v2.1.16

Security

• Attachment href attributes are now validated using DOMPurify.isValidAttribute() before rendering as anchor tags. @flavorjones

Added

• New .editorElements and .editorElement properties have been added to <trix-toolbar> elements for accessing associated <trix-editor> elements. @seanpdoyle #1127
• <trix-editor> elements can now function without an associated <input type="hidden"> element when using ElementInternals. This is configured by setting willCreateInput = false in the before-trix-initialize event and using the [name] attribute for form submissions. @seanpdoyle #1128
• Alt text can now be set on attachment preview images via attachment.setAttributes({ alt: "..." }) in trix-attachment-add event handlers. @seanpdoyle #1198
• Attachment preview URLs can be customized using the new setPreviewURL() and getPreviewURL() methods on ManagedAttachment, accessible from event handlers. @seanpdoyle #1210
• A new trix-before-render event is dispatched before rendering, with a customizable render property for advanced use cases like morph-style rendering integration. @seanpdoyle #1252
• When no associated <input> element is present, HTML content within <trix-editor> tags is now safely sanitized and loaded as the initial editor value. @seanpdoyle #1253

New Contributors

• @flavorjones made their first contribution in #1234
• @MatheusRich made their first contribution in #1162

Full Changelog: v2.1.15...v2.1.16

v2.1.15

Full Changelog: v2.1.14...v2.1.15

Fixes GHSA-mcrw-746g-9q8h

v2.1.14

What's Changed

• Bump dompurify to 3.2.5 to resolve security issue by @jakeonrails in #1232

New Contributors

• @jakeonrails made their first contribution in #1232

Full Changelog: v2.1.13...v2.1.14

v2.1.13

What's Changed

• Add test coverage for CSP-<style> integration by @seanpdoyle in #1199
• Correct a weird sentence in README.md by @Uaitt in #1220
• Make Trix compatible with morphing by @jorgemanrubia in #1227

New Contributors

• @Uaitt made their first contribution in #1220

Full Changelog: v2.1.12...v2.1.13

v2.1.12

What's Changed

• Fix XSS via javascript: or data: url in a link by @intrip in 180c8d3

Full changelog: v2.1.11...v2.1.12

v2.1.11

What's Changed

• Make DOMPurify configurable by @djmb in #1208
• Allow comments in attachments by @djmb in #1214
• Switch from node-sass to sass by @intrip in #1215
• Reintroduce yarn build --watch by @intrip in #1216

New Contributors

• @intrip made their first contribution in #1215

Full Changelog: v2.1.10...v2.1.11

1.3.5

Trix 1.3.5

v2.1.10

What's Changed

• Update to DomPurify 3.2.3 by @djmb in #1205

Full Changelog: v2.1.9...v2.1.10

v2.1.9

What's Changed

• Sanitize HTML with DOMPurify by @djmb in #1203

Full Changelog: v2.1.8...v2.1.9

1.3.4

Trix 1.3.4