Two rendering fixes, both cases where the frontend produced markup the editor had not asked for.
A resized image rendered at full size. CKEditor 5's resize handles store the chosen size as a width declaration on the <figure> (class image_resized) and leave the <img> at its intrinsic pixel size. The frontend dropped that declaration and replaced it with the computed max-width, so every resized image came out full width — the resize was visible in the editor and gone on the page. Reported by @martin-git-kristensen in #863, fixed in #865 (@CybotTM).
An unresolved TypoScript constant reached the markup. On installations without EXT:fluid_styled_content, RTE images rendered loading="{$styles.content.image.lazyLoading}" verbatim: that constant is defined only by fluid_styled_content, this extension lists it under optionalDependencies and defines nothing itself, so TypoScript emitted the placeholder as a plain string. ImageResolverService::getLazyLoadingConfiguration() accepted it because it only checked for a non-empty string, and an unresolved constant is one. Invalid values are now rejected (#881, @CybotTM).
Alongside those, the CI checks gained gitleaks and zizmor scanners, the local zizmor policy copy was dropped in favour of the one the reusable workflow supplies, the repository adopted the shared Renovate preset, and the commit-signing requirement is now stated where contributors look for it.
Installation
composer require netresearch/rte-ckeditor-imagePublication status
- TER: extensions.typo3.org/extension/rte_ckeditor_image — 13.10.2 verified
- Packagist: packagist.org/packages/netresearch/rte-ckeditor-image — 13.10.2 verified
- Documentation: docs.typo3.org/p/netresearch/rte-ckeditor-image/13.10/en-us/ — render verified
Security
All release artifacts are signed with Sigstore keyless signing.
Verify signatures
cosign verify-blob \
--bundle rte-ckeditor-image-13.10.2.zip.sigstore.json \
--certificate-identity-regexp "https://github.com/netresearch/.*" \
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
rte-ckeditor-image-13.10.2.zipVerify checksums
sha256sum -c checksums.txtSoftware Bill of Materials (SBOM)
SBOMs are provided in both SPDX and CycloneDX formats for supply chain transparency.
