Upgrading @tiptap/extension-link 2 to 3
Breaking2.27.3 → 3.32.2Breaking21Security11Platform2New102Changed259Fixed285Other45
Fetching 152 releases from GitHub…150 / 152
BreakingUpgrade verdict
16 breaking changes and 2 platform requirement changes and 11 security fixes.
In plain terms
- Custom configuration keys on extensions now require extending the TypeScript types.
- Clearing or setting content now triggers update events by default, making reactivity more predictable.
- Menus like FloatingMenu, BubbleMenu, Mention and Suggestion now use Floating UI instead of Tippy.js, which requires code changes and a new peer dependency.
- The package no longer ships a browser-global build; you must bundle it yourself if you relied on that.
Must act Top 5 of 29 that need code or config changes
What you must change
Breaking16
Node, Mark, and Extension configs no longer allow arbitrary keys unless their TypeScript interfaces are extended.
NodeMarkExtensionclearContent and setContent now emit updates by default.
clearContentsetContentReplaces Tippy.js with Floating UI across menu-related extensions, removing tippyOptions in favor of an options prop.
FloatingMenuBubbleMenuMentionSuggestiontippyOptionsoptionsSwitches to tsup for bundling, so UMD builds are no longer supported.
tsupRenames the History extension to UndoRedo.
HistoryUndoRedoRenames the CollaborationCursor extension to CollaborationCaret.
CollaborationCursorCollaborationCaretRenames @tiptap/extension-utils to @tiptap/extensions.
@tiptap/extension-utils@tiptap/extensionsRemoves tippy.js and replaces it with Floating UI for floating elements.
tippy.jsFloating UIChanges Tiptap component prop types so that either the
editor or the instance field is required.TiptapeditorinstanceSwitches @tiptap/core to tsup for bundling, dropping UMD builds.
getPos now returns number | undefined for stronger typings.
getPoseditor.storage becomes per-editor instance and strongly typed.
editor.storageVueNodeViewRenderer returns null for contentDOM when the node is not a leaf and no NodeViewContent is rendered.
VueNodeViewRenderercontentDOMNodeViewContentChanges math node insertion so the current text selection is used and replaced when no LaTeX string is given.
The Math extension now renders math content using nodes instead of text content, which is not backwards compatible.
Updating a math equation's latex content now requires an explicit update command.
editor.commands.updateInlineMath()editor.commands.updateBlockMath()Security11
Prevents extra CSS declarations from being rendered from editor content.
Prevents extra CSS declarations from being rendered from editor content.
Fixes a bug that allowed potentially unsafe color values from other collaboration clients; unsafe colors are now ignored.
Bumps prosemirror-view to ^1.42.3, fixing an XSS vulnerability where pasting crafted HTML could run arbitrary JavaScript.
prosemirror-viewFixes a denial-of-service risk where crafted block or inline Markdown attributes could consume excessive CPU and block the event loop.
Prevents untrusted HTML attributes from changing an object's prototype when merged with mergeAttributes.
mergeAttributesEscapes HTML string renderer text content and attribute values to prevent injected markup from untrusted content.
Fixes CVE-2025-62410 by updating happy-dom to ^20.0.2.
happy-domFixes CVE-2025-61927 by bumping happy-dom to 20.0.0 in @tiptap/html.
happy-dom@tiptap/htmlBumps linkifyjs to the latest version to address a recently discovered prototype pollution vulnerability.
linkifyjsFixes Link extension commands not respecting XSS prevention via unallowed protocols.
Platform2
Adds @tiptap/pm as a peer dependency of @tiptap/extension-blockquote to avoid duplicate ProseMirror packages.
@tiptap/pm@tiptap/extension-blockquoteprosemirror-modelRequires installing @floating-ui/dom@^1.6.0 as a peer dependency.
@floating-ui/dom