build(deps): bump jodit from 4.12.33 to 4.12.37

[dependabot]

Bumps jodit from 4.12.33 to 4.12.37.

Release notes

Sourced from jodit's releases.

4.12.37

🐛 Bug Fix

• Source mode / ACE options: only a fixed set of sourceEditorNativeOptions (theme, mode, wrap, showGutter, highlightActiveLine) was applied to the ACE editor — any other native option, such as fontSize, tabSize or useSoftTabs, was silently dropped, so sourceEditorNativeOptions: { fontSize: '30px' } had no effect. The whole options object is now forwarded to ACE's editor.setOptions(), and the type accepts arbitrary native keys. Fixes #1285.

4.12.36

🐛 Bug Fix

• Lists / enter: 'br' mode: converting a list type (ul ↔ ol, or applying a class/style that forces the REPLACE path) destroyed the list — unwrapList extracted the li content into a DocumentFragment that was dissolved on insertion, so wrapList received an empty detached node and the new <ol>/<ul> was never inserted into the document; the content was left as bare inline nodes. In the REPLACE path the li now stays in the document and is re-wrapped directly.
• commitStyle / attributes: a number/boolean attribute value (e.g. commitStyle({ element: 'a', attributes: { tabindex: 2 } })) could never be toggled off — the attr() getter returns a string, so the strict comparison against the raw value always failed and every re-apply took the CHANGE branch instead of UNSET. The value is normalized to a string before comparison now.
• Selection: cursorInTheEdge() (and its cursorOnTheLeft/cursorOnTheRight wrappers) threw IndexSizeError when the document had no selection ranges — getRangeAt(0) was called without checking rangeCount. It returns null now, as documented.
• Selection: eachSelection() threw TypeError when the selection root was an empty editor (childNodes[-1] produced an undefined start node).
• Dom.isFragment: fragments belonging to an inert document (template.content, DOMParser output) were not recognized because of a stale defaultView requirement — same class of problem already fixed for Dom.isElement earlier.
• Dom.between: when end was an ancestor of start, the ascent skipped over it and the callback kept firing for nodes far outside the intended range, up to the end of the tree.
• Dom.replaceTemporaryFromString: the regular expression hardcoded the data-jodit-temp attribute name instead of using the TEMP_ATTR constant and did not match a temporary element whose marker attribute has no value (<span data-jodit-temp>).
• LazyWalker: stopping a walk did not really cancel it — stop() called cancelIdleCallback with an id that was never assigned (dead code left from the pre-scheduler.postTask implementation) and the scheduler's AbortController was never aborted. Also, setWork() called before the first chunk had started did not cancel the previously scheduled pass. Repeated setWork() calls (the clean-html plugin does this on every change) piled up concurrent loops pumping the same generator, defeating the chunked-walk throttling. The pending task is now aborted in stop().
• LazyWalker: the affect flag was not reset when a pass was interrupted via break(), so the next pass reported end(affect = true) even if it had not changed anything (a false synchronizeValues trigger for clean-html). It also processed timeoutChunkSize + 1 nodes per chunk instead of the configured size.

🏠 Internal

• Dom: the Dom.replace(elm, 'p') overload without a create instance is removed from the type surface — it always failed at runtime on an assertion (Need create instance for new tag); create is now required whenever the replacement is defined by a tag name or an HTML string. Dom.isList is honestly typed as HTMLUListElement | HTMLOListElement, Dom.isComment accepts Nullable<Node>, isSameAttributes no longer pretends to be a type predicate, CommitStyle.isApplied returns a real boolean.
• Dom: nextGen builds its sibling stack with push + reverse instead of unshift in a loop (was O(n²) on wide sibling lists); isTag computes the upper-case tag name lazily; the temporary-element regexp is compiled once at the module level.
• Docs: fixed the misleading/inverted JSDoc for Dom.between, Dom.up (root-check asymmetry), Dom.safeInsertNode, LazyWalker options and events, cursorInTheEdgeOfString, isSuitElement (strictStyle description was inverted), the LazyWalker example in the DOM module README (options object, not a number), and the Dom.replace example (missing create argument).
• Tests: new coverage for Dom.between, Dom.isFragment (inert documents), Dom.replace, Dom.replaceTemporaryFromString, wide sibling traversal order in Dom.find, LazyWalker restart/affect-flag reset, cursorInTheEdge without a selection, eachSelection on an empty editor, ul → ol conversion in enter: 'br' mode, and toggling a numeric attribute via commitStyle.
• Tests / hermetic images: the resize, image-editor and image-properties karma tests that wait for a real image load no longer fetch https://xdsoft.net/jodit/files/artio.jpg/th.jpg from the live server — they use the byte-identical tests/artio.jpg already served by karma, so a slow or unreachable xdsoft.net can't time these tests out anymore (~17 tests were flaking on degraded networks). The onLoadImage test helper now also rejects with a clear failed to load "<src>" message on an image error event instead of hanging until the mocha timeout.

4.12.35

🐛 Bug Fix

• Ajax / GET requests: when a request URL already contained a query string (e.g. filebrowser.ajax.url: '/connector/index.php?uid=123'), prepareRequest corrupted it — parseQuery received the whole URL instead of just its query part, so the URL path was glued into the first parameter name (index.php?connector%2Findex.php%3Fuid=123&...) and the baked-in parameters were duplicated instead of being merged with (and overridden by) the request data. The query part is now extracted before parsing, so URL parameters merge cleanly and data keys take priority. Reported by a customer (EventSystemPro, Jodit Multi PRO).

4.12.34

🚀 New Feature

• Image editor / openImageEditor save contract: ImageEditorActionBox.action now also accepts 'saved' (plus an optional newPath). A replacement image editor (e.g. the Jodit PRO one, which uploads the fully edited blob itself through the connector's imageSave action) can report "the file is already persisted" — the core then skips the server resize/crop request and only runs the success wiring (file browser refresh, in-content <img> swap via onSuccess(newPath)). Previously every save was forced through dataProvider.resize/crop, which produced a redundant request that could 404 ("Source not found") when the editor was opened from the Image properties dialog.

🐛 Bug Fix

• Dialog: destructing a dialog from its own afterClose handler (a common pattern for one-shot dialogs, e.g. the finder preview lightbox) made close() throw TypeError: Need subject — after the handler ran, close() still fired joditCloseDialog on this.ow, which the destructor had already cleared. close() now skips that fire when the dialog is being destructed.

Changelog

Sourced from jodit's changelog.

4.12.37

🐛 Bug Fix

• Source mode / ACE options: only a fixed set of sourceEditorNativeOptions (theme, mode, wrap, showGutter, highlightActiveLine) was applied to the ACE editor — any other native option, such as fontSize, tabSize or useSoftTabs, was silently dropped, so sourceEditorNativeOptions: { fontSize: '30px' } had no effect. The whole options object is now forwarded to ACE's editor.setOptions(), and the type accepts arbitrary native keys. Fixes #1285.

4.12.36

🐛 Bug Fix

• Lists / enter: 'br' mode: converting a list type (ul ↔ ol, or applying a class/style that forces the REPLACE path) destroyed the list — unwrapList extracted the li content into a DocumentFragment that was dissolved on insertion, so wrapList received an empty detached node and the new <ol>/<ul> was never inserted into the document; the content was left as bare inline nodes. In the REPLACE path the li now stays in the document and is re-wrapped directly.
• commitStyle / attributes: a number/boolean attribute value (e.g. commitStyle({ element: 'a', attributes: { tabindex: 2 } })) could never be toggled off — the attr() getter returns a string, so the strict comparison against the raw value always failed and every re-apply took the CHANGE branch instead of UNSET. The value is normalized to a string before comparison now.
• Selection: cursorInTheEdge() (and its cursorOnTheLeft/cursorOnTheRight wrappers) threw IndexSizeError when the document had no selection ranges — getRangeAt(0) was called without checking rangeCount. It returns null now, as documented.
• Selection: eachSelection() threw TypeError when the selection root was an empty editor (childNodes[-1] produced an undefined start node).
• Dom.isFragment: fragments belonging to an inert document (template.content, DOMParser output) were not recognized because of a stale defaultView requirement — same class of problem already fixed for Dom.isElement earlier.
• Dom.between: when end was an ancestor of start, the ascent skipped over it and the callback kept firing for nodes far outside the intended range, up to the end of the tree.
• Dom.replaceTemporaryFromString: the regular expression hardcoded the data-jodit-temp attribute name instead of using the TEMP_ATTR constant and did not match a temporary element whose marker attribute has no value (<span data-jodit-temp>).
• LazyWalker: stopping a walk did not really cancel it — stop() called cancelIdleCallback with an id that was never assigned (dead code left from the pre-scheduler.postTask implementation) and the scheduler's AbortController was never aborted. Also, setWork() called before the first chunk had started did not cancel the previously scheduled pass. Repeated setWork() calls (the clean-html plugin does this on every change) piled up concurrent loops pumping the same generator, defeating the chunked-walk throttling. The pending task is now aborted in stop().
• LazyWalker: the affect flag was not reset when a pass was interrupted via break(), so the next pass reported end(affect = true) even if it had not changed anything (a false synchronizeValues trigger for clean-html). It also processed timeoutChunkSize + 1 nodes per chunk instead of the configured size.

🏠 Internal

• Dom: the Dom.replace(elm, 'p') overload without a create instance is removed from the type surface — it always failed at runtime on an assertion (Need create instance for new tag); create is now required whenever the replacement is defined by a tag name or an HTML string. Dom.isList is honestly typed as HTMLUListElement | HTMLOListElement, Dom.isComment accepts Nullable<Node>, isSameAttributes no longer pretends to be a type predicate, CommitStyle.isApplied returns a real boolean.
• Dom: nextGen builds its sibling stack with push + reverse instead of unshift in a loop (was O(n²) on wide sibling lists); isTag computes the upper-case tag name lazily; the temporary-element regexp is compiled once at the module level.
• Docs: fixed the misleading/inverted JSDoc for Dom.between, Dom.up (root-check asymmetry), Dom.safeInsertNode, LazyWalker options and events, cursorInTheEdgeOfString, isSuitElement (strictStyle description was inverted), the LazyWalker example in the DOM module README (options object, not a number), and the Dom.replace example (missing create argument).
• Tests: new coverage for Dom.between, Dom.isFragment (inert documents), Dom.replace, Dom.replaceTemporaryFromString, wide sibling traversal order in Dom.find, LazyWalker restart/affect-flag reset, cursorInTheEdge without a selection, eachSelection on an empty editor, ul → ol conversion in enter: 'br' mode, and toggling a numeric attribute via commitStyle.
• Tests / hermetic images: the resize, image-editor and image-properties karma tests that wait for a real image load no longer fetch https://xdsoft.net/jodit/files/artio.jpg/th.jpg from the live server — they use the byte-identical tests/artio.jpg already served by karma, so a slow or unreachable xdsoft.net can't time these tests out anymore (~17 tests were flaking on degraded networks). The onLoadImage test helper now also rejects with a clear failed to load "<src>" message on an image error event instead of hanging until the mocha timeout.

4.12.35

🐛 Bug Fix

• Ajax / GET requests: when a request URL already contained a query string (e.g. filebrowser.ajax.url: '/connector/index.php?uid=123'), prepareRequest corrupted it — parseQuery received the whole URL instead of just its query part, so the URL path was glued into the first parameter name (index.php?connector%2Findex.php%3Fuid=123&...) and the baked-in parameters were duplicated instead of being merged with (and overridden by) the request data. The query part is now extracted before parsing, so URL parameters merge cleanly and data keys take priority. Reported by a customer (EventSystemPro, Jodit Multi PRO).

4.12.34

🚀 New Feature

• Image editor / openImageEditor save contract: ImageEditorActionBox.action now also accepts 'saved' (plus an optional newPath). A replacement image editor (e.g. the Jodit PRO one, which uploads the fully edited blob itself through the connector's imageSave action) can report "the file is already persisted" — the core then skips the server resize/crop request and only runs the success wiring (file browser refresh, in-content <img> swap via onSuccess(newPath)). Previously every save was forced through dataProvider.resize/crop, which produced a redundant request that could 404 ("Source not found") when the editor was opened from the Image properties dialog.

🐛 Bug Fix

• Dialog: destructing a dialog from its own afterClose handler (a common pattern for one-shot dialogs, e.g. the finder preview lightbox) made close() throw TypeError: Need subject — after the handler ran, close() still fired joditCloseDialog on this.ow, which the destructor had already cleared. close() now skips that fire when the dialog is being destructed.

Commits

• dd56880 New version 4.12.37 Read more https://github.com/xdan/jodit/blob/main/CHANGEL...
• 6969a97 fix(source): forward all native ACE options (fontSize etc.) to the editor
• e29c3b5 New version 4.12.36 Read more https://github.com/xdan/jodit/blob/main/CHANGEL...
• 790caf7 feat: update tests to use local image paths and improve error handling for im...
• bc8decd feat: enhance DOM manipulation and selection features with new methods and im...
• 0a531ff New version 4.12.35 Read more https://github.com/xdan/jodit/blob/main/CHANGEL...
• 01ffbba fix(ajax): don't corrupt GET URLs that already contain a query string
• a1e3b0d chore: update statoscope reference stats
• 0d6f254 Merge branch 'main' of github.com:xdan/jodit
• 0c6723c New version 4.12.34 Read more https://github.com/xdan/jodit/blob/main/CHANGEL...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)