Bump jodit from 4.10.2 to 4.11.3

[dependabot]

Bumps jodit from 4.10.2 to 4.11.3.

Release notes

Sourced from jodit's releases.

4.11.3

Full Changelog: xdan/jodit@4.11.2...4.11.3

4.11.2

Full Changelog: xdan/jodit@4.11.1...4.11.2

4.10.3

Full Changelog: xdan/jodit@4.10.2...4.10.3

Changelog

Sourced from jodit's changelog.

Changelog

Tags:

• 💥 [Breaking Change]
• 🚀 [New Feature]
• 🐛 [Bug Fix]
• 📝 [Documentation]
• 🏠 [Internal]
• 💅 [Polish]

4.11.2

💥 Breaking Change

• cleanHTML.denyTags default changed from 'script' to 'script,iframe,object,embed' — iframes, objects, and embeds are now blocked by default
• cleanHTML.removeOnError is deprecated in favor of cleanHTML.removeEventAttributes — all on* event handler attributes (onerror, onclick, onload, onmouseover, etc.) are now removed by default, not just onerror
• cleanHTML.safeLinksTarget is now true by default — links with target="_blank" automatically get rel="noopener noreferrer"
• cleanHTML.sandboxIframesInContent is now true by default — all <iframe> elements in editor content get sandbox="" attribute
• cleanHTML.convertUnsafeEmbeds is now ['object', 'embed'] by default — listed elements are converted to sandboxed <iframe>

🏠 Internal

• Add Statoscope for webpack bundle size analysis and build comparison
• refactor: replace setAttribute and removeAttribute with attr helper in multiple files

🚀 New Feature

• New option cleanHTML.removeEventAttributes — removes all on* event handler attributes for comprehensive XSS protection (onerror, onclick, onload, onmouseover, onfocus, etc.)
• New option cleanHTML.safeLinksTarget — automatically adds rel="noopener noreferrer" to target="_blank" links to prevent window.opener attacks
• New option cleanHTML.allowedStyles — whitelist of allowed CSS properties in style attributes, prevents CSS injection attacks (e.g. data exfiltration via background-image: url(...))
• New option cleanHTML.sanitizer — hook for external sanitizer integration (e.g. DOMPurify). Called before Jodit's built-in sanitization
• New option cleanHTML.sandboxIframesInContent — adds sandbox="" to all <iframe> in editor content
• New option cleanHTML.convertUnsafeEmbeds (false | string[]) — converts listed tags to sandboxed <iframe>, customizable list

📝 Documentation

• New comprehensive security guide: docs/security.md covering XSS protection, CSP, Trusted Types, HTML Sanitizer API, server-side sanitization, and hardened configuration examples

4.10.1

💥 Breaking Change

• Fix custom cell popup buttons not working when referenced by string name (e.g. popup: { cells: Jodit.atom(['valign', 'deleteTable', ...]) }) #1328
• Rename cell popup button delete → deleteTable to avoid conflict with document.execCommand('delete')

4.9.18

🐛 Bug Fix

... (truncated)

Commits

• b5036b7 New version 4.11.3 Read more https://github.com/xdan/jodit/blob/main/CHANGELO...
• 1149756 New version 4.11.2 Read more https://github.com/xdan/jodit/blob/main/CHANGELO...
• 9106dc1 New version 4.11.1 Read more https://github.com/xdan/jodit/blob/main/CHANGELO...
• dc16b33 feat: enhance Statoscope workflow by generating and uploading diff report for...
• e388516 Refactor code structure for improved readability and maintainability
• ac70a98 refactor: replace setAttribute and removeAttribute with attr helper in multip...
• 66cd541 feat: update version to 4.11.0 and enhance cleanHTML plugin
• 4cb505a Add security documentation for Jodit Editor, covering sanitization and CSP
• c5c732a New version 4.10.3 Read more https://github.com/xdan/jodit/blob/main/CHANGELO...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[bdukes]

@dependabot rebase

[dependabot]

Looks like this PR is already up-to-date with master! If you'd still like to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.