chore(deps): bump jodit from 4.2.24 to 4.13.16 in /plugins/jodit-html-editor

[dependabot]

Bumps jodit from 4.2.24 to 4.13.16.

Release notes

Sourced from jodit's releases.

4.13.16

🐛 Bug Fix

• Enter: pressing Enter with the caret at the bottom of a fixed-height (scrollable) editor left the new line clipped below the visible area — the view only caught up once you started typing. Three stacked causes: after splitting a paragraph the scroll targeted the left (already visible) half instead of the block that keeps the caret; inView treated a line clipped by the container's bottom edge as visible; and Chrome's scroll anchoring shifted the scroll position during the split. The editor now keeps the scroll stable across the split and follows the caret, scrolling the minimal distance (new line aligned to the bottom edge instead of jumping to the top). Fixes #1300.

4.13.15

🚀 New Feature

• Uploader / insert popup: new option uploader.showTabInFileSelector (default true). Set it to false to hide the Upload (drag-and-drop) tab in the image/file insert popup while keeping the uploader configured for the file browser — previously any configured uploader forced the tab to appear. Fixes #1406.

4.13.14

💅 Polish

• Languages: Slovak locale polish — consistent capitalization (Premenovať, Ukážka, Stiahnuť) and translations for the file-browser actions (Upload file, Remove file, Update file list, Select file, Edit image, Tiles view, List view). Thanks @​KamikX (#1417).

4.13.13

🚀 New Feature

• Color picker: the palette popup now has a text input for the color value — paste or type a hex code (#FF0000, FF0000, short #F00) or an rgb()/rgba() value and press Enter (or blur) to apply it. Previously the only way to pick a non-palette color was the native browser picker. Invalid values are ignored. Requested in jodit-react#310.

🏠 Internal

• Regression tests: applying styles/commands (color, fontsize, bold) to a fully selected list hits every <li>, not just one (reported in jodit-react#313 against an older jodit; not reproducible on current code).

4.13.12

🏠 Internal

• Dependencies: dev/build-only bumps — webpack-dev-server 6.0.0 (#1400), fast-uri 3.1.5 and socket.io-parser 4.2.7 (security, #1416, #1415), prettier 3.9.6 with the repo reformatted to its new union-type wrapping (#1403), terser-webpack-plugin 5.6.1 (#1402) — the minimizer config now uses the format key instead of its deprecated output alias: the new plugin merges its own format on top of the user options, and passing both crashed the SWC minifier with duplicate field `format` . No runtime changes.

4.13.11

🚀 New Feature

• Languages: Slovak (sk) localization — thanks @​KamikX (#1412). Also wired up the Persian (fa) and Swedish (sv) locales: both files have existed in src/langs/ for years but were never registered in src/languages.ts, so language: 'fa' / language: 'sv' silently fell back to English. Swedish additionally got the missing Spellcheck/Speech Recognize plugin translations.

🐛 Bug Fix

• File browser / i18n: the "create directory" prompt reused the same type name translation key as file rename, so both prompts always showed the same text; it now uses its own type dir name key (translated in every locale). The French type name translation was also wrong — it read "type de fichier" ("file type") instead of a "enter the name" prompt. Thanks @​AntoineRoue (#1405).

🏠 Internal

• Dependencies: dev/build-only Dependabot bumps — postcss 8.5.25, shell-quote+concurrently (security), http-proxy-middleware 2.0.10 (security), eslint-plugin-mocha 11.3.0, cssnano-preset-advanced 8.0.2, eslint-plugin-prettier 5.5.6, autoprefixer 10.5.4, @eslint/compat 2.1.0, @eslint/eslintrc 3.3.6, tsx 4.23.1 (#1413, #1410, #1409, #1404, #1401, #1399, #1398, #1397, #1396, #1395); GitHub Actions bumps setup-node 7, first-interaction 3, upload-pages-artifact 5, deploy-pages 5, sticky-pull-request-comment 3 (#1390–#1394).

4.13.10

... (truncated)

Changelog

Sourced from jodit's changelog.

4.13.16

🐛 Bug Fix

• Enter: pressing Enter with the caret at the bottom of a fixed-height (scrollable) editor left the new line clipped below the visible area — the view only caught up once you started typing. Three stacked causes: after splitting a paragraph the scroll targeted the left (already visible) half instead of the block that keeps the caret; inView treated a line clipped by the container's bottom edge as visible; and Chrome's scroll anchoring shifted the scroll position during the split. The editor now keeps the scroll stable across the split and follows the caret, scrolling the minimal distance (new line aligned to the bottom edge instead of jumping to the top). Fixes #1300.

4.13.15

🚀 New Feature

• Uploader / insert popup: new option uploader.showTabInFileSelector (default true). Set it to false to hide the Upload (drag-and-drop) tab in the image/file insert popup while keeping the uploader configured for the file browser — previously any configured uploader forced the tab to appear. Fixes #1406.

4.13.14

💅 Polish

• Languages: Slovak locale polish — consistent capitalization (Premenovať, Ukážka, Stiahnuť) and translations for the file-browser actions (Upload file, Remove file, Update file list, Select file, Edit image, Tiles view, List view). Thanks @​KamikX (#1417).

4.13.13

🚀 New Feature

• Color picker: the palette popup now has a text input for the color value — paste or type a hex code (#FF0000, FF0000, short #F00) or an rgb()/rgba() value and press Enter (or blur) to apply it. Previously the only way to pick a non-palette color was the native browser picker. Invalid values are ignored. Requested in jodit-react#310.

🏠 Internal

• Regression tests: applying styles/commands (color, fontsize, bold) to a fully selected list hits every <li>, not just one (reported in jodit-react#313 against an older jodit; not reproducible on current code).

4.13.12

🏠 Internal

• Dependencies: dev/build-only bumps — webpack-dev-server 6.0.0 (#1400), fast-uri 3.1.5 and socket.io-parser 4.2.7 (security, #1416, #1415), prettier 3.9.6 with the repo reformatted to its new union-type wrapping (#1403), terser-webpack-plugin 5.6.1 (#1402) — the minimizer config now uses the format key instead of its deprecated output alias: the new plugin merges its own format on top of the user options, and passing both crashed the SWC minifier with duplicate field `format` . No runtime changes.

4.13.11

🚀 New Feature

• Languages: Slovak (sk) localization — thanks @​KamikX (#1412). Also wired up the Persian (fa) and Swedish (sv) locales: both files have existed in src/langs/ for years but were never registered in src/languages.ts, so language: 'fa' / language: 'sv' silently fell back to English. Swedish additionally got the missing Spellcheck/Speech Recognize plugin translations.

🐛 Bug Fix

• File browser / i18n: the "create directory" prompt reused the same type name translation key as file rename, so both prompts always showed the same text; it now uses its own type dir name key (translated in every locale). The French type name translation was also wrong — it read "type de fichier" ("file type") instead of a "enter the name" prompt. Thanks @​AntoineRoue (#1405).

🏠 Internal

• Dependencies: dev/build-only Dependabot bumps — postcss 8.5.25, shell-quote+concurrently (security), http-proxy-middleware 2.0.10 (security), eslint-plugin-mocha 11.3.0, cssnano-preset-advanced 8.0.2, eslint-plugin-prettier 5.5.6, autoprefixer 10.5.4, @eslint/compat 2.1.0, @eslint/eslintrc 3.3.6, tsx 4.23.1 (#1413, #1410, #1409, #1404, #1401, #1399, #1398, #1397, #1396, #1395); GitHub Actions bumps setup-node 7, first-interaction 3, upload-pages-artifact 5, deploy-pages 5, sticky-pull-request-comment 3 (#1390–#1394).

4.13.10

... (truncated)

Commits

• 620f645 New version 4.13.16 Read more https://github.com/xdan/jodit/blob/main/CHANGEL...
• b1c0851 fix(enter): follow the caret when Enter is pressed at the bottom of a scrolla...
• caeaac7 chore: update statoscope reference stats
• b413032 test(security): pin CVE-2023-42399 payload — javascript: iframe src is stripp...
• 17e8f8a New version 4.13.15 Read more https://github.com/xdan/jodit/blob/main/CHANGEL...
• d1a3b8f feat(uploader): showTabInFileSelector option — hide the Upload tab in the ins...
• bd62e90 chore: update statoscope reference stats
• f817939 test(delete): regression — deleting a selected image must not throw
• e3822fb chore: update statoscope reference stats
• f2fa179 Merge release 4.13.14 into main (statoscope bot raced the release push)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for jodit since your current version.

[changeset-bot]

⚠️ No Changeset found

Latest commit: bd1d221

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[nx-cloud]

View your CI Pipeline Execution ↗ for commit a7793f8

Command	Status	Duration	Result
nx test @e2e/qwik-city	✅ Succeeded	8m 10s	View ↗
nx test @e2e/nextjs-sdk-next-app	✅ Succeeded	7m 11s	View ↗
nx test @e2e/react	✅ Succeeded	4m 22s	View ↗
nx test @e2e/vue	✅ Succeeded	3m 41s	View ↗
nx test @e2e/react-sdk-next-pages	✅ Succeeded	4m 21s	View ↗
nx test @e2e/react-native-74	✅ Succeeded	3m 31s	View ↗
nx test @e2e/svelte	✅ Succeeded	4m 21s	View ↗
nx test @e2e/hydrogen	✅ Succeeded	4m 41s	View ↗
Additional runs (36)	✅ Succeeded	...	View ↗

💡 Verify your cache is correct by running tasks in a sandbox. Read docs ↗

---

☁️ Nx Cloud last updated this comment at 2026-08-06 14:21:16 UTC

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit bd1d221. Configure here.}

[cursor]

Video iframes broken after upgrade

High Severity

Bumping jodit to 4.13.10 pulls in 4.11.2 cleanHTML defaults that deny iframe/object/embed and sandbox remaining iframes. The editor config in plugin.tsx does not override these, so video embeds this plugin advertises get stripped or disabled, including on existing content load.

Additional Locations (1)

• plugins/jodit-html-editor/package-lock.json#L35375-L35378

 

^{Reviewed by Cursor Bugbot for commit bd1d221. Configure here.}