Skip to content

Upgrading @tiptap/extension-placeholder 2 to 3

Breaking2.27.3 → 3.32.2Breaking18Security11Platform2New111Changed309Fixed322Other42

Full comparisonBack to @tiptap/extension-placeholder
Fetching 151 releases from GitHub…149 / 151
BreakingUpgrade verdict

13 breaking changes and 2 platform requirement changes and 11 security fixes.

In plain terms
  • The package no longer ships a browser-global build; you must bundle it yourself if you relied on that.
  • Custom configuration keys now need to be declared in TypeScript before use.
  • Setting or clearing content now triggers update events, which may affect listeners.
  • Menus now use a different positioning library, so menu configuration and dependencies must be updated.
Must act Top 5 of 26 that need code or config changes

What you must change

Breaking13
Switches to tsup for bundling, so UMD builds are no longer supported.
tsup
3.0.1GitHub ReleaseSummarizedView source
Node, Mark, and Extension configs no longer allow arbitrary keys unless their TypeScript interfaces are extended.
NodeMarkExtension
3.0.1GitHub ReleaseSummarizedView source
clearContent and setContent now emit updates by default.
clearContentsetContent
3.0.1GitHub ReleaseSummarizedView source
Replaces Tippy.js with Floating UI across menu-related extensions, removing tippyOptions in favor of an options prop.
FloatingMenuBubbleMenuMentionSuggestiontippyOptionsoptions@floating-ui/dom
3.0.1GitHub ReleaseSummarizedView source
Renames the History extension to UndoRedo.
HistoryUndoRedo
3.0.0-next.7GitHub ReleaseSummarizedView source
Renames the CollaborationCursor extension to CollaborationCaret.
CollaborationCursorCollaborationCaret
3.0.0-next.7GitHub ReleaseSummarizedView source
Renames @tiptap/extension-utils to @tiptap/extensions.
@tiptap/extension-utils@tiptap/extensions
3.0.0-next.5GitHub ReleaseSummarizedView source
Removes tippy.js and replaces it with Floating UI.
tippy.jsFloating UI
3.0.0-next.1GitHub ReleaseSummarizedView source
Changes prop types of the Tiptap component so that either the editor or the instance field is required.
Tiptapeditorinstance
3.27.2GitHub ReleaseSummarizedView source
Moves BubbleMenu and FloatingMenu to a separate @tiptap/react/menus entrypoint to keep floating-ui optional.
BubbleMenuFloatingMenu@tiptap/react/menus
3.20.0GitHub ReleaseSummarizedView source
getPos now returns number | undefined to reflect runtime reality.
getPos
3.0.1GitHub ReleaseSummarizedView source
editor.storage becomes per-editor instance and strongly typed.
editor.storage
3.0.1GitHub ReleaseSummarizedView source
VueNodeViewRenderer returns null for contentDOM when the node is not a leaf and no NodeViewContent is rendered.
VueNodeViewRenderercontentDOMNodeViewContent
3.0.1GitHub ReleaseSummarizedView source
Security11
Prevents extra CSS declarations from being rendered from editor content.
3.31.4GitHub ReleaseSummarizedView source
Prevents extra CSS declarations from being rendered from editor content.
3.31.4GitHub ReleaseSummarizedView source
Ignores potentially unsafe color values received from other collaboration users.
3.31.3GitHub ReleaseSummarizedView source
Bumps prosemirror-view to ^1.42.3, fixing an XSS vulnerability where pasting crafted HTML could run arbitrary JavaScript.
prosemirror-view
3.31.2GitHub ReleaseSummarizedView source
Fixes a denial-of-service risk where crafted block or inline Markdown attributes could consume excessive CPU and block the event loop.
3.30.5GitHub ReleaseSummarizedView source
Prevents untrusted HTML attributes from changing an object's prototype when merged with mergeAttributes.
mergeAttributes
3.30.4GitHub ReleaseSummarizedView source
Escapes HTML string renderer text content and attribute values to prevent injected markup from untrusted content.
3.22.5GitHub ReleaseSummarizedView source
Fixes CVE-2025-62410 by updating happy-dom to ^20.0.2.
happy-dom
3.7.2GitHub ReleaseSummarizedView source
Bumps happy-dom from ^18.0.1 to ^20.0.0 in @tiptap/html to fix CVE-2025-61927.
happy-dom@tiptap/html
3.6.7GitHub ReleaseSummarizedView source
Bumps linkifyjs to the latest version to address a recently discovered prototype pollution vulnerability.
linkifyjs
3.0.8GitHub ReleaseSummarizedView source
Fixes the Link extension's commands not respecting XSS prevention via unallowed protocols.
3.0.0-next.5GitHub ReleaseSummarizedView source
Platform2
Adds @tiptap/pm as a peer dependency so bundlers resolve ProseMirror packages from the app instead of duplicating prosemirror-model.
@tiptap/pmprosemirror-model@tiptap/extension-blockquote
3.27.4GitHub ReleaseSummarizedView source
Updates the @tiptap/pm dependency to 3.22.4.
@tiptap/pm
3.22.4GitHub ReleaseSummarizedView source