Skip to content

[stable34] Fix npm audit - #9272

Merged
mejo- merged 1 commit into
stable34from
automated/noid/stable34-fix-npm-audit
Oct 7, 2026
Merged

[stable34] Fix npm audit#9272
mejo- merged 1 commit into
stable34from
automated/noid/stable34-fix-npm-audit

Conversation

@nextcloud-command

@nextcloud-command nextcloud-command commented Sep 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Audit report

This audit fix resolves 27 of the total 80 vulnerabilities found in your project.

Updated dependencies

Fixed vulnerabilities

@tiptap/extension-blockquote #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-blockquote

@tiptap/extension-bold #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-bold

@tiptap/extension-code #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-code

@tiptap/extension-code-block #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-code-block

@tiptap/extension-code-block-lowlight #

@tiptap/extension-collaboration-caret #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-collaboration-caret

@tiptap/extension-document #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-document

@tiptap/extension-hard-break #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-hard-break

@tiptap/extension-heading #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-heading

@tiptap/extension-highlight #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-highlight

@tiptap/extension-horizontal-rule #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-horizontal-rule

@tiptap/extension-image #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-image

@tiptap/extension-italic #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-italic

@tiptap/extension-link #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-link

@tiptap/extension-list #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-list

@tiptap/extension-mathematics #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-beta.30 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-mathematics

@tiptap/extension-mention #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-mention

@tiptap/extension-paragraph #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-paragraph

@tiptap/extension-placeholder #

  • Caused by vulnerable dependency:
  • Affected versions: 3.0.0-beta.0 - 3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-placeholder

@tiptap/extension-strike #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-strike

@tiptap/extension-table #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-table

@tiptap/extension-text #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-text

@tiptap/extension-typography #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-typography

@tiptap/extension-underline #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extension-underline

@tiptap/extensions #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/extensions

@tiptap/suggestion #

  • Caused by vulnerable dependency:
  • Affected versions: <=3.0.0-next.8 || 3.22.4 - 3.30.3
  • Package usage:
    • node_modules/@tiptap/suggestion

markdown-it #

  • markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds
  • Severity: moderate
  • Reference: GHSA-253c-mchw-3w2r
  • Affected versions: <14.3.1
  • Package usage:
    • node_modules/markdown-it

@nextcloud-command nextcloud-command added dependencies Pull requests that update a dependency file 3. to review labels Sep 27, 2026
@max-nextcloud

max-nextcloud commented Sep 27, 2026

Copy link
Copy Markdown
Collaborator

I'm not sure what this is trying to do. It's claiming tiptap is vulnerable - but not updating it. I also found no mention of the tiptap vulnerability and no newer version than 3.30.3.

@max-nextcloud

max-nextcloud commented Sep 27, 2026

Copy link
Copy Markdown
Collaborator

this will be reopened on the next run I assume.

@max-nextcloud

max-nextcloud commented Sep 27, 2026

Copy link
Copy Markdown
Collaborator

Tiptap now uses a release/v3 branch for the releases separate from main. That's where the CHANGELOG has been updated.

Looks like there actually are quite a few security relevant fixes in there.

@max-nextcloud max-nextcloud reopened this Sep 27, 2026
@max-nextcloud

max-nextcloud commented Sep 27, 2026

Copy link
Copy Markdown
Collaborator

bumped all of tiptap with

rg '"@tiptap\S*"' -o package.json | sed -e 's/"$/@^3.31.3"/' | xargs npm install --save

@max-nextcloud
max-nextcloud force-pushed the automated/noid/stable34-fix-npm-audit branch 2 times, most recently from 150aeb4 to d092ba0 Compare September 27, 2026 15:31
@nextcloud-command
fix(deps): Fix npm audit
0f80f14 
Signed-off-by: GitHub <noreply@github.com>
@nextcloud-command
nextcloud-command force-pushed the automated/noid/stable34-fix-npm-audit branch from d092ba0 to 0f80f14 Compare October 4, 2026 09:27
@mejo-
mejo- merged commit 0214423 into stable34 Oct 7, 2026
77 of 81 checks passed
@mejo-
mejo- deleted the automated/noid/stable34-fix-npm-audit branch October 7, 2026 22:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mejo- mejo- mejo- approved these changes
@max-nextcloud max-nextcloud Awaiting requested review from max-nextcloud max-nextcloud is a code owner
@silverkszlo silverkszlo Awaiting requested review from silverkszlo silverkszlo is a code owner

Assignees

No one assigned

Labels

3. to review dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@nextcloud-command @max-nextcloud @mejo-