Skip to content

fix(deps): update prod minor+patch - #102

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/prod-minor+patch
Open

fix(deps): update prod minor+patch#102
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/prod-minor+patch

Conversation

@renovate

@renovate renovate Bot commented Aug 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@noble/curves (source) ^2.2.0 → ^2.3.0 age confidence
@noble/hashes (source) ^2.2.0 → ^2.3.0 age confidence
@radix-ui/react-alert-dialog (source) ^1.1.21 → ^1.1.23 age confidence
@radix-ui/react-avatar (source) ^1.2.4 → ^1.2.6 age confidence
@radix-ui/react-context-menu (source) ^2.3.5 → ^2.3.7 age confidence
@radix-ui/react-dialog (source) ^1.1.21 → ^1.1.23 age confidence
@radix-ui/react-dropdown-menu (source) ^2.1.22 → ^2.1.24 age confidence
@radix-ui/react-label (source) ^2.1.13 → ^2.1.15 age confidence
@radix-ui/react-popover (source) ^1.1.21 → ^1.1.23 age confidence
@radix-ui/react-select (source) ^2.3.5 → ^2.3.7 age confidence
@radix-ui/react-separator (source) ^1.1.13 → ^1.1.15 age confidence
@radix-ui/react-slider (source) ^1.4.5 → ^1.4.7 age confidence
@radix-ui/react-slot (source) ^1.3.1 → ^1.3.3 age confidence
@radix-ui/react-switch (source) ^1.3.5 → ^1.3.7 age confidence
@radix-ui/react-tabs (source) ^1.1.19 → ^1.1.21 age confidence
@radix-ui/react-tooltip (source) ^1.2.14 → ^1.2.16 age confidence
@tiptap/core (source) ^3.28.0 → ^3.30.1 age confidence
@tiptap/extension-emoji (source) ^3.28.0 → ^3.30.1 age confidence
@tiptap/pm (source) ^3.28.0 → ^3.30.1 age confidence
@tiptap/react (source) ^3.28.0 → ^3.30.1 age confidence
@tiptap/starter-kit (source) ^3.28.0 → ^3.30.1 age confidence
@tiptap/suggestion (source) ^3.28.0 → ^3.30.1 age confidence
highlight.js (source) ^11.11.1 → ^11.12.0 age confidence
html-react-parser ^6.1.5 → ^6.1.7 age confidence
ipaddr.js ^2.4.0 → ^2.5.0 age confidence
lucide-react (source) ^1.26.0 → ^1.31.0 age confidence
marked (source) ^18.0.7 → ^18.0.10 age confidence
mediasoup (source) 3.22.0 → 3.25.0 age confidence
mediasoup-client (source) ^3.21.0 → ^3.22.0 age confidence
prosemirror-view ^1.42.1 → ^1.42.2 age confidence
re-reselect ^5.1.0 → ^5.1.1 age confidence
react-lite-youtube-embed ^3.6.0 → ^3.6.2 age confidence
react-virtuoso (source) ^4.18.11 → ^4.18.12 age confidence
sanitize-html (source) ^2.17.6 → ^2.17.7 age confidence
sonner (source) ^2.0.7 → ^2.0.8 age confidence
ws ^8.21.1 → ^8.21.3 age confidence

Release Notes

paulmillr/noble-curves (@​noble/curves)

v2.3.0

Compare Source

Security & constant-timeness
  • Hardened constant-time execution from best-effort to actual guarantees: no measurable timing behavior on 200K samples. Scalar multiplication now uses secret-scalar blinding via CSPRNG, un-precomputed points now use a constant-time fixed-window multiply instead of variable-time fallbacks, and modular arithmetic helpers were hardened. New CT benchmarks track timing behavior.
  • General hardening across all modules
  • Fixes from the Trail of Bits review: recovered ECDSA signatures are now bound to their recovery id, non-canonical BLS signature encodings are rejected, Edwards <-> Montgomery conversion helpers were corrected, and FROST DKG round-2 retry handling was hardened.
X25519 hardening

It was possible to execute a remote timing attack on X25519, across many samples, and learn up to 4.036 bits of long-term private key. Other 247 bits were NOT affected.

The impact: mainly fingerprinting (recognition of key across deployments), NOT key recovery, NOT X25519 breakage. Maintainer was also not able to escalate to co-residency (SMT).

Reported and found by:

  • George Stergiopoulos, Department of Informatics, Athens University of Economics and Business, Greece (geostergiop@aueb.gr)
  • Constantinos Patsakis, Department of Informatics, University of Piraeus, 80 Karaoli & Dimitriou str., 18534 Piraeus, Greece (kpatsak@unipi.gr)
Performance
  • ECDSA/EdDSA verification up to +32%, Weierstrass ECDH up to +19%, x25519 getPublicKey 2.7×
  • BLS signatures 2x
  • Init time (first getPublicKey or sign) reduced ~2x for ed25519, p256, p384, p521
  • Also faster verification of recovered signatures, pairing tower / FFT / Pippenger optimizations, and joint-MSM paths in FROST and OPRF
  • getPublicKey / sign got slower because we've decreased window size (W=8 => W=6) and hardened CT execution (see above). Long-running apps that prefer 2.2.0-level speed can restore it with one line: secp256k1.Point.BASE.precompute(8) (likewise for other curves).
Misc
  • Smaller bundles: improved tree-shaking across modules
  • Better error messages and type checks
  • Upgrade noble-hashes to 2.3.0, with performance boost
  • Reduce on-disk size 1831kb → 1548kb (-282kb) by disabling source maps (they became less relevant).

Full Changelog: paulmillr/noble-curves@2.2.0...2.3.0

paulmillr/noble-hashes (@​noble/hashes)

v2.3.0

Compare Source

Improve speed:

  • +10-45% 32b inputs across all hashes
  • +40% SHA-3 / SHAKE, +50% 1mb KT128 / KT256 / TurboSHAKE, +20% kmac
  • 2.2x argon
  • +20% pbkdf2 and hkdf

Other changes:

  • Better error messages and stricter type checks everywhere
  • Bugfix: HMAC _cloneInto now preserves canXOF (#​134, ChALkeR); Argon2d typo rename (#​135).
  • blake2.compress renamed to _compress (marked internal).
  • Reduce on-disk unpacked size 869kb → 665kb (-204kb) by disabling source maps (they became less relevant).

Full Changelog: paulmillr/noble-hashes@2.2.0...2.3.0

ueberdosis/tiptap (@​tiptap/core)

v3.30.1

Compare Source

Patch Changes
  • abc8828: Added new ProseMirror helpers that check whether a value is a specific ProseMirror type.

v3.30.0

Compare Source

Minor Changes

  • 0247d39: ListKeymap now registers a Tab shortcut that sinks a top-level textblock into the previous list's last item. Pressing Tab at the start of a paragraph right after a bullet/ordered/task list moves the paragraph inside the last list item. The handler does nothing when the cursor is already inside a list item (sinkListItem keeps working), when there is no list before the paragraph, when the caret is mid-textblock, or when the selection is not a text selection (for example a gap cursor).

    @tiptap/core also exposes a new getPreviousBlockSibling($pos) helper that returns the block-level sibling before the cursor's textblock, or null at the first child of the block parent.

  • 3099eef: New Decorations API

    Finally the decorations API is here! Even though Decorations itself are nothing new in ProseMirror, the new API makes it much easier to use them in Tiptap without leaving your extensions.

    Decorations change how the document looks without changing the document itself. Highlighting search results, marking spelling mistakes, showing collaborator cursors, putting a drag handle next to every block.

    Until now you had to write a ProseMirror plugin by hand for this, keep the decoration set in plugin state, and map it forward on every transaction. Extensions can now declare decorations directly with a new addDecorations() hook.

    addDecorations() {
  return {
    create: ({ state }) =>
      // findMatches can be any function that returns an array of { from, to } ranges
      findMatches(state.doc).map(match =>
        Decoration.Inline(match.from, match.to, { class: 'highlight' }),
      ),
  }
}

    There are three kinds. Decoration.Inline() styles a range of text. Decoration.Node() puts attributes on a block's DOM element. Decoration.Widget() renders your own element at a single position.

    Every extension that declares decorations is collected into one plugin, so several extensions can decorate the same document without fighting over it.

    Doing less work on every keystroke

    By default decorations are rebuilt whenever the document changes. That is fine for small documents and wasteful for large ones, so there are two ways to narrow it down.

    shouldUpdate() skips transactions you do not care about. If your decorations only depend on headings, ignore everything else.

    update: 'changedRanges' together with createInRange() only rescans the blocks that actually changed. On a long document this is the difference between scanning the whole thing on every keystroke and scanning one paragraph.

    For decorations driven by data outside the editor, like comments loaded from a server, use update: 'manual' and refresh them yourself with editor.commands.updateDecorations().

    React and Vue components as widgets

    ReactWidgetRenderer and VueWidgetRenderer render a real component into a widget decoration, inside your existing app context. Providers, context and stores work as usual.

    Widgets take a key. Reuse the same key and the component instance stays mounted while the document changes around it, so local state such as an open menu, a counter or a half-typed input survives editing. Use a stable id from your own data, not a position or a list index, otherwise the component remounts and loses that state.

    Widgets also accept the ProseMirror options side, relaxedSide, stopEvent and ignoreSelection.

    Documentation

Patch Changes
  • 51909d3: Fixed insertContent, insertContentAt and setContent failing when prosemirror-model is loaded more than once.
  • Updated dependencies [58a8953]

v3.29.2

Compare Source

Patch Changes

v3.29.1

Compare Source

Patch Changes
ueberdosis/tiptap (@​tiptap/extension-emoji)

v3.30.1

Compare Source

Patch Changes

v3.30.0

Compare Source

Patch Changes

v3.29.2

Compare Source

Patch Changes

v3.29.1

Compare Source

Patch Changes
ueberdosis/tiptap (@​tiptap/pm)

v3.30.1

Compare Source

v3.30.0

Compare Source

Patch Changes
  • 58a8953: Fix the ./schema-list export map pointing types at dist/schema/, which is not emitted. Tools that read the types condition directly could not resolve @tiptap/pm/schema-list.

v3.29.2

Compare Source

v3.29.1

Compare Source

ueberdosis/tiptap (@​tiptap/react)

v3.30.1

Compare Source

Patch Changes

v3.30.0

Compare Source

Minor Changes

  • 3099eef: New Decorations API

    Finally the decorations API is here! Even though Decorations itself are nothing new in ProseMirror, the new API makes it much easier to use them in Tiptap without leaving your extensions.

    Decorations change how the document looks without changing the document itself. Highlighting search results, marking spelling mistakes, showing collaborator cursors, putting a drag handle next to every block.

    Until now you had to write a ProseMirror plugin by hand for this, keep the decoration set in plugin state, and map it forward on every transaction. Extensions can now declare decorations directly with a new addDecorations() hook.

    addDecorations() {
  return {
    create: ({ state }) =>
      // findMatches can be any function that returns an array of { from, to } ranges
      findMatches(state.doc).map(match =>
        Decoration.Inline(match.from, match.to, { class: 'highlight' }),
      ),
  }
}

    There are three kinds. Decoration.Inline() styles a range of text. Decoration.Node() puts attributes on a block's DOM element. Decoration.Widget() renders your own element at a single position.

    Every extension that declares decorations is collected into one plugin, so several extensions can decorate the same document without fighting over it.

    Doing less work on every keystroke

    By default decorations are rebuilt whenever the document changes. That is fine for small documents and wasteful for large ones, so there are two ways to narrow it down.

    shouldUpdate() skips transactions you do not care about. If your decorations only depend on headings, ignore everything else.

    update: 'changedRanges' together with createInRange() only rescans the blocks that actually changed. On a long document this is the difference between scanning the whole thing on every keystroke and scanning one paragraph.

    For decorations driven by data outside the editor, like comments loaded from a server, use update: 'manual' and refresh them yourself with editor.commands.updateDecorations().

    React and Vue components as widgets

    ReactWidgetRenderer and VueWidgetRenderer render a real component into a widget decoration, inside your existing app context. Providers, context and stores work as usual.

    Widgets take a key. Reuse the same key and the component instance stays mounted while the document changes around it, so local state such as an open menu, a counter or a half-typed input survives editing. Use a stable id from your own data, not a position or a list index, otherwise the component remounts and loses that state.

    Widgets also accept the ProseMirror options side, relaxedSide, stopEvent and ignoreSelection.

    Documentation

Patch Changes

v3.29.2

Compare Source

Patch Changes

v3.29.1

Compare Source

Patch Changes
ueberdosis/tiptap (@​tiptap/starter-kit)

v3.30.1

Compare Source

Patch Changes

v3.30.0

Compare Source

Patch Changes

v3.29.2

Compare Source

Patch Changes

v3.29.1

Compare Source

Patch Changes
ueberdosis/tiptap (@​tiptap/suggestion)

v3.30.1

Compare Source

Patch Changes

v3.30.0

Compare Source

Patch Changes

v3.29.2

Compare Source

Patch Changes

v3.29.1

Compare Source

Patch Changes
highlightjs/highlight.js (highlight.js)

v11.12.0

Compare Source

Parser Engine:

  • fix(parser) count named capture groups when rewriting backreferences spokodev

New Grammars:

  • add FreeDesktop config file (.desktop / systemd) grammar gg582
  • added 3rd party Cedar grammar to SUPPORTED_LANGUAGES Dhruv Maniya
  • added 3rd party DAX and M (Power Query) grammars to SUPPORTED_LANGUAGES jiaopengzi
  • added 3rd party Djot grammar to SUPPORTED_LANGUAGES Mark Scherer
  • added 3rd party Igor Pro grammar to SUPPORTED_LANGUAGES Ryne Andal
  • added 3rd party Jaiva grammar to SUPPORTED_LANGUAGES Lehlogonolo Poole
  • added 3rd party Liquidsoap grammar to SUPPORTED_LANGUAGES Romain Beauxis
  • added 3rd party MoonBit grammar to SUPPORTED_LANGUAGES Kaida-Amethyst
  • added 3rd party Pkl grammar to SUPPORTED_LANGUAGES Dan Chao
  • added 3rd party RAScript grammar to SUPPORTED_LANGUAGES Joshua Raphael
  • added 3rd party Veryl grammar to SUPPORTED_LANGUAGES Naoya Hatta
  • added 3rd party Why3 grammar to SUPPORTED_LANGUAGES JGalego
  • added 3rd party Xojo grammar to SUPPORTED_LANGUAGES patricksalo
  • referenced existing 3rd party ES|QL grammar in SUPPORTED_LANGUAGES Styx0x6

Core Grammars:

  • fix(c) only match real atomic_* type names, not C11 atomic functions, issue #​3837 Mark Xian
  • fix(c) do not highlight C++ std types as built-ins, issue #​4103 Arron Zou
  • fix(c, cpp) bound the run of type tokens in front of a function name (ReDoS), issue #​4362 Jayesh Bhade
  • fix(c, cpp) scope angle-bracket header string to #include, issue #​3505 Pablo
  • fix(c, cpp) stop a raw string's closing delimiter from swallowing quotes, issue #​3585 David Pavlovschii
  • enh(cmake) add block and endblock keywords Anonymous Maarten
  • fix(cmake) only highlight standalone numbers, not digits that begin an identifier (e.g. 3rdparty), issue #​4170 Mark Xian
  • fix(cpp) require a word boundary before numeric literals so digits inside identifiers aren't highlighted as numbers, issue #​4231 Mark Xian
  • fix(crystal) stop treating integer division // as a regex literal Zain Asif
  • enh(csharp) support digit separators in binary literals and numeric type suffixes, and stop highlighting the leading _ of an identifier, issue #​4258 Sarath Francis
  • enh(css) add corner-shape properties Hama Tanveer
  • enh(css) support six-digit unicode-range values Konstantin Baltsat
  • enh(dart) add highlighting for class and function names guuido
  • enh(dns) highlight registered CAA property tags, issue #​4475 [Joey Huang][]
  • enh(dns) improve grammar: character strings, TXT, classes, escapes, addresses [Checconio][]
  • enh(dos) add batch as an alias, issue #​4395 [Hashim Khan][]
  • enh(gherkin) update keyword list [Hirse][]
  • enh(gherkin) variables can't contain whitespace [Hirse][]
  • enh(gherkin) docstrings can use backticks [Hirse][]
  • enh(go) recognize binary integer literals spokodev
  • enh(groovy) support underscores in numeric literals [greymoth][]
  • fix(haskell) highlight where in GADT and closed type-family declarations, issue #​3753 Konstantin Baltsat
  • enh(java) improve detection of types, including generic and array types [Hannes Wallnoefer][]
  • enh(javascript) add self to built-in variables [Dsaquel][]
  • enh(kotlin) add ktm and ktx aliases [DarkMatter-999][]
  • fix(leaf) fix bug in Leaf keyword highlighting [Francesco Paolo Severino][]
  • fix(lisp) preserve highlighting after quoted multiplication expressions [arturict][]
  • enh(llvm) support block C-style comments [utam-1][]
  • enh(lua) add Lua 5.5 global keyword [Nibiri][]
  • fix(markdown) don't treat a *** or ___ thematic break as the start of bold text, issue #​3719 [Mayank Gupta][]
  • enh(nsis) enhance NSIS rules [Jan T. Sott][]
  • enh(python) add missing builtins: aiter and anext (3.10), frozendict and sentinel (3.15) [Hugo van Kemenade][]
  • enh(python) correctly highlight lazy import syntax from PEP 810 [Peter Bierma][]
  • enh(python) support t-strings [Nicolas Le Cam][]
  • fix(ruby) don't treat the scope resolution operator :: as a symbol, issue #​4294 [Hashim Khan][]
  • enh(rust) add safe keyword [Frances Wingerter][]
  • enh(rust) include the raw borrow operator in keywords [Shiva Kiran Koninty][]
  • enh(rust) parse f16 and f128 literals [usamoi][]
  • fix(rust) allow function invocations whose names start with a keyword [Xia Li-yao][]
  • fix(rust) recognize \\ and \" char-literal escapes so highlighting doesn't leak, issue #​4351 Sarath Francis
  • enh(shell) match period (.) as part of shell prompt [Ian Wienand][]
  • enh(sqf) update to Arma 3 v2.22 [LouMontana][]
  • fix(xml) remove recursive sublanguage references to prevent ReDoS [petejm][]

Documentation:

  • docs(php) explain the difference between php and php-template Zain Asif
  • document LLVM IR in SUPPORTED_LANGUAGES [Jan Schultke][]
  • document the existing pwsh alias for PowerShell [helpimnotdrowning][]
  • list languages with category "common" in SUPPORTED_LANGUAGES [Marc Bernard][]
  • remind contributors to run npm i [Proliecan][]
  • fix typos in README.CDN.md [Zitrone][]

Themes:

  • added Equinox theme [Griffon Langyer][]

Build / Tooling:

  • (build) allow third-party packages to override default languages [Lysxia][]
  • (build) use Trusted Publishers in the publishing pipeline [allejo][]
  • fix(types) allow RegExp in Mode.keywords [KJyang-0114][]
  • refactor(tools) replace @colors/colors with ansis [webdiscus][]
  • chore: dependency updates

CONTRIBUTORS

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Europe/Lisbon)

  • Branch creation
    • "before 5am on monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/prod-minor+patch branch 11 times, most recently from 6c5908c to 2581180 Compare August 12, 2026 21:38
@renovate
renovate Bot force-pushed the renovate/prod-minor+patch branch 6 times, most recently from 9ab6d99 to 2873321 Compare August 20, 2026 19:03
@renovate
renovate Bot force-pushed the renovate/prod-minor+patch branch from 2873321 to 6e5bcde Compare August 21, 2026 05:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants