 3.30.1 to 3.30.5 - [Release notes](https://github.com/ueberdosis/tiptap/releases) - [Commits](https://github.com/ueberdosis/tiptap/commits/v3.30.5/packages/extension-table-header) Updates `@tiptap/extension-table-row` from 3.30.1 to 3.30.5 - [Release notes](https://github.com/ueberdosis/tiptap/releases) - [Commits](https://github.com/ueberdosis/tiptap/commits/v3.30.5/packages/extension-table-row) Updates `@tiptap/extension-task-item` from 3.30.1 to 3.30.5 - [Release notes](https://github.com/ueberdosis/tiptap/releases) - [Commits](https://github.com/ueberdosis/tiptap/commits/v3.30.5/packages/extension-task-item) Updates `@tiptap/extension-task-list` from 3.30.1 to 3.30.5 - [Release notes](https://github.com/ueberdosis/tiptap/releases) - [Commits](https://github.com/ueberdosis/tiptap/commits/v3.30.5/packages/extension-task-list) Updates `@tiptap/starter-kit` from 3.30.1 to 3.30.5 - [Release notes](https://github.com/ueberdosis/tiptap/releases) - [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.30.5/packages/starter-kit/CHANGELOG.md) - [Commits](https://github.com/ueberdosis/tiptap/commits/v3.30.5/packages/starter-kit) Updates `happy-dom` from 20.11.2 to 20.11.12 - [Release notes](https://github.com/capricorn86/happy-dom/releases) - [Commits](capricorn86/happy-dom@v20.11.2...v20.11.12) Updates `vite` from 8.2.1 to 8.2.2 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.2.2/packages/vite) --- updated-dependencies: - dependency-name: "@cloudflare/workers-types" dependency-version: 5.20260828.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: vitest dependency-version: 4.1.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: hono dependency-version: 4.13.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: wrangler dependency-version: 4.127.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: "@types/node" dependency-version: 26.4.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: "@tiptap/core" dependency-version: 3.30.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: "@tiptap/extension-image" dependency-version: 3.30.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: "@tiptap/extension-placeholder" dependency-version: 3.30.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: "@tiptap/extension-table" dependency-version: 3.30.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: "@tiptap/extension-table-cell" dependency-version: 3.30.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: "@tiptap/extension-table-header" dependency-version: 3.30.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: "@tiptap/extension-table-row" dependency-version: 3.30.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: "@tiptap/extension-task-item" dependency-version: 3.30.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: "@tiptap/extension-task-list" dependency-version: 3.30.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: "@tiptap/starter-kit" dependency-version: 3.30.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: happy-dom dependency-version: 20.11.12 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: vite dependency-version: 8.2.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 31, 2026

joelborch merged commit 8446efd into main Sep 2, 2026
5 checks passed

joelborch deleted the dependabot/npm_and_yarn/npm-dependencies-8e6f6fa652 branch September 2, 2026 11:53

Navigation Menu

build(deps): bump the npm-dependencies group with 17 updates - #35

build(deps): bump the npm-dependencies group with 17 updates#35
joelborch merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-dependencies-8e6f6fa652

dependabot Bot commented on behalf of github Aug 31, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Dependency	From	To
`@cloudflare/workers-types`	^5.20260825.1	^5.20260826.1
workerd	1.20260825.1	1.20260826.1

Conversation

dependabot Bot commented on behalf of github Aug 31, 2026

v4.1.11

🐞 Bug Fixes

View changes on GitHub

v4.13.5

Security fixes

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

v4.13.4

What's Changed

v4.13.3

What's Changed

wrangler@4.127.0

Minor Changes

Patch Changes

wrangler@4.126.0

Minor Changes

v3.30.5

@​tiptap/core

Patch Changes

v3.30.4

@​tiptap/core

Patch Changes

v3.30.3

@​tiptap/extension-text-style

Patch Changes

@​tiptap/extension-youtube

Patch Changes

@​tiptap/core

Patch Changes

@​tiptap/react

Patch Changes

@​tiptap/ai-toolkit

Minor Changes

v3.30.2

@​tiptap/core

Patch Changes

3.30.5

Patch Changes

3.30.4

Patch Changes

3.30.3

Patch Changes

3.30.2

Patch Changes

v3.30.5

@​tiptap/core

Patch Changes

v3.30.4

@​tiptap/core

Patch Changes

v3.30.3

@​tiptap/extension-text-style

Patch Changes

@​tiptap/extension-youtube

Patch Changes

@​tiptap/core

Patch Changes

@​tiptap/react

Patch Changes

@​tiptap/ai-toolkit

Minor Changes

v3.30.2

@​tiptap/core

Patch Changes

3.30.5

Patch Changes

3.30.4

Patch Changes

3.30.3

Patch Changes

3.30.2

Patch Changes

v3.30.5

@​tiptap/core

Patch Changes

v3.30.4

@​tiptap/core

Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion

`@tiptap/core`

`@tiptap/core`

`@tiptap/extension-text-style`

`@tiptap/extension-youtube`

`@tiptap/core`

`@tiptap/react`

`@tiptap/ai-toolkit`

`@tiptap/core`

`@tiptap/core`

`@tiptap/core`

`@tiptap/extension-text-style`

`@tiptap/extension-youtube`

`@tiptap/core`

`@tiptap/react`

`@tiptap/ai-toolkit`

`@tiptap/core`

`@tiptap/core`

`@tiptap/core`

`@tiptap/extension-text-style`

`@tiptap/extension-youtube`

`@tiptap/core`

`@tiptap/react`

`@tiptap/ai-toolkit`

`@tiptap/core`

`@tiptap/core`

`@tiptap/core`

`@tiptap/extension-text-style`

`@tiptap/extension-youtube`

`@tiptap/core`

`@tiptap/react`

`@tiptap/ai-toolkit`

`@tiptap/core`

`@tiptap/core`

`@tiptap/core`

`@tiptap/extension-text-style`

`@tiptap/extension-youtube`

`@tiptap/core`

`@tiptap/react`

`@tiptap/ai-toolkit`