@atlaskit/editor-plugin-paste 17.1.7 → 17.1.9

package/CHANGELOG.md

@@ -1,5 +1,50 @@
 # @atlaskit/editor-plugin-paste
 
+## 17.1.9
+
+### Patch Changes
+
+- [`0927c3666c010`](https://bitbucket.org/atlassian/atlassian-frontend-monorepo/commits/0927c3666c010) -
+  Upgrade `uuid` from `3.x` to `11.1.1` to remediate GHSA-w5hq-g745-h8pq / SNYK-JS-UUID-16133035.
+
+  `uuid@11` removed the deep subpath exports (`uuid/v4`, `uuid/v1`, `uuid/v5`) and the default
+  export, so all internal call sites were migrated to named imports:
+
+  ```diff
+  -import uuid from 'uuid/v4';
+  +import { v4 as uuid } from 'uuid';
+
+  -import uuid from 'uuid';
+  +import { v4 as uuid } from 'uuid';
+  ```
+
+  With the exception of `@atlassian/integrations` (below), this is an internal implementation change
+  only - no public API, export, or entrypoint changed. UUID generation behaviour is unchanged
+  (`uuid@3`'s default export was already `v4`).
+
+  `@atlassian/integrations` declares `uuid` as a peer dependency, so its declared range moved from
+  `^3.1.0` to `^11.1.1`. That is a peer dependency declaration change, hence `minor` rather than
+  `patch` for that package.
+
+  The following `platform/packages/ai-mate` packages were also touched, but are all `private: true`
+  and so are intentionally not listed in the frontmatter above:
+  - `@atlassian/csm-assistance-service` - bumped its explicit `uuid` dependency from `npm:^9.0.0` to
+    `npm:^11.1.1` (`9.0.1` is also within the advisory's affected range).
+  - `@atlassian/csm-guidance-config` - example helper only, migrated to the named `uuid` import.
+  - `@atlassian/csm-ui-components` - example helper only, migrated to the named `uuid` import.
+
+- Updated dependencies
+
+## 17.1.8
+
+### Patch Changes
+
+- [`513f878e1df07`](https://bitbucket.org/atlassian/atlassian-frontend-monorepo/commits/513f878e1df07) -
+  [ux] Behind the platform_editor_preserve_mention_on_paste experiment, stop hoisting a mention's
+  avatar image out of its span during paste, so pasting a mention pastes a mention instead of a
+  standalone image
+- Updated dependencies
+
 ## 17.1.7
 
 ### Patch Changes

package/dist/cjs/pm-plugins/main.js

@@ -9,7 +9,7 @@ exports.isInsideBlockQuote = void 0;
 exports.isSharePointUrl = isSharePointUrl;
 var _regenerator = _interopRequireDefault(require("@babel/runtime/regenerator"));
 var _asyncToGenerator2 = _interopRequireDefault(require("@babel/runtime/helpers/asyncToGenerator"));
-var _uuid = _interopRequireDefault(require("uuid"));
+var _uuid = require("uuid");
 var _analytics = require("@atlaskit/editor-common/analytics");
 var _card = require("@atlaskit/editor-common/card");
 var _coreUtils = require("@atlaskit/editor-common/core-utils");
@@ -237,7 +237,7 @@ function createPlugin(schema, dispatchAnalyticsEvent, dispatch, featureFlags, pl
         var state = view.state;
         var content = (0, _analytics2.getContentNodeTypes)(slice.content);
         // eslint-disable-next-line @atlaskit/platform/prefer-crypto-random-uuid -- Use crypto.randomUUID instead
-        var pasteId = (0, _uuid.default)();
+        var pasteId = (0, _uuid.v4)();
         var measureName = "".concat(PASTE, "_").concat(pasteId);
         (0, _measureRender.measureRender)(measureName, function (_ref) {
           var duration = _ref.duration,

package/dist/cjs/pm-plugins/media.js

@@ -12,6 +12,7 @@ var _mediaSingle = require("@atlaskit/editor-common/media-single");
 var _utils = require("@atlaskit/editor-common/utils");
 var _utils2 = require("@atlaskit/editor-prosemirror/utils");
 var _mediaCommon = require("@atlaskit/media-common");
+var _isExperimentEnabled = require("@atlaskit/platform-feature-experiments/is-experiment-enabled");
 function ownKeys(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
 function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t), !0).forEach(function (r) { (0, _defineProperty2.default)(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
 /**
@@ -200,6 +201,14 @@ var unwrapNestedMediaElements = exports.unwrapNestedMediaElements = function unw
       return;
     }
 
+    // Bypass mention avatars - a mention's avatar <img> is nested only inside <span>s
+    // (never a valid container), so it would otherwise get hoisted out of the mention's
+    // DOM subtree and parsed as a standalone image instead of leaving the mention intact
+    // for its own parseDOM rule to match.
+    if ((0, _isExperimentEnabled.isExperimentEnabled)('platform_editor_preserve_mention_on_paste') && imageTag.closest('[data-mention-id]')) {
+      return;
+    }
+
     // Bypass mediaInline images - don't hoist images that are inside a mediaInline wrapper
     // as this would break parseDOM matching for mediaInline nodes
     // We remove the img from the DOM since mediaInline is a leaf node with no content

package/dist/cjs/pm-plugins/util/handlers.js

@@ -33,7 +33,7 @@ var _regenerator = _interopRequireDefault(require("@babel/runtime/regenerator"))
 var _toConsumableArray2 = _interopRequireDefault(require("@babel/runtime/helpers/toConsumableArray"));
 var _asyncToGenerator2 = _interopRequireDefault(require("@babel/runtime/helpers/asyncToGenerator"));
 var _defineProperty2 = _interopRequireDefault(require("@babel/runtime/helpers/defineProperty"));
-var _v = _interopRequireDefault(require("uuid/v4"));
+var _uuid = require("uuid");
 var _transforms = require("@atlaskit/adf-utils/transforms");
 var _analytics = require("@atlaskit/editor-common/analytics");
 var _card = require("@atlaskit/editor-common/card");
@@ -699,7 +699,7 @@ function handleMacroAutoConvert(text, slice, queueCardsFromChangedTr, runMacroAu
         }
 
         // eslint-disable-next-line @atlaskit/platform/prefer-crypto-random-uuid -- Use crypto.randomUUID instead
-        var trackingId = (0, _v.default)();
+        var trackingId = (0, _uuid.v4)();
         var trackingFrom = "handleMacroAutoConvert-from-".concat(trackingId);
         var trackingTo = "handleMacroAutoConvert-to-".concat(trackingId);
         (0, _commands.startTrackingPastedMacroPositions)((0, _defineProperty2.default)((0, _defineProperty2.default)({}, trackingFrom, state.selection.from), trackingTo, state.selection.to))(state, dispatch);

package/dist/es2019/pm-plugins/main.js

@@ -1,5 +1,5 @@
 // eslint-disable-next-line @atlaskit/platform/prefer-crypto-random-uuid -- Use crypto.randomUUID instead
-import uuid from 'uuid';
+import { v4 as uuid } from 'uuid';
 import { ACTION, INPUT_METHOD, PasteTypes } from '@atlaskit/editor-common/analytics';
 import { addLinkMetadata } from '@atlaskit/editor-common/card';
 import { insideTable } from '@atlaskit/editor-common/core-utils';

package/dist/es2019/pm-plugins/media.js

@@ -2,6 +2,7 @@ import { DEFAULT_IMAGE_WIDTH } from '@atlaskit/editor-common/media-single';
 import { mapSlice, removeNestedEmptyEls, unwrap, walkUpTreeUntil } from '@atlaskit/editor-common/utils';
 import { hasParentNodeOfType } from '@atlaskit/editor-prosemirror/utils';
 import { getRandomHex } from '@atlaskit/media-common';
+import { isExperimentEnabled } from '@atlaskit/platform-feature-experiments/is-experiment-enabled';
 /**
  * Ensure correct layout in nested mode
  *
@@ -196,6 +197,14 @@ export const unwrapNestedMediaElements = html => {
       return;
     }
 
+    // Bypass mention avatars - a mention's avatar <img> is nested only inside <span>s
+    // (never a valid container), so it would otherwise get hoisted out of the mention's
+    // DOM subtree and parsed as a standalone image instead of leaving the mention intact
+    // for its own parseDOM rule to match.
+    if (isExperimentEnabled('platform_editor_preserve_mention_on_paste') && imageTag.closest('[data-mention-id]')) {
+      return;
+    }
+
     // Bypass mediaInline images - don't hoist images that are inside a mediaInline wrapper
     // as this would break parseDOM matching for mediaInline nodes
     // We remove the img from the DOM since mediaInline is a leaf node with no content

package/dist/es2019/pm-plugins/util/handlers.js

@@ -1,5 +1,5 @@
 // eslint-disable-next-line @atlaskit/platform/prefer-crypto-random-uuid -- Use crypto.randomUUID instead
-import uuid from 'uuid/v4';
+import { v4 as uuid } from 'uuid';
 import { transformContainerNodes } from '@atlaskit/adf-utils/transforms';
 import { INPUT_METHOD } from '@atlaskit/editor-common/analytics';
 import { addLinkMetadata } from '@atlaskit/editor-common/card';

package/dist/esm/pm-plugins/main.js

@@ -4,7 +4,7 @@ function _createForOfIteratorHelper(r, e) { var t = "undefined" != typeof Symbol
 function _unsupportedIterableToArray(r, a) { if (r) { if ("string" == typeof r) return _arrayLikeToArray(r, a); var t = {}.toString.call(r).slice(8, -1); return "Object" === t && r.constructor && (t = r.constructor.name), "Map" === t || "Set" === t ? Array.from(r) : "Arguments" === t || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t) ? _arrayLikeToArray(r, a) : void 0; } }
 function _arrayLikeToArray(r, a) { (null == a || a > r.length) && (a = r.length); for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e]; return n; }
 // eslint-disable-next-line @atlaskit/platform/prefer-crypto-random-uuid -- Use crypto.randomUUID instead
-import uuid from 'uuid';
+import { v4 as uuid } from 'uuid';
 import { ACTION, INPUT_METHOD, PasteTypes } from '@atlaskit/editor-common/analytics';
 import { addLinkMetadata } from '@atlaskit/editor-common/card';
 import { insideTable } from '@atlaskit/editor-common/core-utils';

package/dist/esm/pm-plugins/media.js

@@ -5,6 +5,7 @@ import { DEFAULT_IMAGE_WIDTH } from '@atlaskit/editor-common/media-single';
 import { mapSlice, removeNestedEmptyEls, unwrap, walkUpTreeUntil } from '@atlaskit/editor-common/utils';
 import { hasParentNodeOfType } from '@atlaskit/editor-prosemirror/utils';
 import { getRandomHex } from '@atlaskit/media-common';
+import { isExperimentEnabled } from '@atlaskit/platform-feature-experiments/is-experiment-enabled';
 /**
  * Ensure correct layout in nested mode
  *
@@ -191,6 +192,14 @@ export var unwrapNestedMediaElements = function unwrapNestedMediaElements(html)
       return;
     }
 
+    // Bypass mention avatars - a mention's avatar <img> is nested only inside <span>s
+    // (never a valid container), so it would otherwise get hoisted out of the mention's
+    // DOM subtree and parsed as a standalone image instead of leaving the mention intact
+    // for its own parseDOM rule to match.
+    if (isExperimentEnabled('platform_editor_preserve_mention_on_paste') && imageTag.closest('[data-mention-id]')) {
+      return;
+    }
+
     // Bypass mediaInline images - don't hoist images that are inside a mediaInline wrapper
     // as this would break parseDOM matching for mediaInline nodes
     // We remove the img from the DOM since mediaInline is a leaf node with no content

package/dist/esm/pm-plugins/util/handlers.js

@@ -8,7 +8,7 @@ function _arrayLikeToArray(r, a) { (null == a || a > r.length) && (a = r.length)
 function ownKeys(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
 function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t), !0).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
 // eslint-disable-next-line @atlaskit/platform/prefer-crypto-random-uuid -- Use crypto.randomUUID instead
-import uuid from 'uuid/v4';
+import { v4 as uuid } from 'uuid';
 import { transformContainerNodes } from '@atlaskit/adf-utils/transforms';
 import { INPUT_METHOD } from '@atlaskit/editor-common/analytics';
 import { addLinkMetadata } from '@atlaskit/editor-common/card';

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@atlaskit/editor-plugin-paste",
-	"version": "17.1.7",
+	"version": "17.1.9",
 	"description": "Paste plugin for @atlaskit/editor-core",
 	"author": "Atlassian Pty Ltd",
 	"license": "Apache-2.0",
@@ -19,8 +19,8 @@
 	"sideEffects": false,
 	"atlaskit:src": "src/index.ts",
 	"dependencies": {
-		"@atlaskit/adf-schema": "^57.2.0",
-		"@atlaskit/adf-utils": "^20.8.0",
+		"@atlaskit/adf-schema": "^57.3.0",
+		"@atlaskit/adf-utils": "^20.9.0",
 		"@atlaskit/code": "^19.2.0",
 		"@atlaskit/editor-markdown-transformer": "^6.3.0",
 		"@atlaskit/editor-plugin-analytics": "^16.1.0",
@@ -39,7 +39,7 @@
 		"@atlaskit/icon": "^37.6.0",
 		"@atlaskit/insm": "^3.0.0",
 		"@atlaskit/linking-common": "^12.1.0",
-		"@atlaskit/media-client": "^37.6.0",
+		"@atlaskit/media-client": "^37.7.0",
 		"@atlaskit/media-common": "^14.6.0",
 		"@atlaskit/platform-feature-experiments": "^0.3.0",
 		"@atlaskit/platform-feature-flags": "^2.2.0",
@@ -48,10 +48,10 @@
 		"@atlaskit/tokens": "^16.11.0",
 		"@babel/runtime": "^7.0.0",
 		"lodash": "^4.17.21",
-		"uuid": "^3.1.0"
+		"uuid": "^11.1.1"
 	},
 	"peerDependencies": {
-		"@atlaskit/editor-common": "^120.12.0",
+		"@atlaskit/editor-common": "^120.13.0",
 		"react": "^18.2.0 || ^19.2.0",
 		"react-dom": "^18.2.0 || ^19.2.0",
 		"react-intl": "^5.25.1 || ^6.0.0 || ^7.0.0"