[CT-9085] Sync main with upstream

.github/FUNDING.yml

@@ -0,0 +1,2 @@
+github: dmonad
+open_collective: y-collective

.github/INCIDENT_RESPONSE.md

@@ -0,0 +1,90 @@
+# Incident Response Plan
+
+How Yjs maintainers handle security incidents. This plan is designed for small teams.
+
+---
+
+## 1. Receive a Private Disclosure
+
+All security issues should be reported privately via the method described in [`SECURITY.md`](../SECURITY.md) (GitHub Security Advisory). Lower-severity issues can be filed as regular issues.
+
+**Target:** Acknowledge receipt within 3 business days.
+
+---
+
+## 2. Triage
+
+Assess severity:
+
+| Severity | Example | Target |
+|----------|---------|--------|
+| **Critical** | Arbitrary code execution, compromised release | Acknowledge < 24h, fix < 7d |
+| **High** | Data leakage, denial of service on shared docs | Acknowledge < 3d, fix < 14d |
+| **Medium** | Edge-case corruption under unusual conditions | Fix in next release |
+| **Low** | Informational, no direct user risk | Fix as scheduled |
+
+These are good-faith targets for a volunteer-maintained project, not SLAs.
+
+---
+
+## 3. Contain & Fix
+
+1. **Open a private GitHub Security Advisory** for the issue if one doesn't already exist.
+2. **Develop the fix** in the advisory's private fork to avoid leaking details.
+3. **Assign a CVE** through GitHub's advisory flow before publishing.
+4. **Yank affected releases from npm** (`npm deprecate` with a message pointing to the advisory) if the severity is Critical or High.
+5. **Publish the patched release** to npm.
+6. **Update the version support matrix** in `SECURITY.md`.
+
+---
+
+## 4. Disclose
+
+After the fix is published:
+
+1. **Publish the GitHub Security Advisory** with:
+   - What happened
+   - Which versions are affected
+   - How users can update or mitigate
+   - The assigned CVE
+2. **Notify sponsors** via the appropriate channel (email, GitHub Sponsors update, or OpenCollective post).
+3. **Post to GitHub Discussions** for broader community awareness, linking to the advisory.
+
+Responsible disclosure principles:
+- Never publish details before a fix is available.
+- Never name reporters without their consent.
+- Coordinate embargo periods with downstream consumers (e.g., major framework integrations) when needed.
+
+---
+
+## 5. Post-Incident
+
+Within one week of resolution:
+
+- Note what happened, what worked, and what to improve (can be a short section in the advisory itself or a comment on the discussion post).
+- Update this plan if the process broke down anywhere.
+
+---
+
+## 6. Checklist (quick reference)
+
+```
+[ ] Private report received & acknowledged
+[ ] Severity assessed
+[ ] Private advisory + fork created on GitHub
+[ ] Fix developed & tested
+[ ] CVE assigned
+[ ] Affected npm versions deprecated (if Critical/High)
+[ ] Patched release published
+[ ] SECURITY.md version matrix updated
+[ ] Advisory published
+[ ] Sponsors notified
+[ ] Community notified (Discussions)
+[ ] Post-incident notes written
+```
+
+---
+
+## Plan Maintenance
+
+Review this plan once a year or after any incident. Changes are tracked in git history.

.github/workflows/node.js.yml

@@ -9,21 +9,26 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions:
+  contents: read
+
 jobs:
   build:
 
     runs-on: ubuntu-latest
 
     strategy:
       matrix:
-        node-version: [10.x, 12.x, 14.x]
+        node-version: [22.x, 24.x]
 
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
     - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v1
+      uses: actions/setup-node@v4
       with:
         node-version: ${{ matrix.node-version }}
     - run: npm ci
-    - run: npm run build --if-present
-    - run: npm test
+    - run: npm run lint
+    - run: npm run test
+      env:
+        CI: true

.github/workflows/publish.yml

@@ -0,0 +1,70 @@
+name: Publish to npm
+
+on:
+  workflow_run:
+    workflows: ["Node.js CI"]
+    types: [completed]
+    branches: [main]
+
+jobs:
+  check:
+    if: github.event.workflow_run.conclusion == 'success'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    outputs:
+      should_publish: ${{ steps.version-check.outputs.should_publish }}
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 24.x
+      - name: Check if version is already published
+        id: version-check
+        run: |
+          NAME=$(node -p "require('./package.json').name")
+          LOCAL=$(node -p "require('./package.json').version")
+          if npm view "${NAME}@${LOCAL}" version 2>/dev/null; then
+            echo "should_publish=false" >> "$GITHUB_OUTPUT"
+            echo "Version $LOCAL already published, skipping."
+          else
+            echo "should_publish=true" >> "$GITHUB_OUTPUT"
+            echo "New version detected: $LOCAL"
+          fi
+
+  publish:
+    needs: check
+    if: needs.check.outputs.should_publish == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 24.x
+      - run: npm ci
+      - name: Build
+        run: npm run dist
+      - name: Determine npm tag
+        id: npm-tag
+        run: |
+          VERSION=$(node -p "require('./package.json').version")
+          if [[ "$VERSION" == *-* ]]; then
+            echo "tag=beta" >> "$GITHUB_OUTPUT"
+          else
+            echo "tag=latest" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Publish
+        run: npm publish --provenance --access public --tag ${{ steps.npm-tag.outputs.tag }}
+      - name: Create GitHub Release
+        run: |
+          VERSION=$(node -p "require('./package.json').version")
+          PRERELEASE=""
+          if [[ "$VERSION" == *-* ]]; then
+            PRERELEASE="--prerelease"
+          fi
+          gh release create "v${VERSION}" --generate-notes $PRERELEASE
+        env:
+          GH_TOKEN: ${{ github.token }}

.github/workflows/scorecard.yml

@@ -0,0 +1,78 @@
+# This workflow uses actions that are not certified by GitHub. They are provided
+# by a third-party and are governed by separate terms of service, privacy
+# policy, and support documentation.
+
+name: Scorecard supply-chain security
+on:
+  # For Branch-Protection check. Only the default branch is supported. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
+  branch_protection_rule:
+  # To guarantee Maintained check is occasionally updated. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
+  schedule:
+    - cron: '28 5 * * 0'
+  push:
+    branches: [ "main" ]
+
+# Declare default permissions as read only.
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    # `publish_results: true` only works when run from the default branch. conditional can be removed if disabled.
+    if: github.event.repository.default_branch == github.ref_name || github.event_name == 'pull_request'
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Needed to publish results and get a badge (see publish_results below).
+      id-token: write
+      # Uncomment the permissions below if installing in a private repository.
+      # contents: read
+      # actions: read
+
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
+          # - you want to enable the Branch-Protection check on a *public* repository, or
+          # - you are installing Scorecard on a *private* repository
+          # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional.
+          # repo_token: ${{ secrets.SCORECARD_TOKEN }}
+
+          # Public repositories:
+          #   - Publish results to OpenSSF REST API for easy access by consumers
+          #   - Allows the repository to include the Scorecard badge.
+          #   - See https://github.com/ossf/scorecard-action#publishing-results.
+          # For private repositories:
+          #   - `publish_results` will always be set to `false`, regardless
+          #     of the value entered here.
+          publish_results: true
+
+          # (Optional) Uncomment file_mode if you have a .gitattributes with files marked export-ignore
+          # file_mode: git
+
+      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+      # format to the repository Actions tab.
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard (optional).
+      # Commenting out will disable upload of results to your repo's Code Scanning dashboard
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: results.sarif

.well-known/funding-manifest-urls

@@ -0,0 +1 @@
+https://yjs.dev

CODE_OF_CONDUCT.md

@@ -0,0 +1,5 @@
+# Contributor Covenant Code of Conduct
+
+This project follows the [Contributor Covenant v2.1](https://www.contributor-covenant.org/version/2/1/code_of_conduct/).
+
+By participating, you agree to uphold this code. Report unacceptable behavior to [kevin.jahns@protonmail.com](mailto:kevin.jahns@protonmail.com).

CONTRIBUTING.md

@@ -0,0 +1,9 @@
+# Contributing
+
+1. **Open an issue first.** Discuss your idea or bug report before writing code.
+2. **Submit a PR** that references the issue.
+3. **Include tests.** Every PR must include tests covering the change. Test-only PRs are welcome too.
+
+Yjs is free to use, but not free to maintain. Companies that rely on Yjs are expected to support the project — through [sponsorship](https://github.com/sponsors/dmonad), contributions, or both — if they want issues, bug reports, and PRs addressed.
+
+Every contribution becomes maintenance work for the project maintainers. Priority is given to features that serve the project's financial supporters. Other contributions may not be accepted solely for this reason.

INTERNALS.md

@@ -26,7 +26,7 @@ article](https://blog.kevinjahns.de/are-crdts-suitable-for-shared-editing/).
 
 Each client is assigned a unique *clientID* property on first insert. This is a
 random 53-bit integer (53 bits because that fits in the javascript safe integer
-range).
+range \[JavaScript uses IEEE 754 floats\]).
 
 ## List items
 
@@ -60,7 +60,7 @@ characters have either been deleted or all characters are not deleted. The item
 will be split if the run is interrupted for any reason (eg a character in the
 middle of the run is deleted).
 
-When an item is created, it stores a reference to the IDs of the preceeding and
+When an item is created, it stores a reference to the IDs of the preceding and
 succeeding item. These are stored in the item's `origin` and `originRight`
 fields, respectively. These are used when peers concurrently insert at the same
 location in a document. Though quite rare in practice, Yjs needs to make sure
@@ -88,7 +88,7 @@ When a local insert happens, Yjs needs to map the insert position in the
 document (eg position 1000) to an ID. With just the linked list, this would
 require a slow O(n) linear scan of the list. But when editing a document, most
 inserts are either at the same position as the last insert, or nearby. To
-improve performance, Yjs stores a cache of the 10 most recently looked up
+improve performance, Yjs stores a cache of the 80 most recently looked up
 insert positions in the document. This is consulted and updated when a position
 is looked up to improve performance in the average case. The cache is updated
 using a heuristic that is still changing (currently, it is updated when a new
@@ -149,8 +149,8 @@ concepts that can be used to create a custom network protocol:
 
 * `update`: The Yjs document can be encoded to an *update* object that can be
   parsed to reconstruct the document. Also every change on the document fires
-an incremental document updates that allows clients to sync with each other.
-The update object is an Uint8Array that efficiently encodes `Item` objects and
+an incremental document update that allows clients to sync with each other.
+The update object is a Uint8Array that efficiently encodes `Item` objects and
 the delete set.
 * `state vector`: A state vector defines the known state of each user (a set of
   tuples `(client, clock)`). This object is also efficiently encoded as a

LICENSE

@@ -1,7 +1,7 @@
 The MIT License (MIT)
 
-Copyright (c) 2014
-  - Kevin Jahns <kevin.jahns@rwth-aachen.de>.
+Copyright (c) 2023
+  - Kevin Jahns <kevin.jahns@protonmail.com>.
   - Chair of Computer Science 5 (Databases & Information Systems), RWTH Aachen University, Germany
 
 Permission is hereby granted, free of charge, to any person obtaining a copy