SpreadJS Designer external dependency vulnerability in prosemirror-view and seroval

External dependencies of SpreadJS Designer, prosemirror-view and seroval, were found to have security vulnerabilities.

CVE: https://nvd.nist.gov/vuln/detail/cve-2026-104847 , https://nvd.nist.gov/vuln/detail/cve-2026-104846 , https://nvd.nist.gov/vuln/detail/cve-2026-104845 

Remediation

Upgrade prosemirror-view to 1.42.3 or later

Upgrade seroval to 1.6.3 or later.

Note: SpreadJS product is unaffected by these vulnerabilities but we are updating dependencies out of caution and will be released in 19.2.5. We still recommend customers update these packages immediately as well.