handsontable 18.1.0-rc7 → 18.1.0

package/3rdparty/walkontable/src/event.mjs

@@ -52,8 +52,23 @@ import { closestDown, eventTargetEl, getDeepActiveElement, hasClass, isChildOf,
 import { getCellCoordsFromMousePosition } from './utils/pointerToCoords.mjs';
 import { isTouchSupported } from '../../../helpers/feature.mjs';
 import { isMobileBrowser, isChromeWebKit, isFirefoxWebKit, isIOS } from '../../../helpers/browser.mjs';
+import { getMouseEventTouchOrigin, TOUCH_SYNTHESIZED_MOUSE_WINDOW } from '../../../helpers/dom/inputOrigin.mjs';
 const LONG_PRESS_DELAY = 500;
 const LONG_PRESS_MOVE_THRESHOLD = 10;
+/**
+ * How long (ms) after a mousedown the double-click detector keeps waiting for the matching
+ * second click. Mirrors the OS double-click tolerance with margin.
+ */ const DBLCLICK_MOUSEDOWN_TIMEOUT = 1000;
+/**
+ * How long (ms) after a mouseup the double-click detector keeps the first click "armed"
+ * for a mouse-driven double-click.
+ */ const DBLCLICK_MOUSEUP_TIMEOUT = 500;
+/**
+ * How long (ms) after a touch tap a second tap on the same cell counts as a double-tap. Touch
+ * taps are paired by `#handleTouchTap()`, independently of the mouse double-click slots, so a
+ * real mouse click after a tap never pairs with it. iOS drops taps under ~250 ms and humans
+ * double-tap at 300–600 ms (DEV-2687).
+ */ const TOUCH_DBLTAP_TIMEOUT = 1000;
 /**
  * Assembles the Event module's dependencies from the engine composition context. The DOM roots,
  * settings, event manager, table, and selection manager fold into this one object; the parent Event
@@ -88,6 +103,17 @@ var /**
    */ _dblClickTimeout = /*#__PURE__*/ new WeakMap(), /**
    * @type {number[]}
    */ _dblClickOrigin = /*#__PURE__*/ new WeakMap(), /**
+   * Coordinates of the most recent touch tap, kept for double-tap detection. Coordinates, not the
+   * resolved TD: Walkontable recycles TD elements across scrolls and re-renders, so element
+   * identity can pair two taps that landed on different cells (DEV-2687 review). Touch taps never
+   * arm the mouse double-click slots, so a mouse click after a tap cannot pair with a tap.
+   *
+   * @type {CellCoords|null}
+   */ _lastTapCoords = /*#__PURE__*/ new WeakMap(), /**
+   * Timestamp (ms) of the most recent touch tap.
+   *
+   * @type {number}
+   */ _lastTapAt = /*#__PURE__*/ new WeakMap(), /**
    * Timer ID for the long-press gesture detection.
    *
    * @type {number|null}
@@ -112,12 +138,25 @@ var /**
    * @type {TouchEvent|null}
    */ _deferredTouchStartEvent = /*#__PURE__*/ new WeakMap(), /**
    * Timestamp (ms) of the most recent `onMouseUp` call that originated from a touch gesture.
-   * Used to suppress the browser-synthesized `mouseup` event that fires after `touchend` on
-   * devices that register both touch and mouse listeners (e.g. iPad Safari), which would
-   * otherwise trigger `onCellMouseUp` — and context-menu commands — a second time.
+   * On devices that register both touch and mouse listeners (iPad with a desktop UA, Windows
+   * touchscreens) the browser synthesizes a `mousedown`/`mouseup`/`click` sequence after
+   * `touchend`. The whole sequence must be ignored – dropping only one half fires
+   * `onCellMouseDown` a second time per tap, and the leaked pair would act as a phantom mouse
+   * click (DEV-2687).
+   * Used as the fallback for engines that do not expose `sourceCapabilities`
+   * (see `#isTouchSynthesizedMouseEvent`).
    *
    * @type {number}
    */ _lastTouchMouseUpAt = /*#__PURE__*/ new WeakMap(), /**
+   * `true` between a touch-driven `onMouseUp` and the browser-synthesized `mouseup` that follows it.
+   * Only that first pair is dropped; once it is consumed, real mouse events pass even inside the
+   * `TOUCH_SYNTHESIZED_MOUSE_WINDOW` ceiling, so a fill-handle drag or a drag-selection started with
+   * a mouse right after a tap works on engines that do not report the input origin (DEV-2687). The
+   * flag is re-armed by every touch-driven `onMouseUp` and cleared when a scroll-classified gesture
+   * ends, so a tap that synthesized nothing cannot swallow that gesture's own compatibility pair.
+   *
+   * @type {boolean}
+   */ _synthesizedPairPending = /*#__PURE__*/ new WeakMap(), /**
    * @type {boolean}
    */ _mouseDown = /*#__PURE__*/ new WeakMap(), /**
    * The last renderable coords seen in `onMouseMove` while the mouse was outside the viewport.
@@ -126,6 +165,18 @@ var /**
    *
    * @type {{ row: number, col: number } | null}
    */ _mouseOverOutsideLastCoords = /*#__PURE__*/ new WeakMap(), /**
+   * Decides whether a mouse event caught by the mouse listeners is one half of the browser-synthesized
+   * `mousedown`/`mouseup` pair that follows a touch tap, and must therefore be dropped. Order of the
+   * checks: an engine that reports the input origin and says "not touch" wins (Blink, a real mouse or
+   * pen is never dropped); otherwise the event is synthesized only if a touch-driven `onMouseUp` just
+   * armed the pair (`#synthesizedPairPending`) and the ceiling has not passed. The `mouseup` half
+   * consumes the pair, so any later mouse event inside the ceiling is treated as real. Dropping both
+   * halves keeps `onCellMouseDown` at one call per tap and context-menu commands at one execution
+   * (#12803); a tap that left no stamp (a gesture treated as a scroll) has its pair processed.
+   *
+   * @param {MouseEvent} event The mouse event object.
+   * @returns {boolean}
+   */ _isTouchSynthesizedMouseEvent = /*#__PURE__*/ new WeakSet(), /**
    * Returns the cell coordinates for the given mouse position and whether the mouse is
    * outside the visible viewport. When the mouse is outside, the nearest edge cell is returned.
    *
@@ -134,6 +185,19 @@ var /**
    * @param {number} mouseY Client Y coordinate of the mouse.
    * @returns {{ coords: CellCoords, isOutside: boolean }}
    */ _getCellCoordsFromMousePosition = /*#__PURE__*/ new WeakSet(), /**
+   * Pairs touch taps into double-taps. Called from `onMouseUp` while `touchApplied` is `true`,
+   * i.e. for the `onMouseUp` that `onTouchEnd` drives. Two taps on the same coordinates within
+   * `TOUCH_DBLTAP_TIMEOUT` fire the double-click callbacks; a long-press, a tap outside the cells,
+   * or a tap on different coordinates resets the detector.
+   *
+   * @param {MouseEvent|TouchEvent} event The event that ended the tap.
+   * @param {ParentCell} cell The tapped cell, as returned by `parentCell()`.
+   */ _handleTouchTap = /*#__PURE__*/ new WeakSet(), /**
+   * Fires the corner or the cell double-click callback for the given cell.
+   *
+   * @param {MouseEvent|TouchEvent} event The event that completed the double-click.
+   * @param {ParentCell} cell The double-clicked cell.
+   */ _fireDblClick = /*#__PURE__*/ new WeakSet(), /**
    * Starts the long-press timer. When the timer fires, a synthetic `contextmenu` event is
    * dispatched on the original touch target so that the existing contextmenu hook chain
    * (and ContextMenu plugin) work without changes.
@@ -167,20 +231,27 @@ var /**
             _class_private_field_get(this, _deps).eventManager.addEventListener(_class_private_field_get(this, _deps).wtTable.holder, 'touchstart', (event)=>this.onTouchStart(event));
             _class_private_field_get(this, _deps).eventManager.addEventListener(_class_private_field_get(this, _deps).wtTable.holder, 'touchend', (event)=>this.onTouchEnd(event));
             _class_private_field_get(this, _deps).eventManager.addEventListener(_class_private_field_get(this, _deps).wtTable.holder, 'touchmove', (event)=>this.onTouchMove(event));
+            _class_private_field_get(this, _deps).eventManager.addEventListener(_class_private_field_get(this, _deps).wtTable.holder, 'touchcancel', ()=>this.onTouchCancel());
             _class_private_field_get(this, _deps).eventManager.addEventListener(_class_private_field_get(this, _deps).wtTable.holder, 'scroll', ()=>this.onHolderScroll());
         };
         const initMouseEvents = ()=>{
+            // On devices that register both touch and mouse listeners (e.g. iPad Safari with a
+            // desktop UA), `touchend` already drove `onMouseDown`/`onMouseUp`. The browser then
+            // synthesizes a `mousedown`/`mouseup` pair ~0-50 ms later; drop BOTH halves when the
+            // touch path handled the tap, so `onCellMouseDown` fires once per tap (DEV-2687) and
+            // context-menu commands do not execute twice (#12803).
             _class_private_field_get(this, _deps).eventManager.addEventListener(_class_private_field_get(this, _deps).wtTable.holder, 'mouseup', (event)=>{
-                // On devices that register both touch and mouse listeners (e.g. iPad Safari),
-                // `touchend` fires first and calls `onMouseUp` directly. The browser then
-                // synthesizes a `mouseup` event ~0-50 ms later; suppress it to prevent
-                // context-menu commands from executing twice.
-                if (Date.now() - _class_private_field_get(this, _lastTouchMouseUpAt) < 500) {
+                if (_class_private_method_get(this, _isTouchSynthesizedMouseEvent, isTouchSynthesizedMouseEvent).call(this, event)) {
                     return;
                 }
                 this.onMouseUp(event);
             });
-            _class_private_field_get(this, _deps).eventManager.addEventListener(_class_private_field_get(this, _deps).wtTable.holder, 'mousedown', (event)=>this.onMouseDown(event));
+            _class_private_field_get(this, _deps).eventManager.addEventListener(_class_private_field_get(this, _deps).wtTable.holder, 'mousedown', (event)=>{
+                if (_class_private_method_get(this, _isTouchSynthesizedMouseEvent, isTouchSynthesizedMouseEvent).call(this, event)) {
+                    return;
+                }
+                this.onMouseDown(event);
+            });
         };
         if (isMobileBrowser()) {
             initTouchEvents();
@@ -277,15 +348,16 @@ var /**
                 this.callListener('onCellMouseDown', event, cell.coords, cell.TD);
             }
         }
-        // doubleclick reacts only for left mouse button or from touch events
-        if ((event.button === 0 || this.touchApplied) && cell.TD) {
+        // The mouse double-click slots are armed by mouse clicks only; touch taps are paired by
+        // #handleTouchTap() in onMouseUp (DEV-2687).
+        if (!this.touchApplied && event.button === 0 && cell.TD) {
             _class_private_field_get(this, _dblClickOrigin)[0] = cell.TD;
             if (_class_private_field_get(this, _dblClickTimeout)[0] !== null) {
                 clearTimeout(_class_private_field_get(this, _dblClickTimeout)[0]);
             }
             _class_private_field_get(this, _dblClickTimeout)[0] = setTimeout(()=>{
                 _class_private_field_get(this, _dblClickOrigin)[0] = null;
-            }, 1000);
+            }, DBLCLICK_MOUSEDOWN_TIMEOUT);
         }
     }
     /**
@@ -394,16 +466,16 @@ var /**
         if (cell.TD && _class_private_field_get(this, _deps).wtSettings.has('onCellMouseUp')) {
             this.callListener('onCellMouseUp', event, cell.coords, cell.TD);
         }
-        // if not left mouse button, and the origin event is not comes from touch
-        if (event.button !== 0 && !this.touchApplied) {
+        if (this.touchApplied) {
+            _class_private_method_get(this, _handleTouchTap, handleTouchTap).call(this, event, cell);
+            return;
+        }
+        // ignore non-left mouse buttons
+        if (event.button !== 0) {
             return;
         }
         if (cell.TD && cell.TD === _class_private_field_get(this, _dblClickOrigin)[0] && cell.TD === _class_private_field_get(this, _dblClickOrigin)[1]) {
-            if (hasClass(eventTargetEl(event), 'corner')) {
-                this.callListener('onCellCornerDblClick', event, cell.coords, cell.TD);
-            } else {
-                this.callListener('onCellDblClick', event, cell.coords, cell.TD);
-            }
+            _class_private_method_get(this, _fireDblClick, fireDblClick).call(this, event, cell);
             _class_private_field_get(this, _dblClickOrigin)[0] = null;
             _class_private_field_get(this, _dblClickOrigin)[1] = null;
         } else if (cell.TD && cell.TD === _class_private_field_get(this, _dblClickOrigin)[0]) {
@@ -413,7 +485,7 @@ var /**
             }
             _class_private_field_get(this, _dblClickTimeout)[1] = setTimeout(()=>{
                 _class_private_field_get(this, _dblClickOrigin)[1] = null;
-            }, 500);
+            }, DBLCLICK_MOUSEUP_TIMEOUT);
         }
     }
     /**
@@ -483,14 +555,51 @@ var /**
         // before/after hooks (e.g. nestedHeaders, ContextMenu close logic).
         // Suppress only for pure scroll gestures, where onMouseDown was never fired.
         if (!wasScrolled || _class_private_field_get(this, _longPressFired)) {
-            _class_private_field_set(this, _lastTouchMouseUpAt, Date.now());
+            // The stamp is taken AFTER the tap is handled, so the selection/render work onMouseUp does
+            // is not charged against the TOUCH_SYNTHESIZED_MOUSE_WINDOW ceiling. Everything onMouseUp
+            // triggers is synchronous; the browser only dispatches the synthesized mousedown/mouseup
+            // sequence after this touchend handler returns.
             this.onMouseUp(event);
+            _class_private_field_set(this, _lastTouchMouseUpAt, Date.now());
+            _class_private_field_set(this, _synthesizedPairPending, true);
+        } else {
+            // A pure scroll gesture calls neither onMouseDown nor onMouseUp, so #handleTouchTap never
+            // runs to reset the tap detector. Reset it here so a scroll between two taps can't pair them.
+            _class_private_field_set(this, _lastTapCoords, null);
+            // This gesture armed nothing, so a still-pending flag belongs to an earlier gesture whose
+            // pair never came; clear it so THIS gesture's compatibility pair is processed.
+            _class_private_field_set(this, _synthesizedPairPending, false);
         }
         this.touchApplied = false;
         _class_private_field_set(this, _touchWasMoved, false);
         _class_private_field_set(this, _longPressFired, false);
     }
     /**
+   * OnTouchCancel callback. Browsers cancel a gesture instead of ending it whenever the system
+   * claims the touch (an edge-swipe, a dialog, a context callout) — `touchend` then never fires.
+   * Without this reset `touchApplied` stays `true` and every REAL mouse `mouseup` is routed into
+   * the touch tap detector, which has no button filter, so two right-clicks or two drag-selections
+   * ending on the same cell within the double-tap window would fire a phantom double-click.
+   * It also releases the mouse-down flag: a long-press fires `onMouseDown` from its timer, and
+   * after a cancel no `mouseup` ever follows, which would leave mouse-move selection dragging
+   * armed until the next click. The pending synthesized-pair flag is cleared for the same reason
+   * the scroll branch of `onTouchEnd` clears it: a cancelled gesture armed nothing, so a
+   * still-pending flag belongs to an earlier gesture whose pair never came, and left in place it
+   * would drop the next real mouse pair inside the ceiling on engines that do not report the
+   * input origin.
+   *
+   * @private
+   */ onTouchCancel() {
+        _class_private_method_get(this, _cancelLongPressTimer, cancelLongPressTimer).call(this);
+        this.touchApplied = false;
+        _class_private_field_set(this, _mouseDown, false);
+        _class_private_field_set(this, _touchWasMoved, false);
+        _class_private_field_set(this, _longPressFired, false);
+        _class_private_field_set(this, _deferredTouchStartEvent, null);
+        _class_private_field_set(this, _lastTapCoords, null);
+        _class_private_field_set(this, _synthesizedPairPending, false);
+    }
+    /**
    * Holder `scroll` callback. Cancels the long-press timer and runs the momentum-scroll
    * bookkeeping. When called during an active touch sequence it also marks the gesture
    * as a scroll so the deferred mousedown is not fired on `touchend` - native scrolling
@@ -574,7 +683,10 @@ var /**
    * @param {EventDeps} deps The Event module dependencies.
    * @param {Event} [parent=null] The main Event instance.
    */ constructor(deps, parent = null){
+        _class_private_method_init(this, _isTouchSynthesizedMouseEvent);
         _class_private_method_init(this, _getCellCoordsFromMousePosition);
+        _class_private_method_init(this, _handleTouchTap);
+        _class_private_method_init(this, _fireDblClick);
         _class_private_method_init(this, _startLongPressTimer);
         _class_private_method_init(this, _cancelLongPressTimer);
         _class_private_field_init(this, _deps, {
@@ -597,6 +709,14 @@ var /**
             writable: true,
             value: void 0
         });
+        _class_private_field_init(this, _lastTapCoords, {
+            writable: true,
+            value: void 0
+        });
+        _class_private_field_init(this, _lastTapAt, {
+            writable: true,
+            value: void 0
+        });
         _class_private_field_init(this, _longPressTimeout, {
             writable: true,
             value: void 0
@@ -621,6 +741,10 @@ var /**
             writable: true,
             value: void 0
         });
+        _class_private_field_init(this, _synthesizedPairPending, {
+            writable: true,
+            value: void 0
+        });
         _class_private_field_init(this, _mouseDown, {
             writable: true,
             value: void 0
@@ -638,12 +762,15 @@ var /**
             null,
             null
         ]);
+        _class_private_field_set(this, _lastTapCoords, null);
+        _class_private_field_set(this, _lastTapAt, 0);
         _class_private_field_set(this, _longPressTimeout, null);
         _class_private_field_set(this, _longPressFired, false);
         _class_private_field_set(this, _touchStartCoords, null);
         _class_private_field_set(this, _touchWasMoved, false);
         _class_private_field_set(this, _deferredTouchStartEvent, null);
         _class_private_field_set(this, _lastTouchMouseUpAt, 0);
+        _class_private_field_set(this, _synthesizedPairPending, false);
         _class_private_field_set(this, _mouseDown, false);
         _class_private_field_set(this, _mouseOverOutsideLastCoords, null);
         _class_private_field_set(this, _deps, deps);
@@ -651,9 +778,48 @@ var /**
         this.registerEvents();
     }
 }
+function isTouchSynthesizedMouseEvent(event) {
+    if (getMouseEventTouchOrigin(event) === false) {
+        return false;
+    }
+    const withinCeiling = Date.now() - _class_private_field_get(this, _lastTouchMouseUpAt) < TOUCH_SYNTHESIZED_MOUSE_WINDOW;
+    if (!_class_private_field_get(this, _synthesizedPairPending) || !withinCeiling) {
+        _class_private_field_set(this, _synthesizedPairPending, false);
+        return false;
+    }
+    if (event.type === 'mouseup') {
+        _class_private_field_set(this, _synthesizedPairPending, false);
+    }
+    return true;
+}
 function getCellCoordsFromMousePosition1(mouseX, mouseY) {
     return getCellCoordsFromMousePosition(_class_private_field_get(this, _deps), mouseX, mouseY);
 }
+function handleTouchTap(event, cell) {
+    if (_class_private_field_get(this, _longPressFired) || !cell.TD || !cell.coords) {
+        _class_private_field_set(this, _lastTapCoords, null);
+        return;
+    }
+    const now = Date.now();
+    const isSameCell = _class_private_field_get(this, _lastTapCoords) !== null && _class_private_field_get(this, _lastTapCoords).row === cell.coords.row && _class_private_field_get(this, _lastTapCoords).col === cell.coords.col;
+    if (isSameCell && now - _class_private_field_get(this, _lastTapAt) < TOUCH_DBLTAP_TIMEOUT) {
+        _class_private_method_get(this, _fireDblClick, fireDblClick).call(this, event, cell);
+        _class_private_field_set(this, _lastTapCoords, null);
+        return;
+    }
+    // Clone: parentCell()'s border branches return references into the live selection CellRange,
+    // which normalize() mutates in place — a stored alias could silently shift within the
+    // double-tap window.
+    _class_private_field_set(this, _lastTapCoords, cell.coords.clone());
+    _class_private_field_set(this, _lastTapAt, now);
+}
+function fireDblClick(event, cell) {
+    if (hasClass(eventTargetEl(event), 'corner')) {
+        this.callListener('onCellCornerDblClick', event, cell.coords, cell.TD);
+    } else {
+        this.callListener('onCellDblClick', event, cell.coords, cell.TD);
+    }
+}
 function startLongPressTimer(event) {
     _class_private_method_get(this, _cancelLongPressTimer, cancelLongPressTimer).call(this);
     const touch = event.touches[0];
@@ -674,6 +840,7 @@ function startLongPressTimer(event) {
         this.onMouseDown(event);
         _class_private_field_get(this, _dblClickOrigin)[0] = null;
         _class_private_field_get(this, _dblClickOrigin)[1] = null;
+        _class_private_field_set(this, _lastTapCoords, null);
         if (_class_private_field_get(this, _dblClickTimeout)[0] !== null) {
             clearTimeout(_class_private_field_get(this, _dblClickTimeout)[0]);
         }

package/CHANGELOG.md

@@ -9,7 +9,7 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 <!-- UNVERSIONED -->
 
-## [18.1.0-rc6] - 2026-08-27
+## [18.1.0] - 2026-09-01
 
 ### Added
 - Added the `modifySinglePassLayout` hook, which forces the previous measure-then-render layout path for a table. [#12951](https://github.com/handsontable/handsontable/pull/12951)
@@ -21,6 +21,7 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 - Added the `colorScheme` and `density` options, which set the color scheme and the spacing of the grid without declaring a theme. [#13205](https://github.com/handsontable/handsontable/pull/13205)
 - Added a public API to the `NestedRows` plugin for collapsing and expanding parent rows: `collapseAll()`, `expandAll()`, `collapseParent()`, `expandParent()`, `toggleParent()`, `getCollapsedParents()`, `isParentCollapsed()`, `isParent()`, `getRowLevel()`, `getRowParent()`, `countChildren()`, `expandToRow()`, and `expandToLevel()`, plus the new `beforeRowCollapse`, `afterRowCollapse`, `beforeRowExpand`, and `afterRowExpand` hooks. The plugin also no longer loses its collapsed rows on an `updateSettings()` call, and no longer throws when asked for the index, parent, or nesting level of a row object held from before a `loadData()` or `updateData()` call. [#13206](https://github.com/handsontable/handsontable/pull/13206)
 - Added the `formulas.hyperlinks` option, which renders cells holding a `HYPERLINK` formula as clickable links. [#13223](https://github.com/handsontable/handsontable/pull/13223)
+- Added the `SanitizerContext` type, which lists the write surfaces the `sanitizer` option receives. [#13240](https://github.com/handsontable/handsontable/pull/13240)
 
 ### Changed
 - Reduced memory usage when scrolling large datasets by releasing cell metadata for rows scrolled out of the viewport. [#12854](https://github.com/handsontable/handsontable/pull/12854)
@@ -49,6 +50,7 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 - Improved the performance of bulk grid alterations: removing many rows or columns, inserting multiple columns, pasting data that extends the grid, and edits with the `minSpareCols` or `minCols` options on large datasets. [#13091](https://github.com/handsontable/handsontable/issues/13091)
 - Improved `getColHeader` performance: the index translation derived from the `columns` function is now cached instead of being rebuilt on every call, which also speeds up grid initialization and `updateSettings` on grids with many columns. [#13096](https://github.com/handsontable/handsontable/issues/13096)
 - Improved sizing plugins performance: AutoColumnSize measures only the changed cells on edits instead of rescanning whole columns, its background width sweep is budgeted and runs on browser idle time, AutoRowSize reuses the cached header height on selection-driven renders, and a multi-column resize triggers one height recalculation instead of one per column. [#13097](https://github.com/handsontable/handsontable/issues/13097)
+- Changed how touch opens the cell editor on devices that report both touch and mouse input, such as iPad: a double-tap opens it (taps up to 1 second apart), and a single tap on an already selected cell no longer opens it as it did in 18.0.0, where duplicated mouse events after the tap triggered the double-click. [#13306](https://github.com/handsontable/handsontable/pull/13306)
 
 ### Removed
 - Removed leftover Pikaday styles from the themes. [#13156](https://github.com/handsontable/handsontable/pull/13156)
@@ -121,6 +123,11 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 - Angular: Fixed custom editor shortcut groups in the Angular wrapper. [#13160](https://github.com/handsontable/handsontable/pull/13160)
 - Fixed the grid no longer responding to keyboard shortcuts after clicking focusable plugin UI placed in the grid's layout slots (for example, pagination controls). [#13243](https://github.com/handsontable/handsontable/pull/13243)
 - Fixed an open cell editor staying visible over an unrelated row, and committing to a row you could no longer see, when the edited cell was hidden - for example by turning a Pagination page or hiding its row or column. [#13245](https://github.com/handsontable/handsontable/pull/13245)
+- Fixed an expired trial license key not blocking the grid when the key carried the `no-ui-warns` flag. [#13312](https://github.com/handsontable/handsontable/pull/13312)
+
+### Security
+- Fixed pasted HTML being able to run scripts, and applied the `sanitizer` option to the surfaces that previously skipped it. [#13236](https://github.com/handsontable/handsontable/pull/13236)
+- Fixed the `dialog` plugin interpolating an unvalidated `template.id` into the dialog's `id` attribute, and the `loading` plugin rendering its `title` and `description` options as HTML. Those two `loading` options now render as text, so markup passed in them shows up literally instead of being interpreted; use `icon` for markup. The button `type` option of the `dialog`, `emptyDataState`, and `notification` plugins is now resolved where the markup is built. [#13242](https://github.com/handsontable/handsontable/pull/13242)
 
 ## [18.0.0] - 2026-06-30
 
@@ -143,7 +150,6 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 - Included Walkontable in the main tsconfig.json type-check program and reduced as unknown escape-hatch casts in Walkontable from 68 to 10 (-85%) by using generics, union types, and direct structural assignments. [#12734](https://github.com/handsontable/handsontable/issues/12734)
 - Added typing for the `handsontable` cell type configuration and the `getValue` setting. [#12763](https://github.com/handsontable/handsontable/issues/12763)
 - Changed the Notification plugin to render its toasts in the grid's overlay layer. [#12777](https://github.com/handsontable/handsontable/issues/12777)
-- Angular: Modernized the Angular wrapper to align with Angular 17–19, simplify setup, reduce dependencies, and clean up tooling. [#12451](https://github.com/handsontable/handsontable/issues/12451)
 - Angular: Added support for installing Angular 16 through 22, without the --force flag [#12752](https://github.com/handsontable/handsontable/issues/12752)
 - Reduced memory usage and improved initialization time for large datasets by no longer materializing cell metadata for every cell during source data validation. [#12847](https://github.com/handsontable/handsontable/pull/12847)
 
@@ -177,7 +183,6 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 - Fixed the dropdown/autocomplete editor overflowing the table's right boundary when `trimDropdown` is set to `false`. [#12506](https://github.com/handsontable/handsontable/issues/12506)
 - Fixed merged cells not following their data when columns or rows are reordered with `manualColumnMove`, `manualRowMove`, or `manualColumnFreeze`. Merges now translate with the underlying data; merges whose physical span becomes non-contiguous after a reorder auto-split into smaller merges, and any single-cell fragment left behind is dropped. [#12508](https://github.com/handsontable/handsontable/issues/12508)
 - Fixed the `handsontable` cell type editor closing unexpectedly when using filters or dropdown menu on the inner Handsontable instance. [#12510](https://github.com/handsontable/handsontable/issues/12510)
-- Fixed the loading overlay resetting the grid scroll position to the top when no cell was selected before showing the overlay. [#12514](https://github.com/handsontable/handsontable/issues/12514)
 - Fixed manual column and row resize handle position after scrolling when `preventOverflow` is set. [#12515](https://github.com/handsontable/handsontable/issues/12515)
 - Fixed the table visually overflowing the configured `width` when `height` was not set. [#12517](https://github.com/handsontable/handsontable/pull/12517)
 - Fixed Prevent crash when Handsontable is initialized inside a hidden container, rowsRenderCalculator and columnsRenderCalculator on Viewport are never assigned and remain undefined. [#12533](https://github.com/handsontable/handsontable/issues/12533)
@@ -190,14 +195,10 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 - Fixed custom editor object values with a different schema being silently discarded by populateFromArray. [#12562](https://github.com/handsontable/handsontable/issues/12562)
 - Fixed `beforeColumnResize` and `beforeRowResize` hook return values being ignored during drag resize. [#12566](https://github.com/handsontable/handsontable/issues/12566)
 - Fixed formulas not being evaluated for array-of-arrays datasets when the `columns` option skips physical column indexes. [#12569](https://github.com/handsontable/handsontable/issues/12569)
-- Fixed a memory leak caused by ThemeManager not unsubscribing from the shared theme object on destroy. [#12570](https://github.com/handsontable/handsontable/issues/12570)
-- Fixed viewport scroll jump when Ctrl+clicking a selected cell to deselect it. [#12574](https://github.com/handsontable/handsontable/issues/12574)
-- Fixed a memory leak where IntersectionObserver instances were not properly disconnected when `document.body` had zero height. [#12578](https://github.com/handsontable/handsontable/issues/12578)
 - Fixed a crash when calling `setSourceDataAtCell()` inside the `afterLoadData()` hook during initialization. [#12585](https://github.com/handsontable/handsontable/issues/12585)
 - Fixed context menu items in object form (e.g. `add_child`, `detach_from_parent`) not rendering plugin-provided callbacks and translated labels. [#12586](https://github.com/handsontable/handsontable/issues/12586)
 - Fixed page scroll jump when inserting or removing a row/column near the bottom of the page on a grid with no fixed height. [#12587](https://github.com/handsontable/handsontable/issues/12587)
 - Fixed NestedRows context menu "Insert row above/below" destroying sibling branches on a deeply-nested leaf. [#12590](https://github.com/handsontable/handsontable/issues/12590)
-- Fixed the browser page scrolling to the grid when `dataProvider` loads rows for the first time into an empty grid with `emptyDataState` enabled. [#12591](https://github.com/handsontable/handsontable/issues/12591)
 - Fixed a crash when `updateSettings` was called from the `beforeContextMenuShow` or `beforeDropdownMenuShow` hook. [#12593](https://github.com/handsontable/handsontable/issues/12593)
 - Fixed the comment editor rendering off-screen on narrow viewports such as mobile portrait. [#12594](https://github.com/handsontable/handsontable/issues/12594)
 - Fixed nested headers rendering incorrectly when manualColumnMove and hiddenColumns are combined. [#12610](https://github.com/handsontable/handsontable/issues/12610)
@@ -247,9 +248,7 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 - Added build weight comparison tables to the Modules guide, showing the minified and gzip size added by each optional module when imported on top of `handsontable/base`. [#12262](https://github.com/handsontable/handsontable/issues/12262)
 - Added Notification plugin for non-blocking toast notifications. [#12299](https://github.com/handsontable/handsontable/issues/12299)
 - Added long-press gesture detection on touch devices to open the context menu. [#12306](https://github.com/handsontable/handsontable/issues/12306)
-- Added dedicated `paginationButton*` theme tokens so pagination navigation button colors can be customized independently via the theme builder. [#12317](https://github.com/handsontable/handsontable/issues/12317)
-- Added dedicated `paginationButton*` theme tokens so pagination navigation button colors can be customized independently for default, hover, focus, and disabled states via the theme builder. [#12404](https://github.com/handsontable/handsontable/issues/12404)
-- Added `rowspan` support to the NestedHeaders plugin, allowing column headers to span multiple header rows. [#191](https://github.com/handsontable/handsontable/issues/191)
+- Added dedicated `paginationButton*` theme tokens so pagination navigation button colors can be customized independently for default, hover, focus, and disabled states via the theme builder. [#12404](https://github.com/handsontable/handsontable/issues/12404) [#12317](https://github.com/handsontable/handsontable/issues/12317)
 
 ### Changed
 - Added a frame-based e2e test wait helper and replaced selected hook test sleeps. [#12161](https://github.com/handsontable/handsontable/pull/12161)
@@ -261,7 +260,6 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 ### Fixed
 - Fixed an issue where the Nested Rows plugin was disabled after calling updateSettings with an empty data array. [#10556](https://github.com/handsontable/handsontable/issues/10556)
 - Fixed `setSourceDataAtCell()` updating parent rows instead of nested child rows when `nestedRows` is enabled. [#10657](https://github.com/handsontable/handsontable/issues/10657)
-- Fixed an issue where the stretchH: 'last' option would ignore the defined column width when the viewport was too narrow, causing the last column to shrink to 0px. [#11761](https://github.com/handsontable/handsontable/issues/11761)
 - Fixed a stack overflow error when pasting large datasets (50,000+ rows) by optimizing array operations in the HTML table parser. [#11784](https://github.com/handsontable/handsontable/issues/11784)
 - Fixed incorrect JSDoc type annotations for the `modifyAutofillRange` hook parameters. The parameters `entireArea` and `startArea` are now correctly documented as `number[]` (a flat 4-element array) instead of the generic `Array` type, and the `@returns` type annotation has been added. [#11862](https://github.com/handsontable/handsontable/issues/11862)
 - Fixed filter by value input performance degradation when searchMode: apply option is enabled. [#12104](https://github.com/handsontable/handsontable/issues/12104)
@@ -273,7 +271,6 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 - Fixed column resizing being misaligned and calculating incorrect widths when the grid container has a CSS `transform: scale()` applied. [#11838](https://github.com/handsontable/handsontable/issues/11838)
 - Fixed the `stretchH: 'last'` option ignoring the defined column width and shrinking the last column to 0px when the viewport was too narrow. [#11761](https://github.com/handsontable/handsontable/issues/11761)
 - Fixed HyperFormula errors when MultiSelect cells store array values. [#12135](https://github.com/handsontable/handsontable/pull/12135)
-- Fixed `setSourceDataAtCell()` updating a parent row instead of the intended nested child row when the `nestedRows` option was enabled. [#10657](https://github.com/handsontable/handsontable/issues/10657)
 - Fixed `setDataAtRowProp()` incorrectly canceling an active editor session when the programmatic update targeted a different cell in the same row. [#4305](https://github.com/handsontable/handsontable/issues/4305)
 - Fix ThemeBuilder false unknown token warning on initialization [#12146](https://github.com/handsontable/handsontable/pull/12146)
 - Prevent after scroll hooks from firing when axis position is unchanged [#12151](https://github.com/handsontable/handsontable/issues/12151)
@@ -289,9 +286,8 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 - Fixed framework wrappers crashing when init-only settings (renderAllRows, renderAllColumns, layoutDirection, ariaTags) changed after initialization. [#12242](https://github.com/handsontable/handsontable/issues/12242)
 - Fixed an issue where `currentRowClassName` and `currentColClassName` could not be changed dynamically using `updateSettings`. [#12247](https://github.com/handsontable/handsontable/issues/12247)
 - Fixed column menu dropdown button styling when a filtered column header is also active [#12253](https://github.com/handsontable/handsontable/issues/12253)
-- Fixed an issue where rows with dataSchema default values (e.g., false for checkbox columns) were not recognized as empty by isEmptyRow and isEmptyCol, causing minSpareRows and minSpareCols to add infinite rows. [#12254](https://github.com/handsontable/handsontable/issues/12254)
+- Fixed an issue where rows with dataSchema default values (e.g., false for checkbox columns) were not recognized as empty by isEmptyRow and isEmptyCol, causing minSpareRows and minSpareCols to add infinite rows. [#12254](https://github.com/handsontable/handsontable/issues/12254) [#2409](https://github.com/handsontable/handsontable/issues/2409)
 - Fixed autocomplete editor with strict mode and allowInvalid discarding typed value on click-away instead of saving it. [#12285](https://github.com/handsontable/handsontable/issues/12285)
-- Fixed incorrect JSDoc type annotations for the `modifyAutofillRange` hook's `entireArea` and `startArea` parameters, and added the missing `@returns` annotation. [#11862](https://github.com/handsontable/handsontable/issues/11862)
 - Fixed filter-by-value search by trimming leading and trailing spaces and treating whitespace-only input as an empty query. [#12290](https://github.com/handsontable/handsontable/issues/12290)
 - Fixed portal-based popups (e.g., date picker) closing immediately on touch devices (Android) due to outside-click detection not accounting for rootPortalElement. [#12298](https://github.com/handsontable/handsontable/pull/12298)
 - Fixed `setDataAtRowProp` ignoring the `source` parameter in array-form calls, causing `beforeChange` and `afterChange` hooks to always receive `'edit'` instead of the provided source string. [#12300](https://github.com/handsontable/handsontable/issues/12300)
@@ -302,9 +298,6 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 - Fixed the `headerRowBackgroundColor` theme token having no visual effect on row headers. The `rowHeaderOddBackgroundColor` and `rowHeaderEvenBackgroundColor` tokens now derive from `headerRowBackgroundColor` by default, so customizing it properly cascades to all row headers. [#12322](https://github.com/handsontable/handsontable/issues/12322)
 - Fixed an exception when showing the loading indicator from the `afterChange` hook during editor close. [#12348](https://github.com/handsontable/handsontable/issues/12348)
 - Fixed TypeScript type for the `dateFormat` option to accept `Intl.DateTimeFormatOptions` objects required by the `intl-date` cell type. [#12395](https://github.com/handsontable/handsontable/issues/12395)
-- Fixed an issue where minSpareRows and minSpareCols kept adding rows/columns when dataSchema defined non-null default values (e.g. false for checkbox columns). [#2409](https://github.com/handsontable/handsontable/issues/2409)
-- Fixed one-pixel horizontal alignment for the left pagination caret [#2791](https://github.com/handsontable/handsontable/pull/2791)
-- Fixed setDataAtRowProp interrupting edits in progress [#4305](https://github.com/handsontable/handsontable/issues/4305)
 - React: Fixed the React wrapper skipping settings updates when `dataSchema` or `columns` contains non-plain objects such as `Date`, `Set`, or `Map`. [#12207](https://github.com/handsontable/handsontable/pull/12207)
 - Fixed the loading overlay resetting the grid scroll position to the top when no cell was selected before showing the overlay. [#12514](https://github.com/handsontable/handsontable/issues/12514)
 - Fixed a memory leak caused by ThemeManager not unsubscribing from the shared theme object on destroy. [#12570](https://github.com/handsontable/handsontable/issues/12570)
@@ -348,7 +341,6 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ### Changed
 - Improved differentiation between Handsontable errors and other errors. [#11780](https://github.com/handsontable/handsontable/pull/11780)
-- Reverted the editors' `updateChoicesList` method type change. [#11943](https://github.com/handsontable/handsontable/pull/11943)
 - Added a hit area to the fill handle. [#11952](https://github.com/handsontable/handsontable/pull/11952)
 - Added a new `parsePastedValue` option to fix issues with pasting object-based values. [#12020](https://github.com/handsontable/handsontable/pull/12020)
 - Introduced a new publishing flow for versions 17.0.0 and above. [#12028](https://github.com/handsontable/handsontable/pull/12028)
@@ -449,7 +441,6 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 - Fixed incorrect resizing behavior when auto-sizing rows or columns by double-clicking separators. [#11671](https://github.com/handsontable/handsontable/pull/11671)
 - Fixed mouse wheel zooming issues on Windows. [#11680](https://github.com/handsontable/handsontable/pull/11680)
 - Fixed autocomplete sorting and option highlighting issues. [#11708](https://github.com/handsontable/handsontable/pull/11708)
-- Fixed a missing `touchend` handler that prevented editors from opening on mobile devices. [#11729](https://github.com/handsontable/handsontable/pull/11729)
 - Fixed misalignment between rows and row headers when using `autoRowSize`. [#11736](https://github.com/handsontable/handsontable/pull/11736)
 - Fixed layout inconsistencies caused by browser zoom and scaling. [#11739](https://github.com/handsontable/handsontable/pull/11739)
 - Fixed an issue with the root-wrapper height calculation. [#11769](https://github.com/handsontable/handsontable/pull/11769)
@@ -631,7 +622,6 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 - Fixed a problem with the header widths when using Nested Headers with the new themes enabled. [#11410](https://github.com/handsontable/handsontable/pull/11410)
 - Fixed the header text overlap in Nested Headers. [#11413](https://github.com/handsontable/handsontable/pull/11413)
 - Fixed a problem with the merged cells height calculation in the new themes. [#11423](https://github.com/handsontable/handsontable/pull/11423)
-- Fixed the copy/paste feature not working correctly in Chrome 133. [#11428](https://github.com/handsontable/handsontable/pull/11428)
 - Fixed a problem, where clicking on the Comments' editor element deselected the currently selected cells. [#11446](https://github.com/handsontable/handsontable/pull/11446)
 
 ## [15.0.1] - 2025-02-10
@@ -639,16 +629,12 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 ### Fixed
 - Fixed the copy/paste feature not working correctly in Chrome 133. [#11428](https://github.com/handsontable/handsontable/pull/11428)
 
-## [14.6.2] - 2025-02-10
-
-### Fixed
-- Fixed the copy/paste feature not working correctly in Chrome 133. [#11428](https://github.com/handsontable/handsontable/pull/11428)
-
 ## [15.0.0] - 2024-12-16
 
 ### Added
 - Added support for row and column virtualization of merged cells. [#11162](https://github.com/handsontable/handsontable/pull/11162)
 - Added missing typings for the language files. [#11236](https://github.com/handsontable/handsontable/pull/11236)
+- Added support for the new themes, including "main" and "horizon".  [#11144](https://github.com/handsontable/handsontable/pull/11144)
 - React: Added `@handsontable/react-wrapper` to the monorepo. [#11212](https://github.com/handsontable/handsontable/pull/11212)
 
 ### Changed
@@ -659,7 +645,6 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ### Removed
 - **Breaking change**: Removed check marks from the Context Menu's alignment submenu. [#11278](https://github.com/handsontable/handsontable/pull/11278)
-- Removed `aria-hidden` from TextEditor's and PasswordEditor's `TEXTAREA` elements.  [#11218](https://github.com/handsontable/handsontable/pull/11218)
 
 ### Fixed
 - Fixed the Autocomplete and Dropdown editors' container size calculations. [#11201](https://github.com/handsontable/handsontable/pull/11201)
@@ -682,7 +667,7 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [14.6.2] - 2025-02-10
 
-#### Fixed
+### Fixed
 - Fixed the copy/paste feature not working correctly in Chrome 133. [#11428](https://github.com/handsontable/handsontable/pull/11428)
 
 ## [14.6.1] - 2024-10-17
@@ -732,10 +717,8 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 - Improved the rendering performance. [#11069](https://github.com/handsontable/handsontable/pull/11069)
 
 ### Fixed
-- Fixed Context.getShortcuts type.  [#10910](https://github.com/handsontable/handsontable/pull/10910)
 - Improved performance of cell merging. [#10995](https://github.com/handsontable/handsontable/pull/10995)
 - Fixed a problem where clicking and dragging on cells in window-controlled scrolled instances would result in unpredictable behavior. [#10996](https://github.com/handsontable/handsontable/pull/10996)
-- Fixed a bug that prevented column sorting of the checkbox cell types. [#11004](https://github.com/handsontable/handsontable/pull/11004)
 - Fixed merged cells misalignment in overlays. [#11007](https://github.com/handsontable/handsontable/pull/11007)
 - Fixed selection expansion for merged cells. [#11010](https://github.com/handsontable/handsontable/pull/11010)
 - Fixed a problem where the table could go into an endless resize loop when one of the instance's parents was using `dvh` values for sizing, and the table was not given any size itself. [#11021](https://github.com/handsontable/handsontable/pull/11021)
@@ -946,7 +929,6 @@ For more information on Handsontable 14.1.0, see:
 - **Breaking change**: Changed the way Handsontable handles focus by focusing the browser on cell elements. Introduced a new `imeFastEdit` option to minimize the negative effects affecting the "fast edit" feature for the IME users. [#10342](https://github.com/handsontable/handsontable/pull/10342)
 - Extended the Core's `scrollViewportTo` method to allow disabling of cell auto-snapping. [#10508](https://github.com/handsontable/handsontable/pull/10508)
 - Improved the keyboard navigation for the context and dropdown menus and added a new `forwardToContext` option to the ShortcutManager. [#10519](https://github.com/handsontable/handsontable/pull/10519)
-- Upgraded the monorepo to utilize Node 20. [#10468](https://github.com/handsontable/handsontable/pull/10468)
 - Improved DX by adding an exception to be thrown when trying to activate a shortcut context that has been not yet registered. [#10476](https://github.com/handsontable/handsontable/pull/10476)
 - Improved the performance of the table for cases when the table is hidden. [#10490](https://github.com/handsontable/handsontable/pull/10490)
 - Updated the TS definitions for the HiddenRows and HiddenColumns plugins. [#10492](https://github.com/handsontable/handsontable/pull/10492)

package/base.js

@@ -72,8 +72,8 @@ Handsontable.hooks = _hooks.Hooks.getSingleton();
 Handsontable.CellCoords = _src.CellCoords;
 Handsontable.CellRange = _src.CellRange;
 Handsontable.packageName = 'handsontable';
-Handsontable.buildDate = "28/08/2026 07:02:54";
-Handsontable.version = "18.1.0-rc7";
+Handsontable.buildDate = "01/09/2026 11:40:24";
+Handsontable.version = "18.1.0";
 Handsontable.languages = {
     dictionaryKeys: _registry.dictionaryKeys,
     getLanguageDictionary: _registry.getLanguageDictionary,

package/base.mjs

@@ -43,8 +43,8 @@ Handsontable.hooks = Hooks.getSingleton();
 Handsontable.CellCoords = CellCoords;
 Handsontable.CellRange = CellRange;
 Handsontable.packageName = 'handsontable';
-Handsontable.buildDate = "28/08/2026 07:02:54";
-Handsontable.version = "18.1.0-rc7";
+Handsontable.buildDate = "01/09/2026 11:40:24";
+Handsontable.version = "18.1.0";
 Handsontable.languages = {
     dictionaryKeys,
     getLanguageDictionary,