Releases: xdan/jodit
Releases · xdan/jodit
Release list
4.15.3
🐛 Bug Fix
- #1474 An iframe lost its box when the editor was created inside a hidden container. The resizer wraps every iframe in a
<jodit>element and copiedoffsetWidth/offsetHeightinto it, but both are0while an ancestor hasdisplay:none, so the wrapper was pinned to0x0and never corrected once the container became visible. The following content then painted over the video. The wrapper now falls back to the iframe's ownwidth/heightattributes when the element cannot be measured, and is left to size itself when there is nothing to fall back to. Relative values such aswidth="100%"are not turned into a fixed pixel box.
4.15.2
🐛 Bug Fix
- Enter inside a table cell always inserted a
<br>, even when the cell already contained a block. The cell check in the Enter plugin walked all the way up to the<td>/<th>and ignored any<p>or heading in between, so every line of a cell stayed inside one block and applying a block style restyled all of them at once. A cell that holds a real block is now split like anywhere else, while bare cell content keeps inserting a<br>(a cell cannot be split into two cells) and Shift+Enter still inserts a<br>everywhere. Reported by Kevin Sormann (li-life web+it, Jodit OEM).
4.15.1
🐛 Bug Fix
- File browser: the "Sort by" select painted its dropdown caret over the option text. The
.jodit-selectcaret rule was overridden by the more specific.jodit .jodit-inputpadding, so there was no room for the icon; the rule now lives inside.jodit, the caret is sized like a regular icon and the option labels use plain↑/↓instead of⬆/⬇, which macOS renders as colour emoji.
4.15.0
💅 Polish
- Redrew the 82 built-in toolbar, dialog and image-editor icons as a consistent, compact SVG family with balanced strokes and rounded corners.
- Improved small-size readability of lists, alignment and line-height controls; distinguished row and column insertion, clarified cell merging and splitting, and restored spacing in font-size and source-code icons.
- Preserved theme colors and the text-color indicator, enlarged dropdown chevrons and refined the assistant icon. Updated visual regression snapshots for the new icon family.
🏠 Internal
- Allow an explicit release version through
make newversion releaseVersion=4.15.0; the default remains a patch increment.
4.14.7
🐛 Bug Fix
- File browser: the Download item of the file context menu showed the upload icon (arrow pointing up into a tray). Added a dedicated
downloadicon (arrow pointing down, same Font Awesome style as the rest of the set — also available viaJodit.modules.Icon.get('download')) and used it for that item. Fixes #1472.
4.14.6
🐛 Bug Fix
- Security / iframe (
editHTMLDocumentMode, stored XSS, CWE-79): withiframe: trueandeditHTMLDocumentMode: truea full HTML document assigned toeditor.valuewas written straight into the live iframe document withdocument.write(), andsafeHTMLwas only applied afterwards. Inline<script>elements andon*handlers therefore executed while the document was being parsed — before the sanitizer could remove them — in an iframe that is same-origin with the host page by default (iframeSandbox: null), so an attacker-supplied document could run script in the host application's origin as soon as another user opened it. The document is now parsed in an inertDOMParserdocument (no browsing context: nothing executes, no sub-resources are fetched), sanitized there via thesafeHTMLevent, and only then adopted into the live iframe document; nodes coming from an inert parser are flagged "already started", so even a<script>the cleaner is configured to keep never executes — the same guaranteeinnerHTMLgives in the regular mode. A partial value (no<html>/<body>) in that mode was also assigned todoc.body.innerHTMLunsanitized beforeclean-htmlran, which fired e.g.<img onerror>; it now goes through the regular sanitized path. Affected all versions witheditHTMLDocumentModethrough 4.14.5. Responsibly reported by @bp0lr (GHSA-w3xv-x3fm-59ph).
4.14.5
🏠 Internal
- Upgraded ESLint 9 to 10 and
@eslint/js9 to 10. Replaced the unmaintainedeslint-plugin-importwith ESLint 10-compatibleeslint-plugin-import-x4, removed the obsolete compatibility wrapper, and upgradedeslint-plugin-mochato 12 and Mocha to 12. - Migrated the release/build scripts from the vulnerable
replacepackage toreplace-in-file9. ESLint 10's new checks removed redundant assignments and test errors now preserve their originalcause. - Updated the screenshot-test image and its packages to Playwright 1.63.0 and refreshed affected browser snapshots. Fixed the Make target so
updateTests=falseno longer enables snapshot updates. Forced the patchedqs6.16.0 for Karma's server dependencies;npm auditnow reports no known vulnerabilities. - Kept TypeScript at 6.0.3 because typescript-eslint does not yet support TypeScript 7 and the project build tools use the compiler API removed from TypeScript 7. Kept
cssnano-preset-advancedat 8.0.10 because version 9 fails while loading itscaniuse-apidependency under the TypeScript Webpack configuration.
4.14.4
🏠 Internal
- Updated development dependencies within their existing version ranges and refreshed transitive dependencies in
package-lock.json. Highlights: Playwright 1.63.0, SWC 1.16.2, TypeScript 6.0.3, typescript-eslint 8.70.0, Less 4.9.1, PostCSS 8.5.28, Stylelint 17.15.0 and Webpack 5.110.3. - Major upgrades are handled separately: ESLint remains on 9, Mocha on 11 and cssnano-preset-advanced on 8 in this release.
4.14.3
🐛 Bug Fix
- Selection:
save(),fakes(),remove()andwrapInTag()leave selections crossing the editor boundary untouched.isInsideAreachecks both boundaries, andrestoreFakes()ignores nodes moved outside the editor. - Selection / caret:
current()resolves the last text descendant when the caret follows a nested element and no longer returns a<br>outside the editor. Edge checks use the correct selection endpoint, including selections across blocks. - Selection / ranges and history: preserve backward selections through save/restore, formatting, expansion and undo/redo, including iframe editors. Restore and format all native disjoint ranges in Firefox; selected HTML and node iteration include all ranges without duplicate callbacks. Existing history snapshots remain supported.
- Selection / insertion: invalid or unsupported cursor point lookups preserve the selection. Selecting the editor root selects its contents; positioning a cursor outside the root is rejected. Splitting validates the block, caret and optional edge before changing DOM. An empty sanitized fragment no longer deletes selected content, and insertion uses the surviving final child after hooks.
- Selection / Shadow DOM:
save()finds markers inside the editor's shadow tree and keeps the saved selection active. - Formatting: splitting a text node preserves live element offsets, so mixed text/element selection boundaries no longer omit part of the selected content. Temporary wrappers are cleaned up when callbacks throw or iteration stops early;
ApplyStylealso restores the selection after a hook throws. Removed fragments are skipped when hooks replace or delete DOM, and formatting stops safely when a hook destroys the editor. - Formatting / CSS: explicit property resets such as
color: nullno longer throw. Wrapper cleanup runs after all attributes have been applied, preserving subsequent CSS rules, classes and unrelated attributes. Applying styles across nested elements overrides overlapping properties without discarding other styles. Formatting skipscontenteditable="false"blocks and preserves styles inside protected inline content. - Formatting / links: extracting selected text no longer removes links from adjacent, unselected images by treating image-only fragments as empty.
- Formatting / classes and lists:
classandclassNameaccept multiple class tokens. Adjacent lists are matched correctly with multiple classes and numeric or boolean attributes. Removing a class firesafterToggleAttributeeven when other classes remain. - TypeScript: corrected the declared argument order of
beforeToggleListand the modes/return type ofbeforeUnwrapListto match existing runtime behavior. Runtime hook signatures are unchanged. - Languages: added missing Azerbaijani translations for
Line height,Spellcheck,Speech Recognizeandnewline.
🏠 Internal
- Simplified style iteration with
for…ofand guaranteed selection cleanup, removed intermediate array copies from caret edge checks, reused CSS reset rules across nested elements, and reused one scratch DOM Range during containment traversal instead of allocating one per node. - Added 92 selection and style regression/edge-case tests, including Shadow DOM, iframe, undo/redo, disjoint and backward selections, hook mutations, protected content, nested lists, CSS/attribute combinations and documents up to 3000 paragraphs. Browser suites verified in Chrome and Firefox; Chromium skips native multi-range cases it does not support.
4.14.2
🏠 Internal
- Dev dependencies: webpack 5.109.2, less-loader 13, webpack-dev-middleware 8, eslint-plugin-simple-import-sort 14 (imports re-sorted), @types/node 26, synchronous-promise 2.0.18, cssnano-preset-advanced 8.0.10 (#1446, #1447, #1448, #1450, #1452, #1454, #1456). eslint 10 / eslint-plugin-mocha 12 stay on hold until
eslint-plugin-importallows eslint 10; TypeScript 7 needs a tsconfig migration first.