@mgdis/mg-components 6.23.0 → 6.24.0

package/dist/cjs/mg-input-rich-text-editor.cjs.entry.js

@@ -6867,10 +6867,10 @@ var e = Object.create, t = Object.defineProperty, n = Object.getOwnPropertyDescr
 								return;
 							}
 						}
-						if (c === "srcset") try {
+						if (c === "srcset" || c === "imagesrcset") try {
 							let e = o(n);
 							if (e.forEach(function(e) {
-								H("srcset", e.url) && (e.evil = true);
+								H(c, e.url) && (e.evil = true);
 							}), e = p(e, function(e) {
 								return !e.evil;
 							}), e.length) n = h(p(e, function(e) {
@@ -6913,8 +6913,8 @@ var e = Object.create, t = Object.defineProperty, n = Object.getOwnPropertyDescr
 				if (I) return;
 				let n = N[N.length - 1], r;
 				if (n && (r = n.tag, e = n.innerText === void 0 ? e : n.innerText), t.disallowedTagsMode === "completelyDiscard" && !C(r)) e = "";
-				else if ((t.disallowedTagsMode === "discard" || t.disallowedTagsMode === "completelyDiscard") && (r === "script" || r === "style")) b += e;
-				else if ((t.disallowedTagsMode === "discard" || t.disallowedTagsMode === "completelyDiscard") && (r === "textarea" || r === "xmp")) b += e;
+				else if (r && C(r) && (t.disallowedTagsMode === "discard" || t.disallowedTagsMode === "completelyDiscard") && (r === "script" || r === "style")) b += e;
+				else if (r && C(r) && (t.disallowedTagsMode === "discard" || t.disallowedTagsMode === "completelyDiscard") && (r === "textarea" || r === "xmp")) b += e;
 				else if (!R) {
 					let n = V(e, false);
 					t.textFilter ? b += t.textFilter(n, r) : b += n;
@@ -7058,7 +7058,24 @@ var e = Object.create, t = Object.defineProperty, n = Object.getOwnPropertyDescr
 		allowedSchemesAppliedToAttributes: [
 			"href",
 			"src",
-			"cite"
+			"cite",
+			"action",
+			"formaction",
+			"data",
+			"xlink:href",
+			"poster",
+			"background",
+			"ping",
+			"longdesc",
+			"usemap",
+			"codebase",
+			"classid",
+			"archive",
+			"profile",
+			"manifest",
+			"itemid",
+			"dynsrc",
+			"lowsrc"
 		],
 		allowProtocolRelative: true,
 		enforceHtmlBoundary: false,
@@ -7123,7 +7140,7 @@ var e = Object.create, t = Object.defineProperty, n = Object.getOwnPropertyDescr
  * Released under MIT see LICENSE.txt in the project root for license information.
  * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
  */
-const APP_VERSION = "4.12.4";
+const APP_VERSION = "4.12.25";
 // prettier-ignore
 const ES = "es2020";
 const IS_ES_MODERN = true;
@@ -8570,12 +8587,12 @@ class Dom {
      * Check if element is element node
      */
     static isElement(node) {
-        var _a;
         if (!Dom.isNode(node)) {
             return false;
         }
-        const win = (_a = node.ownerDocument) === null || _a === void 0 ? void 0 : _a.defaultView;
-        return Boolean(win && node.nodeType === Node.ELEMENT_NODE);
+        // no `defaultView` requirement — nodes of an inert document
+        // (`DOMParser`, `implementation.createHTMLDocument`) are still elements
+        return node.nodeType === Node.ELEMENT_NODE;
     }
     /**
      * Check if element is document fragment
@@ -8596,8 +8613,10 @@ class Dom {
         if (!Dom.isNode(node)) {
             return false;
         }
+        // an inert document has no browsing context (`defaultView` is null),
+        // but its nodes are same-realm HTMLElements
         const win = (_a = node.ownerDocument) === null || _a === void 0 ? void 0 : _a.defaultView;
-        return Boolean(win && node instanceof win.HTMLElement);
+        return node instanceof (win ? win.HTMLElement : HTMLElement);
     }
     /**
      * Check element is inline block
@@ -9164,11 +9183,22 @@ function isFastEqual(a, b) {
  * @module helpers/checker
  */
 /**
- * Detect if string is HTML from MS Word or Excel
+ * Detect if string is HTML from MS Word, Excel or LibreOffice/OpenOffice
  */
 function isHtmlFromWord(data) {
     return (data.search(/<meta.*?Microsoft Excel\s[\d].*?>/) !== -1 ||
         data.search(/<meta.*?Microsoft Word\s[\d].*?>/) !== -1 ||
+        // `<meta name=ProgId content=Word.Document>` — attribute values are
+        // unquoted in the raw Word clipboard fragment
+        data.search(/<meta[^>]*?ProgId[^>]*?(Word|Excel)\./i) !== -1 ||
+        // LibreOffice/OpenOffice Writer & Calc
+        data.search(/<meta[^>]*?(LibreOffice|OpenOffice)/i) !== -1 ||
+        // Office namespaces on the root element of the clipboard fragment
+        data.search(/urn:schemas-microsoft-com:office:(word|excel)/) !== -1 ||
+        // `class=MsoNormal` and friends (unquoted/quoted)
+        data.search(/<\w[^>]*\sclass=("|')?Mso/) !== -1 ||
+        // the raw Word clipboard uses SINGLE quotes: style='mso-…'
+        data.search(/style='[^']*mso-/) !== -1 ||
         (data.search(/style="[^"]*mso-/) !== -1 && data.search(/<font/) !== -1));
 }
 
@@ -11237,6 +11267,17 @@ function applyStyles(html) {
             iframeDoc.open();
             iframeDoc.write(html);
             iframeDoc.close();
+            // Word marks its auto-generated list markers (the literal
+            // bullet/number, e.g. `1.` or `·`) with `mso-list:Ignore`.
+            // They are display-only and must not be imported, otherwise
+            // the marker text leaks into the content. Drop them before any
+            // style normalization strips the `mso-list` hint. See #948
+            Dom.each(iframeDoc.body, (node) => {
+                if (Dom.isElement(node) &&
+                    /mso-list:\s*ignore/i.test(node.getAttribute('style') || '')) {
+                    Dom.safeRemove(node);
+                }
+            });
             try {
                 for (let i = 0; i < iframeDoc.styleSheets.length; i += 1) {
                     const rules = iframeDoc.styleSheets[i].cssRules;
@@ -11327,6 +11368,15 @@ function cleanFromWord(html) {
                                 Dom.unwrap(node);
                                 break;
                             default:
+                                // Word marks its auto-generated list markers
+                                // (the literal bullet/number, e.g. `1.` or `·`)
+                                // with `mso-list:Ignore`. They are display-only
+                                // and must not be imported, otherwise the marker
+                                // text leaks into the content. See #948
+                                if (/mso-list:\s*ignore/i.test(node.getAttribute('style') || '')) {
+                                    marks.push(node);
+                                    break;
+                                }
                                 toArray(node.attributes).forEach((attr) => {
                                     if ([
                                         'src',
@@ -12593,6 +12643,15 @@ function fastClone(object) {
  * Released under MIT see LICENSE.txt in the project root for license information.
  * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
  */
+/**
+ * Keys that must never be copied from a (potentially untrusted) config object —
+ * assigning them during a recursive merge can reach and mutate
+ * `Object.prototype` (prototype pollution, CWE-1321).
+ */
+const UNSAFE_PROTO_KEYS = ['__proto__', 'constructor', 'prototype'];
+function isUnsafeProtoKey(key) {
+    return UNSAFE_PROTO_KEYS.indexOf(key) !== -1;
+}
 /**
  * @example
  * ```js
@@ -12642,6 +12701,9 @@ function ConfigProto(options, proto, deep = 0) {
     }
     const newOpt = {};
     Object.keys(options).forEach(key => {
+        if (isUnsafeProtoKey(key)) {
+            return;
+        }
         const opt = options[key], protoKey = proto ? proto[key] : null;
         if (isPlainObject(opt) && isPlainObject(protoKey) && !isAtom(opt)) {
             newOpt[key] = ConfigProto(opt, protoKey, deep + 1);
@@ -12702,6 +12764,9 @@ function ConfigFlatten(obj) {
  */
 function ConfigMerge(target, source) {
     Object.keys(source).forEach(key => {
+        if (isUnsafeProtoKey(key)) {
+            return;
+        }
         const srcVal = source[key];
         const tgtVal = target[key];
         if (isPlainObject(srcVal) && isPlainObject(tgtVal) && !isAtom(srcVal)) {
@@ -12754,7 +12819,6 @@ const convertMediaUrlToVideoEmbed = (url, { width = 400, height = 345 } = {}) =>
         return url;
     }
     const parser = globalDocument.createElement('a');
-    const pattern1 = /(?:http?s?:\/\/)?(?:www\.)?(?:vimeo\.com)\/?(.+)/g;
     parser.href = url;
     if (!width) {
         width = 400;
@@ -12765,27 +12829,50 @@ const convertMediaUrlToVideoEmbed = (url, { width = 400, height = 345 } = {}) =>
     const protocol = parser.protocol || '';
     switch (parser.hostname) {
         case 'www.vimeo.com':
-        case 'vimeo.com':
-            return pattern1.test(url)
-                ? url.replace(pattern1, '<iframe width="' +
-                    width +
-                    '" height="' +
-                    height +
-                    '" src="' +
-                    protocol +
-                    '//player.vimeo.com/video/$1" frameborder="0" allowfullscreen></iframe>')
-                : url;
+        case 'vimeo.com': {
+            // The numeric video id can be preceded by `channels/<name>/` or
+            // `groups/<name>/videos/` and followed by tracking params (e.g.
+            // `?share=copy`). Unlisted videos keep a hash right after the id
+            // (`vimeo.com/<id>/<hash>`). Extract the id (+ hash) from the path
+            // so all of those forms produce a valid embed. See #1209
+            const segments = parser.pathname.split('/').filter(Boolean);
+            const idIndex = segments.findIndex(s => /^\d+$/.test(s));
+            if (idIndex === -1) {
+                return url;
+            }
+            let path = segments[idIndex];
+            const hash = segments[idIndex + 1];
+            if (hash && idIndex === 0) {
+                path += '/' + hash;
+            }
+            return ('<iframe width="' +
+                width +
+                '" height="' +
+                height +
+                '" src="' +
+                protocol +
+                '//player.vimeo.com/video/' +
+                path +
+                '" frameborder="0" allowfullscreen></iframe>');
+        }
         case 'youtube.com':
         case 'www.youtube.com':
+        case 'm.youtube.com':
+        case 'music.youtube.com':
         case 'youtu.be':
         case 'www.youtu.be': {
-            const query = parser.search
-                ? parseQuery(parser.search)
-                : { v: parser.pathname.substring(1) };
-            if (/^embed\/.*/.test(query.v)) {
-                query.v = query.v.substring(6);
-            }
-            return query.v
+            const query = parser.search ? parseQuery(parser.search) : {};
+            // `youtube.com/watch` keeps the video id in the `v` query
+            // parameter, while the short `youtu.be/<id>` links and the
+            // `/embed/`, `/shorts/`, `/live/` paths keep it in the pathname.
+            // Modern share urls add tracking params (e.g. `?si=`, `?t=`), so
+            // the pathname must still be used as a fallback when there is no
+            // `v`. See #1209
+            let v = query.v || parser.pathname.substring(1);
+            v = v
+                .replace(/^(watch|embed|shorts|live|v)\//, '')
+                .replace(/\/$/, '');
+            return v
                 ? '<iframe width="' +
                     width +
                     '" height="' +
@@ -12793,7 +12880,7 @@ const convertMediaUrlToVideoEmbed = (url, { width = 400, height = 345 } = {}) =>
                     '" src="' +
                     protocol +
                     '//www.youtube.com/embed/' +
-                    query.v +
+                    v +
                     '" frameborder="0" allowfullscreen></iframe>'
                 : url;
         }
@@ -13179,21 +13266,22 @@ function safeHTML(box, options) {
         return;
     }
     const removeEvents = (_a = options.removeEventAttributes) !== null && _a !== void 0 ? _a : options.removeOnError;
-    if (removeEvents) {
-        removeAllEventAttributes(box);
-        $$('*', box).forEach(elm => removeAllEventAttributes(elm));
-    }
-    else if (options.removeOnError) {
-        sanitizeHTMLElement(box, options);
-        $$('[onerror]', box).forEach(elm => sanitizeHTMLElement(elm, options));
-    }
-    if (options.safeJavaScriptLink) {
-        sanitizeHTMLElement(box, options);
-        $$('a[href^="javascript"]', box).forEach(elm => sanitizeHTMLElement(elm, options));
-    }
-    if (options.safeLinksTarget) {
-        $$('a[target="_blank"]', box).forEach(elm => {
-            const rel = elm.getAttribute('rel') || '';
+    // Single synchronous traversal of the subtree. Besides removing event
+    // handlers and `javascript:` links, `sanitizeHTMLElement` neutralises
+    // executable `iframe[srcdoc]`, `data:text/html` / SVG `data:` document
+    // sources and dangerous schemes in every URL-bearing attribute.
+    const process = (node) => {
+        if (!Dom.isElement(node)) {
+            return;
+        }
+        if (removeEvents) {
+            removeAllEventAttributes(node);
+        }
+        sanitizeHTMLElement(node, options);
+        if (options.safeLinksTarget &&
+            node.nodeName === 'A' &&
+            node.getAttribute('target') === '_blank') {
+            const rel = node.getAttribute('rel') || '';
             const parts = rel.split(/\s+/).filter(Boolean);
             if (!parts.includes('noopener')) {
                 parts.push('noopener');
@@ -13201,9 +13289,11 @@ function safeHTML(box, options) {
             if (!parts.includes('noreferrer')) {
                 parts.push('noreferrer');
             }
-            attr(elm, 'rel', parts.join(' '));
-        });
-    }
+            attr(node, 'rel', parts.join(' '));
+        }
+    };
+    process(box);
+    Dom.each(box, process);
 }
 /**
  * Remove all on* event handler attributes from an element
@@ -13225,6 +13315,39 @@ function removeAllEventAttributes(elm) {
     }
     return effected;
 }
+/**
+ * URL-bearing attributes (besides `href`) that can load or execute content.
+ */
+const URL_ATTRIBUTES = [
+    'src',
+    'data',
+    'action',
+    'formaction',
+    'poster',
+    'background',
+    'xlink:href'
+];
+/**
+ * Tags that load their URL as a *document* (scripts inside run). An SVG data
+ * URL is only an XSS vector here — as an `<img>` source it renders inertly.
+ */
+const DOCUMENT_EMBED_TAGS = new Set(['iframe', 'frame', 'object', 'embed']);
+/**
+ * Detects executable / script-bearing URL schemes. The attribute value is
+ * already HTML-entity-decoded by `getAttribute`, so only whitespace and
+ * control characters (which browsers ignore inside a scheme) need stripping.
+ */
+function isDangerousUrl(value, tagName) {
+    // eslint-disable-next-line no-control-regex
+    const normalized = value.replace(/[\u0000-\u0020]+/g, '').toLowerCase();
+    if (/^(?:javascript|vbscript|livescript|mocha):/.test(normalized)) {
+        return true;
+    }
+    if (/^data:(?:text\/html|application\/xhtml)/.test(normalized)) {
+        return true;
+    }
+    return (/^data:image\/svg/.test(normalized) && DOCUMENT_EMBED_TAGS.has(tagName));
+}
 function sanitizeHTMLElement(elm, { safeJavaScriptLink, removeOnError } = {
     safeJavaScriptLink: true,
     removeOnError: true
@@ -13242,6 +13365,22 @@ function sanitizeHTMLElement(elm, { safeJavaScriptLink, removeOnError } = {
         attr(elm, 'href', location.protocol + '//' + href);
         effected = true;
     }
+    if (safeJavaScriptLink) {
+        // `srcdoc` runs its content as a full HTML document — drop it entirely.
+        if (elm.hasAttribute('srcdoc')) {
+            attr(elm, 'srcdoc', null);
+            effected = true;
+        }
+        // Strip executable schemes from any other URL-bearing attribute.
+        const tagName = elm.nodeName.toLowerCase();
+        for (const name of URL_ATTRIBUTES) {
+            const value = elm.getAttribute(name);
+            if (value && isDangerousUrl(value, tagName)) {
+                attr(elm, name, null);
+                effected = true;
+            }
+        }
+    }
     return effected;
 }
 
@@ -13267,7 +13406,7 @@ const ALONE_TAGS = new Set(['br', 'hr', 'input']);
 /**
  * Extract plain text from HTML text
  */
-function stripTags(html, doc = document, exclude = null) {
+function stripTags(html, doc = document, exclude = null, blockBr = false) {
     const tmp = doc.createElement('div');
     if (isString(html)) {
         tmp.innerHTML = html;
@@ -13283,7 +13422,7 @@ function stripTags(html, doc = document, exclude = null) {
         if (exclude && Dom.isTag(p, exclude)) {
             const tag = p.nodeName.toLowerCase();
             const text = !Dom.isTag(p, ALONE_TAGS)
-                ? `%%%jodit-${tag}%%%${stripTags(p.innerHTML, doc, exclude)}%%%/jodit-${tag}%%%`
+                ? `%%%jodit-${tag}%%%${stripTags(p.innerHTML, doc, exclude, blockBr)}%%%/jodit-${tag}%%%`
                 : `%%%jodit-single-${tag}%%%`;
             Dom.before(p, doc.createTextNode(text));
             Dom.safeRemove(p);
@@ -13301,7 +13440,11 @@ function stripTags(html, doc = document, exclude = null) {
             return;
         }
         if (nx) {
-            pr.insertBefore(doc.createTextNode(' '), nx);
+            // By default blocks are joined with a single space (single-line
+            // plain text). When `blockBr` is set, separate them with a line
+            // break instead, so paragraph structure survives — e.g. the
+            // "Insert only Text" paste option. See #1232
+            pr.insertBefore(doc.createTextNode(blockBr ? '%%%jodit-single-br%%%' : ' '), nx);
         }
     });
     return restoreTags(trim(tmp.innerText));
@@ -13508,6 +13651,53 @@ const getContentWidth = (element, win) => {
     return width - paddingLeft - paddingRight;
 };
 
+/*!
+ * Jodit Editor (https://xdsoft.net/jodit/)
+ * Released under MIT see LICENSE.txt in the project root for license information.
+ * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
+ */
+/**
+ * Whether the element establishes a containing block for its
+ * `position: fixed` descendants, so their coordinates become relative to it
+ * instead of the viewport.
+ */
+function isContainingBlockForFixed(style) {
+    return ((style.transform !== '' && style.transform !== 'none') ||
+        (style.perspective !== '' && style.perspective !== 'none') ||
+        (style.filter !== '' && style.filter !== 'none') ||
+        style.willChange === 'transform' ||
+        style.willChange === 'perspective' ||
+        style.willChange === 'filter' ||
+        style.contain === 'paint' ||
+        style.contain === 'layout' ||
+        style.contain === 'strict' ||
+        style.contain === 'content');
+}
+/**
+ * Returns the viewport offset of the containing block of a `position: fixed`
+ * descendant of `elm`. A fixed element is normally positioned relative to the
+ * viewport, but an ancestor with `transform`, `filter`, `perspective`, etc.
+ * establishes a new containing block, shifting the fixed element by that
+ * ancestor's top-left corner. The returned offset should be subtracted from
+ * the desired viewport coordinates before applying them.
+ *
+ * Returns `{ x: 0, y: 0 }` when no such ancestor exists (the common case), so
+ * call sites keep their previous behaviour unchanged.
+ */
+function getFixedPositionOffset(elm) {
+    var _a;
+    const win = (_a = elm.ownerDocument) === null || _a === void 0 ? void 0 : _a.defaultView;
+    let node = elm.parentElement;
+    while (win && node) {
+        if (isContainingBlockForFixed(win.getComputedStyle(node))) {
+            const rect = node.getBoundingClientRect();
+            return { x: rect.left, y: rect.top };
+        }
+        node = node.parentElement;
+    }
+    return { x: 0, y: 0 };
+}
+
 /*!
  * Jodit Editor (https://xdsoft.net/jodit/)
  * Released under MIT see LICENSE.txt in the project root for license information.
@@ -13856,6 +14046,7 @@ var index = /*#__PURE__*/Object.freeze({
 	getClassName: getClassName,
 	getContentWidth: getContentWidth,
 	getDataTransfer: getDataTransfer,
+	getFixedPositionOffset: getFixedPositionOffset,
 	getPropertyDescriptor: getPropertyDescriptor,
 	getScrollParent: getScrollParent,
 	getXPathByElement: getXPathByElement,
@@ -14150,6 +14341,14 @@ class ViewComponent extends Component {
      */
     setParentView(jodit) {
         this.jodit = jodit;
+        // Inherit the owner window from the parent view — for an editor
+        // created with a custom `ownerWindow` (e.g. inside an iframe) the
+        // component default (the global `window`) is wrong: outside-click
+        // handlers of dropdowns/popups listened to the wrong window. See
+        // https://github.com/xdan/jodit/issues/965
+        if (jodit.ow) {
+            this.ownerWindow = jodit.ow;
+        }
         jodit.components.add(this);
         return this;
     }
@@ -15902,9 +16101,14 @@ let UITooltip = UITooltip_1 = class UITooltip extends UIElement {
         this.setMod('above', false);
         this.getElm('content').innerHTML = content;
         const point = getPoint();
+        // The tooltip is `position: fixed`. If it is rendered inside an ancestor
+        // with a `transform` (e.g. an editor placed in a modal/flyout), that
+        // ancestor becomes the containing block, so viewport coordinates must be
+        // shifted by its offset. Returns `{0, 0}` when there is no such ancestor.
+        const offset = getFixedPositionOffset(this.container);
         css(this.container, {
-            left: point.x,
-            top: point.y
+            left: point.x - offset.x,
+            top: point.y - offset.y
         });
         const tooltipPos = position(this.container);
         const viewHeight = this.j.ow.innerHeight;
@@ -15913,7 +16117,7 @@ let UITooltip = UITooltip_1 = class UITooltip extends UIElement {
             const targetPos = position(this.__currentTarget);
             this.setMod('above', true);
             css(this.container, {
-                top: targetPos.top - tooltipPos.height
+                top: targetPos.top - tooltipPos.height - offset.y
             });
         }
     }
@@ -17058,8 +17262,11 @@ class Popup extends UIGroup {
      * Calculate static bound for point
      */
     getKeepBound(getBound) {
+        var _a;
         const oldBound = getBound();
-        const elmUnderCursor = this.od.elementFromPoint(oldBound.left, oldBound.top);
+        // Inside Shadow DOM `document.elementFromPoint` returns the shadow
+        // host, so the lookup must start from the shadow root
+        const elmUnderCursor = ((_a = this.j.o.shadowRoot) !== null && _a !== void 0 ? _a : this.od).elementFromPoint(oldBound.left, oldBound.top);
         if (!elmUnderCursor) {
             return getBound;
         }
@@ -17086,9 +17293,13 @@ class Popup extends UIGroup {
         }
         const [pos, strategy] = this.__calculatePosition(this.__targetBound(), this.viewBound(), position(this.container, this.j));
         this.setMod('strategy', strategy);
+        // The popup is `position: fixed`; shift by the containing-block offset
+        // when it is rendered inside a transformed ancestor (e.g. a modal),
+        // otherwise `{0, 0}` keeps the viewport coordinates unchanged.
+        const offset = getFixedPositionOffset(this.container);
         css(this.container, {
-            left: pos.left,
-            top: pos.top
+            left: pos.left - offset.x,
+            top: pos.top - offset.y
         });
         this.__childrenPopups.forEach(popup => popup.updatePosition());
         return this;
@@ -18691,7 +18902,7 @@ let Dialog = Dialog_1 = class Dialog extends ViewWithToolbar {
             e.stopImmediatePropagation();
         }
         if (this.resizable && this.o.resizable) {
-            this.setSize(this.startPoint.w + e.clientX - this.startX, this.startPoint.h + e.clientY - this.startY);
+            this.setSize(Math.max(this.startPoint.w + e.clientX - this.startX, this.minSize.w), Math.max(this.startPoint.h + e.clientY - this.startY, this.minSize.h));
             if (this.e) {
                 /**
                  * Fired when dialog box is resized
@@ -18718,11 +18929,29 @@ let Dialog = Dialog_1 = class Dialog extends ViewWithToolbar {
         }
     }
     __onResizerMouseDown(e) {
+        var _a, _b, _c;
         this.resizable = true;
         this.startX = e.clientX;
         this.startY = e.clientY;
         this.startPoint.w = this.dialog.offsetWidth;
         this.startPoint.h = this.dialog.offsetHeight;
+        const header = this.getElm('header');
+        const footer = this.getElm('footer');
+        const content = this.getElm('content');
+        // the content area does not shrink below its CSS `min-height`,
+        // so it is part of the smallest height the panel can take
+        const contentMinHeight = content
+            ? parseFloat(this.ow.getComputedStyle(content).minHeight) || 0
+            : 0;
+        this.minSize.w = isNumber(this.o.minWidth)
+            ? this.o.minWidth
+            : Math.max(100, (_a = footer === null || footer === void 0 ? void 0 : footer.scrollWidth) !== null && _a !== void 0 ? _a : 0);
+        this.minSize.h = isNumber(this.o.minHeight)
+            ? this.o.minHeight
+            : ((_b = header === null || header === void 0 ? void 0 : header.offsetHeight) !== null && _b !== void 0 ? _b : 0) +
+                ((_c = footer === null || footer === void 0 ? void 0 : footer.offsetHeight) !== null && _c !== void 0 ? _c : 0) +
+                contentMinHeight +
+                this.resizer.offsetHeight;
         this.lockSelect();
         this.__addGlobalResizeListeners();
         if (this.e) {
@@ -19034,6 +19263,11 @@ let Dialog = Dialog_1 = class Dialog extends ViewWithToolbar {
                 this.setPosition();
             }
         };
+        /**
+         * Minimal size the dialog can be resized to — the header and the footer
+         * (with its buttons) must always stay inside the panel
+         */
+        this.minSize = { w: 0, h: 0 };
         this.isModal = false;
         /**
          * True, if dialog was opened
@@ -20910,12 +21144,17 @@ let ImageEditor = ImageEditor_1 = class ImageEditor extends ViewComponent {
                                     self.j.alert('The name should not be empty');
                                     return false;
                                 }
+                                self.j.e.fire('afterImageEditorSave', data, name);
                                 self.onSave(name, data, self.hide, (e) => {
                                     self.j.alert(e.message);
                                 });
                             });
                             break;
                         case self.buttons.save:
+                            // Notify listeners that a crop/resize was applied,
+                            // passing the action box (action + box dimensions).
+                            // See https://github.com/xdan/jodit/issues/820
+                            self.j.e.fire('afterImageEditorSave', data);
                             self.onSave(undefined, data, self.hide, (e) => {
                                 self.j.alert(e.message);
                             });
@@ -22778,8 +23017,22 @@ class Table extends ViewComponent {
                     }
                     const nextRow = Dom.next(cell.parentNode, elm => Dom.isTag(elm, 'tr'), table);
                     if (nextRow) {
-                        if (box[rowIndex + 1][nextCell]) {
-                            nextRow.insertBefore(cell, box[rowIndex + 1][nextCell]);
+                        // `box[rowIndex + 1][nextCell]` is the cell that
+                        // logically follows the moved cell in the next row, but
+                        // it may physically belong to an earlier `<tr>` (when it
+                        // spans down from a row above). Inserting before such a
+                        // cell throws `NotFoundError`, so look for the first
+                        // following cell that is actually a child of `nextRow`.
+                        let referenceCell = null;
+                        for (let nextColumn = nextCell; nextColumn < box[rowIndex + 1].length; nextColumn += 1) {
+                            const candidate = box[rowIndex + 1][nextColumn];
+                            if (candidate && candidate.parentNode === nextRow) {
+                                referenceCell = candidate;
+                                break;
+                            }
+                        }
+                        if (referenceCell) {
+                            nextRow.insertBefore(cell, referenceCell);
                         }
                         else {
                             nextRow.appendChild(cell);
@@ -23684,13 +23937,38 @@ let ToolbarContent = class ToolbarContent extends UIButton {
     }
     /** @override */
     update() {
-        const content = this.control.getContent(this.j, this);
+        var _a, _b, _c;
+        const { control } = this;
+        const content = control.getContent(this.j, this);
         if (isString(content) || content.parentNode !== this.container) {
             Dom.detach(this.container);
             this.container.appendChild(isString(content) ? this.j.create.fromHTML(content) : content);
         }
+        // Content controls never went through the ToolbarButton status
+        // calculation, so `isDisabled`/`isActive`/`update` declared on the
+        // control were silently ignored (e.g. the FileBrowser Upload button
+        // ignored the backend permissions). See
+        // https://github.com/xdan/jodit/issues/1094
+        this.state.disabled = Boolean((_a = control.isDisabled) === null || _a === void 0 ? void 0 : _a.call(control, this.j, this));
+        this.state.activated = Boolean((_b = control.isActive) === null || _b === void 0 ? void 0 : _b.call(control, this.j, this));
+        (_c = control.update) === null || _c === void 0 ? void 0 : _c.call(control, this.j, this);
+        // The first update() runs before the state watchers are attached, so
+        // apply the calculated state explicitly (the calls are idempotent)
+        this.onChangeDisabled();
+        this.onChangeActivated();
         super.update();
     }
+    /**
+     * The content is arbitrary HTML — propagate the disabled state to the
+     * nested form controls (e.g. the file input of the Upload button),
+     * otherwise they stay interactive.
+     */
+    onChangeDisabled() {
+        super.onChangeDisabled();
+        this.container
+            .querySelectorAll('input,button,select,textarea')
+            .forEach(elm => attr(elm, 'disabled', this.state.disabled || null));
+    }
     /** @override */
     createContainer() {
         return this.j.c.span(this.componentName);
@@ -24129,6 +24407,15 @@ function sendFiles(uploader, files, handlerSuccess, handlerError, process) {
     if (!fileList.length) {
         return Promise.reject(error('Need files'));
     }
+    // Client-side validation hook — returning `false` aborts the upload.
+    // See https://github.com/xdan/jodit/issues/1329
+    if (isFunction(o.beforeUpload)) {
+        if (o.beforeUpload.call(uploader, fileList) === false) {
+            const err = error('Upload canceled');
+            (handlerError || o.defaultHandlerError).call(uploader, err);
+            return Promise.reject(err);
+        }
+    }
     const promises = [];
     if (o.insertImageAsBase64URI) {
         readImagesWithReader(fileList, o.imagesExtensions, promises, uploader, handlerSuccess, o.defaultHandlerSuccess);
@@ -24248,7 +24535,17 @@ Config.prototype.enableDragAndDropFileToEditor = true;
 Config.prototype.uploader = {
     url: '',
     insertImageAsBase64URI: false,
-    imagesExtensions: ['jpg', 'png', 'jpeg', 'gif'],
+    imagesExtensions: [
+        'jpg',
+        'jpeg',
+        'png',
+        'gif',
+        'webp',
+        'bmp',
+        'svg',
+        'tiff',
+        'avif'
+    ],
     headers: null,
     data: null,
     filesVariableName(i) {
@@ -25030,12 +25327,19 @@ function getShadowRoot(jodit) {
  * `strong -> fontWeight 700`
  */
 function getNativeCSSValue(jodit, elm, key) {
+    const root = getShadowRoot(jodit);
+    // Reproduce the editor's inherited text color inside the isolated probe so
+    // that a value equal to the editor's *effective* default (not only the
+    // browser default black) is recognised. Without this, applying black after
+    // the default font color was changed was wrongly treated as a no-op (#1311).
+    const wrapper = jodit.create.element('div');
+    wrapper.style.color = css(jodit.editor, 'color');
     const newElm = jodit.create.element(elm.tagName.toLowerCase());
     newElm.style.cssText = elm.style.cssText;
-    const root = getShadowRoot(jodit);
-    root.appendChild(newElm);
+    wrapper.appendChild(newElm);
+    root.appendChild(wrapper);
     const result = css(newElm, key);
-    Dom.safeRemove(newElm);
+    Dom.safeRemove(wrapper);
     return result;
 }
 
@@ -25249,9 +25553,23 @@ function wrapUnwrappedText(style, elm, jodit) {
  */
 function wrap(commitStyle, font, jodit) {
     const wrapper = findOrCreateWrapper(commitStyle, font, jodit);
-    return commitStyle.elementIsList
-        ? wrapList(commitStyle, wrapper, jodit)
-        : Dom.replace(wrapper, commitStyle.element, jodit.createInside, true);
+    if (commitStyle.elementIsList) {
+        return wrapList(commitStyle, wrapper, jodit);
+    }
+    const newWrapper = Dom.replace(wrapper, commitStyle.element, jodit.createInside, true);
+    if (commitStyle.elementIsBlock) {
+        // Inline font styles left over from pasted content visually override
+        // the new block format — e.g. an h2 with `font-weight: normal;
+        // font-size: 24px` does not look like a heading at all, so the
+        // command seems to do nothing. See
+        // https://github.com/xdan/jodit/issues/1063
+        css(newWrapper, 'fontSize', null);
+        css(newWrapper, 'fontWeight', null);
+        if (!attr(newWrapper, 'style')) {
+            attr(newWrapper, 'style', null);
+        }
+    }
+    return newWrapper;
 }
 const WRAP_NODES = new Set([
     'td',
@@ -27932,6 +28250,18 @@ let Jodit$1 = Jodit_1 = class Jodit extends ViewWithToolbar {
                 (opt.uploader.url || opt.uploader.insertImageAsBase64URI)) {
                 this.uploader.bind(this.editor);
             }
+            else if (!opt.enableDragAndDropFileToEditor) {
+                // Without a bound uploader nobody cancels a file drop, and
+                // Firefox inserts the dropped image natively — the option
+                // must mean "do nothing". See
+                // https://github.com/xdan/jodit/issues/1077
+                this.e.on(editor, 'drop', (e) => {
+                    var _a, _b;
+                    if ((_b = (_a = e.dataTransfer) === null || _a === void 0 ? void 0 : _a.files) === null || _b === void 0 ? void 0 : _b.length) {
+                        e.preventDefault();
+                    }
+                });
+            }
             // in initEditor - the editor could change
             if (!this.__elementToPlace.get(this.editor)) {
                 this.__elementToPlace.set(this.editor, currentPlace);
@@ -28069,6 +28399,26 @@ let Jodit$1 = Jodit_1 = class Jodit extends ViewWithToolbar {
                 }
                 this.synchronizeValues();
             }
+        })
+            .on(this.ow, 'mouseup', (event) => {
+            if (this.o.readonly || this.__isSilentChange) {
+                return;
+            }
+            // When a selection is started inside the editor and the
+            // mouse button is released outside of it, the editable
+            // area never receives the `mouseup` event, so the toolbar
+            // state (active buttons) is not recalculated. Re-fire the
+            // event manually for that case while the selection still
+            // belongs to the editor. See #1251
+            const target = event.target;
+            const insideEditor = Boolean(target &&
+                isNumber(target.nodeType) &&
+                editor.contains(target));
+            if (insideEditor || !this.s.isInsideArea) {
+                return;
+            }
+            this.e.fire('changeSelection');
+            this.synchronizeValues();
         });
     }
     fetch(url, options) {
@@ -32562,7 +32912,7 @@ var tr = {
 	'Insert as Text': 'Yazı olarak ekle',
 	'Word Paste Detected': 'Word biçiminde yapıştırma algılandı',
 	'The pasted content is coming from a Microsoft Word/Excel document. Do you want to keep the format or clean it up?':
-		'Der Inhalt, den Sie einfügen, stammt aus einem Microsoft Word / Excel-Dokument. Möchten Sie das Format erhalten oder löschen?',
+		'Yapıştırılan içerik bir Microsoft Word/Excel belgesinden geliyor. Formatı korumak mı yoksa temizlemek mi istiyorsunuz?',
 	'Insert only Text': 'Sadece yazıyı ekle',
 	'File Browser': 'Dosya Listeleyici',
 	'Error on load list': 'Liste yüklenirken hata oluştu',
@@ -33581,15 +33931,37 @@ function checkJoinNeighbors(jodit, fakeNode, backspace) {
     if (Dom.isElement(mainClosestBox) &&
         Dom.isContentEditable(mainClosestBox, jodit.editor)) {
         const sibling = Dom.findNotEmptySibling(mainClosestBox, backspace);
+        // A line break before the cursor is a single unit: remove it instead of
+        // merging the current element into the (void) `<br>`, which used to move
+        // the whole element's content into the `<br>` and delete it (#1282).
+        if (Dom.isTag(sibling, 'br')) {
+            Dom.safeRemove(sibling);
+            jodit.s.setCursorBefore(fakeNode);
+            return true;
+        }
         if (sibling &&
             (checkMoveListContent(jodit, mainClosestBox, sibling, backspace) ||
-                moveContentAndRemoveEmpty(jodit, mainClosestBox, sibling, backspace))) {
+                moveContentAndRemoveEmpty(jodit, mainClosestBox, resolveTableSibling(sibling, backspace), backspace))) {
             jodit.s.setCursorBefore(fakeNode);
             return true;
         }
     }
     return false;
 }
+/**
+ * Content cannot be merged into the `<table>` element itself — it would land
+ * between the table sections (after `</tbody>`), which is invalid HTML and
+ * gets foster-parented out of the table on the next parse. Merge into the
+ * edge cell instead. See https://github.com/xdan/jodit/issues/1064
+ * @private
+ */
+function resolveTableSibling(sibling, backspace) {
+    if (!Dom.isTag(sibling, 'table')) {
+        return sibling;
+    }
+    const cells = sibling.querySelectorAll('td,th');
+    return cells.length ? cells[backspace ? cells.length - 1 : 0] : null;
+}
 function checkMoveListContent(jodit, mainClosestBox, sibling, backspace) {
     // Process UL/LI/OL cases
     const siblingIsList = Dom.isTag(sibling, LIST_TAGS);
@@ -33735,6 +34107,14 @@ function getNextInlineSibling(sibling, backspace, root) {
     let nextSibling = Dom.sibling(sibling, backspace);
     if (!nextSibling && sibling.parentNode && sibling.parentNode !== root) {
         nextSibling = findMostNestedNeighbor(sibling, !backspace, root, true);
+        // Do not cross a list-item boundary. At the start of a list item the
+        // neighbor can be the text of the parent/previous item; deleting a char
+        // there is wrong — the list cases must handle the outdent/merge (#1277).
+        if (nextSibling &&
+            Dom.closest(sibling, 'li', root) !==
+                Dom.closest(nextSibling, 'li', root)) {
+            return null;
+        }
     }
     return nextSibling;
 }
@@ -34036,21 +34416,21 @@ function checkUnwrapFirstListItem(jodit, fakeNode, backspace) {
  * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
  */
 /**
- * @module plugins/backspace
- */
-/**
+ * Ordered delete/backspace cases with stable keys. The first one returning
+ * `true` wins. The keys are stable across minified builds (function names are
+ * mangled by terser) so they can be referenced by `delete.disableCases`.
  * @private
  */
-const cases = [
-    checkRemoveUnbreakableElement,
-    checkRemoveContentNotEditable,
-    checkRemoveChar,
-    checkTableCell,
-    checkRemoveEmptyParent,
-    checkRemoveEmptyNeighbor,
-    checkJoinTwoLists,
-    checkJoinNeighbors,
-    checkUnwrapFirstListItem
+const casesMap = [
+    ['remove-unbreakable', checkRemoveUnbreakableElement],
+    ['remove-not-editable', checkRemoveContentNotEditable],
+    ['remove-char', checkRemoveChar],
+    ['table-cell', checkTableCell],
+    ['remove-empty-parent', checkRemoveEmptyParent],
+    ['remove-empty-neighbor', checkRemoveEmptyNeighbor],
+    ['join-two-lists', checkJoinTwoLists],
+    ['join-neighbors', checkJoinNeighbors],
+    ['unwrap-first-list-item', checkUnwrapFirstListItem]
 ];
 
 /*!
@@ -34117,7 +34497,11 @@ class backspace extends Plugin {
                 return false;
             }
             moveNodeInsideStart(jodit, fakeNode, backspace);
-            if (cases.some((func) => {
+            const disabled = jodit.o.delete.disableCases;
+            if (casesMap.some(([key, func]) => {
+                if (disabled && disabled.has(key)) {
+                    return;
+                }
                 if (isFunction(func) &&
                     func(jodit, fakeNode, backspace, mode)) {
                     return true;
@@ -34800,8 +35184,9 @@ Config.prototype.controls.brush = {
         const update = (key, value) => {
             if (value && value !== css(editor.editor, key).toString()) {
                 button.state.icon.fill = value;
-                return;
+                return true;
             }
+            return false;
         };
         if (color) {
             const mode = dataBind(button, 'color');
@@ -34811,8 +35196,16 @@ Config.prototype.controls.brush = {
         const current = editor.s.current();
         if (current && !button.state.disabled) {
             const currentBpx = Dom.closest(current, Dom.isElement, editor.editor) || editor.editor;
-            update('color', css(currentBpx, 'color').toString());
-            update('background-color', css(currentBpx, 'background-color').toString());
+            // The icon's fill mirrors the current text/background color so the
+            // button reflects the formatting under the caret. Both calls run so
+            // that a background color (the second call) wins over the text color
+            // when both are set. Keep the computed fill instead of resetting it
+            // below. See #195, #182
+            const hasColor = update('color', css(currentBpx, 'color').toString());
+            const hasBackground = update('background-color', css(currentBpx, 'background-color').toString());
+            if (hasColor || hasBackground) {
+                return;
+            }
         }
         button.state.icon.fill = '';
         button.state.activated = false;
@@ -34915,28 +35308,28 @@ function color(editor) {
         group: 'color'
     });
     const callback = (command, second, third) => {
+        var _a;
         const colorHEX = normalizeColor(third);
-        switch (command) {
-            case 'background':
-                editor.s.commitStyle({
-                    attributes: {
-                        style: {
-                            backgroundColor: !colorHEX
-                                ? ''
-                                : colorHEX
-                        }
-                    }
-                });
-                break;
-            case 'forecolor':
-                editor.s.commitStyle({
-                    attributes: {
-                        style: {
-                            color: !colorHEX ? '' : colorHEX
-                        }
-                    }
-                });
-                break;
+        const value = !colorHEX ? '' : colorHEX;
+        const style = command === 'background'
+            ? { backgroundColor: value }
+            : { color: value };
+        // Cells selected with the `select-cells` plugin drop or collapse the
+        // native range, so `commitStyle` would paint a pending caret format
+        // outside the table instead of the selection the user sees. Apply the
+        // style to the content of every selected cell instead. See #1250
+        const selectedCells = editor
+            .getInstance('Table', editor.o)
+            .getAllSelectedCells();
+        if (selectedCells.length && editor.s.isCollapsed()) {
+            selectedCells.forEach(cell => {
+                editor.s.select(cell, true);
+                editor.s.commitStyle({ attributes: { style } });
+            });
+            (_a = editor.s.sel) === null || _a === void 0 ? void 0 : _a.removeAllRanges();
+        }
+        else {
+            editor.s.commitStyle({ attributes: { style } });
         }
         editor.synchronizeValues();
         return false;
@@ -35238,12 +35631,17 @@ class enter extends Plugin {
             if (beforeEnter !== undefined) {
                 return beforeEnter;
             }
-            if (!editor.s.isCollapsed()) {
-                editor.execCommand('Delete');
-            }
-            editor.s.focus();
-            this.onEnter(event);
-            editor.e.fire('afterEnter', event);
+            // Delete-of-selection + new block must be a single history step,
+            // otherwise pressing Enter over a selection needs two Ctrl+Z to undo
+            // (the first only reverts to the intermediate empty state). #1292
+            editor.history.snapshot.transaction(() => {
+                if (!editor.s.isCollapsed()) {
+                    editor.execCommand('Delete');
+                }
+                editor.s.focus();
+                this.onEnter(event);
+                editor.e.fire('afterEnter', event);
+            });
             editor.synchronizeValues(); // fire change
             return false;
         }
@@ -35413,6 +35811,25 @@ Config.prototype.controls.font = {
                 .replace(/[^a-z0-9-]+/g, ',');
         }
     },
+    // When no font is explicitly set, the computed font-family equals the
+    // editor's own default (e.g. `-apple-system, …`). Return '' so the
+    // button shows the `Default` list entry instead of that raw stack.
+    // See #1370
+    value: (editor) => {
+        const current = editor.s.current();
+        if (!current) {
+            return;
+        }
+        const box = Dom.closest(current, Dom.isElement, editor.editor);
+        if (!box) {
+            return;
+        }
+        const value = css(box, 'font-family').toString();
+        if (value === css(editor.editor, 'font-family').toString()) {
+            return '';
+        }
+        return value;
+    },
     tooltip: 'Font family'
 };
 
@@ -35549,7 +35966,7 @@ pluginSystem.add('formatBlock', formatBlock);
 Config.prototype.commandToHotkeys = {
     removeFormat: ['ctrl+shift+m', 'cmd+shift+m'],
     insertOrderedList: ['ctrl+shift+7', 'cmd+shift+7'],
-    insertUnorderedList: ['ctrl+shift+8, cmd+shift+8'],
+    insertUnorderedList: ['ctrl+shift+8', 'cmd+shift+8'],
     selectall: ['ctrl+a', 'cmd+a']
 };
 
@@ -36014,13 +36431,15 @@ pluginSystem.add('image', image);
  * Released under MIT see LICENSE.txt in the project root for license information.
  * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
  */
+const isSafeHref = (href) => /^(https?:|mailto:|tel:)/i.test(href.trim()) &&
+    !/^(javascript:|data:|vbscript:)/i.test(href.trim());
 var a = [
     {
         name: 'eye',
         tooltip: 'Open link',
         exec: (editor, current) => {
             const href = attr(current, 'href');
-            if (current && href) {
+            if (current && href && isSafeHref(href)) {
                 editor.ow.open(href);
             }
         }
@@ -36347,6 +36766,12 @@ class inlinePopup extends Plugin {
     constructor() {
         super(...arguments);
         this.type = null;
+        /**
+         * The user pressed a button inside the selection toolbar — after the
+         * command fires `closeAllPopups`, the toolbar should be shown again
+         * while the selection is still there. See #1238
+         */
+        this.__reopenSelectionPopup = false;
         this.snapRange = null;
         this.elmsList = keys$2(this.j.o.popup, false).filter(s => !this.isExcludedTarget(s));
     }
@@ -36462,9 +36887,52 @@ class inlinePopup extends Plugin {
                 this.previousTarget = undefined;
             }
         })
-            .on([this.j.ew, this.j.ow], 'mouseup keyup', this.onSelectionEnd);
+            .on([this.j.ew, this.j.ow], 'mouseup keyup', this.onSelectionEnd)
+            .on([this.j.ew, this.j.ow], 'mousedown touchstart', this.__onDocumentMouseDown)
+            .on('closeAllPopups', this.__onCloseAllPopups);
         this.addListenersForElements();
     }
+    __onDocumentMouseDown(e) {
+        if (this.popup.isOpened &&
+            this.type === 'selection' &&
+            e.target &&
+            UIElement.closestElement(e.target, Popup)) {
+            this.__reopenSelectionPopup = true;
+        }
+    }
+    __onCloseAllPopups() {
+        if (!this.__reopenSelectionPopup) {
+            return;
+        }
+        this.__reopenSelectionPopup = false;
+        if (!this.j.o.toolbarInlineForSelection) {
+            return;
+        }
+        // a zero timeout would run synchronously — before the popup's own
+        // `closeAllPopups` handler closes it; defer to the next macrotask
+        this.j.async.setTimeout(() => {
+            const sel = this.j.s.sel;
+            if (sel && !sel.isCollapsed) {
+                this.showPopup(() => this.__selectionBound(), 'selection');
+            }
+        }, 1);
+    }
+    /**
+     * The selection rect comes from the editor document — in iframe mode its
+     * coordinates are iframe-local, while the popup lives in the host
+     * document, so the iframe offset must be added. See
+     * https://github.com/xdan/jodit/issues/1058
+     */
+    __selectionBound() {
+        const rect = this.j.s.range.getBoundingClientRect();
+        let { left, top } = rect;
+        if (this.j.iframe) {
+            const offset = position(this.j.iframe, this.j, true);
+            left += offset.left;
+            top += offset.top;
+        }
+        return { left, top, width: rect.width, height: rect.height };
+    }
     onSelectionStart() {
         this.snapRange = this.j.s.range.cloneRange();
     }
@@ -36504,7 +36972,7 @@ class inlinePopup extends Plugin {
         if (!node) {
             return;
         }
-        this.showPopup(() => range.getBoundingClientRect(), type);
+        this.showPopup(() => this.__selectionBound(), type);
     }
     /**
      * In not collapsed selection - only one image
@@ -36526,7 +36994,9 @@ class inlinePopup extends Plugin {
     beforeDestruct(jodit) {
         jodit.e
             .off('showPopup')
-            .off([this.j.ew, this.j.ow], 'mouseup keyup', this.onSelectionEnd);
+            .off([this.j.ew, this.j.ow], 'mouseup keyup', this.onSelectionEnd)
+            .off([this.j.ew, this.j.ow], 'mousedown touchstart', this.__onDocumentMouseDown)
+            .off('closeAllPopups', this.__onCloseAllPopups);
         this.removeListenersForElements();
     }
     _eventsList() {
@@ -36575,6 +37045,12 @@ __decorate$c([
 __decorate$c([
     watch(':outsideClick')
 ], inlinePopup.prototype, "onOutsideClick", null);
+__decorate$c([
+    autobind
+], inlinePopup.prototype, "__onDocumentMouseDown", null);
+__decorate$c([
+    autobind
+], inlinePopup.prototype, "__onCloseAllPopups", null);
 __decorate$c([
     autobind
 ], inlinePopup.prototype, "onSelectionStart", null);
@@ -36599,7 +37075,7 @@ var unlinkIcon = "<svg xmlns='http://www.w3.org/2000/svg' viewBox=\"0 0 1792 179
  * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
  */
 const formTemplate = (editor) => {
-    const { openInNewTabCheckbox, noFollowCheckbox, modeClassName, selectSizeClassName, selectMultipleClassName, selectOptionsClassName } = editor.o.link;
+    const { openInNewTabCheckbox, noFollowCheckbox, ariaLabelInput, modeClassName, selectSizeClassName, selectMultipleClassName, selectOptionsClassName } = editor.o.link;
     return new UIForm(editor, [
         new UIBlock(editor, [
             new UIInput(editor, {
@@ -36611,6 +37087,15 @@ const formTemplate = (editor) => {
                 required: true
             })
         ]),
+        ariaLabelInput
+            ? new UIBlock(editor, [
+                new UIInput(editor, {
+                    name: 'ariaLabel',
+                    ref: 'aria_label_input',
+                    label: 'Aria label'
+                })
+            ])
+            : null,
         new UIBlock(editor, [
             new UIInput(editor, {
                 name: 'content',
@@ -36689,6 +37174,7 @@ Config.prototype.link = {
     noFollowCheckbox: true,
     openInNewTabCheckbox: true,
     openInNewTabCheckboxDefaultChecked: false,
+    ariaLabelInput: false,
     modeClassName: 'input',
     selectMultipleClassName: true,
     preventReadOnlyNavigation: true,
@@ -36837,7 +37323,7 @@ class link extends Plugin {
         const currentElement = current;
         const isImageContent = Dom.isImage(currentElement);
         let { content_input } = elements;
-        const { className_input } = elements, { className_select } = elements;
+        const { className_input } = elements, { className_select } = elements, { aria_label_input } = elements;
         if (!content_input) {
             content_input = jodit.c.element('input', {
                 type: 'hidden',
@@ -36863,6 +37349,9 @@ class link extends Plugin {
         if (!isImageContent && current) {
             content_input.value = getSelectionText();
         }
+        if (aria_label_input) {
+            aria_label_input.value = link ? attr(link, 'aria-label') || '' : '';
+        }
         if (link) {
             url_input.value = attr(link, 'href') || '';
             if (modeClassName) {
@@ -36953,6 +37442,10 @@ class link extends Plugin {
                     }
                     attr(a, 'rel', relParts.length ? relParts.join(' ') : null);
                 }
+                if (aria_label_input) {
+                    const ariaLabel = aria_label_input.value.trim();
+                    attr(a, 'aria-label', ariaLabel || null);
+                }
                 jodit.e.fire('applyLink', jodit, a, form);
             });
             jodit.synchronizeValues();
@@ -38141,6 +38634,12 @@ function removeExtraBr(jodit, node) {
         if (!Dom.isTag(br, 'br')) {
             return;
         }
+        // Only a trailing `<br>` is "extra". If meaningful content follows it,
+        // the `<br>` is a real line break and removing it would merge two lines
+        // (e.g. toggling a style on an empty line), so keep it (#1302).
+        if (Dom.findNotEmptySibling(br, false)) {
+            return;
+        }
         jodit.s.setCursorBefore(br);
         Dom.safeRemove(br);
     }
@@ -38408,6 +38907,68 @@ class select extends Plugin {
         s.expandSelection();
         return false;
     }
+    /**
+     * Fix caret position when clicking to the right of a list item that has a
+     * nested list. Blink/WebKit place the caret at the start of the line instead
+     * of the end (#1296); move it to the end of the item's own text.
+     */
+    onClickRightOfNestedListItem(e) {
+        const { s } = this.j;
+        const range = s.range;
+        if (!range.collapsed ||
+            range.startOffset !== 0 ||
+            !Dom.isText(range.startContainer)) {
+            return;
+        }
+        const text = range.startContainer;
+        const li = text.parentNode;
+        // The text must be the direct content of a list item that has a nested
+        // list (the last level has no nested list and behaves correctly).
+        if (!Dom.isTag(li, 'li') ||
+            !(li.querySelector('ul') || li.querySelector('ol'))) {
+            return;
+        }
+        const measure = this.j.ed.createRange();
+        measure.selectNodeContents(text);
+        const rect = measure.getBoundingClientRect();
+        // Only when the click happened to the right of the text.
+        if (e.clientX > rect.right) {
+            s.setCursorAfter(text);
+        }
+    }
+    /**
+     * Keep pending inline formatting after a click. Toggling Bold/Italic/etc. on
+     * a collapsed cursor leaves empty marker elements with the caret inside; a
+     * click puts the caret right before them (outside), so they get cleaned up
+     * and the formatting is lost. Move the caret back into the innermost marker
+     * so the next typed character keeps every pending format (#1291).
+     */
+    onClickKeepPendingFormat() {
+        var _a, _b;
+        const { s } = this.j;
+        const range = s.range;
+        if (!range.collapsed || !Dom.isText(range.startContainer)) {
+            return;
+        }
+        const text = range.startContainer;
+        // Caret must sit at the very end of the text, right before the markers.
+        if (range.startOffset !== ((_b = (_a = text.nodeValue) === null || _a === void 0 ? void 0 : _a.length) !== null && _b !== void 0 ? _b : 0)) {
+            return;
+        }
+        const marker = text.nextSibling;
+        if (!Dom.isElement(marker) ||
+            !marker.nodeName.match(IS_INLINE) ||
+            !Dom.isEmpty(marker)) {
+            return;
+        }
+        let inner = marker;
+        // Descend into the innermost empty formatting marker.
+        while (Dom.isElement(inner.firstElementChild) &&
+            inner.firstElementChild.nodeName.match(IS_INLINE)) {
+            inner = inner.firstElementChild;
+        }
+        s.setCursorIn(inner);
+    }
     /**
      * Normalize selection after triple click
      */
@@ -38448,6 +39009,12 @@ __decorate$5([
 __decorate$5([
     watch([':beforeCommandSelectall'])
 ], select.prototype, "beforeCommandSelectAll", null);
+__decorate$5([
+    watch([':click'])
+], select.prototype, "onClickRightOfNestedListItem", null);
+__decorate$5([
+    watch([':click'])
+], select.prototype, "onClickKeepPendingFormat", null);
 __decorate$5([
     watch([':click'])
 ], select.prototype, "onTripleClickNormalizeSelection", null);
@@ -38667,7 +39234,11 @@ class resizer extends Plugin {
             this.pointerX = e.clientX;
             this.pointerY = e.clientY;
             let diff_x, diff_y;
-            if (this.j.options.iframe) {
+            if (this.j.options.iframe && e.view === this.j.ew) {
+                // the event was proxied from the editor's iframe — its client
+                // coordinates are relative to the iframe viewport, while
+                // `startX/startY` were captured on a host-document handle;
+                // shift them into the host coordinate space
                 const workplacePosition = this.getWorkplacePosition();
                 diff_x = e.clientX + workplacePosition.left - this.startX;
                 diff_y = e.clientY + workplacePosition.top - this.startY;
@@ -39007,15 +39578,42 @@ class selectCells extends Plugin {
     /**
      * Mouse click inside the table
      */
-    onStartSelection(cell) {
+    onStartSelection(cell, event) {
+        var _a;
         if (this.j.o.readonly) {
             return;
         }
+        const table = Dom.closest(cell, 'table', this.j.editor);
+        // Ctrl/Cmd + click toggles a single cell into the existing selection
+        // instead of resetting it — non-contiguous multi-cell selection.
+        // See https://github.com/xdan/jodit/issues/1163
+        if (((event === null || event === void 0 ? void 0 : event.ctrlKey) || (event === null || event === void 0 ? void 0 : event.metaKey)) &&
+            cell !== this.j.editor &&
+            table &&
+            Dom.isCell(cell)) {
+            if (this.__tableModule.getAllSelectedCells().includes(cell)) {
+                this.__tableModule.removeSelection(cell);
+            }
+            else {
+                if (!cell.firstChild) {
+                    cell.appendChild(this.j.createInside.element('br'));
+                }
+                this.__tableModule.addSelection(cell);
+            }
+            this.__selectedCell = cell;
+            (_a = this.j.s.sel) === null || _a === void 0 ? void 0 : _a.removeAllRanges();
+            if (this.__tableModule.getAllSelectedCells().length) {
+                this.j.e.fire('showPopup', table, () => position(cell, this.j), 'cells');
+            }
+            else {
+                this.j.e.fire('hidePopup', 'cells');
+            }
+            return false;
+        }
         this.unselectCells();
         if (cell === this.j.editor) {
             return;
         }
-        const table = Dom.closest(cell, 'table', this.j.editor);
         if (!cell || !table) {
             return;
         }
@@ -39048,14 +39646,16 @@ class selectCells extends Plugin {
      * Mouse move inside the table
      */
     __onMove(table, e) {
-        var _a;
+        var _a, _b;
         if (this.j.o.readonly && !this.j.isLocked) {
             return;
         }
         if (this.j.isLockedNotBy(key$1)) {
             return;
         }
-        const node = this.j.ed.elementFromPoint(e.clientX, e.clientY);
+        // Inside Shadow DOM `document.elementFromPoint` returns the shadow
+        // host, so the lookup must start from the shadow root
+        const node = ((_a = this.j.o.shadowRoot) !== null && _a !== void 0 ? _a : this.j.ed).elementFromPoint(e.clientX, e.clientY);
         if (!node) {
             return;
         }
@@ -39078,7 +39678,7 @@ class selectCells extends Plugin {
         }
         const cellsCount = this.__tableModule.getAllSelectedCells().length;
         if (cellsCount > 1) {
-            (_a = this.j.s.sel) === null || _a === void 0 ? void 0 : _a.removeAllRanges();
+            (_b = this.j.s.sel) === null || _b === void 0 ? void 0 : _b.removeAllRanges();
         }
         this.j.e.fire('hidePopup');
         e.stopPropagation();
@@ -39112,12 +39712,15 @@ class selectCells extends Plugin {
      * Stop a selection process
      */
     __onStopSelection(table, e) {
+        var _a, _b, _c;
         if (!this.__selectedCell) {
             return;
         }
         this.__isSelectionMode = false;
         this.j.unlock();
-        const node = this.j.ed.elementFromPoint(e.clientX, e.clientY);
+        // Inside Shadow DOM `document.elementFromPoint` returns the shadow
+        // host, so the lookup must start from the shadow root
+        const node = ((_a = this.j.o.shadowRoot) !== null && _a !== void 0 ? _a : this.j.ed).elementFromPoint(e.clientX, e.clientY);
         if (!node) {
             return;
         }
@@ -39133,7 +39736,16 @@ class selectCells extends Plugin {
             cell,
             this.__selectedCell
         ]), box = this.__tableModule.formalMatrix(table);
-        const max = box[bound[1][0]][bound[1][1]], min = box[bound[0][0]][bound[0][1]];
+        const max = (_b = box[bound[1][0]]) === null || _b === void 0 ? void 0 : _b[bound[1][1]], min = (_c = box[bound[0][0]]) === null || _c === void 0 ? void 0 : _c[bound[0][1]];
+        // `getSelectedBound` keeps its `Infinity` sentinel when none of the
+        // selected cells belong to this table's matrix — e.g. after a
+        // drag-and-drop that moved/removed the cells, leaving a stale anchor and
+        // a drop target outside the table. Bail out instead of dereferencing an
+        // out-of-range matrix slot (which threw `Cannot read properties of
+        // undefined`).
+        if (!min || !max) {
+            return;
+        }
         this.j.e.fire('showPopup', table, () => {
             const minOffset = position(min, this.j), maxOffset = position(max, this.j);
             return {
@@ -39166,6 +39778,21 @@ class selectCells extends Plugin {
      * Execute custom commands for table
      */
     onExecCommand(command) {
+        // When several cells are selected, Backspace/Delete must clear the
+        // selected cells instead of running the normal delete (whose collapsed
+        // document-level range threw `insertNode ... #document`). See #1273.
+        if (/^(delete|backspace)(word|sentence)?button$/.test(command) &&
+            this.__tableModule.getAllSelectedCells().length > 1) {
+            const cells = this.__tableModule.getAllSelectedCells();
+            cells.forEach(td => {
+                Dom.detach(td);
+                td.appendChild(this.j.createInside.element('br'));
+            });
+            this.unselectCells();
+            this.j.s.setCursorIn(cells[0]);
+            this.j.synchronizeValues();
+            return false;
+        }
         if (/table(splitv|splitg|merge|empty|bin|binrow|bincolumn|addcolumn|addrow)/.test(command)) {
             command = command.replace('table', '');
             const cells = this.__tableModule.getAllSelectedCells();
@@ -39712,6 +40339,7 @@ Config.prototype.cleanHTML = {
     timeout: 300,
     removeEmptyElements: true,
     fillEmptyParagraph: true,
+    collapseEmptyValueToEmptyString: false,
     replaceNBSP: true,
     replaceOldTags: {
         i: 'em',
@@ -39887,12 +40515,19 @@ function removeFormatForSelection(jodit) {
  * @private
  */
 function allowAttributes(jodit, nodeElm, hadEffect, allow) {
-    if (allow && Dom.isElement(nodeElm) && allow[nodeElm.nodeName] !== true) {
+    const allowedForTag = allow && Dom.isElement(nodeElm) && allow[nodeElm.nodeName];
+    if (allow && Dom.isElement(nodeElm) && allowedForTag !== true) {
+        // the tag is not in the allow list at all — attributes do not matter,
+        // the element itself will be removed by the tags filter. Without this
+        // check `allow[nodeName][attr]` threw on e.g. `<meta charset>`. See #1224
+        if (!allowedForTag) {
+            return hadEffect;
+        }
         const attrs = nodeElm.attributes;
         if (attrs && attrs.length) {
             const removeAttrs = [];
             for (let i = 0; i < attrs.length; i += 1) {
-                const attr = allow[nodeElm.nodeName][attrs[i].name];
+                const attr = allowedForTag[attrs[i].name];
                 if (!attr || (attr !== true && attr !== attrs[i].value)) {
                     removeAttrs.push(attrs[i].name);
                 }
@@ -40230,11 +40865,18 @@ function isRemovableNode(jodit, node, current, allow, deny) {
     if (!jodit.o.cleanHTML.removeEmptyElements) {
         return false;
     }
+    // Never drop an empty inline element that currently holds the caret — it is
+    // a pending-format marker the user is about to type into (#1291). `current`
+    // is captured before a click moves the caret, so also check the live caret.
+    const liveCaret = jodit.s.isCollapsed()
+        ? jodit.s.range.startContainer
+        : null;
     return (Dom.isElement(node) &&
         node.nodeName.match(IS_INLINE) != null &&
         !Dom.isTemporary(node) &&
         trimInv(node.innerHTML).length === 0 &&
-        (current == null || !Dom.isOrContains(node, current)));
+        (current == null || !Dom.isOrContains(node, current)) &&
+        (liveCaret == null || !Dom.isOrContains(node, liveCaret)));
 }
 
 /*!
@@ -40369,14 +41011,33 @@ class cleanHtml extends Plugin {
     onBeforeSetNativeEditorValue(data) {
         const [sandBox, iframe] = this.j.o.cleanHTML.useIframeSandbox
             ? this.j.createInside.sandbox()
-            : [this.j.createInside.div()];
+            : [
+                // an inert document never loads sub-resources, so the
+                // images in the value are not re-requested from the
+                // server on every assignment (e.g. on each change in
+                // jodit-react). See #1237
+                this.j.od.implementation.createHTMLDocument('').body
+            ];
         sandBox.innerHTML = data.value;
-        this.onSafeHTML(sandBox);
+        this.j.e.fire('safeHTML', sandBox);
         data.value = sandBox.innerHTML;
         safeHTML(sandBox, { safeJavaScriptLink: true, removeOnError: true });
         Dom.safeRemove(iframe);
         return false;
     }
+    /**
+     * Collapse a value that holds only a single empty block (e.g.
+     * `<p><br></p>` left after deleting all content) to an empty string —
+     * opt-in via `cleanHTML.collapseEmptyValueToEmptyString`. See #1149
+     */
+    onAfterGetValueFromEditor(data) {
+        if (!this.j.o.cleanHTML.collapseEmptyValueToEmptyString) {
+            return;
+        }
+        if (/^<([a-z][a-z0-9]*)\b[^>]*>(?:<br\/?>)?<\/\1>$/i.test(data.value.trim())) {
+            data.value = '';
+        }
+    }
     onSafeHTML(sandBox) {
         const sanitizer = this.j.o.cleanHTML.sanitizer;
         if (sanitizer) {
@@ -40401,6 +41062,9 @@ __decorate$1([
 __decorate$1([
     watch(':beforeSetNativeEditorValue')
 ], cleanHtml.prototype, "onBeforeSetNativeEditorValue", null);
+__decorate$1([
+    watch(':afterGetValueFromEditor')
+], cleanHtml.prototype, "onAfterGetValueFromEditor", null);
 __decorate$1([
     watch(':safeHTML')
 ], cleanHtml.prototype, "onSafeHTML", null);
@@ -40651,7 +41315,7 @@ Config.prototype.sourceEditorNativeOptions = {
     highlightActiveLine: true
 };
 Config.prototype.sourceEditorCDNUrlsJS = [
-    'https://cdnjs.cloudflare.com/ajax/libs/ace/1.4.2/ace.js'
+    'https://cdnjs.cloudflare.com/ajax/libs/ace/1.43.3/ace.js'
 ];
 Config.prototype.beautifyHTMLCDNUrlsJS = [
     'https://cdnjs.cloudflare.com/ajax/libs/js-beautify/1.14.4/beautify.min.js',
@@ -41173,6 +41837,15 @@ class source extends Plugin {
     }
     setFocusToMirror() {
         var _a;
+        const active = this.j.od.activeElement;
+        // do not steal focus from another editor or control — e.g. when the
+        // mode is switched programmatically (a Vue/React wrapper re-render)
+        // while the user is already typing elsewhere. See #1356
+        if (active &&
+            active !== this.j.od.body &&
+            !this.j.container.contains(active)) {
+            return;
+        }
         (_a = this.sourceEditor) === null || _a === void 0 ? void 0 : _a.focus();
     }
     saveSelection() {