@atlaskit/editor-synced-block-provider 12.2.0 → 12.2.2

package/CHANGELOG.md

@@ -1,5 +1,50 @@
 # @atlaskit/editor-synced-block-provider
 
+## 12.2.2
+
+### Patch Changes
+
+- [`0927c3666c010`](https://bitbucket.org/atlassian/atlassian-frontend-monorepo/commits/0927c3666c010) -
+  Upgrade `uuid` from `3.x` to `11.1.1` to remediate GHSA-w5hq-g745-h8pq / SNYK-JS-UUID-16133035.
+
+  `uuid@11` removed the deep subpath exports (`uuid/v4`, `uuid/v1`, `uuid/v5`) and the default
+  export, so all internal call sites were migrated to named imports:
+
+  ```diff
+  -import uuid from 'uuid/v4';
+  +import { v4 as uuid } from 'uuid';
+
+  -import uuid from 'uuid';
+  +import { v4 as uuid } from 'uuid';
+  ```
+
+  With the exception of `@atlassian/integrations` (below), this is an internal implementation change
+  only - no public API, export, or entrypoint changed. UUID generation behaviour is unchanged
+  (`uuid@3`'s default export was already `v4`).
+
+  `@atlassian/integrations` declares `uuid` as a peer dependency, so its declared range moved from
+  `^3.1.0` to `^11.1.1`. That is a peer dependency declaration change, hence `minor` rather than
+  `patch` for that package.
+
+  The following `platform/packages/ai-mate` packages were also touched, but are all `private: true`
+  and so are intentionally not listed in the frontmatter above:
+  - `@atlassian/csm-assistance-service` - bumped its explicit `uuid` dependency from `npm:^9.0.0` to
+    `npm:^11.1.1` (`9.0.1` is also within the advisory's affected range).
+  - `@atlassian/csm-guidance-config` - example helper only, migrated to the named `uuid` import.
+  - `@atlassian/csm-ui-components` - example helper only, migrated to the named `uuid` import.
+
+- Updated dependencies
+
+## 12.2.1
+
+### Patch Changes
+
+- [`c5bc5493c5486`](https://bitbucket.org/atlassian/atlassian-frontend-monorepo/commits/c5bc5493c5486) -
+  Fix migrateSyncBlockIds mutating the caller's input ADF document. traverse() falls back to
+  mutating a node in place whenever its visitor returns undefined, so the transform now always
+  returns a copy instead.
+- Updated dependencies
+
 ## 12.2.0
 
 ### Minor Changes

package/dist/cjs/utils/migrateSyncBlockIds.js

@@ -72,14 +72,19 @@ var migrateAttrs = function migrateAttrs(attrs, resolvers, unresolvedContentIds)
 var migrateSyncBlockIds = exports.migrateSyncBlockIds = function migrateSyncBlockIds(adf, resolvers) {
   var unresolvedContentIds = new Set();
   var isTransformed = false;
+
+  // Always returns a copy, even when nothing changes: traverse() falls back to mutating
+  // the original node in place (its `content` array gets reassigned) whenever a visitor
+  // returns undefined, so returning undefined here would leak that mutation onto the
+  // caller's input document.
   var migrateNode = function migrateNode(node) {
     var syncBlockAttrs = node.attrs && parseSyncBlockAttrs(node.attrs);
     if (!syncBlockAttrs) {
-      return undefined;
+      return _objectSpread({}, node);
     }
     var nextAttrs = migrateAttrs(syncBlockAttrs, resolvers, unresolvedContentIds);
     if (!nextAttrs) {
-      return undefined;
+      return _objectSpread({}, node);
     }
     isTransformed = true;
     return _objectSpread(_objectSpread({}, node), {}, {

package/dist/es2019/utils/migrateSyncBlockIds.js

@@ -67,14 +67,23 @@ const migrateAttrs = (attrs, resolvers, unresolvedContentIds) => {
 export const migrateSyncBlockIds = (adf, resolvers) => {
   const unresolvedContentIds = new Set();
   let isTransformed = false;
+
+  // Always returns a copy, even when nothing changes: traverse() falls back to mutating
+  // the original node in place (its `content` array gets reassigned) whenever a visitor
+  // returns undefined, so returning undefined here would leak that mutation onto the
+  // caller's input document.
   const migrateNode = node => {
     const syncBlockAttrs = node.attrs && parseSyncBlockAttrs(node.attrs);
     if (!syncBlockAttrs) {
-      return undefined;
+      return {
+        ...node
+      };
     }
     const nextAttrs = migrateAttrs(syncBlockAttrs, resolvers, unresolvedContentIds);
     if (!nextAttrs) {
-      return undefined;
+      return {
+        ...node
+      };
     }
     isTransformed = true;
     return {

package/dist/esm/utils/migrateSyncBlockIds.js

@@ -66,14 +66,19 @@ var migrateAttrs = function migrateAttrs(attrs, resolvers, unresolvedContentIds)
 export var migrateSyncBlockIds = function migrateSyncBlockIds(adf, resolvers) {
   var unresolvedContentIds = new Set();
   var isTransformed = false;
+
+  // Always returns a copy, even when nothing changes: traverse() falls back to mutating
+  // the original node in place (its `content` array gets reassigned) whenever a visitor
+  // returns undefined, so returning undefined here would leak that mutation onto the
+  // caller's input document.
   var migrateNode = function migrateNode(node) {
     var syncBlockAttrs = node.attrs && parseSyncBlockAttrs(node.attrs);
     if (!syncBlockAttrs) {
-      return undefined;
+      return _objectSpread({}, node);
     }
     var nextAttrs = migrateAttrs(syncBlockAttrs, resolvers, unresolvedContentIds);
     if (!nextAttrs) {
-      return undefined;
+      return _objectSpread({}, node);
     }
     isTransformed = true;
     return _objectSpread(_objectSpread({}, node), {}, {

package/package.json

@@ -16,7 +16,7 @@
 	],
 	"atlaskit:src": "src/index.ts",
 	"dependencies": {
-		"@atlaskit/adf-utils": "^20.8.0",
+		"@atlaskit/adf-utils": "^20.9.0",
 		"@atlaskit/browser-apis": "^1.2.0",
 		"@atlaskit/editor-json-transformer": "^9.8.0",
 		"@atlaskit/editor-prosemirror": "^8.0.0",
@@ -30,10 +30,10 @@
 		"graphql-ws": "^5.14.2",
 		"lodash": "^4.17.21",
 		"raf-schd": "^4.0.3",
-		"uuid": "^3.1.0"
+		"uuid": "^11.1.1"
 	},
 	"peerDependencies": {
-		"@atlaskit/editor-common": "^120.12.0",
+		"@atlaskit/editor-common": "^120.13.0",
 		"react": "^18.2.0 || ^19.2.0"
 	},
 	"devDependencies": {
@@ -42,7 +42,7 @@
 		"react-dom": "^19.2.0"
 	},
 	"name": "@atlaskit/editor-synced-block-provider",
-	"version": "12.2.0",
+	"version": "12.2.2",
 	"description": "Synced Block Provider for @atlaskit/editor-plugin-synced-block",
 	"author": "Atlassian Pty Ltd",
 	"license": "Apache-2.0",