Skip to content

Stable reconcilation q2 m2 2026#5502

Merged
boutell merged 16 commits into
stablefrom
stable-reconcilation-q2-m2-2026
Jul 8, 2026
Merged

Stable reconcilation q2 m2 2026#5502
boutell merged 16 commits into
stablefrom
stable-reconcilation-q2-m2-2026

Conversation

@boutell

@boutell boutell commented Jul 8, 2026

Copy link
Copy Markdown
Member

No description provided.

Manohar2503 and others added 16 commits July 8, 2026 10:56
* fix: treat col as a self-closing tag
* fromRichText adds metatype to new widget

* change
…lter is set (#5494)

When a transformTags handler adds text to an allowed tag that originally had
no text content, the injected text was silently dropped if any textFilter was
configured. The onopentag branch that emits frame.innerText was guarded by
!options.textFilter, deferring emission to ontext so the filter could run
there. For an empty element htmlparser2 never fires ontext, so the text was
emitted by neither branch.

Emit frame.innerText through options.textFilter here when present (mirroring
the discard path), so the transformTags text contract holds for empty tags
regardless of whether a textFilter is set.
* Fix backspace after slash deleting a rich-text widget

* Fix copy/paste widget/text conflicts
* fix path traversal in import/export

* correct credits

* additional guards
* wip

* fix for math/svg vulnerabilities
@boutell boutell requested a review from BoDonkey July 8, 2026 15:14
@boutell boutell merged commit 0f9630c into stable Jul 8, 2026
101 checks passed
@boutell boutell deleted the stable-reconcilation-q2-m2-2026 branch July 8, 2026 15:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants