GHSA-cp6q-959q-f8rh: patched_versions metadata missing v2 backport (2.27.3)

Summary

The security advisory GHSA-cp6q-959q-f8rh (mergeAttributes __proto__ prototype pollution) lists patched_versions: 3.30.4 only. It does not reflect that the fix was also backported to the v2 line in @tiptap/[email protected].

Evidence

• PR #8301 ("fix: backport GHSA-cp6q-959q-f8rh to v2", merged 2026-09-03) cherry-picks commit 01d7af8 onto maintenance/v2, opened by the advisory's own publisher (@bdbch).
• Released as @tiptap/[email protected] via PR #8310, changelog entry: "fa6abcc: Prevent untrusted HTML attributes from changing an object's prototype when merged with mergeAttributes."
• Verified directly against the published @tiptap/[email protected] bundle: mergeAttributes guards the __proto__ key via Object.defineProperty, identical in effect to the 3.30.4 fix.

Impact

Because the GHSA's patched_versions field only names 3.30.4, GitHub's Dependabot (and any other consumer of the advisory metadata) treats every 2.x release — including the already-patched 2.27.3 — as vulnerable. This forces a recurring, unresolvable Dependabot security-update proposal to jump the entire v2 → v3 major (a breaking upgrade across ~20 packages) for projects that have already applied the v2 patch and pinned to it deliberately.

Ask

Please update the advisory's patched-versions metadata to include 2.27.3 (and any later 2.x release, if a newer one already carries the fix) alongside 3.30.4, so Dependabot and similar tools stop flagging patched v2 installs.