OpenCATS icon indicating copy to clipboard operation
OpenCATS copied to clipboard

Published 20 hours ago • verified publisher icon opencats

Bump ckeditor/ckeditor from 4.5.11 to 4.16.1

Open dependabot-preview[bot] opened this issue 4 years ago • 0 comments

Bumps ckeditor/ckeditor from 4.5.11 to 4.16.1.

Changelog

Sourced from ckeditor/ckeditor's changelog.

CKEditor 4.16.1

Fixed Issues:

  • #4617: Fixed: Autocomplete is not accessible in inline editors.
  • #4493: Fixed: The drop-down label does not reflect the current value of the drop-down.
  • #1572: Fixed: A paragraph before or after a widget cannot be removed. Thanks to bunglegrind!
  • #4301: Fixed: Pasted content is overwritten when pasted in an initially empty editor with the div Enter mode.
  • #4351: Fixed: Incorrect values for RGBA/HSLA colors in Color Dialog.
  • #4509: Fixed: Incorrect handling of drag & drop inside widgets and nested editables.
  • #4611: [Android, iOS] Fixed: Incorrect hover styles for buttons in the toolbar on mobile devices.
  • #4652: Fixed: Event data set to false is treated as an event cancelation.

CKEditor 4.16

Security Updates:

  • Fixed ReDoS vulnerability in the Autolink plugin.

    Issue summary: It was possible to execute a ReDoS-type attack inside CKEditor 4 by persuading a victim to paste a specially crafted URL-like text into the editor and press Enter or Space.

  • Fixed ReDoS vulnerability in the Advanced Tab for Dialogs plugin.

    Issue summary: It was possible to execute a ReDoS-type attack inside CKEditor 4 by persuading a victim to paste a specially crafted text into the Styles dialog.

An upgrade is highly recommended!

New Features:

  • #2800: Unsupported image formats are now gracefully handled by the Paste from Word plugin on paste, additionally showing descriptive error messages.
  • #2800: Unsupported image formats are now gracefully handled by the Paste from LibreOffice plugin on paste, additionally showing descriptive error messages.
  • #3582: Introduced smart positioning of the Autocomplete panel used by the Mentions and Emoji plugins. The panel will now be additionally positioned related to the browser viewport to be always fully visible.
  • #4388: Added the option to remove an iframe created with the IFrame Dialog plugin from the sequential keyboard navigation using the tabindex attribute. Thanks to Timo Kirkkala!

Fixed Issues:

API Changes:

... (truncated)

Commits
  • 814c589 Added CKEditor 4.16.1 standard-all.
  • 98a1bce Added CKEditor 4.16.0 standard-all.
  • b1aa2f3 Added CKEditor 4.15.1 standard-all.
  • f233b05 Added CKEditor 4.15.0 standard-all.
  • 8d84af6 Merge pull request #93 from ckeditor/t/4129
  • 4ce8d5c Add .npmignore file to ignore dotfiles.
  • 8eccaf3 Added CKEditor 4.14.1 standard-all.
  • 998e43c Added CKEditor 4.14.0 standard-all.
  • 83ca48a Added CKEditor 4.13.1 standard-all.
  • 31ad30d Merge pull request #88 from Dumluregn/t/3518
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  • @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
  • @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
  • @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
  • @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
  • @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

  • Update frequency (including time of day and day of week)
  • Pull request limits (per update run and/or open at any time)
  • Out-of-range updates (receive only lockfile updates, if desired)
  • Security updates (receive only security updates, if desired)

dependabot-preview[bot] avatar May 28 '21 05:05 dependabot-preview[bot]