
Security News
GitHub Actions Checkout Now Blocks Risky pull_request_target Checkouts
GitHub Actions checkout now blocks risky pull_request_target checkouts by default to help prevent pwn request supply chain attacks.
yjs-editorjs-binding
Advanced tools
THIS IS A WORK-IN-PROGRESS: I'm currently exploring the idea; below is the vision, time will tell 😉 - Matt
There are no timelines for the moment, although I'm keen to quite quickly get this sorted over a period of weeks.
Looking to utilise collaboration in a product that uses Editor JS. hughfenghen/y-editorjs is a fantastic starting point but needs a little more love that includes breaking changes. Mad credit to hughfenghen for getting this on the road.
Decided not to create a pull request as we're in need of active development on this. Open to potentially merging in the future.
BETA - This is still under active development
yjs-editorjs-binding package| Package Manager | Command |
|---|---|
| NPM | npm i yjs-editorjs-binding |
| Yarn | yarn add yjs-editorjs-binding |
| PNPM | pnpm i yjs-editorjs-binding |
import { Doc as YDoc } from "yjs"
import EditorJS from "@editorjs/editorjs"
import { YJSEditorJSBinding } from "yjs-editorjs-binding"
const yDoc = new YDoc()
const yArray = yDoc.getArray("docId")
const binding = new YJSEditorJSBinding(yArray)
const editor = new EditorJS({
holder: document.querySelector<HTMLElement>("#editor-js"),
// Hook in our binding listener into Editor JS
onChange: (api, event: CustomEvent) => {
binding.onBlockEventEditorJS(api, event)
},
})
binding.bindEditor(editor)
pnpm ipnpm run dev and pnpm run ws (runs client and WS server)Pull requests and issues are highly encouraged and will be responded to rather quickly.
Like any Open Source project; this doesn't pay the bills! Consideration of that is expected in all community comms. We're in this together. 🔥
It's coming! With PNPM becoming a first-class recommendation in many ecosystems, the Dependabot team are looking to release a solution soon - https://github.com/dependabot/dependabot-core/issues/1736#issuecomment-1507582193
FAQs
Editor.js binding for yjs
We found that yjs-editorjs-binding demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
GitHub Actions checkout now blocks risky pull_request_target checkouts by default to help prevent pwn request supply chain attacks.

Product
Socket now supports Custom Roles and Repository Access Permissions so organizations can control who can access specific repositories and actions.

Product
Socket MCP now lets AI assistants review org alerts, investigate threats using the Socket threat feed, and inspect package files in addition to dependency scoring.