pull · Sep 22, 2026 · Sep 1, 2026 · Sep 1, 2026 · Sep 3, 2026 · Sep 3, 2026
diff --git a/.changeset/2026-09-02-fix-code-span-backtick-fence.md b/.changeset/2026-09-02-fix-code-span-backtick-fence.md
@@ -0,0 +1,6 @@
+---
+'@tiptap/markdown': patch
+'@tiptap/extension-code': patch
+---
+
+Fix Markdown serialization of inline code containing backticks
diff --git a/.changeset/2026-09-02-table-cell-pipe-escape.md b/.changeset/2026-09-02-table-cell-pipe-escape.md
@@ -0,0 +1,5 @@
+---
+'@tiptap/extension-table': patch
+---
+
+Table cells exported to Markdown now escape literal pipe characters, so the cell content survives when the output is read back.
diff --git a/.changeset/2026-09-03-ordered-list-markdown-linear-scan.md b/.changeset/2026-09-03-ordered-list-markdown-linear-scan.md
@@ -0,0 +1,5 @@
+---
+'@tiptap/extension-list': patch
+---
+
+Parsing large Markdown documents that contain ordered lists is much faster. A 578KB document went from about 19s to about 160ms.
diff --git a/.changeset/2026-09-06-table-markdown-cell-separator.md b/.changeset/2026-09-06-table-markdown-cell-separator.md
@@ -0,0 +1,5 @@
+---
+'@tiptap/extension-table': patch
+---
+
+Multi-block table cells no longer leak a U+001F control character into Markdown.
diff --git a/.changeset/2026-09-20-decode-numeric-html-entities.md b/.changeset/2026-09-20-decode-numeric-html-entities.md
@@ -0,0 +1,5 @@
+---
+'@tiptap/core': patch
+---
+
+Numeric HTML entities (`&#39;`, `&#x27;`) are now decoded when parsing markdown, instead of showing up as literal text in the editor.
diff --git a/packages/core/src/utilities/htmlEntities.test.ts b/packages/core/src/utilities/htmlEntities.test.ts
@@ -19,6 +19,110 @@ describe('decodeHtmlEntities', () => {
     expect(decodeHtmlEntities('&amp;lt;')).toBe('&lt;')
   })
 
+  it('decodes decimal numeric entities like &#39;', () => {
+    expect(decodeHtmlEntities('it&#39;s')).toBe("it's")
+  })
+
+  it('decodes hex numeric entities like &#x27;', () => {
+    expect(decodeHtmlEntities('&#x27;')).toBe("'")
+  })
+
+  it('decodes decimal numeric entities for non-ASCII characters like &#8212;', () => {
+    expect(decodeHtmlEntities('&#8212;')).toBe('\u2014')
+  })
+
+  it('handles doubly-encoded numeric entities like &amp;#39;', () => {
+    expect(decodeHtmlEntities('&amp;#39;')).toBe('&#39;')
+  })
+
+  it('leaves decimal references over 7 digits as a literal (exceeds CommonMark digit limit)', () => {
+    expect(decodeHtmlEntities('&#999999999;')).toBe('&#999999999;')
+  })
+
+  it('leaves hex references over 6 digits as a literal (exceeds CommonMark digit limit)', () => {
+    expect(decodeHtmlEntities('&#xFFFFFFFF;')).toBe('&#xFFFFFFFF;')
+  })
+
+  it('leaves an 8-digit decimal reference as a literal (format exceeds the limit)', () => {
+    expect(decodeHtmlEntities('&#12345678;')).toBe('&#12345678;')
+  })
+
+  it('replaces a 7-digit decimal reference whose value exceeds 0x10FFFF with U+FFFD', () => {
+    expect(decodeHtmlEntities('&#1114112;')).toBe('\uFFFD')
+  })
+
+  it('replaces a 6-digit hex reference whose value exceeds 0x10FFFF with U+FFFD', () => {
+    expect(decodeHtmlEntities('&#xFFFFFF;')).toBe('\uFFFD')
+  })
+
+  it('matches a 7-digit decimal reference greedily and leaves the trailing digit as a literal', () => {
+    expect(decodeHtmlEntities('&#1234567;8')).toBe('\uFFFD8')
+  })
+
+  it('replaces &#0; (NUL) with U+FFFD', () => {
+    expect(decodeHtmlEntities('&#0;')).toBe('\uFFFD')
+  })
+
+  it('replaces a lone low surrogate &#xD800; with U+FFFD', () => {
+    expect(decodeHtmlEntities('&#xD800;')).toBe('\uFFFD')
+  })
+
+  it('replaces a lone high surrogate &#xDFFF; with U+FFFD', () => {
+    expect(decodeHtmlEntities('&#xDFFF;')).toBe('\uFFFD')
+  })
+
+  it('decodes &#xD7FF; normally (just below the surrogate range)', () => {
+    expect(decodeHtmlEntities('&#xD7FF;')).toBe(String.fromCodePoint(0xd7ff))
+  })
+
+  it('decodes &#xE000; normally (just above the surrogate range)', () => {
+    expect(decodeHtmlEntities('&#xE000;')).toBe(String.fromCodePoint(0xe000))
+  })
+
+  it('decodes &#x10FFFF; normally (the maximum valid code point)', () => {
+    expect(decodeHtmlEntities('&#x10FFFF;')).toBe(String.fromCodePoint(0x10ffff))
+  })
+
+  it('remaps &#128; (0x80) to the Windows-1252 euro sign', () => {
+    expect(decodeHtmlEntities('&#128;')).toBe('\u20AC')
+  })
+
+  it('remaps &#151; (0x97) to the Windows-1252 em dash', () => {
+    expect(decodeHtmlEntities('&#151;')).toBe('\u2014')
+  })
+
+  it('remaps &#147; (0x93) to the Windows-1252 left double quote', () => {
+    expect(decodeHtmlEntities('&#147;')).toBe('\u201C')
+  })
+
+  it('remaps &#148; (0x94) to the Windows-1252 right double quote', () => {
+    expect(decodeHtmlEntities('&#148;')).toBe('\u201D')
+  })
+
+  it('remaps &#x80; (hex form) to the Windows-1252 euro sign', () => {
+    expect(decodeHtmlEntities('&#x80;')).toBe('\u20AC')
+  })
+
+  it('leaves &#129; (0x81) as the raw C1 control character (not in the Windows-1252 table)', () => {
+    expect(decodeHtmlEntities('&#129;')).toBe('\u0081')
+  })
+
+  it('leaves &#141; (0x8D) as the raw C1 control character (not in the Windows-1252 table)', () => {
+    expect(decodeHtmlEntities('&#141;')).toBe('\u008D')
+  })
+
+  it('does not re-scan replaced output for a second round of decoding', () => {
+    expect(decodeHtmlEntities('&#38;#x27;')).toBe('&#x27;')
+  })
+
+  it('does not turn a decoded &amp; into a second-pass &lt; decode', () => {
+    expect(decodeHtmlEntities('&#38;lt;')).toBe('&lt;')
+  })
+
+  it('does not turn a decoded &amp; into a second-pass &amp; decode', () => {
+    expect(decodeHtmlEntities('&#38;amp;')).toBe('&amp;')
+  })
+
   it('returns plain text unchanged', () => {
     expect(decodeHtmlEntities('hello world')).toBe('hello world')
   })
@@ -47,7 +151,7 @@ describe('roundtrip', () => {
     expect(decodeHtmlEntities(encodeHtmlEntities(input))).toBe(input)
   })
 
-  it('decode is a superset of encode – &quot; decodes but " is not encoded', () => {
+  it('decode is a superset of encode - &quot; decodes but " is not encoded', () => {
     // " passes through encode unchanged, &quot; decodes to "
     expect(encodeHtmlEntities('"hello"')).toBe('"hello"')
     expect(decodeHtmlEntities('&quot;hello&quot;')).toBe('"hello"')

diff --git a/packages/core/src/utilities/htmlEntities.ts b/packages/core/src/utilities/htmlEntities.ts
@@ -1,15 +1,63 @@
+const NAMED_ENTITIES: Record<string, string> = { lt: '<', gt: '>', quot: '"', amp: '&' }
+
 /**
  * Decode common HTML entities in text content so they display as literal
- * characters inside the editor.  The decode order matters: `&amp;` must be
- * decoded **last** so that doubly-encoded sequences like `&amp;lt;` first
- * survive the `&lt;` pass and then correctly become `&lt;` (not `<`).
+ * characters inside the editor. Runs as a single pass so a decoded entity
+ * (e.g. `&#38;` → `&`) is never re-scanned and decoded again.
  */
 export function decodeHtmlEntities(text: string): string {
-  return text
-    .replace(/&lt;/g, '<')
-    .replace(/&gt;/g, '>')
-    .replace(/&quot;/g, '"')
-    .replace(/&amp;/g, '&')
+  // Digit limits per CommonMark: decimal refs are 1-7 digits, hex refs are 1-6.
+  return text.replace(
+    /&(?:#(\d{1,7})|#[xX]([0-9a-fA-F]{1,6})|(lt|gt|quot|amp));/g,
+    (match, dec, hex, name) => {
+      if (dec !== undefined) {
+        return decodeCodePoint(Number(dec))
+      }
+      if (hex !== undefined) {
+        return decodeCodePoint(parseInt(hex, 16))
+      }
+      return NAMED_ENTITIES[name]
+    },
+  )
+}
+
+// HTML5 maps numeric references in the C1 range (0x80-0x9F) to Windows-1252 characters.
+const WINDOWS_1252 = new Map<number, number>([
+  [0x80, 0x20ac],
+  [0x82, 0x201a],
+  [0x83, 0x0192],
+  [0x84, 0x201e],
+  [0x85, 0x2026],
+  [0x86, 0x2020],
+  [0x87, 0x2021],
+  [0x88, 0x02c6],
+  [0x89, 0x2030],
+  [0x8a, 0x0160],
+  [0x8b, 0x2039],
+  [0x8c, 0x0152],
+  [0x8e, 0x017d],
+  [0x91, 0x2018],
+  [0x92, 0x2019],
+  [0x93, 0x201c],
+  [0x94, 0x201d],
+  [0x95, 0x2022],
+  [0x96, 0x2013],
+  [0x97, 0x2014],
+  [0x98, 0x02dc],
+  [0x99, 0x2122],
+  [0x9a, 0x0161],
+  [0x9b, 0x203a],
+  [0x9c, 0x0153],
+  [0x9e, 0x017e],
+  [0x9f, 0x0178],
+])
+
+// Replace invalid code points with U+FFFD, per the CommonMark spec.
+function decodeCodePoint(codePoint: number): string {
+  if (codePoint === 0 || codePoint > 0x10ffff || (codePoint >= 0xd800 && codePoint <= 0xdfff)) {
+    return '\uFFFD'
+  }
+  return String.fromCodePoint(WINDOWS_1252.get(codePoint) ?? codePoint)
 }
 
 /**

diff --git a/packages/extension-code/src/code.ts b/packages/extension-code/src/code.ts
@@ -93,6 +93,18 @@ export const pasteRegexMatch = (text: string): PasteRuleMatch[] => {
   return matches
 }
 
+// A code span must be fenced by a backtick run its own content does not contain
+function shortestUnusedBacktickRun(text: string): number {
+  const runs = new Set((text.match(/`+/g) || []).map(run => run.length))
+  let length = 1
+
+  while (runs.has(length)) {
+    length += 1
+  }
+
+  return length
+}
+
 /**
  * This extension allows you to mark text as inline code.
  * @see https://tiptap.dev/api/marks/code
@@ -128,12 +140,18 @@ export const Code = Mark.create<CodeOptions>({
     return helpers.applyMark('code', [{ type: 'text', text: token.text || '' }])
   },
 
-  renderMarkdown: (node, h) => {
+  renderMarkdown: (node, h, context) => {
     if (!node.content) {
       return ''
     }
 
-    return `\`${h.renderChildren(node.content)}\``
+    // Children are a placeholder here, so the fence comes from the full span text
+    const markText = typeof context?.meta?.markText === 'string' ? context.meta.markText : ''
+    const fence = '`'.repeat(shortestUnusedBacktickRun(markText))
+    // CommonMark strips one space on each side, so padding keeps backticks apart
+    const padding = markText.startsWith('`') || markText.endsWith('`') ? ' ' : ''
+
+    return `${fence}${padding}${h.renderChildren(node.content)}${padding}${fence}`
   },
 
   addCommands() {

diff --git a/packages/extension-list/src/ordered-list/collectOrderedListItemsFromSource.ts b/packages/extension-list/src/ordered-list/collectOrderedListItemsFromSource.ts
@@ -0,0 +1,58 @@
+import type { OrderedListItem } from './utils.js'
+import { collectOrderedListItems, ORDERED_LIST_ITEM_REGEX } from './utils.js'
+
+const ORDERED_LIST_SCAN_WINDOW = 64
+
+// Fewer than `max` lines means `source` ended.
+function takeLines(source: string, max: number): string[] {
+  const lines: string[] = []
+  let start = 0
+
+  while (lines.length < max) {
+    const lineEnd = source.indexOf('\n', start)
+
+    if (lineEnd === -1) {
+      lines.push(source.slice(start))
+      return lines
+    }
+
+    lines.push(source.slice(start, lineEnd))
+    start = lineEnd + 1
+  }
+
+  return lines
+}
+
+/**
+ * Collect ordered list items from the start of `source`, reading only the lines the list needs.
+ *
+ * @param source Markdown beginning at a block boundary.
+ * @returns The items, how many lines they consumed, and the lines that were read.
+ * @example
+ *   collectOrderedListItemsFromSource('1. one\n2. two\n\nAfter')
+ *   // → [[item, item], 3, ['1. one', '2. two', '', 'After']]
+ */
+export function collectOrderedListItemsFromSource(
+  source: string,
+): [OrderedListItem[], number, string[]] {
+  const firstLineEnd = source.indexOf('\n')
+  const firstLine = firstLineEnd === -1 ? source : source.slice(0, firstLineEnd)
+
+  // Every block start is offered here, so reject non-lists before reading further.
+  if (!ORDERED_LIST_ITEM_REGEX.test(firstLine)) {
+    return [[], 0, []]
+  }
+
+  let windowSize = ORDERED_LIST_SCAN_WINDOW
+  let lines = takeLines(source, windowSize)
+  let collected = collectOrderedListItems(lines)
+
+  // Consuming the whole window means the list may continue past it.
+  while (collected[1] === lines.length && lines.length === windowSize) {
+    windowSize *= 2
+    lines = takeLines(source, windowSize)
+    collected = collectOrderedListItems(lines)
+  }
+
+  return [collected[0], collected[1], lines]
+}
diff --git a/packages/extension-list/src/ordered-list/ordered-list.ts b/packages/extension-list/src/ordered-list/ordered-list.ts
@@ -3,12 +3,8 @@ import { Plugin } from '@tiptap/pm/state'
 
 import { mergeAttributes, Node, wrappingInputRule } from '@tiptap/core'
 
-import {
-  buildNestedStructure,
-  collectOrderedListItems,
-  parseListItems,
-  parsePlainTextOrderedListPaste,
-} from './utils.js'
+import { collectOrderedListItemsFromSource } from './collectOrderedListItemsFromSource.js'
+import { buildNestedStructure, parseListItems, parsePlainTextOrderedListPaste } from './utils.js'
 
 const ListItemName = 'listItem'
 const TextStyleName = 'textStyle'
@@ -236,8 +232,7 @@ export const OrderedList = Node.create<OrderedListOptions>({
     // `tokenize`, which would re-introduce the mid-line split.
     start: () => -1,
     tokenize: (src: string, _tokens, lexer) => {
-      const lines = src.split('\n')
-      const [listItems, consumed] = collectOrderedListItems(lines)
+      const [listItems, consumed, lines] = collectOrderedListItemsFromSource(src)
 
       if (listItems.length === 0) {
         return undefined