chore(deps): bump @tiptap/starter-kit from 2.14.0 to 3.9.1

[dependabot]

Bumps @tiptap/starter-kit from 2.14.0 to 3.9.1.

Release notes

Sourced from @​tiptap/starter-kit's releases.

v3.9.1

Releases

v3.9.1

@​tiptap/extension-table

Patch Changes

• Add a renderWrapper option to the Table extension so consumers can customize whether the table wrapper for the resizable node view should be rendered in non-editable mode as well.

v3.9.0

Releases

v3.9.0

@​tiptap/vue-3

Patch Changes

• Fix attribute forwarding for BubbleMenu and FloatingMenu Vue 3 components to allow setting z-index and other HTML attributes

@​tiptap/extension-hard-break

Patch Changes

• Ensure that markdown hard breaks (two spaces followed by a newline) are parsed so they render as line breaks (<br>) in the editor when using contentType: 'markdown'.

  Fixes #7107

@​tiptap/extension-unique-id

Minor Changes

• Add updateDocument option to disable document updates caused by the Unique ID extension.

@​tiptap/core

Patch Changes

• Only remove injected CSS on unmount if no other editors are in the document (fixes #6836)

@​tiptap/extension-drag-handle

Patch Changes

• Replace DOM traversal with browser's native elementsFromPoint for better performance.

  • Use elementsFromPoint instead of querySelectorAll
  • Add clampToContent helper for coordinate boundary validation

... (truncated)

Changelog

Sourced from @​tiptap/starter-kit's changelog.

3.9.1

Patch Changes

• @​tiptap/extension-dropcursor@​3.9.1
• @​tiptap/extension-gapcursor@​3.9.1
• @​tiptap/extension-list-item@​3.9.1
• @​tiptap/extension-list-keymap@​3.9.1
• @​tiptap/core@​3.9.1
• @​tiptap/extension-blockquote@​3.9.1
• @​tiptap/extension-bold@​3.9.1
• @​tiptap/extension-bullet-list@​3.9.1
• @​tiptap/extension-code@​3.9.1
• @​tiptap/extension-code-block@​3.9.1
• @​tiptap/extension-document@​3.9.1
• @​tiptap/extension-hard-break@​3.9.1
• @​tiptap/extension-heading@​3.9.1
• @​tiptap/extension-horizontal-rule@​3.9.1
• @​tiptap/extension-italic@​3.9.1
• @​tiptap/extension-link@​3.9.1
• @​tiptap/extension-list@​3.9.1
• @​tiptap/extension-ordered-list@​3.9.1
• @​tiptap/extension-paragraph@​3.9.1
• @​tiptap/extension-strike@​3.9.1
• @​tiptap/extension-text@​3.9.1
• @​tiptap/extension-underline@​3.9.1
• @​tiptap/extensions@​3.9.1
• @​tiptap/pm@​3.9.1

3.9.0

Patch Changes

• Updated dependencies [6e734a3]
• Updated dependencies [bbb8e16]
  • @​tiptap/extension-hard-break@​3.9.0
  • @​tiptap/core@​3.9.0
  • @​tiptap/extension-blockquote@​3.9.0
  • @​tiptap/extension-bold@​3.9.0
  • @​tiptap/extension-code@​3.9.0
  • @​tiptap/extension-code-block@​3.9.0
  • @​tiptap/extension-document@​3.9.0
  • @​tiptap/extension-heading@​3.9.0
  • @​tiptap/extension-horizontal-rule@​3.9.0
  • @​tiptap/extension-italic@​3.9.0
  • @​tiptap/extension-link@​3.9.0
  • @​tiptap/extension-list@​3.9.0
  • @​tiptap/extension-paragraph@​3.9.0
  • @​tiptap/extension-strike@​3.9.0
  • @​tiptap/extension-text@​3.9.0

... (truncated)

Commits

• 73f5632 chore(release): publish a new release version (#7143)
• f74ce9f chore(release): publish a new release version (#7131)
• 3439bcb chore(release): publish a new release version
• 035b3f2 chore(release): publish a new release version (#7089)
• 3b2fccc chore(release): publish a new release version (#7085)
• dab80e9 chore(release): publish a new release version (#7076)
• ca8713b chore(release): publish a new release version (#7075)
• 89ef4d2 chore(release): publish a new release version (#7061)
• 82e03b5 chore(release): publish a new release version (#7042)
• 6f06a69 chore(release): publish a new release version (#7041)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
app	Error			Nov 20, 2025 11:20am
portal	Error			Nov 20, 2025 11:20am

[comp-ai-code-review]

🔒 Comp AI - Security Review

🟡 Risk Level: MEDIUM

OSV scan: 2 high vulns in xlsx@0.18.5 (Prototype Pollution, ReDoS) and 1 low in ai@5.0.0 (filetype whitelist bypass; fixed in 5.0.52). No hardcoded creds or code-injection issues visible.

---

📦 Dependency Vulnerabilities

🟠 NPM Packages (HIGH)

Risk Score: 8/10 | Summary: 2 high, 1 low CVEs found

Package	Version	CVE	Severity	CVSS	Summary	Fixed In
xlsx	0.18.5	GHSA-4r6h-8v6p-xvw6	HIGH	N/A	Prototype Pollution in sheetJS	No fix yet
xlsx	0.18.5	GHSA-5pgg-2g8v-p4x9	HIGH	N/A	SheetJS Regular Expression Denial of Service (ReDoS)	No fix yet
ai	5.0.0	GHSA-rwvc-j5jr-mgvh	LOW	N/A	Vercel’s AI SDK's filetype whitelists can be bypassed when uploading files	5.0.52

---

🛡️ Code Security Analysis

✅ No security issues detected in code changes.

---

💡 Recommendations

View 3 recommendation(s)

1. Bump ai from 5.0.0 to >=5.0.52 in package.json to apply the reported fix (GHSA-rwvc-j5jr-mgvh), then reinstall and run tests.
2. Upgrade xlsx (currently 0.18.5) to a release that patches GHSA-4r6h-8v6p-xvw6 and GHSA-5pgg-2g8v-p4x9; if a patched release is not yet available, remove or avoid code paths that parse untrusted XLSX input.
3. Add server-side file validation before calling these libraries: verify actual file type/content, enforce size and parsing timeouts, and reject suspicious inputs to reduce ReDoS and filetype-bypass exposure.

---

Powered by Comp AI - AI that handles compliance for you. Reviewed Nov 20, 2025