chore(deps): bump @tiptap/core from 3.28.0 to 3.30.4 in /web in the npm_and_yarn group across 1 directory

[dependabot]

Bumps the npm_and_yarn group with 1 update in the /web directory: @tiptap/core.

Updates @tiptap/core from 3.28.0 to 3.30.4

Release notes

Sourced from @​tiptap/core's releases.

v3.30.4

@​tiptap/core

Patch Changes

• Prevent untrusted HTML attributes from changing an object's prototype when merged with mergeAttributes.

v3.30.3

@​tiptap/extension-text-style

Patch Changes

• Unsetting one text style inside a blockquote no longer removes the other text styles in it.

@​tiptap/extension-youtube

Patch Changes

• YouTube live URLs (/live/<id>) now embed the video.

@​tiptap/core

Patch Changes

• Fix JSX runtime to properly render nested sibling elements by spreading children arrays into DOMOutputSpec

@​tiptap/react

Patch Changes

• Fix ReactNodeViewRenderer crash when contentComponent is not available

@​tiptap/ai-toolkit

Minor Changes

• Add the AiInsertReveal extension (@tiptap/ai-toolkit/streaming-reveal) to fade in text as the AI streams it into a collaborative document.

v3.30.2

@​tiptap/core

Patch Changes

• Keep mixed JSX children as separate siblings in DOM output.
• Fixed a bug where editor.chain and editor.can can not be accessed on editor initialization

@​tiptap/extension-image

Patch Changes

... (truncated)

Changelog

Sourced from @​tiptap/core's changelog.

3.30.4

Patch Changes

• 01d7af8: Prevent untrusted HTML attributes from changing an object's prototype when merged with mergeAttributes.
  • @​tiptap/pm@​3.30.4

3.30.3

Patch Changes

• 965a880: Fix JSX runtime to properly render nested sibling elements by spreading children arrays into DOMOutputSpec
  • @​tiptap/pm@​3.30.3

3.30.2

Patch Changes

• 3dffed5: Keep mixed JSX children as separate siblings in DOM output.
• 214a140: Fixed a bug where editor.chain and editor.can can not be accessed on editor initialization
  • @​tiptap/pm@​3.30.2

3.30.1

Patch Changes

• abc8828: Added new ProseMirror helpers that check whether a value is a specific ProseMirror type.
  • @​tiptap/pm@​3.30.1

3.30.0

Minor Changes

• 0247d39: ListKeymap now registers a Tab shortcut that sinks a top-level textblock into the previous list's last item. Pressing Tab at the start of a paragraph right after a bullet/ordered/task list moves the paragraph inside the last list item. The handler does nothing when the cursor is already inside a list item (sinkListItem keeps working), when there is no list before the paragraph, when the caret is mid-textblock, or when the selection is not a text selection (for example a gap cursor).

  @tiptap/core also exposes a new getPreviousBlockSibling($pos) helper that returns the block-level sibling before the cursor's textblock, or null at the first child of the block parent.

• 3099eef: New Decorations API

  Finally the decorations API is here! Even though Decorations itself are nothing new in ProseMirror, the new API makes it much easier to use them in Tiptap without leaving your extensions.

  Decorations change how the document looks without changing the document itself. Highlighting search results, marking spelling mistakes, showing collaborator cursors, putting a drag handle next to every block.

  Until now you had to write a ProseMirror plugin by hand for this, keep the decoration set in plugin state, and map it forward on every transaction. Extensions can now declare decorations directly with a new addDecorations() hook.

  addDecorations() {
    return {
      create: ({ state }) =>
        // findMatches can be any function that returns an array of { from, to } ranges

... (truncated)

Commits

• 55f59e4 chore(release): release new stable release (#8260)
• 01d7af8 Merge commit from fork
• 98b469d chore: complete Vite+ migration (#8258)
• db790a7 chore(release): release new stable release (#8216)
• f434577 chore: migrate over to vite+ for tooling (#8151)
• 965a880 fix(core): preserve JSX child boundaries (#7491)
• cef2c9a chore(release): release new stable release (#8190)
• 214a140 fixed editor.can and editor.chain to not be accessible on editor … (#8210)
• 3dffed5 fix(core): keep mixed JSX children separate in DOM output
• 4c4933d chore(release): release new stable release (#8181)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[themoosebot]

Automated review for c78958cefe79a2972a4386713ce6c6acc3874208

Recommendation: COMMENT

Changes since the last automated review:

• resolved: 0
• superseded: 0
• persistent: 17
• invalidated: 0

Files reviewed: 2
Diff chunks reviewed: 8/8

Findings requiring attention

• [medium] web/pnpm-lock.yaml:1153 — @tiptap/core was bumped to 3.30.4 but its peerDependency requires '@tiptap/pm': 3.30.4, while the lockfile still resolves @tiptap/pm to 3.28.0 for this dependency graph. This is a peer dependency version mismatch that pnpm will silently paper over, but could cause runtime incompatibilities between @tiptap/core and @tiptap/pm APIs. (UNVERIFIED (2/3 lenses returned))
• [medium] web/pnpm-lock.yaml:1157 — @tiptap/core@3.30.4 declares a peerDependency of @tiptap/pm: 3.30.4 (exact version, not a range), but the lockfile resolves it against @tiptap/pm@3.28.0 everywhere (e.g. @tiptap/core@3.30.4(@tiptap/pm@3.28.0)), while the importer entry for @tiptap/pm was left at ^3.28.0/3.28.0. This is a peer dependency version mismatch that pnpm normally would not silently satisfy for an exact peer spec, and may cause runtime incompatibilities between tiptap/core and prosemirror-model internals if 3.30.4 relies on pm APIs introduced after 3.28.0. (UNVERIFIED (2/3 lenses returned))
• [low] web/pnpm-lock.yaml:1 — Lockfile updates dependency versions (@tiptap/core, @adobe/react-spectrum, @codemirror packages, react-aria, etc.) as a routine dependency bump; no obvious malicious packages or suspicious registry sources detected, but integrity hashes should be verified against upstream npm registry to rule out supply-chain tampering. (UNVERIFIED (2/3 lenses returned))
• [low] web/pnpm-lock.yaml:253 — New transitive dependency @adobe/react-spectrum@3.47.4 (and related @spectrum-icons, react-aria, react-stately updates) introduced without corresponding importer/package.json specifier change shown in this diff; verify this is an intentional transitive bump pulled in by @react-spectrum/provider and not an unreviewed supply-chain change. (UNVERIFIED (2/3 lenses returned))
• [medium] web/pnpm-lock.yaml:3841 — codemirror@6.0.2 now resolves @codemirror/commands to 6.11.0 (which depends on @codemirror/state@6.7.2 and @codemirror/view@6.43.10) while other codemirror plugins such as @codemirror/lang-sql, @uiw/codemirror-themes, etc. may still reference the older @codemirror/state@6.7.1/@codemirror/view@6.43.6 versions, creating a split dependency graph with two versions of core CodeMirror state/view packages in the bundle, which can cause runtime errors due to state/view instance identity checks across mismatched versions. (UNVERIFIED (1/3 lenses returned))
• [low] web/pnpm-lock.yaml:4261 — A new major dependency tree for @adobe/react-spectrum@3.47.4 (with react-aria@3.52.0, react-aria-components@1.21.0, react-stately@3.50.0, @internationalized/number@3.6.8, @internationalized/string@3.2.10, @react-types/shared@3.36.1) was introduced alongside the pre-existing @adobe/react-spectrum@3.47.2 tree (react-aria@3.50.0, react-stately@3.48.0, etc.), resulting in two parallel major version sets of the same libraries in the dependency graph. This duplication increases bundle size and can cause subtle behavioral inconsistencies (e.g., different components using different React Aria internals/context) if both trees are loaded simultaneously in the app. (UNVERIFIED (1/3 lenses returned))
• [info] web/pnpm-lock.yaml:3868 — The @codemirror/state, @codemirror/view, and @codemirror/commands packages are bumped to new versions (6.7.2, 6.43.10, 6.11.0) causing @codemirror/lint and @codemirror/search to be repinned to the newer state/view versions, which is a coordinated but potentially risky transitive upgrade of the CodeMirror ecosystem without corresponding version specifier changes visible in this diff. (UNVERIFIED (2/3 lenses returned))
• [low] web/pnpm-lock.yaml:63 — The importer specifier for @tiptap/core was bumped to ^3.30.4 while all other @tiptap/extension-* packages remain pinned to 3.28.0 and their peer resolution now points at @tiptap/core@3.30.4; if there are breaking API changes between 3.28.0 and 3.30.4 (minor version bump within tiptap v3 that historically has introduced behavior changes), the extensions built against the older core version may not be validated against the new core, risking subtle runtime bugs despite lockfile resolving without error. (UNVERIFIED (0/3 lenses returned))

Other findings

• [medium] web/pnpm-lock.yaml:1157 — @tiptap/pm remains at 3.28.0 while @tiptap/core is bumped to 3.30.4, but @tiptap/core@3.30.4 declares peerDependency '@tiptap/pm': 3.30.4; the lockfile resolves it against 3.28.0 instead, which is a peer dependency mismatch that pnpm allows but could cause runtime bugs. (REFUTED (3/3 lenses refuted))
• [medium] web/pnpm-lock.yaml:66 — All @tiptap/extension-* packages (extension-link, extension-underline, extensions, react, suggestion, starter-kit) remain pinned at 3.28.0 while @tiptap/core was bumped to 3.30.4. Since these extensions were built and tested against tiptap/core@3.28.0's internal API, mixing a newer core with older extensions increases risk of subtle breakage or missing features if 3.30.x introduced internal API changes. (REFUTED (3/3 lenses refuted))
• [low] web/package.json:30 — Dependency version bump for @tiptap/core (from ^3.28.0 to ^3.30.4) with no corresponding update to other @tiptap/* packages (extension-link, extension-underline, extensions still at ^3.28.0), which may cause version mismatch/incompatibility issues. (REFUTED (3/3 lenses refuted))
• [medium] web/pnpm-lock.yaml:63 — package.json specifiers for @tiptap packages remain pinned to ^3.28.0 while the resolved version for @tiptap/core is bumped to 3.30.4, creating a mismatch where sibling tiptap extension packages (extension-link, extension-underline, extensions, react, suggestion) still resolve to 3.28.0 while depending on @tiptap/core 3.30.4; this could introduce subtle API incompatibilities between core and extensions if breaking changes exist between 3.28.0 and 3.30.4. (REFUTED (3/3 lenses refuted))
• [low] web/pnpm-lock.yaml:61 — Lockfile bumps @tiptap/core to ^3.30.4 while other @tiptap packages (extension-link, extension-underline, extensions, react, suggestion, starter-kit, pm) remain pinned at 3.28.0, creating a mixed-version dependency graph that could introduce subtle incompatibilities between tiptap core and its extensions. (REFUTED (3/3 lenses refuted))
• [info] web/pnpm-lock.yaml:250 — @adobe/react-spectrum is bumped from 3.47.2 to 3.47.4 along with several transitive dependencies (@spectrum-icons/workflow, @spectrum-icons/ui, react-aria, react-stately, @internationalized/number, @internationalized/string), but this appears to be an indirect/transitive lockfile change not explicitly reflected in package.json specifiers shown in the diff, which may indicate an unintended or unreviewed major dependency tree change. (REFUTED (3/3 lenses refuted))
• [medium] web/package.json:27 — The @tiptap/core version was bumped to ^3.30.4 while other @tiptap packages (extension-link, extension-underline, extensions) remain pinned at ^3.28.0, creating a version mismatch across the tiptap monorepo packages that could cause peer dependency or runtime incompatibilities. (REFUTED (3/3 lenses refuted))
• [low] web/package.json:27 — The @tiptap/core package version was bumped to ^3.30.4 while other @tiptap packages (extension-link, extension-underline, extensions) remain pinned at ^3.28.0, creating a potential version mismatch across the Tiptap ecosystem which may cause compatibility issues. (REFUTED (3/3 lenses refuted))
• [low] web/package.json:30 — The @tiptap/core dependency was bumped to ^3.30.4 while other @tiptap/* packages (extension-link, extension-underline, extensions) remain at ^3.28.0, potentially causing version mismatches between tiptap packages that are expected to be kept in sync. (REFUTED (3/3 lenses refuted))