Dependencies

• Upgrade DOMPurify to 3.4.2 from 3.2.7 by @flavorjones in #1310

Full Changelog: v2.1.18...v2.1.19

Security

• Sanitize javascript: URI in JSON drag-drop deserialization by @flavorjones in #1293

Infrastructure/CI

• ci: harden GitHub Actions workflows by @flavorjones in #1284

Full Changelog: v2.1.17...v2.1.18

Security

• Address potential XSS vector via data-trix-serialized-attributes sanitizer bypass by @flavorjones in #1282

Bug fixes

• Fix bullets merging with prior elements on Firefox when the first node is removed by @monorkin in #1280

Infrastructure/CI

• Replace Karma with @web/test-runner by @flavorjones in #1272
• ci: get green (2026-01-09 edition) by @flavorjones in #1276
• Report web-test-runner test failures by @flavorjones in #1275

Chores

• Update README.md by @Cromian in #1239

New Contributors

• @monorkin made their first contribution in #1280
• @Cromian made their first contribution in #1239

Full Changelog: v2.1.16...v2.1.17

Security

• Attachment href attributes are now validated using DOMPurify.isValidAttribute() before rendering as anchor tags. @flavorjones

Added

• New .editorElements and .editorElement properties have been added to <trix-toolbar> elements for accessing associated <trix-editor> elements. @seanpdoyle #1127
• <trix-editor> elements can now function without an associated <input type="hidden"> element when using ElementInternals. This is configured by setting willCreateInput = false in the before-trix-initialize event and using the [name] attribute for form submissions. @seanpdoyle #1128
• Alt text can now be set on attachment preview images via attachment.setAttributes({ alt: "..." }) in trix-attachment-add event handlers. @seanpdoyle #1198
• Attachment preview URLs can be customized using the new setPreviewURL() and getPreviewURL() methods on ManagedAttachment, accessible from event handlers. @seanpdoyle #1210
• A new trix-before-render event is dispatched before rendering, with a customizable render property for advanced use cases like morph-style rendering integration. @seanpdoyle #1252
• When no associated <input> element is present, HTML content within <trix-editor> tags is now safely sanitized and loaded as the initial editor value. @seanpdoyle #1253

New Contributors

• @flavorjones made their first contribution in #1234
• @MatheusRich made their first contribution in #1162

Full Changelog: v2.1.15...v2.1.16

Full Changelog: v2.1.14...v2.1.15

Fixes GHSA-mcrw-746g-9q8h

What's Changed

• Bump dompurify to 3.2.5 to resolve security issue by @jakeonrails in #1232

New Contributors

• @jakeonrails made their first contribution in #1232

Full Changelog: v2.1.13...v2.1.14

What's Changed

• Add test coverage for CSP-<style> integration by @seanpdoyle in #1199
• Correct a weird sentence in README.md by @Uaitt in #1220
• Make Trix compatible with morphing by @jorgemanrubia in #1227

New Contributors

• @Uaitt made their first contribution in #1220

Full Changelog: v2.1.12...v2.1.13

What's Changed

• Fix XSS via javascript: or data: url in a link by @intrip in 180c8d3

Full changelog: v2.1.11...v2.1.12

What's Changed

• Make DOMPurify configurable by @djmb in #1208
• Allow comments in attachments by @djmb in #1214
• Switch from node-sass to sass by @intrip in #1215
• Reintroduce yarn build --watch by @intrip in #1216

New Contributors

• @intrip made their first contribution in #1215

Full Changelog: v2.1.10...v2.1.11