Skip to content

build(deps): bump jodit from 4.12.44 to 4.13.3#4508

Merged
thorsten merged 1 commit into
mainfrom
dependabot/npm_and_yarn/jodit-4.13.3
Jul 21, 2026
Merged

build(deps): bump jodit from 4.12.44 to 4.13.3#4508
thorsten merged 1 commit into
mainfrom
dependabot/npm_and_yarn/jodit-4.13.3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 21, 2026

Copy link
Copy Markdown
Contributor

Bumps jodit from 4.12.44 to 4.13.3.

Changelog

Sourced from jodit's changelog.

4.13.3

🚀 New Feature

  • AsyncStorage: AsyncStorage.makeStorage(persistentOrStrategy, suffix, options?) now accepts a third options argument with a defaultProvider field that overrides which provider backs the storage — 'local' (localStorage), 'memory', or a custom IAsyncStorage implementation. When omitted the behaviour is unchanged (persistent IndexedDB with an in-memory fallback). The same option is exposed on the editor as the asyncStorage config option (Jodit.make('#editor', { asyncStorage: { defaultProvider: 'local' } })), so jodit.asyncStorage can be pointed at localStorage, memory, or your own backend without subclassing.
  • Slots: a new above workplace slot (editor.currentPlace.slots.above) that always stays above the toolbar — the spot Google-Docs-style presence bars and banners live in. The toolbar box used to re-pin itself as the container's first child on every toolbarContainer access; it now keeps itself below any container children flagged with the data-jodit-above-toolbar attribute (the new slot carries the flag). The slot renders as nothing while empty and gets the standard border-bottom once filled, like the other slots.

🐛 Bug Fix

  • Storage: LocalStorageProvider.delete(key) removed the entire storage scope (every key sharing the same rootKey/suffix) instead of just the requested key — delete behaved identically to clear. It now reads the JSON blob, drops only that key and writes the rest back. Affects Jodit.modules.Storage/buffer/storage and the @persistent decorator when a single key is deleted.

🏠 Internal

  • Selection: Select.wrapInTagGen no longer relies on the browser's document.execCommand('fontSize', false, '7') to split a non-collapsed selection into wrappable inline fragments. It now uses a pure-DOM implementation that splits the boundary text nodes and wraps every contiguous run of selected inline content (grouped per block) into a <font> element. This removes one more dependency on the deprecated execCommand API and makes selection wrapping (commitStyle, bold/italic/font/color, wrapInTag) behave identically across Chrome and Firefox. No public API or output change; covered by new wrapInTag tests.

4.12.42

🐛 Bug Fix

  • Insert YouTube/Vimeo video: an inserted video was shown for a moment and then immediately removed. Since 4.11.2 cleanHTML.denyTags includes iframe by default, and the plugin's async cleanup walker (which runs ~300 ms after every change) stripped the freshly inserted embed — so the built-in Video button produced nothing that survived. Recognized YouTube/Vimeo player iframes (the output of the Video button / convertMediaUrlToVideoEmbed) are now exempt from the denyTags sweep and from the automatic empty sandbox="" (which would have blocked playback anyway); arbitrary and bare <iframe> elements are still removed as before. Fixes #1381.

4.12.40

💅 Polish

  • Insert image / file popup: the tabs of the insert-image / insert-file popup now size to their labels, so long localized captions — e.g. the German "Datei hochladen" / "Durchsuchen" — are no longer clipped and the popup widens to fit. Previously each tab was forced to an equal column width, which cut off longer translations. The change is scoped to a new jodit-file-selector class, so other tab popups (link, video …) keep their fixed equal-column layout.

4.12.39

🐛 Bug Fix

  • Fullsize / global fullscreen: exiting fullsize scrolled the whole page back to the top. Entering global fullsize puts <html> into position: fixed, which makes the browser reset the page scroll to 0; that position was never restored on exit. The scroll offset is now saved when entering fullsize and restored with window.scrollTo() when leaving it. Fixes #1255.
  • Scroll into view / Search: inView (used by scrollIntoViewIfNeeded) only checked that an element wasn't below the viewport bottom, not that it wasn't above the top. An element scrolled above the visible area was therefore reported as visible, so navigating to it never scrolled — most visibly, cycling through search results and wrapping around to a match near the top of the page did not scroll up to it. inView now also requires the element's bottom to be at or below the viewport top. Fixes #1279.

🚀 New Feature

  • Link dialog / link.deriveUrlFromText: new opt-in option (default false). When the link dialog is opened for a new link with an empty URL field, the URL is pre-filled from the selected text when it looks like a URL or email — a bare domain gets https:// (example.com → https://example.com), an email gets mailto:, an already-schemed URL is kept as is, and plain text is left untouched. Requested in #1248 / #1323.

  • CSP nonce support: added a nonce option that is applied to every <style>, <script> and <link> element Jodit injects at runtime (plugin styles, CDN scripts for ACE/beautify, downloaded stylesheets). Setting it to the nonce from your Content-Security-Policy header lets the editor run under a strict style-src/script-src policy without 'unsafe-inline'. Requested in #1276.

    Jodit.make('#editor', { nonce: 'r4nd0m' });

📝 Documentation

  • Getting started / CDN: bumped the pinned Jodit version in the cdnjs/unpkg snippets in README.md and docs/getting-started.md from the stale 4.7.6 to 4.12.37. Refs #1208.

🏠 Internal

  • Enter tests: added a regression test asserting that pressing Enter with the caret at the bottom of a scrollable editing area scrolls to follow the cursor (and does not scroll when the caret line is already visible). Covers the scenario from #1300, which works on the current version.

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
build(deps): bump jodit from 4.12.44 to 4.13.3
0607d37 
Bumps [jodit](https://github.com/xdan/jodit) from 4.12.44 to 4.13.3.
- [Changelog](https://github.com/xdan/jodit/blob/main/CHANGELOG.md)
- [Commits](xdan/jodit@4.12.44...4.13.3)

---
updated-dependencies:
- dependency-name: jodit
  dependency-version: 4.13.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file JavaScript Pull requests that update Javascript code labels Jul 21, 2026
@thorsten
thorsten merged commit 232b2be into main Jul 21, 2026
16 checks passed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/jodit-4.13.3 branch July 21, 2026 16:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file JavaScript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@thorsten