build(deps): bump the npm-dependencies group with 18 updates by dependabot[bot] · Pull Request #36 · joelborch/flow

dependabot · 2026-09-07T10:31:21Z

Bumps the npm-dependencies group with 18 updates:

Package	From	To
@cloudflare/workers-types	`5.20260828.1`	`5.20260904.1`
vitest	`4.1.11`	`5.0.0`
zod	`4.4.3`	`4.5.4`
wrangler	`4.127.0`	`4.129.0`
@types/node	`26.4.0`	`26.4.1`
tsx	`4.23.12`	`4.23.13`
@preact/signals	`2.11.1`	`2.11.2`
@tiptap/core	`3.30.5`	`3.31.2`
@tiptap/extension-image	`3.30.5`	`3.31.2`
@tiptap/extension-placeholder	`3.30.5`	`3.31.2`
@tiptap/extension-table	`3.30.5`	`3.31.2`
@tiptap/extension-table-cell	`3.30.5`	`3.31.2`
@tiptap/extension-table-header	`3.30.5`	`3.31.2`
@tiptap/extension-table-row	`3.30.5`	`3.31.2`
@tiptap/extension-task-item	`3.30.5`	`3.31.2`
@tiptap/extension-task-list	`3.30.5`	`3.31.2`
@tiptap/starter-kit	`3.30.5`	`3.31.2`
happy-dom	`20.11.12`	`20.14.0`

Updates @cloudflare/workers-types from 5.20260828.1 to 5.20260904.1

Commits

See full diff in compare view

Updates vitest from 4.1.11 to 5.0.0

Release notes

Sourced from vitest's releases.

v5.0.0

Vitest 5 is officially out! This release focuses on performance and brings a lot of new features while fixing long-standing bugs. See our blog post for the official announcement.

🚨 Breaking Changes

Replace loupe.inspect with pretty-format - by @hi-ogawa, Claude Opus 5 (1M context) and OpenAI Codex in vitest-dev/vitest#9609 (3f802)

Remove quotes from string values in test.for/each title $ variable (take 2) - by @hi-ogawa in vitest-dev/vitest#10170 (04d37)

Default attachmentsDir from .vitest-attachements/ to .vitest/attachments/ - by @MdSadiqMd in vitest-dev/vitest#10186 (1ba73)

Remove sequential test/suite options in favor of concurrent - by @hi-ogawa and OpenAI Codex in vitest-dev/vitest#10198 (9229f)

Represent locator as an object instead of a string - by @sheremet-va in vitest-dev/vitest#10212 (80f07)

Inline expect package - by @sheremet-va in vitest-dev/vitest#10221 (ad162)

Remove deprecated entry points - by @sheremet-va in vitest-dev/vitest#10222 (994c6)

Require Node.js 22 and Vite 6.4 - by @sheremet-va in vitest-dev/vitest#10178 (38762)

Fail expect.poll when function didn't resolve in time - by @hi-ogawa and OpenAI Codex in vitest-dev/vitest#10233 (4df04)

Throw an error if hoistable methods are outside the top level scope - by @sheremet-va in vitest-dev/vitest#10460 (d0b4f)

toHaveTextContent is strict, add toMatchTextContent as alternative - by @sheremet-va in vitest-dev/vitest#10473 (18f30)

Don't lookup config file from ancestor directories - by @hi-ogawa, OpenAI Codex and Hiroshi Ogawa in vitest-dev/vitest#10428 (945d9)

Inline @vitest/runner package, do not publish it anymore - by @sheremet-va in vitest-dev/vitest#10511 (6d6e4)

Allow mutating happy-dom/jsdom window object - by @hi-ogawa, Hiroshi Ogawa and OpenAI Codex in vitest-dev/vitest#10373 (206e8)

Expose concurrencyId/workerId on TestModule's diagnostics, make id 1-based - by @sheremet-va in vitest-dev/vitest#10516 (bdd98)

Add screenshotDirectory config to browser.expect.toMatchScreenshot - by @macarie in vitest-dev/vitest#10592 (a60de)

Update @sinonjs/fake-timers and support mocking Temporal - by @hi-ogawa, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in vitest-dev/vitest#10654 (f8b15)

Remove webdriverio package - by @sheremet-va in vitest-dev/vitest#10675 (5fed6)

Clear mocks by default before each test - by @sheremet-va in vitest-dev/vitest#10613 (0f646)

Don't emit localStorage warnings on Node 26, fail gracefully when worker fails to start - by @sheremet-va in vitest-dev/vitest#10293 (334ed)

Separate config resolution from the server creation - by @sheremet-va in vitest-dev/vitest#10554 (1c0ec)

Inline projects extend the root config by default - by @sheremet-va in vitest-dev/vitest#10750 (fec00)

Enable mocking Temporal without fake timers - by @fabon-f, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in vitest-dev/vitest#10757 (ac2d4)

Support nested projects - by @sheremet-va in vitest-dev/vitest#10846 (ec367)

Use > as separator in -t, calculate only once - by @sheremet-va in vitest-dev/vitest#10686 (a0b20)

Fail the test when an asynchronous assertion is not awaited - by @sheremet-va in vitest-dev/vitest#10868 (86d4a)

Share the Vite server between inline projects - by @sheremet-va in vitest-dev/vitest#10848 (d87c9)

Parse files statically in vitest list by default - by @sheremet-va in vitest-dev/vitest#11088 (51e94)

benchmark:

Rewrite the public API - by @sheremet-va in vitest-dev/vitest#10113 (19f6e)

browser:

Iframe scale - by @macarie in vitest-dev/vitest#9745 (b6398)

Enable locators.exact by default - by @sheremet-va in vitest-dev/vitest#10430 (e2032)

Require sessionId for orchestrator html request - by @hi-ogawa, Hiroshi Ogawa and OpenAI Codex in vitest-dev/vitest#10522 (79b7d)

Save failure screenshots in attachmentsDir - by @macarie in vitest-dev/vitest#10917 (3b5bb)

coverage:

include/exclude globs too eager - by @AriPerkkio in vitest-dev/vitest#9818 (edacb)

Allow thresholds.perFile to accept an object - by @vladlenskiy and @AriPerkkio in vitest-dev/vitest#10190 (13b78)

expect:

Fix toThrow("") behavior by reverting #6710 - by @hi-ogawa in vitest-dev/vitest#9643 and vitest-dev/vitest#6710 (6c3e4)

mocker:

Deserialize automock as automock - by @nami8824 in vitest-dev/vitest#10192 (2f892)

reporters:

blob reporter and --merge-reports default to .vitest/blob/ - by @AriPerkkio in vitest-dev/vitest#10232 (d22b0)

Write json and junit reporter output files to .vitest by default - by @hi-ogawa, Hiroshi Ogawa, OpenCode (gpt-5.6-sol) and @AriPerkkio in vitest-dev/vitest#10621 (58577)

... (truncated)

Commits

f441c6f chore: release v5.0.0 (#11130)
d46a747 fix: treat test.describe as a suite during static collection (#11128)
584cf30 fix: add a warning if inline project has duplicate plugins due to unexpected ...
f08ce4b fix: apply queued mocks from doMock() in queue order (fixes #10706) (#11127)
897f51f chore: release v5.0.0-rc.4 (#11107)
1339b06 chore(deps): update all non-major dependencies (#11104)
51e9494 feat!: parse files statically in vitest list by default (#11088)
2122ffd fix: propagate --maxWorkers to projects (#11102)
dc10f5f fix(browser): report the action error when a task times out (#11101)
d4fe198 feat: promote clearCache out of experimental (#11086)
Additional commits viewable in compare view

Updates zod from 4.4.3 to 4.5.4

Release notes

Sourced from zod's releases.

v4.5.4

Commits:

84e416fbf4740527bbc8f319634f4e1b065bb42c fix(v4): stop the cycle walk from firing a default factory (#6500)

e8e206fa33ac5fe7ce20a2beb12d57b1cb3df653 4.5.4

v4.5.3

Commits:

e6b6ab347675cd2bd54b1bdbed16f98c59be82a9 docs(blog): widen the z.compile example to a 20-property schema

87d6464418582bb96fc665a01f852ca6da324ad0 fix(docs): drop the OG description when the title wraps past two lines

99fce394a026823e602b9c30d8d5d9f5f1932ce7 bench(v4): z.compile() against zod-compiler (#6499)

e3a695b6bf3f0d591ea682816e3cdaea04b0f967 docs(v4): record the email regex and container output-shape findings under Open

7e24a24288183ce02554f1ded7775d0650a7b7e6 docs(blog): drop the reading time and put a GitHub link in the navbar

eab51ff3592b2d11d863f4ee4d5452f31a3de1b6 fix(v4): emit record numeric keys as strings in toJSONSchema (#6497)

v4.5.2

Commits:

a354314ac04fdd5484aa62dd5c3a4b553211a0e4 fix(docs): keep blog posts out of the docs collection (#6484)

d378c42aff6869f0929058a7923cd775880f5c4c ci: drop canary publishing from the release workflow (#6487)

212b941791e7faae078e17645eb612824fd8f79a fix(v4): let a prototype method getter answer a bare call so vi.spyOn works (#6488)

e7576f542a7bc7ef3cc5eeec237714fd0e6b6e98 docs(blog): let the page show through the navbar in dark mode (#6489)

fedb06fafe33a66ce0b5c236ad2557e0a5a170fe fix(docs): match the blog TOC hover bar to the 2px active indicator

6c932fcb2eea6eb671710ea058ca9fdc382ada89 chore: bump devcontainer image to Node 24 (#6470)

6635d9dd367a664109de83c021995821f48efa29 docs(blog): soften the "method memoization" attribution

019ae299cc75daa132bf1acf59086a520abf6b85 fix(docs): drop ISR on the docs route so the home page hydrates

652bb438aa4c626c1cd7948c6849c4691239fca7 chore(docs): drop the scroll log from the route-change scroller

571c8e8a3d73b4305f4abfdd6977773cc12f2bf5 fix(docs): render blog tabs with the stock fumadocs tab card

9a193aa24b4efa3b315b91d4c56c8bc385b8513f 4.5.2

v4.5.1

Commits:

2e862dbf89da2835e5206a8fd3d3be61afe3cf7f ci: gate the GitHub release and JSR publish on the version being live on npm

8e03380510db36fa6fda979fc78a375fdea8021c 4.5.1

v4.5.0

Zod 4.5 is now available.
npm install zod@latest
At a glance:

https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADmhttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADmhttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD — the flagship feature of Zod 4.5

https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADChttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD — 12–19 digits plus Luhn checksum

https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADshttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADshttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD — the multi-property counterpart to z.property()

https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADPhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD/https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADxhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADPhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADxhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD

... (truncated)

Commits

e8e206f 4.5.4
84e416f fix(v4): stop the cycle walk from firing a default factory (#6500)
1a16102 4.5.3
eab51ff fix(v4): emit record numeric keys as strings in toJSONSchema (#6497)
7e24a24 docs(blog): drop the reading time and put a GitHub link in the navbar
e3a695b docs(v4): record the email regex and container output-shape findings under Open
99fce39 bench(v4): z.compile() against zod-compiler (#6499)
87d6464 fix(docs): drop the OG description when the title wraps past two lines
e6b6ab3 docs(blog): widen the z.compile example to a 20-property schema
9a193aa 4.5.2
Additional commits viewable in compare view

Updates wrangler from 4.127.0 to 4.129.0

Release notes

Sourced from wrangler's releases.

wrangler@4.129.0

Minor Changes

#15460 93d72a5 Thanks @QnJ1c2kNCg! - Support gzip compression for JSON Pipelines sinks

Pipelines is in open beta. wrangler pipelines sinks create and the interactive setup flow now pass the selected JSON compression to the Pipelines API. JSON sinks accept uncompressed or gzip, while Parquet retains its existing compression options and zstd default.

#15358 d2d8eea Thanks @pombosilva! - Add a --json flag to the wrangler workflows commands

Every wrangler workflows command now accepts --json, which emits the raw API payload instead of the human-readable rendering. The formatted output remains the default, so existing usage is unaffected:

wrangler workflows instances list my-workflow --json

The JSON output carries raw values rather than a serialisation of the formatted view: ISO timestamps instead of locale-formatted dates, plain status strings instead of emojified labels, and no presentation-only derived fields.

Patch Changes

#15469 d40a634 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

@cloudflare/workers-types ^5.20260831.1 ^5.20260902.1

workerd 1.20260831.1 1.20260902.1

#15481 7c1b2a6 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

@cloudflare/workers-types ^5.20260902.1 ^5.20260903.1

workerd 1.20260902.1 1.20260903.1

#15472 f6fb347 Thanks @emily-shen! - Tolerate missing permissions during wrangler delete cleanup checks

wrangler delete now warns and continues when it cannot inspect Worker dependencies or clean up legacy Workers Sites KV namespaces because of missing permissions. The Worker delete request itself still fails normally if the token cannot delete the Worker.

#15472 f6fb347 Thanks @emily-shen! - Tolerate missing resource permissions during resource provisioning

When Wrangler cannot check whether a bound resource exists because the API returns a 403, it now skips automatic provisioning for that resource type and continues the deploy. The deploy may still fail later if the resource is missing.

#15476 dc24057 Thanks @christhorwarth! - Fix remote development with static assets for API tokens using granular Worker permissions

Wrangler now creates Workers.dev preview sessions through the Worker-scoped endpoint and derives the preview hostname from the session response. This avoids requiring account-level Workers subdomain access.

Updated dependencies [00a9f2f, 1dba24a, d40a634, 7c1b2a6]:

miniflare@5.20260903.0-alpha

... (truncated)

Commits

be87ff0 Version Packages (#15461)
f6fb347 tolerate missing permissions for pre-flight checks (#15472)
dc24057 [wrangler] Use worker-scoped preview sessions (#15476)
d2d8eea [wrangler] Add --json output to Workflows commands (#15358)
93d72a5 PIPE-635: Support gzip compression for JSON sinks (#15460)
b7b4ff8 Version Packages (#15450)
ea28cc3 [wrangler] Add observability query string redaction (#15379)
1809c5e [wrangler] Stop publishing build metafile (#15398)
10d6bfb Support partial manifests in build output (#15388)
dbbb795 Move binding utilities into workers-utils (#15454)
Additional commits viewable in compare view

Updates @types/node from 26.4.0 to 26.4.1

Commits

See full diff in compare view

Updates tsx from 4.23.12 to 4.23.13

Release notes

Sourced from tsx's releases.

v4.23.13

4.23.13 (2026-08-30)

Bug Fixes

cache: bound shared transform cache memory (#835) (28e1f12)

This release is also available on:

npm package (@latest dist-tag)

Commits

28e1f12 fix(cache): bound shared transform cache memory (#835)
See full diff in compare view

Updates @preact/signals from 2.11.1 to 2.11.2

Release notes

Sourced from @preact/signals's releases.

@preact/signals@2.11.2

Patch Changes

#979 7526ad0 Thanks @andrewiggins! - Stop component tracking before Preact reconciles the returned VNode so Signals read by DOM property getters do not subscribe the parent component.

Changelog

Sourced from @preact/signals's changelog.

2.11.2

Patch Changes

#979 7526ad0 Thanks @andrewiggins! - Stop component tracking before Preact reconciles the returned VNode so Signals read by DOM property getters do not subscribe the parent component.

Commits

b0df09a Version Packages (#980)
7526ad0 Prevent parent signal subscriptions during DOM diff (#979)
See full diff in compare view

Updates @tiptap/core from 3.30.5 to 3.31.2

Release notes

Sourced from @tiptap/core's releases.

v3.31.2

@tiptap/pm

Patch Changes

Bump prosemirror-view to ^1.42.3, which fixes an XSS vulnerability where pasting crafted HTML could run arbitrary JavaScript (GHSA-c8x8-7fp4-3x9w).

v3.31.1

@tiptap/core

Patch Changes

Fix freezes in framework-based node views on iOS and Android

v3.31.0

@tiptap/react

Minor Changes

e7bf804: Align selected with ProseMirror node selections by default, expose text selections through selectionInside, and keep selectedOnTextSelection compatible.

v3.30.6

@tiptap/core

Patch Changes

Nested lists exported to Markdown now keep their hierarchy when the file is read back by other Markdown tools.

@tiptap/extension-list

Patch Changes

Nested lists exported to Markdown now keep their hierarchy when the file is read back by other Markdown tools.

@tiptap/extension-youtube

Patch Changes

Pasting a YouTube iframe without a src attribute no longer crashes the editor. The embed is kept without a source.

@tiptap/markdown

Patch Changes

Fix Markdown serialization of whitespace-only marked text.

@tiptap/react

Patch Changes

... (truncated)

Changelog

Sourced from @tiptap/core's changelog.

3.31.2

Patch Changes

Updated dependencies [c56b4c9]

@tiptap/pm@3.31.2

3.31.1

Patch Changes

cd32a2f: Fix freezes in framework-based node views on iOS and Android

@tiptap/pm@3.31.1

3.31.0

Patch Changes

@tiptap/pm@3.31.0

3.30.6

Patch Changes

9f844ab: Nested lists exported to Markdown now keep their hierarchy when the file is read back by other Markdown tools.

@tiptap/pm@3.30.6

Commits

f38fec0 chore(release): release new stable release (#8304)
bd35333 chore(release): release new stable release (#8297)
cd32a2f fix: ignore iOS chrome mutations outside contentDOM (#8221) (#8296)
0280f4a chore(release): release new stable release (#8292)
e7bf804 fix: linting
5302fda chore(release): release new stable release (#8264)
9f844ab fix(markdown): indent nested list content to the parent marker (#8219) (#8274)
See full diff in compare view

Updates @tiptap/extension-image from 3.30.5 to 3.31.2

Release notes

Sourced from @tiptap/extension-image's releases.

v3.31.2

@tiptap/pm

Patch Changes

Bump prosemirror-view to ^1.42.3, which fixes an XSS vulnerability where pasting crafted HTML could run arbitrary JavaScript (GHSA-c8x8-7fp4-3x9w).

v3.31.1

@tiptap/core

Patch Changes

Fix freezes in framework-based node views on iOS and Android

v3.31.0

@tiptap/react

Minor Changes

e7bf804: Align selected with ProseMirror node selections by default, expose text selections through selectionInside, and keep selectedOnTextSelection compatible.

v3.30.6

@tiptap/core

Patch Changes

Nested lists exported to Markdown now keep their hierarchy when the file is read back by other Markdown tools.

@tiptap/extension-list

Patch Changes

Nested lists exported to Markdown now keep their hierarchy when the file is read back by other Markdown tools.

@tiptap/extension-youtube

Patch Changes

Pasting a YouTube iframe without a src attribute no longer crashes the editor. The embed is kept without a source.

@tiptap/markdown

Patch Changes

Fix Markdown serialization of whitespace-only marked text.

@tiptap/react

Patch Changes

... (truncated)

Changelog

Sourced from @tiptap/extension-image's changelog.

3.31.2

Patch Changes

@tiptap/core@3.31.2

3.31.1

Patch Changes

Updated dependencies [cd32a2f]

@tiptap/core@3.31.1

3.31.0

Patch Changes

@tiptap/core@3.31.0

3.30.6

Patch Changes

Updated dependencies [9f844ab]

@tiptap/core@3.30.6

Commits

f38fec0 chore(release): release new stable release (#8304)
bd35333 chore(release): release new stable release (#8297)
0280f4a chore(release): release new stable release (#8292)
5302fda chore(release): release new stable release (#8264)
See full diff in compare view

Updates @tiptap/extension-placeholder from 3.30.5 to 3.31.2

Release notes

Sourced from @tiptap/extension-placeholder's releases.

v3.31.2

@tiptap/pm

Patch Changes

Bump prosemirror-view to ^1.42.3, which fixes an XSS vulnerability where pasting crafted HTML could run arbitrary JavaScript (GHSA-c8x8-7fp4-3x9w).

v3.31.1

@tiptap/core

Patch Changes

Fix freezes in framework-based node views on iOS and Android

v3.31.0

@tiptap/react

Minor Changes

e7bf804: Align selected with ProseMirror node selections by default, expose text selections through selectionInside, and keep selectedOnTextSelection compatible.

v3.30.6

@tiptap/core

Patch Changes

Nested lists exported to Markdown now keep their hierarchy when the file is read back by other Markdown tools.

@tiptap/extension-list

Patch Changes

Nested lists exported to Markdown now keep their hierarchy when the file is read back by other Markdown tools.

@tiptap/extension-youtube

Patch Changes

Pasting a YouTube iframe without a src attribute no longer crashes the editor. The embed is kept without a source.

@tiptap/markdown

Patch Changes

Fix Markdown serialization of whitespace-only marked text.

@tiptap/react

Patch Changes

... (truncated)

Details

Description has been truncated

Bumps the npm-dependencies group with 18 updates: | Package | From | To | | --- | --- | --- | | [@cloudflare/workers-types](https://github.com/cloudflare/workerd) | `5.20260828.1` | `5.20260904.1` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.11` | `5.0.0` | | [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.5.4` | | [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.127.0` | `4.129.0` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.4.0` | `26.4.1` | | [tsx](https://github.com/privatenumber/tsx) | `4.23.12` | `4.23.13` | | [@preact/signals](https://github.com/preactjs/signals/tree/HEAD/packages/preact) | `2.11.1` | `2.11.2` | | [@tiptap/core](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/core) | `3.30.5` | `3.31.2` | | [@tiptap/extension-image](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-image) | `3.30.5` | `3.31.2` | | [@tiptap/extension-placeholder](https://github.com/ueberdosis/tiptap/tree/HEAD/packages-deprecated/extension-placeholder) | `3.30.5` | `3.31.2` | | [@tiptap/extension-table](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-table) | `3.30.5` | `3.31.2` | | [@tiptap/extension-table-cell](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-table-cell) | `3.30.5` | `3.31.2` | | [@tiptap/extension-table-header](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-table-header) | `3.30.5` | `3.31.2` | | [@tiptap/extension-table-row](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-table-row) | `3.30.5` | `3.31.2` | | [@tiptap/extension-task-item](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-task-item) | `3.30.5` | `3.31.2` | | [@tiptap/extension-task-list](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-task-list) | `3.30.5` | `3.31.2` | | [@tiptap/starter-kit](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/starter-kit) | `3.30.5` | `3.31.2` | | [happy-dom](https://github.com/capricorn86/happy-dom) | `20.11.12` | `20.14.0` | Updates `@cloudflare/workers-types` from 5.20260828.1 to 5.20260904.1 - [Release notes](https://github.com/cloudflare/workerd/releases) - [Changelog](https://github.com/cloudflare/workerd/blob/main/RELEASE.md) - [Commits](https://github.com/cloudflare/workerd/commits) Updates `vitest` from 4.1.11 to 5.0.0 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.0/packages/vitest) Updates `zod` from 4.4.3 to 4.5.4 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.4.3...v4.5.4) Updates `wrangler` from 4.127.0 to 4.129.0 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.129.0/packages/wrangler) Updates `@types/node` from 26.4.0 to 26.4.1 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `tsx` from 4.23.12 to 4.23.13 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.23.12...v4.23.13) Updates `@preact/signals` from 2.11.1 to 2.11.2 - [Release notes](https://github.com/preactjs/signals/releases) - [Changelog](https://github.com/preactjs/signals/blob/main/packages/preact/CHANGELOG.md) - [Commits](https://github.com/preactjs/signals/commits/@preact/signals@2.11.2/packages/preact) Updates `@tiptap/core` from 3.30.5 to 3.31.2 - [Release notes](https://github.com/ueberdosis/tiptap/releases) - [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.31.2/packages/core/CHANGELOG.md) - [Commits](https://github.com/ueberdosis/tiptap/commits/v3.31.2/packages/core) Updates `@tiptap/extension-image` from 3.30.5 to 3.31.2 - [Release notes](https://github.com/ueberdosis/tiptap/releases) - [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.31.2/packages/extension-image/CHANGELOG.md) - [Commits](https://github.com/ueberdosis/tiptap/commits/v3.31.2/packages/extension-image) Updates `@tiptap/extension-placeholder` from 3.30.5 to 3.31.2 - [Release notes](https://github.com/ueberdosis/tiptap/releases) - [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.31.2/packages-deprecated/extension-placeholder/CHANGELOG.md) - [Commits](https://github.com/ueberdosis/tiptap/commits/v3.31.2/packages-deprecated/extension-placeholder) Updates `@tiptap/extension-table` from 3.30.5 to 3.31.2 - [Release notes](https://github.com/ueberdosis/tiptap/releases) - [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.31.2/packages/extension-table/CHANGELOG.md) - [Commits](https://github.com/ueberdosis/tiptap/commits/v3.31.2/packages/extension-table) Updates `@tiptap/extension-table-cell` from 3.30.5 to 3.31.2 - [Release notes](https://github.com/ueberdosis/tiptap/releases) - [Commits](https://github.com/ueberdosis/tiptap/commits/v3.31.2/packages/extension-table-cell) Updates `@tiptap/extension-table-header` from 3.30.5 to 3.31.2 - [Release notes](https://github.com/ueberdosis/tiptap/releases) - [Commits](https://github.com/ueberdosis/tiptap/commits/v3.31.2/packages/extension-table-header) Updates `@tiptap/extension-table-row` from 3.30.5 to 3.31.2 - [Release notes](https://github.com/ueberdosis/tiptap/releases) - [Commits](https://github.com/ueberdosis/tiptap/commits/v3.31.2/packages/extension-table-row) Updates `@tiptap/extension-task-item` from 3.30.5 to 3.31.2 - [Release notes](https://github.com/ueberdosis/tiptap/releases) - [Commits](https://github.com/ueberdosis/tiptap/commits/v3.31.2/packages/extension-task-item) Updates `@tiptap/extension-task-list` from 3.30.5 to 3.31.2 - [Release notes](https://github.com/ueberdosis/tiptap/releases) - [Commits](https://github.com/ueberdosis/tiptap/commits/v3.31.2/packages/extension-task-list) Updates `@tiptap/starter-kit` from 3.30.5 to 3.31.2 - [Release notes](https://github.com/ueberdosis/tiptap/releases) - [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.31.2/packages/starter-kit/CHANGELOG.md) - [Commits](https://github.com/ueberdosis/tiptap/commits/v3.31.2/packages/starter-kit) Updates `happy-dom` from 20.11.12 to 20.14.0 - [Release notes](https://github.com/capricorn86/happy-dom/releases) - [Commits](capricorn86/happy-dom@v20.11.12...v20.14.0) --- updated-dependencies: - dependency-name: "@cloudflare/workers-types" dependency-version: 5.20260904.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: vitest dependency-version: 5.0.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: npm-dependencies - dependency-name: zod dependency-version: 4.5.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: wrangler dependency-version: 4.129.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: "@types/node" dependency-version: 26.4.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: tsx dependency-version: 4.23.13 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: "@preact/signals" dependency-version: 2.11.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: "@tiptap/core" dependency-version: 3.31.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: "@tiptap/extension-image" dependency-version: 3.31.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: "@tiptap/extension-placeholder" dependency-version: 3.31.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: "@tiptap/extension-table" dependency-version: 3.31.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: "@tiptap/extension-table-cell" dependency-version: 3.31.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: "@tiptap/extension-table-header" dependency-version: 3.31.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: "@tiptap/extension-table-row" dependency-version: 3.31.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: "@tiptap/extension-task-item" dependency-version: 3.31.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: "@tiptap/extension-task-list" dependency-version: 3.31.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: "@tiptap/starter-kit" dependency-version: 3.31.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: happy-dom dependency-version: 20.14.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 7, 2026

Navigation Menu

build(deps): bump the npm-dependencies group with 18 updates - #36

build(deps): bump the npm-dependencies group with 18 updates#36
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-dependencies-fdab9c2a20

dependabot Bot commented on behalf of github Sep 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Dependency	From	To
`@cloudflare/workers-types`	^5.20260831.1	^5.20260902.1
workerd	1.20260831.1	1.20260902.1

Dependency	From	To
`@cloudflare/workers-types`	^5.20260902.1	^5.20260903.1
workerd	1.20260902.1	1.20260903.1

Conversation

dependabot Bot commented on behalf of github Sep 7, 2026

v5.0.0

🚨 Breaking Changes

v4.5.4

Commits:

v4.5.3

Commits:

v4.5.2

Commits:

v4.5.1

Commits:

v4.5.0

wrangler@4.129.0

Minor Changes

Patch Changes

v4.23.13

4.23.13 (2026-08-30)

Bug Fixes

@​preact/signals@​2.11.2

Patch Changes

2.11.2

Patch Changes

v3.31.2

@​tiptap/pm

Patch Changes

v3.31.1

@​tiptap/core

Patch Changes

v3.31.0

@​tiptap/react

Minor Changes

v3.30.6

@​tiptap/core

Patch Changes

@​tiptap/extension-list

Patch Changes

@​tiptap/extension-youtube

Patch Changes

@​tiptap/markdown

Patch Changes

@​tiptap/react

Patch Changes

3.31.2

Patch Changes

3.31.1

Patch Changes

3.31.0

Patch Changes

3.30.6

Patch Changes

v3.31.2

@​tiptap/pm

Patch Changes

v3.31.1

@​tiptap/core

Patch Changes

v3.31.0

@​tiptap/react

Minor Changes

v3.30.6

@​tiptap/core

Patch Changes

@​tiptap/extension-list

Patch Changes

@​tiptap/extension-youtube

Patch Changes

@​tiptap/markdown

Patch Changes

@​tiptap/react

Patch Changes

3.31.2

Patch Changes

3.31.1

Patch Changes

3.31.0

Patch Changes

3.30.6

Patch Changes

v3.31.2

`@preact/signals@2`.11.2

`@tiptap/pm`

`@tiptap/core`

`@tiptap/react`

`@tiptap/core`

`@tiptap/extension-list`

`@tiptap/extension-youtube`

`@tiptap/markdown`

`@tiptap/react`

`@tiptap/pm`

`@tiptap/core`

`@tiptap/react`

`@tiptap/core`

`@tiptap/extension-list`

`@tiptap/extension-youtube`

`@tiptap/markdown`

`@tiptap/react`

`@tiptap/pm`

`@tiptap/core`

`@tiptap/react`

`@tiptap/core`

`@tiptap/extension-list`

`@tiptap/extension-youtube`

`@tiptap/markdown`

`@tiptap/react`