Changelog

📋 Changelog

Version history and release notes for Neiki's Editor.

---

[3.1.0]

• Added new built-in theme: midnight — deep black editor background (#0a0a10), slightly lighter toolbar (#111118), and purple-pink accent color (#c084fc)
• Added theme.midnight translation key to all 8 built-in languages (en, cs, zh, es, de, fr, pt, ja)

---

[3.0.3]

• Fixed empty editor submitting <p><br></p> instead of a blank value — getContent() now returns an empty string when the editor contains only the default empty block inserted by the browser

---

[3.0.2]

• Hid the left-side block drag grip on touch and coarse-pointer devices, relying on the existing move up/down toolbar buttons for precise block repositioning
• Fixed blockquote toggling when the quote contains a nested <p> by unwrapping the active <blockquote> instead of formatting the inner paragraph
• Added missing i18n keys for the Insert Video toolbar item, dropdown item, modal labels, upload states, and validation messages across all built-in languages

---

[3.0.1] — Security Fix

• Fixed a polynomial regular expression risk in the HTML code view formatter by replacing the regex tokenizer with a deterministic linear scan

---

[3.0.0] — Major Release

New Features

• Added two new built-in themes: Blue and Dark Blue
• Added Insert → Video with URL / file-upload modal, base64 embedding, and optional videoUploadHandler
• Added video resizing, repositioning, replacement, delete toolbar actions, and drag-and-drop video file insertion
• Added drag-and-drop moving for selected text inside the editor
• Added a shared caret-style drop indicator for dragged text, images, and videos
• Replaced the old Toggle Theme action with a translated Change theme select (Light, Dark, Blue, Dark Blue)
• Improved HTML code view: formatted multi-line HTML with syntax highlighting

Fixes

• Fixed editor grip SVGs occasionally being inserted into the document — grip handles moved outside editable content
• Prevented native blue selection highlights on selected images/videos and their media toolbars
• Stripped editor UI from dragged fragments

---

[2.10.1] — Security Patch

• Fixed a cross-site scripting (XSS) vulnerability in the HTML sanitizer's entity decoding — replaced innerHTML-based decoding with a safe regex approach that only resolves named and numeric HTML entities without ever parsing HTML

---

[2.10.0]

• Added code toolbar button with smart behavior: single-line selection → inline <code>, multi-line → <pre><code> block. Works as a toggle (click again to unwrap). Included in default toolbar between subscript and removeFormat.
• Fixed text not being wrapped in <p> after toggling off Bullet List or Numbered List
• Fixed HTML entities being displayed as literal text instead of decoded
• Renamed custom_class config option to customClass (camelCase). Old name still works for backward compatibility.
• Added toolbar.code translation key to all 8 built-in languages

---

[2.9.5]

• Added custom_class config option (now customClass)
• Fixed display: inline-block on .neiki-content img for compatibility with CSS resets

---

[2.9.4] — Security + UX Improvements

• Security: Reworked autosave storage key normalization to avoid polynomial regex on uncontrolled input
• Security: Updated HTML sanitization parsing to avoid DOMParser.parseFromString
• Improved image insert dialog: prominent upload area, click-to-select, drag-and-drop support, selected-file feedback
• Added responsive upload-zone styling for mobile
• Removed selector-string URL escaping when applying target="_blank" to links
• Fixed floating selection toolbar positioning when page is scrolled and toolbar is sticky
• Changed license from MIT to GNU AGPLv3

---

[2.9.3] — Security Hardening

• Fixed autosave storage collisions by scoping localStorage keys per page URL + editor identity
• Added autosaveKey config option and data-neiki-autosave-key attribute for custom draft scopes
• Security: Hardened HTML sanitization for autosave restoration, textarea/source HTML, and public HTML insertion
• Security: Fixed unsafe modal value interpolation for link/image dialogs
• Security: Guarded translation/config merging against prototype pollution (__proto__, prototype, constructor)
• Removed unused internal variables

---

[2.9.2] — Image & Toolbar Enhancements

• Added Drag to Reposition Images — drag images to any position in the editor, including inline placement
• Added Image-Specific Toolbar — contextual toolbar with Drag handle, Move Block Up/Down, Replace, and Delete actions
• Added Replace Image action — quickly swap a selected image via file picker
• Fixed image toolbar positioning near the top of the editor
• Fixed Blockquote Toggle — clicking again now properly removes the blockquote
• Added Sticky Toolbar — when maxHeight is null, the toolbar uses position: sticky
• Fixed font size selection being lost after clicking +/− buttons or preset dropdown
• Fixed resized image dimensions not being preserved on form submission
• New translation keys for image toolbar in all 8 languages
• Added Touch/Mobile Image Drag & Drop support
• Improved modal responsiveness for mobile (max-height, scrollable body, stacked rows, iOS zoom prevention)

---

[2.9.1]

• Fixed image URL insertion placing images at wrong cursor position
• Fixed selected image deletion after undo
• Added copy and cut support for selected images (including HTML clipboard data)
• Fixed Emoji picker and Insert dropdown positioning on narrow screens

---

[2.9.0] — Multiple Image Upload & Upload Handler

• Added Multiple Image Upload — dialog accepts multiple files, all inserted sequentially
• Added imageUploadHandler config option — async (file) => Promise<url> for server/CDN uploads
• When imageUploadHandler is configured, drag & drop and clipboard paste also use the handler
• Added clipboard image paste support (Ctrl+V)
• Image dialog hint text dynamically reflects base64 vs handler mode

---

_{← Back to Home}