This issue has been cleared by the security team to handled in public.
Update from 4.10.1 to CKEditor 4.11.3: https://ckeditor.com/blog/CKEditor-4.10.1-released/
https://ckeditor.com/cke4/release/CKEditor-4.11.0
https://ckeditor.com/cke4/release/CKEditor-4.11.1
https://ckeditor.com/cke4/release/CKEditor-4.11.2
https://ckeditor.com/cke4/release/CKEditor-4.11.3
https://ckeditor.com/blog/CKEditor-4.11-with-emoji-dropdown-and-auto-lin...
Main justification for upgrade would be the security fix, though emojis are cool too! ;-)
See also:
#1858210: [meta] Content editing experience follow-ups — in-place editing and WYSIWYG
#1950098: Update CKEditor library to 4.1
#2036253: Update CKEditor library to 4.2
#2039163: Update CKEditor library to 4.4
#2271051: Update CKEditor library to 4.4.4
#2345961: Update CKEditor library to 4.4.5
#2384581: Security: Update CKEditor library to 4.4.6
#2415111: Update CKEditor library to 4.4.7
#2521820: Update CKEditor library to 4.5.3
#2321583: Update CKEditor library to 4.5.5
#2663566: Update CKEditor library to 4.5.7
#2698587: Update CKEditor library to 4.5.8
#2724225: Update CKEditor library to 4.5.9
#2765751: Update CKEditor library to 4.5.10
#2797427: Update CKEditor library to 4.5.11
#2828494: Update CKEditor library to 4.6
#2848215: Update CKEditor library to 4.6.2
#2893566: Update CKEditor library to 4.7.1
#2904142: Update CKEditor library to 4.7.2
#2908864: Update CKEditor library to 4.7.3
#2926932: Update CKEditor library to 4.8.0
#2962330: Update CKEditor library to 4.9.2
#2983516: Update CKEditor library to 4.10.0
#2999691: Update CKEditor library to 4.10.1
CKEditor updated to 4.11.3
| Comment | File | Size | Author |
|---|---|---|---|
| #9 | 3035933-9.patch | 3.42 MB | wim leers |
| #9 | interdiff.txt | 685 bytes | wim leers |
| #4 | 3035933-3.patch | 3.42 MB | cilefen |
Comments
Comment #2
cilefen commentedI built this from the source code on tag 4.11.3 with
sh build.sh -s --leave-js-unminified. It looks like some files had been minified earlier (#2999691-5: Update CKEditor library to 4.10.1).Comment #3
cilefen commentedComment #4
cilefen commentedI read the next comment by Wim on #2999691: Update CKEditor library to 4.10.1 and now understand we want minified.
Comment #6
dudleyc commentedPatch works for me, thanks!
Comment #7
cilefen commentedThis is allowed in 8.7.x.
Comment #8
cilefen commentedComment #9
wim leersWe won't get that, because it's a separate CKEditor plugin that we don't include in our build.
Fun note: with https://github.com/ckeditor/ckeditor-dev/issues/2478 (in 4.11.0), they finally changed the default to be sane, which we did nearly six years ago, in #1879120-84: Use Drupal-specific image and link plugins — use core dialogs rather than CKEditor dialogs, containing alterable Drupal forms :) We can't remove our own code for this though, because Drupal has its own
drupallinkCKEditor plugin.#4 was nearly perfect — thanks! 🙏The only thing that you forgot was to update
core.libraries.yml:)Manually tested, no problems. 👍
Comment #10
alexpottCommitted and pushed 3eff3b33d7 to 8.8.x and 2d2a118498 to 8.7.x. Thanks!