jodit 4.12.16 → 4.12.18

package/CHANGELOG.md

@@ -9,6 +9,28 @@
 > - :house: [Internal]
 > - :nail_care: [Polish]
 
+## 4.12.18
+
+#### :rocket: New Feature
+
+- **Drag and drop element**: added a `startDragElement` event so another plugin can begin dragging a specific element programmatically — e.g. from a dedicated drag handle/anchor shown next to a block. Fire `editor.e.fire('startDragElement', element, mouseEvent)`; the element does **not** need to be listed in `draggableTags` (the listener is registered even when that list is empty), so handles can move elements such as `<pre>` code blocks that are not auto-draggable.
+
+#### :bug: Bug Fix
+
+- **Formatting / Selection**: toggling Bold/Italic/Underline (etc.) on a collapsed cursor and then clicking in the editor lost one or more of the pending formats. The click placed the caret just before the empty marker elements, so `clean-html` removed them. The caret is now moved back into the innermost pending marker on click, and `clean-html` keeps empty inline elements that hold the live caret, so the next typed character keeps every format. Fixes [#1291](https://github.com/xdan/jodit/issues/1291).
+- **History / Enter**: pressing Enter while a selection was active (e.g. Ctrl+A then Enter) required two Ctrl+Z presses to undo — the first only reverted to an intermediate empty state. The delete-of-selection and the new block are now a single history transaction, so one undo restores the original content. Fixes [#1292](https://github.com/xdan/jodit/issues/1292).
+- **Security / Config (prototype pollution)**: `Jodit.configure()` — and the internal `ConfigMerge`/`ConfigProto` helpers — merged user-supplied options without filtering prototype-mutating keys, so a payload nested under an existing plain-object option such as `controls` (e.g. `{"controls":{"__proto__":{"polluted":"yes"}}}`) could reach and mutate `Object.prototype` (CWE-1321). Merging now rejects `__proto__`, `constructor`, and `prototype` at every nesting level. Responsibly reported by Junming Wu (Dremig).
+
+#### :nail_care: Polish
+
+- **Drag and drop element**: dropping a non-editable block (e.g. a `<pre>` code sample) no longer leaves an invisible filler text node (``) next to it. Previously this stray node showed up as an extra empty line until `clean-html` removed it later; it is now stripped in `onDrop` right after insertion.
+
+## 4.12.17
+
+#### :bug: Bug Fix
+
+- **Lists / Selection**: in a multi-level bulleted/numbered list, clicking to the right of an item that has a nested list put the caret at the **start** of the line instead of the end (a Blink/WebKit contenteditable quirk; Firefox was already correct). A `:click` handler now moves the caret to the end of the item's own text in that case. Fixes [#1296](https://github.com/xdan/jodit/issues/1296).
+
 ## 4.12.16
 
 #### :bug: Bug Fix

package/es2015/jodit.css

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.16
+ * Version: v4.12.18
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */