chore(deps): bump prosemirror-view from 1.41.3 to 1.42.6 in /frontend

[dependabot]

Bumps prosemirror-view from 1.41.3 to 1.42.6.

Changelog

Sourced from prosemirror-view's changelog.

1.41.7 (2026-03-18)

Bug fixes

Work around a Chrome bug where it sometimes inserts a random <br> node when you press backspace before a widget.

Fix a crash that could happen when deleting content during a node drag.

1.41.6 (2026-02-06)

Bug fixes

Fix an issue where backspacing content before a flexbox or grid styled widget would insert a bogus line break on Firefox.

1.41.5 (2026-01-14)

Bug fixes

Work around an issue where, after some kinds of changes, Chrome misreports the cursor position and breaks composition.

Improve DOM update behavior when deleting three or more nodes right before a mark, which would unnecessarily re-render the entire mark.

Work around a newly introduced bug in Safari where composition in an empty table cell causes it to move the text out of the cell into the row element.

1.41.4 (2025-12-01)

Bug fixes

EditorView.dragging is now only cleared after the drop event has entirely been handled.

Add a workaround for an issue where Chrome and Safari will, if you backspace out the last text before an inline-flex node, insert a bogus hard break.

Fix a composition problem on Chrome Windows when starting a composition before an absolutely positioned widget.

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[claude]

Review: bump prosemirror-view 1.41.3 → 1.42.6

Lockfile-only change (frontend/yarn.lock). The new view version looks fine on its own, but I'd check one thing before merging.

Duplicate prosemirror-model in the tree. prosemirror-view@1.42.6 requires prosemirror-model@^1.25.12. The rest of the tree stays on the existing 1.25.4 entry, so the lockfile now has two copies:

• 1.25.4, used by the other prosemirror packages
• 1.25.12, used by prosemirror-view

ProseMirror packages share prosemirror-model types such as Schema, Node and Fragment, and rely on them being a single instance. Two copies can cause subtle runtime failures like mismatched instanceof checks and "Mismatched transaction" or schema errors. Whether this bites depends on how the bundler resolves it. I haven't run the editor.

Suggested fix: run yarn upgrade prosemirror-model (or add a resolutions entry) so every consumer resolves to 1.25.12, then confirm with yarn why prosemirror-model that only one copy is left. Dependabot won't do this itself.

Testing

• There are no source changes and no new tests, so existing CI has to cover this. Please check that the Playwright component tests and the typecheck for any ProseMirror/rich-text editor surface pass. Those are where the new view code is exercised.
• Per the changelog, 1.41.4–1.42.x are bug-fix releases (Chrome/Safari/Firefox composition and widget workarounds, a drag crash fix), so the risk is low once the dedupe is sorted.

Process: no changelog fragment is needed for a pure dependency bump. Nothing here touches security or permissions.

Once the dedupe is verified, this is good to merge.