I've patched CKEditor5 to add proper table footer support, and to add indentation to source HTML. This involves patching the table, style, and source-editing packages, which ship in Drupal core at assets/vendor/ckeditor5/.
But the CKEditor packages which ship in Drupal core at assets/vendor/ckeditor5/ are all minified, so to do this, I have to clone CKEditor at the version that ships with the version of Drupal core we want to upgrade to, apply the patches to CKEditor5, run pnpm dll:build to minify, them, copy them into a clone of Drupal core (replacing the old files), and generate a patch, which I can then apply to my site.
But in Drupal 11.3.17, CKEditor reports that it's at version 47.6.3-drupal.0 — and there is no v47.6.3 nor v47.6.3-drupal.0 branch/tag in the CKEditor source repo.
Where is the v47.6.3 / 47.6.3-drupal.0 source code? Do the 11.3 maintainers have a fork of CKEditor that was used to generate the 47.6.3-drupal.0 version that ships in 11.3.17?
mkdir patchcke5
cd patchcke5
ddev config --corepack-enable --auto
ddev start
git clone --branch=11.3.17 --single-branch https://git.drupalcode.org/project/drupal.git drupal
git clone --branch=v47.6.3 --single-branch https://github.com/ckeditor/ckeditor5.git ckeditor5
... the last command fails with fatal: Remote branch v47.6.3 not found in upstream origin. Looking at other candidate tags/branches, release-v47-6 was last updated on 2026-04-08 and has the tag v47.6.2, i.e.: one patch version before what we want, and presumably excluding the security fix.
If I could find the v47.6.3 / 47.6.3-drupal.0 source code, then I could continue my patching process.
The code for v47.6.3 / 47.6.3-drupal.0 doesn't appear to be in the repo at https://github.com/ckeditor/ckeditor5 — do the 11.3 maintainers have a fork of CKEditor somewhere that was used to generate the 47.6.3-drupal.0 version that ships in 11.3.17?
Comments
Comment #2
mparker17As per Slack thread p1789657135697069 in the #security-discussion channel...
It sounds like CKSource (the maintainers of CKEditor) are giving Drupal, and only Drupal, access to assets and services that otherwise only their enterprise clients get, and have thus requested that the fork of CKEditor that was used to generate CKEditor v47.6.3-drupal.0 (that ships in 11.3.17) remain private.
One consequence of this is that users of Drupal 10.6.17, 11.3.17 and 11.4.7 (i.e.: all supported versions of Drupal core at time-of-writing, all of which use CKEditor v47.6.3) are unable to apply patches to CKEditor unless they subscribe to CKEditor 5 LTS Edition.
Another consequence of this is that it puts a great burden on Drupal's core release managers: it's not any easier for them to patch or update CKEditor either, and they have to do it alone without the help of the community! (and, core release managers have a lot on their plate already!)
A proposal has been made in #3588899: [policy, no patch] Move ckeditor to contrib to move ckeditor to contrib to address its the maintainability burden that reconciling its release cycle with Drupal core creates, among other things.
Comment #4
jacobupal commentedIt seems like as well as there being no upstream tag, there's also no CDN for plug-ins, this blocks premium features from working.
We're seeing the editor revert to plain-text when we try and enable track changes and the console log is littered with red. One example:
So for example:
That means we're stuck between a security upgrade and losing paid-for features.
Upgrading CKEditor Premium Features fixes it - they explicitly included a fallback for compatibility: https://git.drupalcode.org/project/ckeditor5_premium_features/-/commit/7...
Comment #5
cilefen commentedI am marking this a duplicate of #3624195: CKEditor 5 library metadata references non-existent upstream version 47.6.3, so people know to continue the conversation there.