Problem/Motivation

CKEditor has released CKEditor v49.0.1, a security update which does not impact Drupal.

Proposed resolution

We should still update main and 12.0.x can get 49.0.1 (or later). All core branches from 11.x through 10.6.x are on a security fork of 47.6 and do not have an update.

We should follow this process to update CKEditor.

Remaining tasks

  • Validate packages are updated correctly. Can consult or repeat update steps linked above
  • Validate tooltips are visible in Admin theme light mode, see #13. Any other manual visual regression testing as time permits is also useful

User interface changes

TBD

API changes

TBD

Data model changes

TBD

Release notes snippet

CKEditor has been updated to CKEditor v49.1.0 for a security release that does not impact Drupal core.

Issue fork drupal-3633459

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

xjm created an issue. See original summary.

xjm’s picture

Issue summary: View changes
xjm’s picture

Issue summary: View changes
xjm’s picture

Issue summary: View changes
xjm’s picture

Issue summary: View changes
godotislate’s picture

Title: Update CKEditor to 49.0.1 and friends » Update CKEditor to 49.0.1
Issue summary: View changes
godotislate’s picture

This is a 12.0.0 rc blocker.

longwave’s picture

Status: Active » Needs work

Some test failures in ckeditor5 JS tests so I guess this needs a bit of work.

godotislate’s picture

The only remaining failing test is

ime: 00:07.980, Memory: 8.00 MB
    
    CKEditor5Height (Drupal\Tests\ckeditor5\FunctionalJavascript\CKEditor5Height)
     ✘ C k editor 5 height
       ┐
       ├ Failed asserting that 637 is less than 625.
       │
       │ /builds/core/modules/ckeditor5/tests/src/FunctionalJavascript/CKEditor5HeightTest.php:62
       ┴
    
    FAILURES!
    Tests: 1, Assertions: 12, Failures: 1.

Relevant test code:

    // Test the max height of the editor is less that the window height.
    $body = \str_repeat('<p>Llamas are cute.</p>', 100);
    $node = $this->drupalCreateNode([
      'body' => $body,
    ]);
    $this->drupalGet($node->toUrl('edit-form'));
    $this->assertLessThan($this->getWindowHeight(), $this->getEditorHeight());

I think this is happening because something changed CKEditor's styles, and there's a margin now above the first line. See below, with the new version test output on the right:
Comparison of test output

I haven't looked into what sets the expectation the window height should be greater than the editor height.

The other failing tests that were resolved:

  • Adjust performance test script byte numbers
  • Had to update tests to close the balloon that is shown on a media object in the editor before the "Source" button could be pressed Covered source button
  • In addition, on one test, the Source button had to pressed again to revert to rich text editing in order for the changes there to be reflected in the editor. This however seems only an issue within the test, and when I tried this manually, I did not have to switch back to rich text editing for my source changes to be retained when I saved, but someone else should probably also validate

Something I discovered in testing is that balloon tool tips now have white backgrounds, so the text can't be read. I haven't looked at what rules need to be changed to fix this yet.
HEAD
Black background tooltip
MR
White background tool tip

Also, seems like this is a preexisting issue, but clicking in editor outside the drupal-media element does not close the balloon like it does for other elements such as table or image. This might be worth a follow up.

Going to take a break from this for now, will see if I can revisit some time over weekend. Others are welcome to jump in.

godotislate’s picture

I also ran into an unrelated Media Library issue while testing, so I opened #3634443: media-library.ui.js added to page before jQuery.

xjm’s picture

I think I figured out the purpose of the test? It's meant to test the auto-expanding of the editor, such that when you add content that will expand past the initial size of the field, the window automatically scrolls to the new bottom edge of the editor. For example, on HEAD, create a new node on standard at /node/add/article, and hit enter a bunch of times in the text field.

So the fact that the margins now push the last line outside the window might actually be a real (albeit slight) bug, despite the... unique nature of the test.

godotislate’s picture

All tests are green now.

tl;dr: This is ready for review now.

First, a correction:

Also, seems like this is a preexisting issue, but clicking in editor outside the drupal-media element does not close the balloon like it does for other elements such as table or image. This might be worth a follow up.

While the balloon does close for the table element, it does not close for image.

About CKEditor5HeightTest:
Traced the origin to #3273755: CKEditor 5 should not grow to infinite height:

  /* Set the max-height to not grow beyond the height of the viewport (minus
   * any toolbars. */
  max-height: calc(100vh - var(--drupal-displace-offset-top, 0px) - var(--drupal-displace-offset-bottom, 0px) - 20px);

Since the test was failing after the update to v49 with the editor height being 637 and the window height being 625, I changed the 20px in the CSS rule to 35px to cover the difference. Note that in CKEditor5HeightTest.php, there are comments documenting expected pixel dimensions for the height. These might be out of date now, but I think we can adjust them in a follow up if need be.

About the tooltips.
Tracked this to a combination of things.
Previously in v48.5.1, the relevant CSS rules were:
https://github.com/ckeditor/ckeditor5/blob/1867f7a292a98e5740873b5f42f20...

.ck.ck-balloon-panel {
  background: var(--ck-color-panel-background);
}

and
https://github.com/ckeditor/ckeditor5/blob/1867f7a292a98e5740873b5f42f20...

.ck.ck-balloon-panel.ck-tooltip {
  --ck-color-panel-background: var(--ck-color-tooltip-background);
}

In 49.0.1, the relevant rules look like this:
https://github.com/ckeditor/ckeditor5/blob/b8cd0da471427176f4cb2c79be503...

.ck.ck-balloon-panel {
  background: var(--ck-color-panel-background, var(--ck-balloon-panel-background-color));
}

and this
https://github.com/ckeditor/ckeditor5/blob/b8cd0da471427176f4cb2c79be503...

.ck.ck-balloon-panel.ck-tooltip {
  --ck-balloon-panel-background-color: var(--ck-color-tooltip-background, var(--ck-tooltip-background-color));
}

The intent is that --ck-balloon-panel-background-color property should set the tooltip balloon bg color, but the use of --ck-color-panel-background is preserved for backwards compatibility.

Because of that BC layer, the rules in default_admin's ckeditor5.pcss.css and variables-color-semantic.pcss.css now set the background for the tooltip to white when the theme is in light mode.

.ck {
   --ck-color-panel-background: var(--admin-color-bg-raised);
}
  --admin-color-bg-raised: light-dark(var(--admin-color-white), #47474c);

With v48.5.1, the default_admin theme .ck override for --ck-color-panel-background was superseded by the value being set in a more specific selector .ck.ck-balloon-panel.ck-tooltip, but the latter was removed in v49.

To fix this, I added a css rule in default_admin to remove the BC layer:

.ck.ck-balloon-panel {
  background: var(--ck-balloon-panel-background-color);
}

Here are screenshots of what the tooltips with v49 looked like before and after the above CSS change:
Before
Light
Light mode tooltip (before)
Dark
Dark mode tooltip (before)

After
Light
Light mode tooltip (after)
Dark
Dark mode tooltip (after)

I think this is good enough to address the regression here. There can be a follow up if desired to made the tooltip colors respect light/dark mode, and/or to check whether --ck-color-panel-background should be used/overridden anymore in default_admin.

xjm’s picture

This looks good to me; while I don't speak modern CSS, the changes seem straightforward enough. I agree that possibly fixing it to respect light/dark mode can be a followup to unblock the RC. It's it's a very small issue now that the underlying accessibility problem is resoled.

godotislate’s picture

xjm’s picture

xjm’s picture

Issue tags: +beta target

Just so we don't miss it by sorting on the other list.

godotislate’s picture

Issue summary: View changes
godotislate’s picture

Issue summary: View changes
godotislate’s picture

Priority: Normal » Critical

Bumping priority since this is a blocker.

needs-review-queue-bot’s picture

Status: Needs review » Needs work
StatusFileSize
new91 bytes

The Needs Review Queue Bot tested this issue. It no longer applies to Drupal core. Therefore, this issue status is now "Needs work".

This does not mean that the patch necessarily needs to be re-rolled or the MR rebased. Read the Issue Summary, the issue tags and the latest discussion here to determine what needs to be done.

Consult the Drupal Contributor Guide to find step-by-step guides for working with issues.

godotislate’s picture

Status: Needs work » Needs review

Merge conflict was in the performance test numbers and has been resolved.

smustgrave’s picture

Okay let me know if there are steps I'm missing.

Applied the MR on a ddev setup
Did a git add core, so I have everything in the MR staged
ddev ssh and cd into core (following the steps from https://www.drupal.org/about/core/policies/core-dependency-policies-and-...)
Ran yarn run vendor-update = no change
Ran yarn run build:ckeditor5 = no change
Ran yarn run build:ckeditor5-types = which made core/modules/ckeditor5/js/build/ckeditor5.types.jsdoc not sure if that's good or bad?

Searched core/core.libraries.yml and found 1 instance that still needs to be replaced and that's the parent ckeditor5 which still says 48.5.1

smustgrave’s picture

For the manual testing never know exactly what to target so I kinda just test the main buttons and of course media library. But question, looking at the MR I see some changes were needed for the tests. Should we do a CR or something as this may be another ckeditor update that breaks contrib modules?

godotislate’s picture

Searched core/core.libraries.yml and found 1 instance that still needs to be replaced and that's the parent ckeditor5 which still says 48.5.1

Not seeing this in the MR.

core/modules/ckeditor5/js/build/ckeditor5.types.jsdoc

Yes, changes are expected and are in the MR.

Should we do a CR or something as this may be another ckeditor update that breaks contrib modules?

No, I don't think so. Changes are specific to these tests. See #10 and #11.

smustgrave’s picture

StatusFileSize
new208.99 KB

It's not in the MR but I still see this locally with the MR applied

ckeditor

godotislate’s picture

Not sure what happened on your local, but the change to 49.0.1 in that line is in the MR.
https://git.drupalcode.org/project/drupal/-/merge_requests/17633/diffs?f...

godotislate’s picture

StatusFileSize
new97.55 KB

I just double-checked my local version of the branch, and 48.5.1 does not appear anywhere

I also switched local branch to main and applied the MR diff downloaded from Gitlab, and the change is applied:
core.libraries.yml diff showing change to ckeditor version

@smustgrave, re-reading #23, I think you might need to do yarn install first, so that your node_modules are updated.

smustgrave’s picture

Status: Needs review » Reviewed & tested by the community

Weird maybe curl didn't pull the full diff down. I switched to the branch though and it's all good. Did the same steps #23 so going to mark.

xjm’s picture

Status: Reviewed & tested by the community » Needs work

Went to rebuild this as part of reviewing and... got 49.1.0 instead of 49.0.1. At first I thought I'd made a typo, but v49.1.0 was released two days ago. So we should probably update to that instead.

godotislate’s picture

Title: Update CKEditor to 49.0.1 » Update CKEditor to 49.1.0
Issue summary: View changes
godotislate’s picture

Status: Needs work » Needs review

Updated the MR to 49.1.0.

smustgrave’s picture

Status: Needs review » Reviewed & tested by the community

Reviewed the new release notes and seems to be around AI improvements. Which makes me concerned about the future of ckeditor and how much AI is taking over it.

  • longwave committed db863809 on 12.0.x
    task: #3633459 Update CKEditor to 49.1.0
    
    By: xjm
    By: godotislate
    By:...

  • longwave committed acfffb43 on main
    task: #3633459 Update CKEditor to 49.1.0
    
    By: xjm
    By: godotislate
    By:...
longwave’s picture

Version: main » 12.0.x-dev
Status: Reviewed & tested by the community » Fixed

Committed and pushed acfffb4307a to main and db863809e63 to 12.0.x. Thanks!

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.