[dependabot]

Bumps @tiptap/pm from 2.27.2 to 3.31.3.

Release notes

Sourced from @​tiptap/pm's releases.

v3.31.3

@​tiptap/extension-collaboration-caret

Patch Changes

• Fixed a bug which allowed potentially unsafe color values being sent by other clients. Those unsafe colors received from collaboration users are now ignored.

@​tiptap/react

Patch Changes

• Fix a TypeScript error (TS2694) in the shipped type declarations when skipLibCheck is turned off.

v3.31.2

@​tiptap/pm

Patch Changes

• Bump prosemirror-view to ^1.42.3, which fixes an XSS vulnerability where pasting crafted HTML could run arbitrary JavaScript (GHSA-c8x8-7fp4-3x9w).

v3.31.1

@​tiptap/core

Patch Changes

• Fix freezes in framework-based node views on iOS and Android

v3.31.0

@​tiptap/react

Minor Changes

• e7bf804: Align selected with ProseMirror node selections by default, expose text selections through selectionInside, and keep selectedOnTextSelection compatible.

v3.30.6

@​tiptap/core

Patch Changes

• Nested lists exported to Markdown now keep their hierarchy when the file is read back by other Markdown tools.

@​tiptap/extension-list

Patch Changes

• Nested lists exported to Markdown now keep their hierarchy when the file is read back by other Markdown tools.

@​tiptap/extension-youtube

Patch Changes

... (truncated)

Changelog

Sourced from @​tiptap/pm's changelog.

3.31.3

3.31.2

Patch Changes

• c56b4c9: Bump prosemirror-view to ^1.42.3, which fixes an XSS vulnerability where pasting crafted HTML could run arbitrary JavaScript (GHSA-c8x8-7fp4-3x9w).

3.31.1

3.31.0

3.30.6

3.30.5

3.30.4

3.30.3

3.30.2

3.30.1

3.30.0

Patch Changes

• 58a8953: Fix the ./schema-list export map pointing types at dist/schema/, which is not emitted. Tools that read the types condition directly could not resolve @tiptap/pm/schema-list.

3.29.2

3.29.1

3.29.0

Patch Changes

• e150ee0: Bump prosemirror-model to ^1.25.11, fixing pasting content copied from the editor inserting extra empty paragraphs (a regression introduced in prosemirror-view 1.42.0).

3.28.0

3.27.4

3.27.3

3.27.2

Patch Changes

... (truncated)

Commits

• 35d2110 chore(release): release new stable release (#8311)
• f38fec0 chore(release): release new stable release (#8304)
• c56b4c9 fix(pm): bump prosemirror-view to ^1.42.3 to patch paste XSS (#8284)
• bd35333 chore(release): release new stable release (#8297)
• 0280f4a chore(release): release new stable release (#8292)
• 5302fda chore(release): release new stable release (#8264)
• b0c188b chore(release): release new stable release (#8261)
• 55f59e4 chore(release): release new stable release (#8260)
• db790a7 chore(release): release new stable release (#8216)
• f434577 chore: migrate over to vite+ for tooling (#8151)
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
getmadrid.app	Error		Sep 13, 2026 8:46am UTC
nota.mrlemoos.dev	Error		Sep 13, 2026 8:46am UTC

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: ed90eed6-3315-46b8-b153-666d98f72ee1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}