[dependabot]

Bumps happy-dom to 21.0.4 and updates ancestor dependency @tiptap/html. These dependencies need to be updated together.

Updates happy-dom from 20.14.6 to 21.0.4

Release notes

Sourced from happy-dom's releases.

v21.0.4

👷‍♂️ Patch fixes

• Fixed a code injection vulnerability in the ESM compiler - By @​capricorn86
• Fixed cross-origin isolation so opaque-origin data: iframes cannot access their parent or top window - By @​capricorn86

v21.0.3

👷‍♂️ Patch fixes

• Fixes security vulnerability where authorization header was forwarded when redirecting - By @​capricorn86

v21.0.2

👷‍♂️ Patch fixes

• Fixes SSRF security vulnerability by doing a target-origin bypass in the proxy server in @​happy-dom/server-renderer - By @​capricorn86

v21.0.1

👷‍♂️ Patch fixes

• Adds aliases --css and --iframe for enabling CSS and iframe loading to @​happy-dom/server-renderer - By @​capricorn86

v21.0.0

💣 Breaking Changes

• Disables CSS and IFrame loading by default to prevent server-side request forgery (SSRF) - By @​capricorn86
  • An attacker could embed <iframe> or <link rel="stylesheet"> elements in untrusted HTML to make Happy DOM send HTTP requests from the server to attacker-chosen URLs, including internal services. This could allow access to otherwise unreachable endpoints or trigger unintended actions, depending on the application and its network access.
  • The settings property disableCSSFileLoading has been deprecated
  • Added the new settings properties enableCSSFileLoading and enableIframePageLoading
  • If you don't believe that you are at risk, you can keep the same behavior as in <=v20.14.6 by sending in { enableCSSFileLoading: true, enableIframePageLoading: true } as broswer settings (e.g. new Window({ settings }));

Commits

• fd16352 fix: Fixed a code injection vulnerability in the ESM compiler (#2537)
• 75ab0fb fix: Fixed cross-origin isolation so opaque-origin data: iframes cannot acces...
• 875ef5c fix: Fixes security vulnerability where authorization header was forwarded wh...
• 1f3ffdf fix: Fixes SSRF security vulnerability by doing a target-origin bypass in the...
• f55c7e0 chore: Update security documentation (#2509)
• 2b91e68 fix: Adds alias for enabling CSS and iframe loading in server-renderer (#2503)
• 0a99c75 BREAKING CHANGE: Disables CSS and IFrame loading by default (#2502)
• See full diff in compare view

Updates @tiptap/html from 3.31.4 to 3.33.0

Release notes

Sourced from @​tiptap/html's releases.

v3.33.0

@​tiptap/extension-collaboration

Minor Changes

• With enableContentCheck: true, shared content that does not fit the editor schema now emits contentError instead of being deleted. The editor pauses editing and sends no changes until compatible content arrives, so read-only users no longer send repairs that the server rejects.

  If you use enableContentCheck with collaboration and want the editor to keep repairing invalid content, turn the content check off.

@​tiptap/y-tiptap

Minor Changes

• Add the onInvalidContent sync option. When it is set, shared content that does not fit the editor schema stays in the shared document instead of being deleted. The editor shows what it can, pauses editing and sends no changes until compatible content arrives.

v3.32.3

@​tiptap/core

Patch Changes

• Clearing formatting on a nested list now turns every level into paragraphs, and clearNodes() works in a chain with other node commands.
• Stop removed resizable node views from responding to later editor updates.

@​tiptap/extension-bubble-menu

Patch Changes

• Bubble menus now update correctly after IME input, including Korean text

@​tiptap/extension-code-block-lowlight

Patch Changes

• Fixed a performance issue where code highlighting updates were unnecessarily triggered by selection-only changes

@​tiptap/extension-floating-menu

Patch Changes

• Floating menus now update correctly after IME input, including Korean text

@​tiptap/extension-link

Patch Changes

• Pasting a link without a protocol now uses the defaultProtocol option instead of always falling back to http.

@​tiptap/extensions

Patch Changes

... (truncated)

Changelog

Sourced from @​tiptap/html's changelog.

3.33.0

No changes in this release.

3.32.3

No changes in this release.

3.32.2

Patch Changes

• b8c7a3b: Support Happy DOM 21.0.4 and later in version 21 while keeping support for Happy DOM 20.
• @​tiptap/core@​3.32.2
  • @​tiptap/pm@​3.32.2

3.32.1

Patch Changes

• Updated dependencies [959e0e8]
• Updated dependencies [3ebb519]
• Updated dependencies [3ebb519]
• Updated dependencies [3ebb519]
• Updated dependencies [3ebb519]
• Updated dependencies [b513d24]
• Updated dependencies [22b0e70]
  • @​tiptap/core@​3.32.1
  • @​tiptap/pm@​3.32.1

3.32.0

Patch Changes

• Updated dependencies [3b5560c]
• Updated dependencies [8e2a86f]
• Updated dependencies [cc90cc5]
  • @​tiptap/pm@​3.32.0
  • @​tiptap/core@​3.32.0

Commits

• a0867ff chore(release): release new stable release
• 603d216 chore(release): release new stable release (#8669)
• a5b6cd9 chore(release): release new stable release
• b8c7a3b Merge pull request #8620 from ueberdosis/feature/upgrade-happy-dom
• f20cb2a chore(release): release new stable release
• 388e722 chore(release): release new stable release (#8420)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[AmrMsCLL]

Superseded by #49, which resolves this alert together with the other open Dependabot alerts.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.