Update main and 11.x to latest CKE release

The 11.x MR is failing performance tests and I cannot update them locally without Chrome crashing and failing the test, so will upload here.

Main MR: https://git.drupalcode.org/project/drupal/-/merge_requests/17155
Updates to CKE v48.5.1. The documented minor breaking changes in v48.4.0, v48.3.0, v48.2.0, and v48.1.0 all have to do with CKEditor AI, which core doesn't use.
https://github.com/ckeditor/ckeditor5/releases/tag/v48.4.0
https://github.com/ckeditor/ckeditor5/releases/tag/v48.3.0
https://github.com/ckeditor/ckeditor5/releases/tag/v48.2.0
https://github.com/ckeditor/ckeditor5/releases/tag/v48.1.0

11.x MR https://git.drupalcode.org/project/drupal/-/merge_requests/17154

Both currently failing on Nightwatch, being addressed in #3623728: Node.js v24 upgrade fails all Nightwatch test runs.

Both MRs are green now.

main MR has merge conflicts

Rebased.

Have read through this issue and viewed the MR's.

The IS states

An MR was also made for 11.x but the performance tests need to be updated.

Then at #3 seems to update that. Can that text be removed from the IS. I notice the 11.x MR is 11 commits behind. A rebase is needed, i think. Otherwise ready for RTBTC.

The IS is fine actually. Just rebase 11.x.

Re: #14

e469de20 - Update CKEditor.

Could that commit from yesterday have triggered the test error in 11.x pipeline?

No, it looks like it's a random failure: ThemeSettingsForm

For reference, documenting how I generated the MR for the main branch update. It's basically these steps:

1. Increase the package constraints for the CKEditor 5 dependencies as needed in core/package.json (all packages with the @ckeditor namespace).
2. Perform a clean installation of core's yarn dependencies:
   

   cd core
   rm -rf node_modules
   yarn install
   

3. Update the vendor assets: yarn run vendor-update.
4. Run the CKEditor 5 build: yarn run build:ckeditor5.
5. Run yarn run build:ckeditor5-types (this step is needed for compiling a map of CKEditor 5 JSDoc types in a format that is compatible with IDEs).

Also ran a selected couple of these other steps for good measure:

1. yarn vendor-update
2. yarn build
3. yarn lint:css
4. yarn lint:core-js-passing

Then I compared the result to #3587182: Update CKEditor 5 to 48.0.1 to make sure I was in the ballpark of being correct.
Then searched the codebase to make sure there were no other relevant 48.0.1 references.

@nicxvan requested some guidance on how to test, so I think the best way would be reproduce steps locally and confirm the same output.

Thank you nicxvan and godotislate read #18 with interest. LGTM.

I ran through those steps on main, my changes are slightly different, I'm not sure why: https://git.drupalcode.org/issue/drupal-3623708/-/compare/main...compare...

First difference is I did not update the performance test so that is expected, the other differences is the core.libraries.yml.
My version only updated two lines, the MR updated 26.

I'm checking 11.x now.

My version only updated two lines, the MR updated 26.

Yeah, I had to clean those up manually when I searched for 48.0.1. IIRC, that doesn't happen automatically anymore via scripts since we switched to the UMD instead of the DLL.

Ok I updated the libraries manually and now they match except the perf test which I'm not running.

+1 RTBC for main only.

11.x needs review still.

Whoops. RTBC for main only.

The docs for updating CKEditor should be updated per #18.

Adding tag per #28.

Re: #18

@nicxvan requested some guidance on how to test, so I think the best way would be reproduce steps locally and confirm the same output.

Sorry guys! I missed that. Was going to do those steps on 11.x branch but my Ubuntu Desktop stopped working.

Re: #28, thanks for updating the docs quietone. I notice you have changed the steps in #18. Let's remove the Needs docs tag and merge unless someone wants to review the docs first.

The Needs Review Queue Bot tested this issue. It no longer applies to Drupal core. Therefore, this issue status is now "Needs work".

This does not mean that the patch necessarily needs to be re-rolled or the MR rebased. Read the Issue Summary, the issue tags and the latest discussion here to determine what needs to be done.

Consult the Drupal Contributor Guide to find step-by-step guides for working with issues.

Rebased main MR for merge conflict in performance tests.

I did not work on the 11.x MR, so for review, I compared the 11.x MR diff to the 11.4.x commit for the recent CKEditor SA, and they are the same other than the performance numbers. Confirming RTBC for 11.x.

@nicxvan confirmed RTBC for main in #27, so we should be all good here.

Thank you godoislate. Have you reviewed quietone's changes to the documentation? His last edit was 17 hours ago. I think he is done. If you can approve and remove the tag, please.

Thank you catch. You left me out of the contribution. I appreciate being credited as I deserve with expending a lof of time and care reading and reviewing issues such as these. If this is not welcome maybe a new tag should be be created similar to 'Novice'. As 'Superstars only' or something?

Committed/pushed to main and 11.x, thanks! Needed a rebase for performance test changes, but I think it was only diff context not even a real change.

@oily Please read the core credit guidelines at https://www.drupal.org/about/core/policies/maintainers/how-credit-is-gra... - I have read each of your comments in this issue and to me none of them meet the criteria for receiving credit, so I agree with @catch's assessment here.

Thank you in advance for adding me to the contribution record, catch! : ). I reviewed the issue as you can see.

For documentation, I re-ran the process from #18 step by step, and found that several of the additional steps I noted there were unnecessary. So I've updated the CKEditor documentation to add just the one step of searching the codebase and replacing instances of the previous version string.

I am also not sure that the notes on how to generate unminified CKEditor5 build assets are current after the change to UMD: https://www.drupal.org/about/core/policies/core-dependency-policies-and-.... On one hand, the need for this is mitigated somewhat because the UMD ships a .map file now, but that does not meet all developer use cases.

Leaving tag for now for that part to be verified (later).

Re: #40 Thank you, much appreciated longwave. I am very keen to keep learning and improving. I make errors but it is not from lack of effort. I will carefully review the docs and get back to you and catch on this. Would you both mind if we review this matter by drupal.org personal email to take it offline? I am open to advice and ideas.

However, it seems that at #44 godotislate has followed up on my comment #34. It appears you both were a little premature in moving the issue to fixed? Had I not made comment #34 is it likely godotislate would have checked the docs? Notice that he at #33 he had changed to RTBTC and. had forgotten about the tag. I also carried out a review earlier.

There is more work to do so Needs work!

This issue is for updating to a security release, it's not for an in-depth review of our ckeditor documentation. If you think there's more to do, open a follow-up issue.

I think all documentation is up to date.

https://www.drupal.org/about/core/policies/core-dependency-policies-and-... is the documentation page.

"Updating CKEditor 5" is correct and the procedure I've followed before when updating CKEditor.

"Reviewing changes to CKEditor 5 build files" I just tested locally and it builds the core plugins as unminified scripts, so to me that works as expected too. I've never actually needed to use this.

As we install CKEditor itself from npm I don't think there is an easy way of getting unminified source and actually running it, although I might be wrong - again I've never needed this so far anyway.

Removing the tag as I don't think there's anything else to do here. I also just closed another issue about CKEditor development docs that turned out to be years out of date because it was talking about the CKEditor 4 build process (which required Java!)

If you think there's more to do, open a follow-up issue.

catch, when we were at RTBTC I wanted to remove the tag since quietone ahd made his last edit to the docs 17 hours previously (seem my comment) so we could get this thing landed. I'm on your side! I thought I had better ask godotislate if he was cool with that, but he might want to check quietone's docs. godotislate created the tag so i thought it best if he decide it is done. If godotislate should not have created the tag and quietone should not have taken on the task then that is something they can comment on.

@xjm I have no idea what you are talking about.