@tiptap/core - npm Package Compare versions

Comparing version 3.20.0 to 3.20.1

package.json

 {
   "name": "@tiptap/core",
   "description": "headless rich text editor",
-  "version": "3.20.0",
+  "version": "3.20.1",
   "homepage": "https://tiptap.dev",
@@ -55,6 +55,6 @@ "keywords": [
   "devDependencies": {
-    "@tiptap/pm": "^3.20.0"
+    "@tiptap/pm": "^3.20.1"
   },
   "peerDependencies": {
-    "@tiptap/pm": "^3.20.0"
+    "@tiptap/pm": "^3.20.1"
   },
@@ -61,0 +61,0 @@ "repository": {

src/utilities/mergeAttributes.ts

@@ -0,1 +1,74 @@
+/** Splits a CSS style string into declarations, ignoring semicolons inside quotes/parentheses. */
+function splitStyleDeclarations(styles: string): string[] {
+  const result: string[] = []
+
+  let current = ''
+  let inSingleQuote = false
+  let inDoubleQuote = false
+  let parenDepth = 0
+
+  const length = styles.length
+  for (let i = 0; i < length; i += 1) {
+    const char = styles[i]
+    if (char === "'" && !inDoubleQuote) {
+      inSingleQuote = !inSingleQuote
+      current += char
+      continue
+    }
+    if (char === '"' && !inSingleQuote) {
+      inDoubleQuote = !inDoubleQuote
+      current += char
+      continue
+    }
+    if (!inSingleQuote && !inDoubleQuote) {
+      if (char === '(') {
+        parenDepth += 1
+        current += char
+        continue
+      }
+      if (char === ')' && parenDepth > 0) {
+        parenDepth -= 1
+        current += char
+        continue
+      }
+      if (char === ';' && parenDepth === 0) {
+        result.push(current)
+        current = ''
+        continue
+      }
+    }
+    current += char
+  }
+  if (current) {
+    result.push(current)
+  }
+
+  return result
+}
+
+/** Yields property/value pairs from a style string. */
+function parseStyleEntries(styles: string | undefined): [property: string, value: string][] {
+  const pairs: [string, string][] = []
+
+  const declarations = splitStyleDeclarations(styles || '')
+  const numDeclarations = declarations.length
+
+  for (let i = 0; i < numDeclarations; i += 1) {
+    const declaration = declarations[i]
+
+    const firstColonIndex = declaration.indexOf(':')
+    if (firstColonIndex === -1) {
+      continue
+    }
+
+    const property = declaration.slice(0, firstColonIndex).trim()
+    const value = declaration.slice(firstColonIndex + 1).trim()
+    if (property && value) {
+      pairs.push([property, value])
+    }
+  }
+
+  return pairs
+}
+
 export function mergeAttributes(...objects: Record<string, any>[]): Record<string, any> {
@@ -24,29 +97,4 @@ return objects
         } else if (key === 'style') {
-          const newStyles: string[] = value
-            ? value
-                .split(';')
-                .map((style: string) => style.trim())
-                .filter(Boolean)
-            : []
-          const existingStyles: string[] = mergedAttributes[key]
-            ? mergedAttributes[key]
-                .split(';')
-                .map((style: string) => style.trim())
-                .filter(Boolean)
-            : []
+          const styleMap = new Map([...parseStyleEntries(mergedAttributes[key]), ...parseStyleEntries(value)])
 
-          const styleMap = new Map<string, string>()
-
-          existingStyles.forEach(style => {
-            const [property, val] = style.split(':').map(part => part.trim())
-
-            styleMap.set(property, val)
-          })
-
-          newStyles.forEach(style => {
-            const [property, val] = style.split(':').map(part => part.trim())
-
-            styleMap.set(property, val)
-          })
-
           mergedAttributes[key] = Array.from(styleMap.entries())
@@ -53,0 +101,0 @@ .map(([property, val]) => `${property}: ${val}`)

New alerts

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

2299758

0.3%

Lines of code

31000

0.47%

Worsened metrics

Number of low supply chain risk alerts

134

97.06%

No dependency changes