Skip to content

build(deps): bump jodit from 4.14.2 to 4.14.6 - #4649

Merged
thorsten merged 1 commit into
mainfrom
dependabot/npm_and_yarn/jodit-4.14.6
Sep 16, 2026
Merged

build(deps): bump jodit from 4.14.2 to 4.14.6#4649
thorsten merged 1 commit into
mainfrom
dependabot/npm_and_yarn/jodit-4.14.6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 16, 2026

Copy link
Copy Markdown
Contributor

Bumps jodit from 4.14.2 to 4.14.6.

Release notes

Sourced from jodit's releases.

4.14.6

🐛 Bug Fix

  • Security / iframe (editHTMLDocumentMode, stored XSS, CWE-79): with iframe: true and editHTMLDocumentMode: true a full HTML document assigned to editor.value was written straight into the live iframe document with document.write(), and safeHTML was only applied afterwards. Inline <script> elements and on* handlers therefore executed while the document was being parsed — before the sanitizer could remove them — in an iframe that is same-origin with the host page by default (iframeSandbox: null), so an attacker-supplied document could run script in the host application's origin as soon as another user opened it. The document is now parsed in an inert DOMParser document (no browsing context: nothing executes, no sub-resources are fetched), sanitized there via the safeHTML event, and only then adopted into the live iframe document; nodes coming from an inert parser are flagged "already started", so even a <script> the cleaner is configured to keep never executes — the same guarantee innerHTML gives in the regular mode. A partial value (no <html>/<body>) in that mode was also assigned to doc.body.innerHTML unsanitized before clean-html ran, which fired e.g. <img onerror>; it now goes through the regular sanitized path. Affected all versions with editHTMLDocumentMode through 4.14.5. Responsibly reported by @​bp0lr (GHSA-w3xv-x3fm-59ph).

4.14.5

🏠 Internal

  • Upgraded ESLint 9 to 10 and @eslint/js 9 to 10. Replaced the unmaintained eslint-plugin-import with ESLint 10-compatible eslint-plugin-import-x 4, removed the obsolete compatibility wrapper, and upgraded eslint-plugin-mocha to 12 and Mocha to 12.
  • Migrated the release/build scripts from the vulnerable replace package to replace-in-file 9. ESLint 10's new checks removed redundant assignments and test errors now preserve their original cause.
  • Updated the screenshot-test image and its packages to Playwright 1.63.0 and refreshed affected browser snapshots. Fixed the Make target so updateTests=false no longer enables snapshot updates. Forced the patched qs 6.16.0 for Karma's server dependencies; npm audit now reports no known vulnerabilities.
  • Kept TypeScript at 6.0.3 because typescript-eslint does not yet support TypeScript 7 and the project build tools use the compiler API removed from TypeScript 7. Kept cssnano-preset-advanced at 8.0.10 because version 9 fails while loading its caniuse-api dependency under the TypeScript Webpack configuration.

4.14.4

🏠 Internal

  • Updated development dependencies within their existing version ranges and refreshed transitive dependencies in package-lock.json. Highlights: Playwright 1.63.0, SWC 1.16.2, TypeScript 6.0.3, typescript-eslint 8.70.0, Less 4.9.1, PostCSS 8.5.28, Stylelint 17.15.0 and Webpack 5.110.3.
  • Major upgrades are handled separately: ESLint remains on 9, Mocha on 11 and cssnano-preset-advanced on 8 in this release.

4.14.3

🐛 Bug Fix

  • Selection: save(), fakes(), remove() and wrapInTag() leave selections crossing the editor boundary untouched. isInsideArea checks both boundaries, and restoreFakes() ignores nodes moved outside the editor.
  • Selection / caret: current() resolves the last text descendant when the caret follows a nested element and no longer returns a <br> outside the editor. Edge checks use the correct selection endpoint, including selections across blocks.
  • Selection / ranges and history: preserve backward selections through save/restore, formatting, expansion and undo/redo, including iframe editors. Restore and format all native disjoint ranges in Firefox; selected HTML and node iteration include all ranges without duplicate callbacks. Existing history snapshots remain supported.
  • Selection / insertion: invalid or unsupported cursor point lookups preserve the selection. Selecting the editor root selects its contents; positioning a cursor outside the root is rejected. Splitting validates the block, caret and optional edge before changing DOM. An empty sanitized fragment no longer deletes selected content, and insertion uses the surviving final child after hooks.
  • Selection / Shadow DOM: save() finds markers inside the editor's shadow tree and keeps the saved selection active.
  • Formatting: splitting a text node preserves live element offsets, so mixed text/element selection boundaries no longer omit part of the selected content. Temporary wrappers are cleaned up when callbacks throw or iteration stops early; ApplyStyle also restores the selection after a hook throws. Removed fragments are skipped when hooks replace or delete DOM, and formatting stops safely when a hook destroys the editor.
  • Formatting / CSS: explicit property resets such as color: null no longer throw. Wrapper cleanup runs after all attributes have been applied, preserving subsequent CSS rules, classes and unrelated attributes. Applying styles across nested elements overrides overlapping properties without discarding other styles. Formatting skips contenteditable="false" blocks and preserves styles inside protected inline content.
  • Formatting / links: extracting selected text no longer removes links from adjacent, unselected images by treating image-only fragments as empty.
  • Formatting / classes and lists: class and className accept multiple class tokens. Adjacent lists are matched correctly with multiple classes and numeric or boolean attributes. Removing a class fires afterToggleAttribute even when other classes remain.
  • TypeScript: corrected the declared argument order of beforeToggleList and the modes/return type of beforeUnwrapList to match existing runtime behavior. Runtime hook signatures are unchanged.
  • Languages: added missing Azerbaijani translations for Line height, Spellcheck, Speech Recognize and newline.

🏠 Internal

  • Simplified style iteration with for…of and guaranteed selection cleanup, removed intermediate array copies from caret edge checks, reused CSS reset rules across nested elements, and reused one scratch DOM Range during containment traversal instead of allocating one per node.
  • Added 92 selection and style regression/edge-case tests, including Shadow DOM, iframe, undo/redo, disjoint and backward selections, hook mutations, protected content, nested lists, CSS/attribute combinations and documents up to 3000 paragraphs. Browser suites verified in Chrome and Firefox; Chromium skips native multi-range cases it does not support.
Changelog

Sourced from jodit's changelog.

4.14.6

🐛 Bug Fix

  • Security / iframe (editHTMLDocumentMode, stored XSS, CWE-79): with iframe: true and editHTMLDocumentMode: true a full HTML document assigned to editor.value was written straight into the live iframe document with document.write(), and safeHTML was only applied afterwards. Inline <script> elements and on* handlers therefore executed while the document was being parsed — before the sanitizer could remove them — in an iframe that is same-origin with the host page by default (iframeSandbox: null), so an attacker-supplied document could run script in the host application's origin as soon as another user opened it. The document is now parsed in an inert DOMParser document (no browsing context: nothing executes, no sub-resources are fetched), sanitized there via the safeHTML event, and only then adopted into the live iframe document; nodes coming from an inert parser are flagged "already started", so even a <script> the cleaner is configured to keep never executes — the same guarantee innerHTML gives in the regular mode. A partial value (no <html>/<body>) in that mode was also assigned to doc.body.innerHTML unsanitized before clean-html ran, which fired e.g. <img onerror>; it now goes through the regular sanitized path. Affected all versions with editHTMLDocumentMode through 4.14.5. Responsibly reported by @​bp0lr (GHSA-w3xv-x3fm-59ph).

4.14.5

🏠 Internal

  • Upgraded ESLint 9 to 10 and @eslint/js 9 to 10. Replaced the unmaintained eslint-plugin-import with ESLint 10-compatible eslint-plugin-import-x 4, removed the obsolete compatibility wrapper, and upgraded eslint-plugin-mocha to 12 and Mocha to 12.
  • Migrated the release/build scripts from the vulnerable replace package to replace-in-file 9. ESLint 10's new checks removed redundant assignments and test errors now preserve their original cause.
  • Updated the screenshot-test image and its packages to Playwright 1.63.0 and refreshed affected browser snapshots. Fixed the Make target so updateTests=false no longer enables snapshot updates. Forced the patched qs 6.16.0 for Karma's server dependencies; npm audit now reports no known vulnerabilities.
  • Kept TypeScript at 6.0.3 because typescript-eslint does not yet support TypeScript 7 and the project build tools use the compiler API removed from TypeScript 7. Kept cssnano-preset-advanced at 8.0.10 because version 9 fails while loading its caniuse-api dependency under the TypeScript Webpack configuration.

4.14.4

🏠 Internal

  • Updated development dependencies within their existing version ranges and refreshed transitive dependencies in package-lock.json. Highlights: Playwright 1.63.0, SWC 1.16.2, TypeScript 6.0.3, typescript-eslint 8.70.0, Less 4.9.1, PostCSS 8.5.28, Stylelint 17.15.0 and Webpack 5.110.3.
  • Major upgrades are handled separately: ESLint remains on 9, Mocha on 11 and cssnano-preset-advanced on 8 in this release.

4.14.3

🐛 Bug Fix

  • Selection: save(), fakes(), remove() and wrapInTag() leave selections crossing the editor boundary untouched. isInsideArea checks both boundaries, and restoreFakes() ignores nodes moved outside the editor.
  • Selection / caret: current() resolves the last text descendant when the caret follows a nested element and no longer returns a <br> outside the editor. Edge checks use the correct selection endpoint, including selections across blocks.
  • Selection / ranges and history: preserve backward selections through save/restore, formatting, expansion and undo/redo, including iframe editors. Restore and format all native disjoint ranges in Firefox; selected HTML and node iteration include all ranges without duplicate callbacks. Existing history snapshots remain supported.
  • Selection / insertion: invalid or unsupported cursor point lookups preserve the selection. Selecting the editor root selects its contents; positioning a cursor outside the root is rejected. Splitting validates the block, caret and optional edge before changing DOM. An empty sanitized fragment no longer deletes selected content, and insertion uses the surviving final child after hooks.
  • Selection / Shadow DOM: save() finds markers inside the editor's shadow tree and keeps the saved selection active.
  • Formatting: splitting a text node preserves live element offsets, so mixed text/element selection boundaries no longer omit part of the selected content. Temporary wrappers are cleaned up when callbacks throw or iteration stops early; ApplyStyle also restores the selection after a hook throws. Removed fragments are skipped when hooks replace or delete DOM, and formatting stops safely when a hook destroys the editor.
  • Formatting / CSS: explicit property resets such as color: null no longer throw. Wrapper cleanup runs after all attributes have been applied, preserving subsequent CSS rules, classes and unrelated attributes. Applying styles across nested elements overrides overlapping properties without discarding other styles. Formatting skips contenteditable="false" blocks and preserves styles inside protected inline content.
  • Formatting / links: extracting selected text no longer removes links from adjacent, unselected images by treating image-only fragments as empty.
  • Formatting / classes and lists: class and className accept multiple class tokens. Adjacent lists are matched correctly with multiple classes and numeric or boolean attributes. Removing a class fires afterToggleAttribute even when other classes remain.
  • TypeScript: corrected the declared argument order of beforeToggleList and the modes/return type of beforeUnwrapList to match existing runtime behavior. Runtime hook signatures are unchanged.
  • Languages: added missing Azerbaijani translations for Line height, Spellcheck, Speech Recognize and newline.

🏠 Internal

  • Simplified style iteration with for…of and guaranteed selection cleanup, removed intermediate array copies from caret edge checks, reused CSS reset rules across nested elements, and reused one scratch DOM Range during containment traversal instead of allocating one per node.
  • Added 92 selection and style regression/edge-case tests, including Shadow DOM, iframe, undo/redo, disjoint and backward selections, hook mutations, protected content, nested lists, CSS/attribute combinations and documents up to 3000 paragraphs. Browser suites verified in Chrome and Firefox; Chromium skips native multi-range cases it does not support.
Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
build(deps): bump jodit from 4.14.2 to 4.14.6
585babb 
Bumps [jodit](https://github.com/xdan/jodit) from 4.14.2 to 4.14.6.
- [Release notes](https://github.com/xdan/jodit/releases)
- [Changelog](https://github.com/xdan/jodit/blob/main/CHANGELOG.md)
- [Commits](xdan/jodit@4.14.2...4.14.6)

---
updated-dependencies:
- dependency-name: jodit
  dependency-version: 4.14.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file JavaScript Pull requests that update Javascript code labels Sep 16, 2026
@coderabbitai

coderabbitai Bot commented Sep 16, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: f04e7b3b-37a3-4962-af6f-6aab25803502

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@thorsten
thorsten merged commit 0c4f44a into main Sep 16, 2026
19 checks passed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/jodit-4.14.6 branch September 16, 2026 15:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file JavaScript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@thorsten