build: bump the npm_and_yarn group across 1 directory with 3 updates

[dependabot]

Bumps the npm_and_yarn group with 3 updates in the / directory: @tiptap/core, browserslist and qs.

Updates @tiptap/core from 3.23.4 to 3.30.4

Release notes

Sourced from @​tiptap/core's releases.

v3.30.4

@​tiptap/core

Patch Changes

• Prevent untrusted HTML attributes from changing an object's prototype when merged with mergeAttributes.

v3.30.3

@​tiptap/extension-text-style

Patch Changes

• Unsetting one text style inside a blockquote no longer removes the other text styles in it.

@​tiptap/extension-youtube

Patch Changes

• YouTube live URLs (/live/<id>) now embed the video.

@​tiptap/core

Patch Changes

• Fix JSX runtime to properly render nested sibling elements by spreading children arrays into DOMOutputSpec

@​tiptap/react

Patch Changes

• Fix ReactNodeViewRenderer crash when contentComponent is not available

@​tiptap/ai-toolkit

Minor Changes

• Add the AiInsertReveal extension (@tiptap/ai-toolkit/streaming-reveal) to fade in text as the AI streams it into a collaborative document.

v3.30.2

@​tiptap/core

Patch Changes

• Keep mixed JSX children as separate siblings in DOM output.
• Fixed a bug where editor.chain and editor.can can not be accessed on editor initialization

@​tiptap/extension-image

Patch Changes

... (truncated)

Changelog

Sourced from @​tiptap/core's changelog.

3.30.4

Patch Changes

• 01d7af8: Prevent untrusted HTML attributes from changing an object's prototype when merged with mergeAttributes.
  • @​tiptap/pm@​3.30.4

3.30.3

Patch Changes

• 965a880: Fix JSX runtime to properly render nested sibling elements by spreading children arrays into DOMOutputSpec
  • @​tiptap/pm@​3.30.3

3.30.2

Patch Changes

• 3dffed5: Keep mixed JSX children as separate siblings in DOM output.
• 214a140: Fixed a bug where editor.chain and editor.can can not be accessed on editor initialization
  • @​tiptap/pm@​3.30.2

3.30.1

Patch Changes

• abc8828: Added new ProseMirror helpers that check whether a value is a specific ProseMirror type.
  • @​tiptap/pm@​3.30.1

3.30.0

Minor Changes

• 0247d39: ListKeymap now registers a Tab shortcut that sinks a top-level textblock into the previous list's last item. Pressing Tab at the start of a paragraph right after a bullet/ordered/task list moves the paragraph inside the last list item. The handler does nothing when the cursor is already inside a list item (sinkListItem keeps working), when there is no list before the paragraph, when the caret is mid-textblock, or when the selection is not a text selection (for example a gap cursor).

  @tiptap/core also exposes a new getPreviousBlockSibling($pos) helper that returns the block-level sibling before the cursor's textblock, or null at the first child of the block parent.

• 3099eef: New Decorations API

  Finally the decorations API is here! Even though Decorations itself are nothing new in ProseMirror, the new API makes it much easier to use them in Tiptap without leaving your extensions.

  Decorations change how the document looks without changing the document itself. Highlighting search results, marking spelling mistakes, showing collaborator cursors, putting a drag handle next to every block.

  Until now you had to write a ProseMirror plugin by hand for this, keep the decoration set in plugin state, and map it forward on every transaction. Extensions can now declare decorations directly with a new addDecorations() hook.

  addDecorations() {
    return {
      create: ({ state }) =>
        // findMatches can be any function that returns an array of { from, to } ranges

... (truncated)

Commits

• 55f59e4 chore(release): release new stable release (#8260)
• 01d7af8 Merge commit from fork
• 98b469d chore: complete Vite+ migration (#8258)
• db790a7 chore(release): release new stable release (#8216)
• f434577 chore: migrate over to vite+ for tooling (#8151)
• 965a880 fix(core): preserve JSX child boundaries (#7491)
• cef2c9a chore(release): release new stable release (#8190)
• 214a140 fixed editor.can and editor.chain to not be accessible on editor … (#8210)
• 3dffed5 fix(core): keep mixed JSX children separate in DOM output
• 4c4933d chore(release): release new stable release (#8181)
• Additional commits viewable in compare view

Updates browserslist from 4.28.2 to 4.28.8

Release notes

Sourced from browserslist's releases.

4.28.8

• Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

• Improved parsing performance.
• Fixed unbounded memory growth (by @​alanturing881).
• Fixed prototype write issue (by @​alanturing881).

4.28.6

• Fixed Electron version queries (by @​spokodev).

4.28.5

• Fixed > and >= queries (by @​spokodev).

4.28.4

• Fixed SyntaxError regression of 4.28.3.

4.28.3

• Fixed baseline query case-insensitivity (by @​swwind).

Changelog

Sourced from browserslist's changelog.

4.28.8

• Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

• Improved parsing performance.
• Fixed unbounded memory growth (by @​alanturing881).
• Fixed prototype write issue (by @​alanturing881).

4.28.6

• Fixed Electron version queries (by @​spokodev).

4.28.5

• Fixed > and >= queries (by @​spokodev).

4.28.4

• Fixed SyntaxError regression of 4.28.3.

4.28.3

• Fixed baseline query case-insensitivity (by @​swwind).

Commits

• f2f2e6c Release 4.28.8 version
• d0787c8 Update dependencies
• fcf8fa9 Merge pull request #939 from Jaybhade/fix/baseline-kaios-without-downstream
• 57ecd64 fix: support "including kaios" without downstream
• 093a0f6 Update EM banner
• b637868 Release 4.28.7 version
• 313f465 Update dependencies
• c935c5a Fix regexp performance
• d7e9e65 Rewrite structure parsing to make it always fast
• ec4a55e Fix import order
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for browserslist since your current version.

Updates qs from 6.15.2 to 6.15.3

Changelog

Sourced from qs's changelog.

6.15.3

• [Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via combine/merge
• [Fix] utils: respect encoding of surrogate pairs across chunks (#559)
• [Robustness] parse: throw the arrayLimit error before splitting oversized comma values
• [Robustness] utils.merge / utils.assign: avoid invoking __proto__ setter when copying own properties
• [Robustness] utils: enforce arrayLimit consistently across merge's array paths
• [Perf] utils: make compact O(n) via a side-channel visited-set instead of Array.indexOf
• [Deps] update side-channel
• [Dev Deps] update eslint, mock-property, tape
• [Tests] parse: characterize current lenient handling of unbalanced bracket keys (#558)

Commits

• 18d085e v6.15.3
• c38af42 [Deps] update side-channel
• adce539 [Dev Deps] update eslint, mock-property, tape
• 74a0f6a [Robustness] utils: enforce arrayLimit consistently across merge's arra...
• f4938f5 [Tests] parse: characterize current lenient handling of unbalanced bracket ...
• 5d5f723 [Perf] utils: make compact O(n) via a side-channel visited-set instead of...
• 52afe00 [Robustness] parse: throw the arrayLimit error before splitting oversized...
• 963e538 [Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via...
• 59da434 [Fix] utils: respect encoding of surrogate pairs across chunks
• 9532969 [Robustness] utils.merge / utils.assign: avoid invoking __proto__ sette...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
puck-demo	Error		Sep 4, 2026 9:37am UTC
puck-docs	Error		Sep 4, 2026 9:37am UTC