prosemirror-schema-basic 1.2.3 → 1.2.5

package/CHANGELOG.md

@@ -1,3 +1,15 @@
+## 1.2.5 (2026-09-25)
+
+### Bug fixes
+
+Make sure that, even if an attacker manages to smuggle a string in a heading's `level` attribute, they cannot inject arbitrary tag names.
+
+## 1.2.4 (2025-03-18)
+
+### Bug fixes
+
+Add a `code` flag to the code mark.
+
 ## 1.2.3 (2024-07-14)
 
 ### Bug fixes

package/CONTRIBUTING.md

@@ -12,7 +12,7 @@ Community discussion, questions, and informal bug reporting is done on the
 ## Submitting bug reports
 
 Report bugs on the
-[GitHub issue tracker](http://github.com/prosemirror/prosemirror/issues).
+[issue tracker](https://code.haverbeke.berlin/prosemirror/prosemirror/issues).
 Before reporting a bug, please read these pointers.
 
 - The issue tracker is for *bugs*, not requests for help. Questions
@@ -34,21 +34,28 @@ Before reporting a bug, please read these pointers.
 
 ## Contributing code
 
-- Make sure you have a [GitHub Account](https://github.com/signup/free)
+Code generated by a language model is not welcome in this project.
+Please don't waste my time with it.
 
-- Fork the relevant repository
-  ([how to fork a repo](https://help.github.com/articles/fork-a-repo))
+If you want to make a change that involves a significant overhaul of
+the code or introduces a user-visible new feature, create an
+[issue](https://code.haverbeke.berlin/prosemirror/prosemirror/issues/)
+first with your proposal.
+
+- Make sure you have a [Codeberg](https://codeberg.org/user/sign_up)
+  or [GitHub](https://github.com/signup/free) account.
+  
+- Use that to create a [code.haverbeke.berlin
+  account](https://code.haverbeke.berlin/user/login).
+
+- Fork the relevant repository.
 
 - Create a local checkout of the code. You can use the
-  [main repository](https://github.com/prosemirror/prosemirror) to
+  [main repository](https://code.haverbeke.berlin/prosemirror/prosemirror) to
   easily check out all core modules.
 
 - Make your changes, and commit them
 
-- Follow the code style of the rest of the project (see below). Run
-  `npm run lint` (in the main repository checkout) to make sure that
-  the linter is happy.
-
 - If your changes are easy to test or likely to regress, add tests in
   the relevant `test/` directory. Either put them in an existing
   `test-*.js` file, if they fit there, or add a new file.
@@ -56,13 +63,13 @@ Before reporting a bug, please read these pointers.
 - Make sure all tests pass. Run `npm run test` to verify tests pass
   (you will need Node.js v6+).
 
-- Submit a pull request ([how to create a pull request](https://help.github.com/articles/fork-a-repo)).
-  Don't put more than one feature/fix in a single pull request.
+- Submit a pull request. Don't put more than one feature/fix in a
+  single pull request.
 
 By contributing code to ProseMirror you
 
  - Agree to license the contributed code under the project's [MIT
-   license](https://github.com/ProseMirror/prosemirror/blob/master/LICENSE).
+   license](https://code.haverbeke.berlin/prosemirror/prosemirror/blob/main/LICENSE).
 
  - Confirm that you have the right to contribute and license the code
    in question. (Either you hold all rights on the code, or the rights
@@ -82,19 +89,16 @@ By contributing code to ProseMirror you
 - Follow the surrounding code when it comes to spacing, brace
   placement, etc.
 
-- Brace-less single-statement bodies are encouraged (whenever they
-  don't impact readability).
+- Brace-less single-statement bodies are encouraged whenever they
+  don't impact readability.
 
-- [getdocs](https://github.com/marijnh/getdocs)-style doc comments
+- [getdocs-ts](https://code.haverbeke.berlin/marijn/getdocs-ts)-style doc comments
   above items that are part of the public API.
 
 - When documenting non-public items, you can put the type after a
   single colon, so that getdocs doesn't pick it up and add it to the
   API reference.
 
-- The linter (`npm run lint`) complains about unused variables and
-  functions. Prefix their names with an underscore to muffle it.
-
 - ProseMirror does *not* follow JSHint or JSLint prescribed style.
   Patches that try to 'fix' code to pass one of these linters will not
   be accepted.

package/README.md

@@ -1,6 +1,6 @@
 # prosemirror-schema-basic
 
-[ [**WEBSITE**](https://prosemirror.net) | [**ISSUES**](https://github.com/prosemirror/prosemirror/issues) | [**FORUM**](https://discuss.prosemirror.net) | [**CHANGELOG**](https://github.com/ProseMirror/prosemirror-schema-basic/blob/master/CHANGELOG.md) ]
+[ [**WEBSITE**](https://prosemirror.net) | [**ISSUES**](https://code.haverbeke.berlin/prosemirror/prosemirror/issues) | [**FORUM**](https://discuss.prosemirror.net) | [**CHANGELOG**](https://code.haverbeke.berlin/prosemirror/prosemirror-schema-basic/src/branch/main/CHANGELOG.md) ]
 
 This is a [schema module](https://prosemirror.net/docs/ref/#schema-basic) for [ProseMirror](https://prosemirror.net).
 ProseMirror is a well-behaved rich semantic content editor based on
@@ -16,10 +16,10 @@ number of [examples](https://prosemirror.net/examples/) and the
 [documentation](https://prosemirror.net/docs/).
 
 This code is released under an
-[MIT license](https://github.com/prosemirror/prosemirror/tree/master/LICENSE).
+[MIT license](https://code.haverbeke.berlin/prosemirror/prosemirror/src/branch/main/LICENSE).
 There's a [forum](http://discuss.prosemirror.net) for general
 discussion and support requests, and the
-[Github bug tracker](https://github.com/prosemirror/prosemirror/issues)
+[bug tracker](https://code.haverbeke.berlin/prosemirror/prosemirror/issues)
 is the place to report issues.
 
 We aim to be an inclusive, welcoming community. To make that explicit,

package/dist/index.cjs

@@ -82,7 +82,7 @@ var nodes = {
       }
     }],
     toDOM: function toDOM(node) {
-      return ["h" + node.attrs.level, 0];
+      return ["h" + +node.attrs.level, 0];
     }
   },
   code_block: {
@@ -228,6 +228,7 @@ var marks = {
     }
   },
   code: {
+    code: true,
     parseDOM: [{
       tag: "code"
     }],

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-import { NodeSpec, MarkSpec, Schema } from 'prosemirror-model';
+import { MarkSpec, NodeSpec, Schema } from 'prosemirror-model';
 
 /**
 [Specs](https://prosemirror.net/docs/ref/#model.NodeSpec) for the nodes defined in this schema.

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { NodeSpec, MarkSpec, Schema } from 'prosemirror-model';
+import { MarkSpec, NodeSpec, Schema } from 'prosemirror-model';
 
 /**
 [Specs](https://prosemirror.net/docs/ref/#model.NodeSpec) for the nodes defined in this schema.

package/dist/index.js

@@ -55,7 +55,7 @@ const nodes = {
             { tag: "h4", attrs: { level: 4 } },
             { tag: "h5", attrs: { level: 5 } },
             { tag: "h6", attrs: { level: 6 } }],
-        toDOM(node) { return ["h" + node.attrs.level, 0]; }
+        toDOM(node) { return ["h" + +node.attrs.level, 0]; }
     },
     /**
     A code listing. Disallows marks or non-text inline
@@ -164,6 +164,7 @@ const marks = {
     Code font mark. Represented as a `<code>` element.
     */
     code: {
+        code: true,
         parseDOM: [{ tag: "code" }],
         toDOM() { return codeDOM; }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prosemirror-schema-basic",
-  "version": "1.2.3",
+  "version": "1.2.5",
   "description": "Basic schema elements for ProseMirror",
   "type": "module",
   "main": "dist/index.cjs",
@@ -21,10 +21,10 @@
   ],
   "repository": {
     "type": "git",
-    "url": "git://github.com/prosemirror/prosemirror-schema-basic.git"
+    "url": "git+https://code.haverbeke.berlin/prosemirror/prosemirror-schema-basic.git"
   },
   "dependencies": {
-    "prosemirror-model": "^1.19.0"
+    "prosemirror-model": "^1.25.0"
   },
   "devDependencies": {
     "@prosemirror/buildhelper": "^0.1.5",

package/src/schema-basic.ts

@@ -50,7 +50,7 @@ export const nodes = {
                {tag: "h4", attrs: {level: 4}},
                {tag: "h5", attrs: {level: 5}},
                {tag: "h6", attrs: {level: 6}}],
-    toDOM(node) { return ["h" + node.attrs.level, 0] }
+    toDOM(node) { return ["h" + +node.attrs.level, 0] }
   } as NodeSpec,
 
   /// A code listing. Disallows marks or non-text inline
@@ -150,6 +150,7 @@ export const marks = {
 
   /// Code font mark. Represented as a `<code>` element.
   code: {
+    code: true,
     parseDOM: [{tag: "code"}],
     toDOM() { return codeDOM }
   } as MarkSpec