Skip to content

v3.37.2

Choose a tag to compare

View all tags
@tjloong tjloong released this 16 Oct 01:55
· 5 commits to main since this release
v3.37.2
1d747c3
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security

  • Security fix in Tiptap\Content::sanitize() and render(). Upgrade soon if you pass user-supplied HTML or stored editor content through them.

Fixes

  • Tiptap\Content prints the same HTML on libxml 2.9 (Ubuntu 22.04/24.04, Debian PHP images) and libxml 2.14+. Processing instructions (<?...>) no longer throw and report() on 2.9; loose top-level text is wrapped in a <p>; NUL bytes are stripped; blank-line runs outside <pre> are collapsed before parsing.
  • Documents nested deeper than 200 levels are refused (depth): render() logs it, sanitize() stays silent.
  • atom:tiptap-migrate converts through the same path as render() and skips (and names) a row it cannot convert instead of aborting the run.

See the README's "Upgrading to 3.37.2" for the output changes.

Assets 2
Loading