✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

I'm going to close this one without merging it.

This PR bumps prosemirror-dev-tools 3.1.0 to 4.3.0 to pull in a patched jsondiffpatch (the actual advisory, SNYK-JS-JSONDIFFPATCH-16322990, is in jsondiffpatch, reached transitively via editor -> prosemirror-dev-tools@3.1.0 -> jsondiffpatch@^0.4.1). The fix only lands in jsondiffpatch 0.7.2+, which has no counterpart in the 0.4.x line, so this genuinely requires the prosemirror-dev-tools v3 to v4 major bump. Snyk itself flagged this as a breaking change and could not update yarn.lock.

I'm advocating for us to decline this one for now because the real-world exploitability is very low:

• prosemirror-dev-tools is a developer debugging panel, only invoked through Editor.enableDevTools() behind the "Enable Dev Tools" command (Ctrl+Alt+P). It is not part of any normal editing workflow.
• When it does run, it diffs the editor's own ProseMirror state, which is trusted local data, not attacker-controlled input, so the prototype-pollution path is not reachable from untrusted content.

The dependency does ship in the extension bundle (the visual editor depends on packages/editor), so this could trigger customer security scans. If that becomes an issue and we want to fully clear it later, the options are a proper prosemirror-dev-tools v4 bump (with @types and lockfile work), or making applyDevTools a dynamic import / gating the command out of the shipped build so the dependency drops out of the bundle entirely.

Let me know if you disagree, @cscheid.

I like and agree with your call.