Skip to content

build(deps): bump @ckeditor/ckeditor5-engine and ckeditor5 in /core/plugins/editors/ckeditor5/build - #1969

Merged
nkissebe merged 1 commit into
2.4-mainfrom
dependabot/npm_and_yarn/core/plugins/editors/ckeditor5/build/multi-95be1dfa6c
Nov 2, 2026
Merged

build(deps): bump @ckeditor/ckeditor5-engine and ckeditor5 in /core/plugins/editors/ckeditor5/build#1969
nkissebe merged 1 commit into
2.4-mainfrom
dependabot/npm_and_yarn/core/plugins/editors/ckeditor5/build/multi-95be1dfa6c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 2, 2026

Copy link
Copy Markdown
Contributor

Bumps @ckeditor/ckeditor5-engine to 48.5.3 and updates ancestor dependency ckeditor5. These dependencies need to be updated together.

Updates @ckeditor/ckeditor5-engine from 48.4.0 to 48.5.3

Release notes

Sourced from @​ckeditor/ckeditor5-engine's releases.

v48.5.3

CKEditor 5 v48.5.3 is now available.

Release highlights

This release addresses three cross-site scripting (XSS) vulnerabilities, two in the Track Changes plugin and one in CKEditor AI. Under specific conditions, described below, each of them could lead to unauthorized JavaScript code execution.

The first vulnerability (GHSA-2x29-fwvw-5g7x) can be triggered by inserting a specially crafted suggestion into the editor. It affects only installations where Track Changes is enabled together with a feature that allows assigning a color or background color to an element, such as the Font Color or Font Background Color plugins.

The second vulnerability (GHSA-xh7q-269v-94j2) affects the "Preview final content" feature of Track Changes and can be triggered when the final content preview is displayed. It applies only to installations that use a plugin allowing unsafe markup in the editor data output, such as General HTML Support with a non-default configuration or HTML Embed.

The third vulnerability (GHSA-vjh8-qw64-q282) can be triggered by inserting a specially crafted message into the CKEditor AI chat. It affects only installations where CKEditor AI is enabled, and exploitation requires tricking the model into returning specific output, for example through prompt injection.

You can read more details in the relevant security advisories and contact us if you have more questions.

We would like to thank Won Yong Jeon for reporting these vulnerabilities.

Other changes

  • track-changes: The final content preview now renders the content using the editing pipeline instead of the data pipeline, so the preview looks and behaves like the content in the read-only editor.

Released packages

Check out the Versioning policy guide for more information.

Other releases:

... (truncated)

Changelog

Sourced from @​ckeditor/ckeditor5-engine's changelog.

48.5.3 (October 27, 2026)

CKEditor 5 v48.5.3 is now available.

Release highlights

This release addresses three cross-site scripting (XSS) vulnerabilities, two in the Track Changes plugin and one in CKEditor AI. Under specific conditions, described below, each of them could lead to unauthorized JavaScript code execution.

The first vulnerability (GHSA-2x29-fwvw-5g7x) can be triggered by inserting a specially crafted suggestion into the editor. It affects only installations where Track Changes is enabled together with a feature that allows assigning a color or background color to an element, such as the Font Color or Font Background Color plugins.

The second vulnerability (GHSA-xh7q-269v-94j2) affects the "Preview final content" feature of Track Changes and can be triggered when the final content preview is displayed. It applies only to installations that use a plugin allowing unsafe markup in the editor data output, such as General HTML Support with a non-default configuration or HTML Embed.

The third vulnerability (GHSA-vjh8-qw64-q282) can be triggered by inserting a specially crafted message into the CKEditor AI chat. It affects only installations where CKEditor AI is enabled, and exploitation requires tricking the model into returning specific output, for example through prompt injection.

You can read more details in the relevant security advisories and contact us if you have more questions.

We would like to thank Won Yong Jeon for reporting these vulnerabilities.

Other changes

  • track-changes: The final content preview now renders the content using the editing pipeline instead of the data pipeline, so the preview looks and behaves like the content in the read-only editor.

Released packages

Check out the Versioning policy guide for more information.

Other releases:

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by CircleCI, a new releaser for @​ckeditor/ckeditor5-engine since your current version.


Updates ckeditor5 from 48.4.0 to 48.5.3

Release notes

Sourced from ckeditor5's releases.

v48.5.3

CKEditor 5 v48.5.3 is now available.

Release highlights

This release addresses three cross-site scripting (XSS) vulnerabilities, two in the Track Changes plugin and one in CKEditor AI. Under specific conditions, described below, each of them could lead to unauthorized JavaScript code execution.

The first vulnerability (GHSA-2x29-fwvw-5g7x) can be triggered by inserting a specially crafted suggestion into the editor. It affects only installations where Track Changes is enabled together with a feature that allows assigning a color or background color to an element, such as the Font Color or Font Background Color plugins.

The second vulnerability (GHSA-xh7q-269v-94j2) affects the "Preview final content" feature of Track Changes and can be triggered when the final content preview is displayed. It applies only to installations that use a plugin allowing unsafe markup in the editor data output, such as General HTML Support with a non-default configuration or HTML Embed.

The third vulnerability (GHSA-vjh8-qw64-q282) can be triggered by inserting a specially crafted message into the CKEditor AI chat. It affects only installations where CKEditor AI is enabled, and exploitation requires tricking the model into returning specific output, for example through prompt injection.

You can read more details in the relevant security advisories and contact us if you have more questions.

We would like to thank Won Yong Jeon for reporting these vulnerabilities.

Other changes

  • track-changes: The final content preview now renders the content using the editing pipeline instead of the data pipeline, so the preview looks and behaves like the content in the read-only editor.

Released packages

Check out the Versioning policy guide for more information.

Other releases:

... (truncated)

Changelog

Sourced from ckeditor5's changelog.

48.5.3 (October 27, 2026)

CKEditor 5 v48.5.3 is now available.

Release highlights

This release addresses three cross-site scripting (XSS) vulnerabilities, two in the Track Changes plugin and one in CKEditor AI. Under specific conditions, described below, each of them could lead to unauthorized JavaScript code execution.

The first vulnerability (GHSA-2x29-fwvw-5g7x) can be triggered by inserting a specially crafted suggestion into the editor. It affects only installations where Track Changes is enabled together with a feature that allows assigning a color or background color to an element, such as the Font Color or Font Background Color plugins.

The second vulnerability (GHSA-xh7q-269v-94j2) affects the "Preview final content" feature of Track Changes and can be triggered when the final content preview is displayed. It applies only to installations that use a plugin allowing unsafe markup in the editor data output, such as General HTML Support with a non-default configuration or HTML Embed.

The third vulnerability (GHSA-vjh8-qw64-q282) can be triggered by inserting a specially crafted message into the CKEditor AI chat. It affects only installations where CKEditor AI is enabled, and exploitation requires tricking the model into returning specific output, for example through prompt injection.

You can read more details in the relevant security advisories and contact us if you have more questions.

We would like to thank Won Yong Jeon for reporting these vulnerabilities.

Other changes

  • track-changes: The final content preview now renders the content using the editing pipeline instead of the data pipeline, so the preview looks and behaves like the content in the read-only editor.

Released packages

Check out the Versioning policy guide for more information.

Other releases:

... (truncated)

Commits
  • 129cfff Release v48.5.3.
  • 2444fc1 Changelog for v48.5.3.
  • d48924d Improved release version reference update script and added tests.
  • 206f5ef Updated release scripts to use npm Trusted Publishing (OIDC) for package publ...
  • d674cac Release v48.5.2.
  • 7b04d44 Changelog for v48.5.2.
  • 38ebc5c Fixed an initialization failure caused by a Safari String#substr() regression.
  • 9875dcb Fixed mixin constructor types resolving to undefined with `strictNullChecks...
  • 1867f7a Release v48.5.1.
  • 4d9c5bb Changelog for v48.5.1.
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by CircleCI, a new releaser for ckeditor5 since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
build(deps): bump @ckeditor/ckeditor5-engine and ckeditor5
ce3267b 
Bumps [@ckeditor/ckeditor5-engine](https://github.com/ckeditor/ckeditor5/tree/HEAD/packages/ckeditor5-engine) to 48.5.3 and updates ancestor dependency [ckeditor5](https://github.com/ckeditor/ckeditor5). These dependencies need to be updated together.


Updates `@ckeditor/ckeditor5-engine` from 48.4.0 to 48.5.3
- [Release notes](https://github.com/ckeditor/ckeditor5/releases)
- [Changelog](https://github.com/ckeditor/ckeditor5/blob/v48.5.3/CHANGELOG.md)
- [Commits](https://github.com/ckeditor/ckeditor5/commits/v48.5.3/packages/ckeditor5-engine)

Updates `ckeditor5` from 48.4.0 to 48.5.3
- [Release notes](https://github.com/ckeditor/ckeditor5/releases)
- [Changelog](https://github.com/ckeditor/ckeditor5/blob/v48.5.3/CHANGELOG.md)
- [Commits](ckeditor/ckeditor5@v48.4.0...v48.5.3)

---
updated-dependencies:
- dependency-name: "@ckeditor/ckeditor5-engine"
  dependency-version: 48.5.3
  dependency-type: indirect
- dependency-name: ckeditor5
  dependency-version: 48.5.3
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 2, 2026
@dependabot
dependabot Bot requested a review from nkissebe as a code owner November 2, 2026 17:33
@dependabot dependabot Bot mentioned this pull request Nov 2, 2026
Closed
@nkissebe
nkissebe merged commit b555102 into 2.4-main Nov 2, 2026
1 check passed
nkissebe added a commit that referenced this pull request Nov 2, 2026
@nkissebe @claude
plg_editors_ckeditor5: rebuild the bundle for CKEditor 5 v48.5.3
225d15f 
Follow-up to #1969, which bumped the build manifests but not the
prebuilt assets/js/ckeditor.js the plugin actually serves. Rebuilt with
`npm ci && npm run build` from the merged lockfile (es-toolkit 1.52.0).

Picks up the 48.5.1 engine fixes that apply to this build's
allow-everything General HTML Support config: GHSA-rh54-vffm-5fvp
(es-toolkit prototype pollution via style attributes) and
GHSA-v6mg-96c6-gmpq (data: URI filtering in the editing view). The
48.5.3 advisories are in Track Changes and CKEditor AI, which are not
bundled here. Data output for GHS-heavy content is unchanged.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@nkissebe nkissebe Awaiting requested review from nkissebe nkissebe is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@nkissebe