jodit 4.12.27 → 4.12.29

package/es5/plugins/debug/debug.css

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.27
+ * Version: v4.12.29
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/debug/debug.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.27
+ * Version: v4.12.29
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/debug/debug.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.27
+ * Version: v4.12.29
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/speech-recognize/speech-recognize.css

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.27
+ * Version: v4.12.29
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/speech-recognize/speech-recognize.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.27
+ * Version: v4.12.29
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/speech-recognize/speech-recognize.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.27
+ * Version: v4.12.29
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/polyfills.fat.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.27
+ * Version: v4.12.29
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/polyfills.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.27
+ * Version: v4.12.29
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/polyfills.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.27
+ * Version: v4.12.29
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/esm/core/constants.js

@@ -3,7 +3,7 @@
  * Released under MIT see LICENSE.txt in the project root for license information.
  * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
  */
-export const APP_VERSION = "4.12.27";
+export const APP_VERSION = "4.12.29";
 // prettier-ignore
 export const ES = "es2020";
 export const IS_ES_MODERN = true;

package/esm/core/event-emitter/event-emitter.js

@@ -53,12 +53,12 @@ export class EventEmitter {
     }
     __removeStoreFromSubject(subject) {
         if (subject[this.__key] !== undefined) {
-            Object.defineProperty(subject, this.__key, {
-                enumerable: false,
-                configurable: true,
-                writable: true,
-                value: undefined
-            });
+            // Fully remove the namespaces store key instead of just setting it to
+            // `undefined`. On long-lived subjects — e.g. `window` in an SPA where
+            // editors are repeatedly created and destroyed — leftover `undefined`
+            // keys would otherwise pile up on the object. The property is defined
+            // as `configurable`, so `delete` removes it cleanly.
+            delete subject[this.__key];
         }
     }
     __triggerNativeEvent(element, event) {

package/esm/core/helpers/html/safe-html.js

@@ -8,6 +8,37 @@
  */
 import { Dom } from "../../dom/dom.js";
 import { attr } from "../utils/index.js";
+const HTML_NAMESPACE = 'http://www.w3.org/1999/xhtml';
+/**
+ * Integration points where HTML is legitimately allowed inside MathML/SVG foreign content.
+ */
+const HTML_INTEGRATION_POINTS = new Set([
+    'foreignobject',
+    'annotation-xml',
+    'desc',
+    'title'
+]);
+/**
+ * True for an HTML element the parser placed inside MathML/SVG outside an integration point - smuggled
+ * HTML (e.g. `mglyph` / `style` under `<math>`) that a reparse can hoist into a live node. Legitimate
+ * MathML/SVG children and HTML below an integration point are kept.
+ */
+function isSmuggledForeignHtml(elm) {
+    if (elm.namespaceURI !== HTML_NAMESPACE ||
+        elm.closest('math,svg') == null) {
+        return false;
+    }
+    for (let parent = elm.parentElement; parent; parent = parent.parentElement) {
+        const name = parent.nodeName.toLowerCase();
+        if (name === 'math' || name === 'svg') {
+            break;
+        }
+        if (HTML_INTEGRATION_POINTS.has(name)) {
+            return false;
+        }
+    }
+    return true;
+}
 /**
  * Removes dangerous constructs from HTML
  */
@@ -16,6 +47,14 @@ export function safeHTML(box, options) {
     if (!Dom.isElement(box) && !Dom.isFragment(box)) {
         return;
     }
+    // Drop HTML smuggled into MathML/SVG before the walk: a reparse would otherwise hoist its hidden
+    // markup into a live node.
+    const foreign = box.querySelectorAll('math *, svg *');
+    for (let i = 0; i < foreign.length; i++) {
+        if (foreign[i].isConnected && isSmuggledForeignHtml(foreign[i])) {
+            Dom.safeRemove(foreign[i]);
+        }
+    }
     const removeEvents = (_a = options.removeEventAttributes) !== null && _a !== void 0 ? _a : options.removeOnError;
     // Single synchronous traversal of the subtree. Besides removing event
     // handlers and `javascript:` links, `sanitizeHTMLElement` neutralises

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "jodit",
-	"version": "4.12.27",
+	"version": "4.12.29",
 	"description": "Jodit is an awesome and useful wysiwyg editor with filebrowser",
 	"main": "esm/index.js",
 	"types": "types/index.d.ts",