Skip to content

npm ci installs @tiptap/markdown 3.21.0, which silently deletes escaped characters on save #424

Description

@ryhowww

package.json has @tiptap/markdown: ^3.20.0, but package-lock.json pins 3.21.0. That version drops a backslash escape along with the character it was protecting, so saving an entry deletes content the user never touched.

Because the pin is only in the lockfile, npm ci and npm install behave differently:

  • npm ci, the documented install, gets 3.21.0 and loses characters on save
  • npm install on a fresh clone resolves a current 3.x and does not

Reproduction, on a rich-text field:

Content After one save on 3.21.0
**\* Catchers in the Rye** asterisk gone
industry\* asterisk gone
1\) First point closing paren gone

The user does not have to edit the affected line. Opening an entry and saving is enough.

Fixed in 3.29.2, where tiptap replaced its markdown engine. Refreshing the lockfile is the whole change, since package.json already allows it. We run 3.29.2 in a fork and next build compiles and type-checks clean with no other dependency movement.

I can open a PR with just the lockfile refresh. I also have a small offline harness that replays the editor round-trip over a content directory and reports which files a save would change, if that is useful to the project.

One implementation (so far), more to come, love it, thank you.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions