Problem/Motivation

CKEditor 5 has released a security update: https://github.com/ckeditor/ckeditor5/releases/tag/v43.1.1

The CKEditor team has determined that Drupal core is not affected by this vulnerability but we should upgrade anyway to avoid security scanners complaining.

Steps to reproduce

Proposed resolution

Update CKEditor5 to v43.1.1 in all supported branches down to 10.2.x, if possible.

Remaining tasks

User interface changes

Introduced terminology

API changes

Data model changes

Release notes snippet

CKEditor 5 is updated to 43.1.1. This is a security release.

The CKEditor team has determined that Drupal core is not affected by this vulnerability but we upgraded anyway to avoid security scanners complaining.

Issue fork drupal-3477799

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

longwave created an issue. See original summary.

spokje made their first commit to this issue’s fork.

spokje’s picture

Let's start this with an MR for 11.x only for now to see what breaks.

spokje’s picture

Status: Active » Needs review

Unsure if this needs some manual testing before creating the back=port MRs, but I've run out of time for today anyway, so NR for now.

smustgrave’s picture

Status: Needs review » Reviewed & tested by the community

Applied locally for 11.x at least and didn't notice anything off.

spokje’s picture

Issue summary: View changes

Added release note snippet.

spokje’s picture

Issue summary: View changes

spokje’s picture

Thanks @smustgrave.

Added backport MRs:

10.2.x: MR !9706
10.3.x: MR !9705
10.4.x: MR !9704
11.0.x: MR !9703
11.x: MR !9702

So this is where the fun starts...

We're making quite big bumps in 10.3.x and 10.2.x .
I remember that there were CKEditor5 bumps on the more current branches that needed to adjust tests to appease the new CKEditor5 versions.
Seems like, if we want to make this work, we need to backport these as well.

I'm a bit unsure if we want to go through that effort for older branches and need some guidance on that.

Besides that the spellcheck job on 11.0.x seems borked on the GitLab side:, I've hit the below error regarding artifact uploading 4 times now:

Uploading artifacts for successful job 06:37
Uploading artifacts...
core/node_modules/: found 250678 matching artifact files and directories 
ERROR: Uploading artifacts as "archive" to coordinator... 503 backend write error  id=2914523 responseStatus=503 backend write error status=503 token=glcbt-64
WARNING: Retrying...                                context=artifacts-uploader error=service unavailable
ERROR: Uploading artifacts as "archive" to coordinator... 503 backend write error  id=2914523 responseStatus=503 backend write error status=503 token=glcbt-64
WARNING: Retrying...                                context=artifacts-uploader error=service unavailable
ERROR: Uploading artifacts as "archive" to coordinator... 503 backend write error  id=2914523 responseStatus=503 backend write error status=503 token=glcbt-64
WARNING: Retrying...                                context=artifacts-uploader error=service unavailable
ERROR: Uploading artifacts as "archive" to coordinator... 503 backend write error  id=2914523 responseStatus=503 backend write error status=503 token=glcbt-64
WARNING: Retrying...                                context=artifacts-uploader error=service unavailable
ERROR: Uploading artifacts as "archive" to coordinator... 503 backend write error  id=2914523 responseStatus=503 backend write error status=503 token=glcbt-64
WARNING: Retrying...                                context=artifacts-uploader error=service unavailable
ERROR: Uploading artifacts as "archive" to coordinator... 503 backend write error  id=2914523 responseStatus=503 backend write error status=503 token=glcbt-64
FATAL: service unavailable                         
Cleaning up project directory and file based variables 00:59
ERROR: Job failed: command terminated with exit code 1

This might be a temporary thingy, so we might want to retry this a bit later.

spokje’s picture

Bonus thought:

We might want to get #3477805: Update Webpack to 5.95.0 in first, that one is all green and might cause merge conflicts with this one.

spokje’s picture

  • nod_ committed 06796271 on 11.x
    Issue #3477799 by spokje, longwave, smustgrave: Update CKEditor 5 to 43....

  • nod_ committed 7a8f123e on 11.0.x
    Issue #3477799 by spokje, longwave, smustgrave: Update CKEditor 5 to 43....

  • nod_ committed bbc8b41b on 10.4.x
    Issue #3477799 by spokje, longwave, smustgrave: Update CKEditor 5 to 43....

  • nod_ committed 7e00c2ba on 10.3.x
    Issue #3477799 by spokje, longwave, smustgrave: Update CKEditor 5 to 43....

  • nod_ committed 838fcb6a on 10.2.x
    Issue #3477799 by spokje, longwave, smustgrave: Update CKEditor 5 to 43....
nod_’s picture

Version: 11.x-dev » 10.2.x-dev
Status: Reviewed & tested by the community » Fixed

Version 42.2.0 got out a few days ago but committing this since it's ready.

  • nod_ committed 75ea8e8b on 10.2.x
    Revert "Issue #3477799 by spokje, longwave, smustgrave: Update CKEditor...
nod_’s picture

Status: Fixed » Needs work

seems like it broke a few things

spokje’s picture

If this needs backporting to 10.2.x, it's also gonna need some JS-test-fixes backported.

Unsure if we want to go through that amount of trouble for a Security Release that doesn't affect us?
I'll leave that question for core committers to ponder about.

  • nod_ committed a35fbc68 on 10.3.x
    Revert "Issue #3477799 by spokje, longwave, smustgrave: Update CKEditor...
nod_’s picture

Version: 10.2.x-dev » 10.3.x-dev

and 10.3.x is not happy either I suspect the 10.3.x fix would fix 10.2.x too

catch’s picture

It looks like there's a version mismatch in the ckeditor5 alignment version on 11.0.x, see notes in #3479160: 11.0.x yarn dependencies have mushroomed.

xjm’s picture

We had previously discussed for this issue that we would not backport this update to 10.2 unless CKSource could provide us a non-standard release on the old major that 10.2 was using, because the changes in CKEditor 5 v41 that were released in Drupal 10.3 broke a number of contributed modules. So this should only be backported to 10.2 if it also comes with a backport to CKEditor 40.

xjm credited quietone.

xjm’s picture

Adding @quietone to the credits since she also contributed to the ongoing RM discussions about this issue.

el7cosmos changed the visibility of the branch 3477799-bump-ckeditor5-10.3.x to active.

el7cosmos changed the visibility of the branch 3477799-bump-ckeditor5-10.3.x to hidden.

el7cosmos’s picture

I updated tests for 10.3 per #3459926-14: Update CKEditor 5 to 42.0.0. I have pushed the changes but can't reopen the MR, should I create a new MR?

prudloff’s picture

Issue tags: +Security
quietone’s picture

longwave’s picture

Version: 10.3.x-dev » 10.4.x-dev
Status: Needs work » Fixed

Let's just close this out now, we aren't going to upgrade 10.3 any more, and CKEditor v45 is out which we will try to upgrade to for 11.2/10.5.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.