[Snyk] Upgrade ckeditor5 from 43.1.1 to 43.3.0 #964
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Snyk has created this PR to upgrade ckeditor5 from 43.1.1 to 43.3.0. See this package in npm: ckeditor5 See this project in Snyk: https://app.snyk.io/org/klantinteractie-servicesysteem/project/5208dc30-2f31-46e9-9126-03cc6e8b7ca8?utm_source=github&utm_medium=referral&page=upgrade-pr
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Snyk has created this PR to upgrade ckeditor5 from 43.1.1 to 43.3.0.
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
The recommended version is 23 versions ahead of your current version.
The recommended version was released on 23 days ago.
Release notes
Package name: ckeditor5
We are happy to announce the release of CKEditor 5 v43.3.0.
Release highlights
Performance improvements
We have improved how the editor handles the document structure by making it more reliable and efficient to access specific elements and verify their positions.
NodeandNodeListelements now cache index and offset values, reducing the need for recalculations and significantly boosting overall performance during model operations.Position#isValid()method is also utilized to better validate selection ranges, ensuring more consistent behavior in various editing scenarios.We’re committed to ongoing performance enhancements, so you can expect even faster, smoother experience in future updates.
Export to Word watermark support
A new configuration option has been added to include a watermark when exporting documents to Word, providing additional flexibility in document branding and protection.
Notable bug fixes and improvements
Features
getChildAtOffset()method formodel.Elementandmodel.DocumentFragment. (commit)Position#isValid()method to check whether the position exists in the current model tree. (commit)RevisionTracker#getRevisionDocumentData()andRevisionTracker#getRevisionRootsAttributes()methods to the public scope of the editor API. You can use them to retrieve document data saved with the revision.FocusTrackerextendable with otherFocusTrackerinstances to allow logical focus tracking across separate DOM sub-trees (see #17277). (commit)Bug fixes
sourcesdowncast. (commit)LinkConfig#addTargetToExternalLinks: trueis set. Closes #17252. (commit)BalloonToolbarwhile the user hovers a nested menu. Closes #17277. (commit)Other changes
NodeandNodeListto improve performance. (commit)ckeditor5-linkpackage. Closes #17304. (commit)Dialogplugin. Closes #17290. (commit)config.ui.viewportOffset. Closes #17290. (commit)Released packages
Check out the Versioning policy guide for more information.
Released packages (summary)
Releases containing new features:
Other releases:
We are happy to announce the release of CKEditor 5 v43.2.0.
Release highlights
Notable improvements
More imports available via
ckeditor5andckeditor5-premium-featuresindexesAs users transition to new installation methods (v42.0.0+) with
ckeditor5andckeditor5-premium-featuresas the main packages, we are continuously addressing missing imports for less common classes, functions, types, and utilities, broadening their availability. Since our TypeScript rewrite (v37.0.0), imports can now be made directly through the package indexes, simplifying integration. As many users historically imported fromsrc, we encourage you to try the new version and report any missing imports. In the future, we are considering removingsrcfrom published packages to reduce package size, so the more feedback we receive, the better and more stable API we will provide.Features
usePassiveoption toDomEventObserverthat enables listening to passive events. Closes #16412. (commit)Bug fixes
CKBoxno longer changes and reinserts them simultaneously. Closes #17056. (commit)model-nodelist-offset-out-of-boundserror. See #9296. (commit)model-nodelist-offset-out-of-boundserror. See #9296. (commit)z-indexordering. (commit)z-indexordering. (commit)Other changes
AttributeCommandclass. Closes #17105. (commit)ckeditor5package aspeerDependencies.Released packages
Check out the Versioning policy guide for more information.
Released packages (summary)
Releases containing new features:
Other releases:
We are happy to announce the release of CKEditor 5 v43.1.1.
During a recent internal audit, we identified a Cross-Site Scripting (XSS) vulnerability in the CKEditor 5 clipboard package (
CVE-2024-45613). This vulnerability could be triggered by a specific user action, leading to unauthorized JavaScript code execution, if the attacker managed to insert malicious content into the editor, which might happen with a very specific editor configuration.This vulnerability affects only installations where the editor configuration meets the following criteria:
You can read more details in the relevant security advisory and contact us if you have more questions.
Taking the occasion, we decided to introduce additional hardening to some parts of our codebase that introduce theoretical and unexploitable issues. Our security team confirmed that none of these issues were exploitable in a real scenario, however, we decided to fix them, in order to increase the overall security posture of our software.
Released packages
Check out the Versioning policy guide for more information.
Released packages (summary)
Other releases: