Repository navigation
fix(deps): bump ckeditor5 from ~47.6.2 to ~47.7.5 (main) - #13754
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
renovate
Bot
force-pushed
the
renovate/main-ckeditor-monorepo
branch
from
September 29, 2026 08:33
565cef0 to
af0a581
Compare
renovate
Bot
force-pushed
the
renovate/main-ckeditor-monorepo
branch
3 times, most recently
from
October 7, 2026 18:05
ab8fb4a to
55c3e98
Compare
renovate
Bot
force-pushed
the
renovate/main-ckeditor-monorepo
branch
3 times, most recently
from
October 20, 2026 11:28
d7d0790 to
b045a1f
Compare
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate
Bot
force-pushed
the
renovate/main-ckeditor-monorepo
branch
from
October 22, 2026 09:20
b045a1f to
160338c
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
~47.6.2→~47.7.5Release Notes
ckeditor/ckeditor5 (ckeditor5)
v47.7.5Compare Source
We are excited to announce the release of CKEditor 5 v47.7.5.
Bug fixes
utils: Fixed an initialization failure in Safari 27 on Intel Macs by working around a regression in the browser’s implementation of
String#substr(). Closes #20237.Affected Safari builds return the entire string instead of an empty string when
String#substr()is called with a negative length. For event names without a namespace separator, this caused an event node to reference itself as a child, leading to infinite recursion and a stack overflow when collecting callbacks. The editor no longer relies onString#substr()for this operation.Thanks to @ld3nl.
Released packages
Check out the Versioning policy guide for more information.
Released packages (summary)
Other releases:
v47.7.4Compare Source
CKEditor 5 v47.7.4 is now available.
Release highlights
This release addresses two cross-site scripting (XSS) vulnerabilities in the CKEditor 5 engine.
The first vulnerability (
GHSA-rh54-vffm-5fvp) is caused by a prototype pollution issue in thees-toolkitlibrary used in the CKEditor 5 codebase. This vulnerability could lead to unauthorized JavaScript code execution when the editor processes incomingstyleattribute values. The underlying issue has been patched by the library maintainers, and the fix has been incorporated into CKEditor 5.The second vulnerability (
GHSA-v6mg-96c6-gmpq) affects only installations where General HTML Support is enabled with a specific configuration that allows inserting objects. This vulnerability could lead to unauthorized JavaScript code execution in a browser context isolated from the origin of the application embedding the editor.You can read more details in the relevant security advisories and contact us if you have more questions.
Note: Publication of the official CVE records for these issues is pending. Due to a significant increase in CVE publication requests across the industry, GitHub has indicated that the process may take approximately five weeks.
Bug fixes
data:URI filtering in the editing view by allowing only binary image, audio and video MIME types. This change addressesGHSA-v6mg-96c6-gmpq.Other changes
es-toolkitdependency from v1.45.1 to v1.52.0 to address the prototype pollution vulnerability described inGHSA-rh54-vffm-5fvp.Released packages
Check out the Versioning policy guide for more information.
Released packages (summary)
Other releases:
v47.7.3Compare Source
We are happy to announce the release of CKEditor 5 v47.7.3.
Release highlights
The release addresses vulnerabilities identified in the
protobuf.jspackage, used within our@ckeditor/ckeditor5-operations-compressorpackage for real-time collaboration.Our analysis confirms that vulnerabilities do not affect CKEditor 5.
This release primarily aims to ensure that our customers using real-time collaboration features do not encounter unnecessary security alerts from their scanning tools. We are committed to maintaining the highest security standards, and this update reflects our ongoing efforts to safeguard user environments proactively.
Released packages
Check out the Versioning policy guide for more information.
Released packages (summary)
Other releases:
v47.7.2Compare Source
We are happy to announce the release of CKEditor 5 v47.7.2.
Release highlights
The release addresses vulnerabilities identified in the
protobuf.jspackage, used within our@ckeditor/ckeditor5-operations-compressorpackage for real-time collaboration.Our analysis confirms that vulnerabilities do not affect CKEditor 5.
This release primarily aims to ensure that our customers using real-time collaboration features do not encounter unnecessary security alerts from their scanning tools. We are committed to maintaining the highest security standards, and this update reflects our ongoing efforts to safeguard user environments proactively.
Released packages
Check out the Versioning policy guide for more information.
Released packages (summary)
Other releases:
v47.7.1Compare Source
We are happy to announce the release of CKEditor 5 v47.7.1.
Release highlights
The release addresses a vulnerability identified in the
protobuf.jspackage (CVE-2026-41242), used within our@ckeditor/ckeditor5-operations-compressorpackage for real-time collaboration.Our analysis confirms that this vulnerability does not affect CKEditor 5, as all protobuf definitions are stat
Configuration
📅 Schedule: (in timezone Europe/Vienna)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.