v3.3.0

Design

• Redesigned the full editor icon set.
• Increased the corner rounding (border-radius) across the editor UI for a rounder look.

New Feature

• A lineBreakClearStyle option has been added — when true, pressing Enter at the end of a line starts a fresh line without carrying the caret's inline style nodes (bold, italic, color, links); the line-level element and its attributes are preserved. Affects the end-of-line case only.
• toolbar_sticky option now accepts a position: 'sticky' | 'fixed' field (default 'sticky'); 'fixed' forces the JS position: fixed sticky engine over native CSS position: sticky for environments where CSS sticky misbehaves.
• placeholder_line option now accepts an object for per-type hints, keyed by tag name (pre, blockquote, ...) or a category sentinel (@line, @normalLine, @list, @brLine, @closureBrLine, @block, @closureBlock), resolved most-specific to least. The string form is unchanged.
• A menu.subscribeDropdownOff(callback) method has been added to subscribe to dropdown-off events; it returns an unsubscribe function.

Enhancement

• Added Esc key support to close open toolbar dropdown menus, including dropdown-free menus like fontColor.
• Updated the table cell controller so the unmerge button is hidden instead of disabled when there are no merged cells, matching the merge/split button toggle.

Bugfix

• Fixed an issue where the off-screen focus-temp input (.__se__focus__temp__) was a keyboard tab stop; it is now tabindex="-1" and no longer reachable by Tab. #1677
• Fixed a bug where the finder toolbar button did not toggle the finder panel closed when pressed again.
• Fixed an issue where pressing Enter on an empty line inside a block (e.g. <blockquote>) with content below placed the new line and caret below the lower chunk instead of between the two chunks.
• Fixed an issue where opening a dropdown-free plugin's sub-panel from the command menu (e.g. fontColor's color-picker hue slider) closed the entire menu; the flyout now closes only when the plugin commits.

v3.2.6

Bugfix

• [v3.1.4] Fixed a bug where Backspace or Delete broke deletion when the caret container was the line element instead of a text node.
• Fixed a bug where the caret was not scrolled into view after Backspace when deleting a character or merging a line at the edge of the viewport, including selection delete, list merge, component delete, <br>-line, soft break, and empty-line merges.
• Fixed a bug where the sticky toolbar offset was not applied when the caret scrolled into the toolbar band during auto-height page scroll.
• Fixed a bug where the caret could be hidden under the top sticky toolbar (_toolbar_sticky) when the editor was placed inside an outer scroll container.
• Fixed a bug where an already-visible caret was pulled downward on Backspace in auto-height mode after it had already cleared the top sticky toolbar.
• Fixed a bug where the per-line placeholder (placeholder_line) lingered on multiple lines after a batched multi-line insert.

v3.2.3

Enhancement

• Improved the per-line slash-command placeholder to no longer appear inside table cells.

Bugfix

• Fixed a bug where the Enter key stopped working in environments that block beforeinput at runtime (some corporate security software, DLP, or VDI).
• Fixed a bug where percentage-sized media components (image, video, audio, iframe) reset to 100% after a code view toggle, setValue, or paste. [#1673]
• Fixed a bug where the block handle buttons were positioned slightly below the block's first line, making them harder to click.
• Fixed a bug where Shift+Enter (soft line break) did nothing on empty lines, split the paragraph on Safari, or stopped when the key was held.
• Fixed a bug where Backspace or Delete did not remove a soft line break (Shift+Enter) in a single press.
• Fixed a bug where some editor-internal buttons defaulted to type="submit" and submitted an enclosing <form> when clicked. [#1675]
• Fixed a bug where an empty heading line was serialized as a bare #### in the markdown view.

v2.47.11

[LEGACY] Release v2.47.11

🔒 This release includes an important security patch regarding an XSS vulnerability.

Security Fixes (v2.47.11)

• Fixed XSS Sanitization Bypass in Namespaced HTML Elements
  • Addressed an issue where crafted custom or namespaced tags could preserve executable event-handler attributes.
  • Improved sanitization of unsafe attributes, nested elements, and JavaScript URI schemes.
  • This issue could potentially allow stored or reflected XSS when malicious content is rendered or interacted with.
  • Affects SUNEDITOR <= 2.47.10.

Users are strongly encouraged to upgrade to v2.47.11.

Special thanks to the security researcher for the responsible disclosure. [#1646] @Adyej999

v3.2.2

Bugfix

• Fixed a bug where the block handle was not visible when the editor was created inside a modal or dialog.

v3.2.1

Bugfix

• Fixed a bug where pressing Enter while composing text with an IME (e.g. Korean) on iOS browsers with a physical keyboard moved the last composed character to the next line. #1654
• Fixed a bug where pressing Tab could move focus to a hidden off-screen element, making the cursor disappear.

v3.2.0

New Feature

• Support Block handle — line side handles provide hover, drag, and an action menu.
• SelectMenu now supports submenus.
• A toolbar_innerWidth and innerWidth option has been added.
• Support slashCommand plugin — a Notion/Tiptap-style command menu with a configurable trigger character (default /) and user-defined menu items.
• A placeholder_line option has been added — a Notion-style line placeholder shown at the cursor line when it is empty. When enabled together with placeholder, the line placeholder takes precedence on the focused empty line.

Enhancement

• Unified dropdown plugin menu creation onto a shared method. menu.initDropdownTarget(classObj, itemsOrNode, options?) now accepts an Array<DropdownItem> in addition to the existing Node argument, generating <button>/<li> markup internally (the existing Node signature stays compatible). A DropdownItem follows the { command, value?, title, innerHTML, className?, attrs? } schema, and the 10 built-in dropdown plugins (align, blockStyle, font, hr, layout, lineHeight, list, paragraphStyle, template, textStyle) were migrated to the new form.
• Coalesced the wysiwyg mousemove handler using requestAnimationFrame.
• Updated SelectMenu item hover/active colors to a blue tone.

Bugfix

• Fixed a bug where a pageBreak component could not be deleted with Delete/Backspace after being selected. #1670
• Fixed a bug where the distributed types (types/) for Hook.* (component/modal/controller/browser/colorPicker/hueSlider) were broken.
• Fixed a bug where SelectMenu did not flip left/right in left/right mode due to mixed coordinate systems.
• Fixed a bug where bullet markers overflowed outside the list by changing list-style-position to inside.
• Fixed a bug where the controller did not hide when its target scrolled out of view inside wysiwyg-inner, or stayed stuck at the editor edge.
• Fixed a bug where the placeholder position was misaligned in documentType.
• Fixed a bug where pressing Enter on an empty line (a line containing only <br>) created a new line above and left the cursor on the original line — the cursor now moves to the new line for empty paragraphs, list items, and headings.
• Fixed a bug where pressing Enter with an active selection (including full-line or multi-line selections) left the cursor on the upper line instead of the lower line.
• Fixed a bug where backspace/delete did not work on empty lines (e.g. created via Enter) in Firefox. #1671
• Fixed a bug where pasting into a table cell threw a JavaScript error and did nothing. #1668
• Fixed a bug where whitespace-only text such as   was removed during HTML cleanup. #1667
• Fixed a bug where HTML cleanup (e.g. value) converted whitespace between block elements (</p>\n<p>) into a dead line without <br> (<p></p>), or left a line break after an in-line <br> (<p><br>\n</p>) as whitespace.
• Fixed a bug where pressing Enter on an empty line or in an empty editor duplicated the paragraph (in an empty editor the wysiwyg container itself was cloned). #1657
• Fixed a bug where pressing Enter inside a PRE code block within a scroll-embedded editor scrolled to the whole PRE block instead of the line — scrolling now uses the actual cursor position after Enter.

v3.1.4

New Feature

• A searchUrl and searchHeaders option has been added to the imageGallery, videoGallery, audioGallery, fileGallery, and fileBrowser plugins for server-side search. #1651
• A scriptSrcWhitelist option has been added to the embed plugin to allow <script src> in raw HTML embeds via an explicit allowlist. #1649

Bugfix

• Fixed a bug where Figure menu actions (alignment, block-inline toggle, preset resize) did not fire onChange. #1644
• Fixed a bug where tagStyles entries were ignored when the tag was also matched by a category default (@text or @line)
• Fixed an issue in the embed plugin where the raw HTML path did not validate iframe src against the URL allowlist, allowing arbitrary iframe URLs to bypass sanitization. #1649

Breaking Changes

• Removed spanStyles / lineStyles options — unified into tagStyles via the category sentinel keys @text / @line. An explicit tag entry always wins over the category default (e.g. tagStyles.div is used even though div is a line element — @line is ignored for div).
  • Migration:

    // Before
    { spanStyles: 'color|font-size', lineStyles: 'text-align|margin', tagStyles: { div: 'color' } }
    
    // After
    { tagStyles: { '@text': 'color|font-size', '@line': 'text-align|margin', div: 'color' } }

• embed plugin: <script> tags in raw HTML embeds are now rejected by default — add trusted patterns to scriptSrcWhitelist to allow them. #1649
  • Migration: for Twitter blockquote and similar embeds that require an external script, configure pluginOptions.embed.scriptSrcWhitelist: [/^https:\/\/platform\.twitter\.com\/widgets\.js$/]
• embed plugin: iframe src in raw HTML embeds is now validated against the registered URL patterns (embedQuery); non-matching URLs are rejected. #1649
• Browser module (modules/contract/Browser): renamed params.searchUrlHeader → params.searchHeaders, internal field urlHeader → headers. Custom browser plugins that import Browser directly must update the option name and field reference. #1651

v3.1.3

Enhancement

• Support Popover API for floating UI elements (dialogs, dropdowns, controllers) to render above browser top-layer contexts such as Angular CDK Overlay. #1639

• Added stable id and autocomplete="off" to generated form fields to suppress Chrome form diagnostics. #1640

• Marked decorative line-number textareas as aria-hidden and removed from tab order

Bugfix

• Fixed a bug where page height calculation did not restart after a page break in document type mode
• Fixed a bug where anchor wrappers were lost when changing image format between inline and block styles. #1636

Breaking Changes

• Minimum supported Firefox version changed from 121 to 125 (required for Popover API)

v.3.1.2

Enhancement

• Updated design border-radius values

Bugfix

• Fixed a bug where textDirection, _editableClass, and printClass options were not synchronized when switching to RTL via setDir()
• Fixed a bug where toolbar button order was not reversed when switching to RTL via setDir()
• Fixed a bug where shortcut tooltips were added as duplicates
• Fixed a bug where tooltips in se-toolbar-bottom toolbar did not appear above the toolbar
• Fixed RTL mode issues including missing wysiwyg dir attribute, arrow key component detection, bidi edge correction for Enter/Backspace/Delete, empty line Backspace component selection, and modal input direction. #1631