Skip to content

[stable34] Fix npm audit - #9272

Open
nextcloud-command wants to merge 5 commits into
stable34from
automated/noid/stable34-fix-npm-audit
Open

[stable34] Fix npm audit#9272
nextcloud-command wants to merge 5 commits into
stable34from
automated/noid/stable34-fix-npm-audit

Conversation

@nextcloud-command

@nextcloud-command nextcloud-command commented Sep 27, 2026

Copy link
Copy Markdown
Collaborator

Audit report

This audit fix resolves 26 of the total 56 vulnerabilities found in your project.

Updated dependencies

Fixed vulnerabilities

@tiptap/extension-blockquote #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-blockquote

@tiptap/extension-bold #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-bold

@tiptap/extension-code #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-code

@tiptap/extension-code-block #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-code-block

@tiptap/extension-code-block-lowlight #

@tiptap/extension-collaboration-caret #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-collaboration-caret

@tiptap/extension-document #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-document

@tiptap/extension-hard-break #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-hard-break

@tiptap/extension-heading #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-heading

@tiptap/extension-highlight #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-highlight

@tiptap/extension-horizontal-rule #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-horizontal-rule

@tiptap/extension-image #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-image

@tiptap/extension-italic #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-italic

@tiptap/extension-link #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-link

@tiptap/extension-list #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-list

@tiptap/extension-mathematics #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-beta.30 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-mathematics

@tiptap/extension-mention #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-mention

@tiptap/extension-paragraph #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-paragraph

@tiptap/extension-placeholder #

  • Caused by vulnerable dependency:
  • Affected versions: 3.0.0-beta.0 - 3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-placeholder

@tiptap/extension-strike #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-strike

@tiptap/extension-table #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-table

@tiptap/extension-text #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-text

@tiptap/extension-typography #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-typography

@tiptap/extension-underline #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-underline

@tiptap/extensions #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extensions

@tiptap/suggestion #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/suggestion

@nextcloud-command nextcloud-command added dependencies Pull requests that update a dependency file 3. to review labels Sep 27, 2026
@max-nextcloud

max-nextcloud commented Sep 27, 2026

Copy link
Copy Markdown
Collaborator

I'm not sure what this is trying to do. It's claiming tiptap is vulnerable - but not updating it. I also found no mention of the tiptap vulnerability and no newer version than 3.30.3.

@max-nextcloud

max-nextcloud commented Sep 27, 2026

Copy link
Copy Markdown
Collaborator

this will be reopened on the next run I assume.

@max-nextcloud

max-nextcloud commented Sep 27, 2026

Copy link
Copy Markdown
Collaborator

Tiptap now uses a release/v3 branch for the releases separate from main. That's where the CHANGELOG has been updated.

Looks like there actually are quite a few security relevant fixes in there.

@max-nextcloud max-nextcloud reopened this Sep 27, 2026
@max-nextcloud

max-nextcloud commented Sep 27, 2026

Copy link
Copy Markdown
Collaborator

bumped all of tiptap with

rg '"@tiptap\S*"' -o package.json | sed -e 's/"$/@^3.31.3"/' | xargs npm install --save

@max-nextcloud
max-nextcloud force-pushed the automated/noid/stable34-fix-npm-audit branch from 912dbf2 to 150aeb4 Compare September 27, 2026 15:14
nextcloud-command and others added 5 commits September 27, 2026 17:30
@nextcloud-command @max-nextcloud
fix(deps): Fix npm audit
17e97bb 
Signed-off-by: GitHub <noreply@github.com>
Signed-off-by: Max <max@nextcloud.com>
@max-nextcloud
chore(deps): actually update tiptap to latest version
4bf29d0 
Signed-off-by: Max <max@nextcloud.com>
@mejo- @max-nextcloud
fix(links): add new required property markdownLinks to LinkOptions
642e52b 
Signed-off-by: Jonas <jonas@freesources.org>
@mejo- @max-nextcloud
chore(links): use upstream markdownLinks option, drop our implement…
7fb3b88 
…ation

Signed-off-by: Jonas <jonas@freesources.org>
@mejo- @max-nextcloud
fix(autofocus): persist position only after autofocus was called
d092ba0 
Due to upstream changes in y-tiptap 3.0.7, `onSelectionUpdate` gets
fired again after `onCreate`, which introduced a race condition in our
autofocus plugin, resulting in the cursor position always being set to
the end of the document when opening a document the first time.

Signed-off-by: Jonas <jonas@freesources.org>
@max-nextcloud
max-nextcloud force-pushed the automated/noid/stable34-fix-npm-audit branch from 150aeb4 to d092ba0 Compare September 27, 2026 15:31

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@max-nextcloud max-nextcloud Awaiting requested review from max-nextcloud max-nextcloud is a code owner
@mejo- mejo- Awaiting requested review from mejo- mejo- is a code owner
@silverkszlo silverkszlo Awaiting requested review from silverkszlo silverkszlo is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

3. to review dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@nextcloud-command @max-nextcloud @mejo-