fix(deps): bump ckeditor5 from ^47.6.2-alpha.0 to ^47.7.3 (main)#13238
fix(deps): bump ckeditor5 from ^47.6.2-alpha.0 to ^47.7.3 (main)#13238renovate[bot] wants to merge 1 commit into
Conversation
![renovate-approve[bot]](https://avatars.githubusercontent.com/in/7394?s=60&v=4){kind=small}
1bedaaa to
51ab3f7
Compare
51ab3f7 to
2ac268e
Compare
2ac268e to
f9133be
Compare
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
f9133be to
d18b0b0
Compare
renovate
Bot
changed the title
|
@coderabbitai review and analyze why tests are failing |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="nextcloud/mail"
pr="13238"
echo "=== PR metadata and changed files ==="
gh pr view "$pr" --repo "$repo" --json number,title,headRefName,baseRefName,changedFiles,files,statusCheckRollup \
--jq '{number,title,headRefName,baseRefName,changedFiles,files:[.files[].path],checks:[.statusCheckRollup[] | {name,conclusion,status,detailsUrl}]}'
echo "=== Check runs ==="
gh api "repos/$repo/commits/$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq .headRefOid)/check-runs?per_page=100" \
--jq '.check_runs[] | {name,status,conclusion,details_url,started_at,completed_at}'
echo "=== Recent workflow runs for the PR ==="
gh run list --repo "$repo" --branch "$(gh pr view "$pr" --repo "$repo" --json headRefName --jq .headRefName)" --limit 30 \
--json databaseId,name,displayTitle,status,conclusion,event,workflowName,url,createdAt,updatedAt \
--jq '.[] | select(.conclusion == "failure" or .status != "completed")'
echo "=== Failed workflow job logs ==="
while IFS= read -r run_id; do
echo "--- Run $run_id ---"
gh run view "$run_id" --repo "$repo" --json jobs \
--jq '.jobs[] | select(.conclusion == "failure") | {name,databaseId,conclusion,steps:[.steps[] | select(.conclusion == "failure") | {name,number,conclusion}]}'
while IFS= read -r job_id; do
echo "--- Failed job $job_id log (tail) ---"
gh run view "$run_id" --repo "$repo" --job "$job_id" --log-failed | tail -n 250 || true
done < <(gh run view "$run_id" --repo "$repo" --json jobs --jq '.jobs[] | select(.conclusion == "failure") | .databaseId')
done < <(gh run list --repo "$repo" --branch "$(gh pr view "$pr" --repo "$repo" --json headRefName --jq .headRefName)" --limit 30 --json databaseId,conclusion --jq '.[] | select(.conclusion == "failure") | .databaseId')Length of output: 20703 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="nextcloud/mail"
pr="13238"
echo "=== Dependency diff ==="
gh pr diff "$pr" --repo "$repo" -- package.json package-lock.json
echo "=== Failed job definitions and logs ==="
for run_id in 29816003815 29787625491 29506887995; do
echo "===== Workflow run: $run_id ====="
gh api "repos/$repo/actions/runs/$run_id/jobs?per_page=100" \
--jq '.jobs[] | select(.conclusion == "failure") | {id,name,conclusion,html_url,started_at,completed_at,failed_steps:[.steps[] | select(.conclusion == "failure") | .name]}'
echo "--- Failure log ---"
gh run view "$run_id" --repo "$repo" --log-failed || true
done
echo "=== CKEditor entries in PR package manifests ==="
rg -n -C 3 '"ckeditor5"|node_modules/ckeditor5|`@ckeditor/ckeditor5`' package.json package-lock.json | head -n 300Length of output: 1181 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="nextcloud/mail"
echo "=== Dependency diff ==="
git diff --no-ext-diff origin/main...HEAD -- package.json package-lock.json
echo "=== Failed job metadata and logs ==="
for run_id in 29816003815 29787625491 29506887995; do
echo "===== Workflow run: $run_id ====="
gh api "repos/$repo/actions/runs/$run_id/jobs?per_page=100" \
--jq '.jobs[] | select(.conclusion == "failure") | {id,name,conclusion,html_url,started_at,completed_at,failed_steps:[.steps[] | select(.conclusion == "failure") | .name]}'
gh api "repos/$repo/actions/runs/$run_id/jobs?per_page=100" --jq '.jobs[] | select(.conclusion == "failure") | .id' \
| while IFS= read -r job_id; do
echo "--- Log for failed job $job_id ---"
gh api -H 'Accept: application/vnd.github+json' \
"repos/$repo/actions/jobs/$job_id/logs" \
| tail -n 300 || true
done
done
echo "=== CKEditor package entries ==="
rg -n -C 3 '"ckeditor5"|node_modules/ckeditor5|`@ckeditor/ckeditor5`' package.json package-lock.json | head -n 300Length of output: 195662
This occurs inside The failure reproduced across all three workflow attempts, so this is not CI flakiness. Recommendation: do not merge this update unless Mail has an CKEditor license key entitled for the LTS edition. Otherwise, remain on 47.6.2 or upgrade to the next standard-release major line (v48+) after validating compatibility. This would also avoid a potential production editor-load failure, not merely fix CI. ✅ Action performedReview finished.
|
📝 WalkthroughWalkthroughThe package manifest updates the ChangesCKEditor 5 dependency
Estimated code review effort: 1 (Trivial) | ~2 minutes Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 33db2930-a378-41b8-8483-5a0a5ddb8339
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (1)
package.json
| "@riophae/vue-treeselect": "^0.4.0", | ||
| "address-rfc2822": "^2.2.4", | ||
| "ckeditor5": "^47.6.2-alpha.0", | ||
| "ckeditor5": "^47.7.3", |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf 'package.json:\n'
nl -ba package.json | sed -n '35,60p'
printf '\nsrc/components/TextEditor.vue:\n'
nl -ba src/components/TextEditor.vue | sed -n '1,220p'
printf '\npackage-lock.json ckeditor5 refs:\n'
rg -n '"ckeditor5"|licenseKey|license-key-lts-not-allowed' package-lock.json src/components/TextEditor.vue package.jsonRepository: nextcloud/mail
Length of output: 206
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
for path, start, end in [
("package.json", 35, 60),
("src/components/TextEditor.vue", 1, 220),
]:
print(f"\n== {path} ==")
text = Path(path).read_text(encoding="utf-8").splitlines()
for i, line in enumerate(text[start-1:end], start=start):
print(f"{i:>4}: {line}")
print("\n== package-lock.json matches ==")
import subprocess, shlex
cmd = r"rg -n '\"ckeditor5\"|licenseKey|license-key-lts-not-allowed' package-lock.json src/components/TextEditor.vue package.json"
subprocess.run(cmd, shell=True, check=False)
PYRepository: nextcloud/mail
Length of output: 9270
🌐 Web query:
CKEditor 5 47.7.3 license-key-lts-not-allowed GPL licenseKey LTS-only 47.7.x
💡 Result:
The license-key-lts-not-allowed error in CKEditor 5 occurs when using an LTS (Long-Term Support) version of the editor—such as version 47.7.3—with a GPL license key [1][2]. Beginning with version 47.7.0, the CKEditor 5 v47.x line transitioned to a maintenance phase that is exclusively available to customers with a commercial LTS Edition subscription [3][4][5]. This release introduced mandatory license verification that specifically blocks the use of GPL or standard commercial keys [4][5]. To resolve this issue, you have two primary options: 1. Switch to the Regular Release Line: If you intend to continue using the GPL license, you must use a non-LTS version of CKEditor 5 [2][4]. Migrate your project to the latest version of the standard release line (e.g., v48.x or newer), which remains compatible with the GPL license key [2][4][5]. 2. Obtain an LTS Subscription: If your project requires the long-term stability and specific security/compatibility fixes provided by the v47.x LTS line, you must purchase a commercial CKEditor 5 LTS Edition subscription [3][5]. Once obtained, you will be provided with a license key that permits the use of these versions [6][3]. In summary, the LTS-only distribution cannot be used under the GPL [7][8][9]. Open-source and standard commercial users should avoid upgrading to versions 47.7.0 and later to prevent this error [4][5].
Citations:
- 1: CKEditor intermittently blocks blog description input with license-key-lts-not-allowed error in Elgg 7.0.2 Elgg/Elgg#15108
- 2: https://github.com/oumarkonate/ckeditor5-simple-space
- 3: https://ckeditor.com/docs/ckeditor5/latest/getting-started/setup/using-lts-edition.html
- 4: https://ckeditor.com/blog/ckeditor-47-7-0-release-highlights/
- 5: https://github.com/ckeditor/ckeditor5/blob/v47.7.0/CHANGELOG.md
- 6: https://ckeditor.com/docs/ckeditor5/latest/getting-started/licensing/license-key-and-activation.html
- 7: https://ckeditor.com/docs/ckeditor5/latest/getting-started/licensing/license-and-legal.html
- 8: https://ckeditor.com/legal/ckeditor-licensing-options/
- 9: https://github.com/ckeditor/ckeditor5/blob/master/docs/getting-started/licensing/license-and-legal.md
Do not upgrade CKEditor 5 to 47.7.x without an LTS entitlement. ckeditor5@^47.7.3 is an LTS-only release line and rejects licenseKey: 'GPL' in src/components/TextEditor.vue, so the editor will fail to initialize. Use a non-LTS CKEditor 5 release line (for example v48+) or add a valid LTS license key.
There was a problem hiding this comment.
This app is open source (AGPLv3-or-later) and uses the open source "license" of CKEditor
There was a problem hiding this comment.
@ChristophWurst, understood—this explains the use of CKEditor’s open-source (GPL) license key. However, it does not grant access to CKEditor’s paid 47.7.x LTS line: the reported license-key-lts-not-allowed failure is precisely the LTS entitlement check rejecting that key.
So the concern remains: this update needs either a CKEditor LTS license key or a move to a non-LTS release line (v48+) that supports the open-source license.
1 participant
This PR contains the following updates:
^47.6.2-alpha.0→^47.7.3Release Notes
ckeditor/ckeditor5 (ckeditor5)
v47.7.3Compare Source
We are happy to announce the release of CKEditor 5 v47.7.3.
Release highlights
The release addresses vulnerabilities identified in the
protobuf.jspackage, used within our@ckeditor/ckeditor5-operations-compressorpackage for real-time collaboration.Our analysis confirms that vulnerabilities do not affect CKEditor 5.
This release primarily aims to ensure that our customers using real-time collaboration features do not encounter unnecessary security alerts from their scanning tools. We are committed to maintaining the highest security standards, and this update reflects our ongoing efforts to safeguard user environments proactively.
Released packages
Check out the Versioning policy guide for more information.
Released packages (summary)
Other releases:
v47.7.2Compare Source
We are happy to announce the release of CKEditor 5 v47.7.2.
Release highlights
The release addresses vulnerabilities identified in the
protobuf.jspackage, used within our@ckeditor/ckeditor5-operations-compressorpackage for real-time collaboration.Our analysis confirms that vulnerabilities do not affect CKEditor 5.
This release primarily aims to ensure that our customers using real-time collaboration features do not encounter unnecessary security alerts from their scanning tools. We are committed to maintaining the highest security standards, and this update reflects our ongoing efforts to safeguard user environments proactively.
Released packages
Check out the Versioning policy guide for more information.
Released packages (summary)
Other releases:
v47.7.1Compare Source
We are happy to announce the release of CKEditor 5 v47.7.1.
Release highlights
The release addresses a vulnerability identified in the
protobuf.jspackage (CVE-2026-41242), used within our@ckeditor/ckeditor5-operations-compressorpackage for real-time collaboration.Our analysis confirms that this vulnerability does not affect CKEditor 5, as all protobuf definitions are static and pre-compiled at build time, and are never parsed or compiled from untrusted input at runtime - which is the condition required to exploit this issue.
This release primarily aims to ensure that our customers using real-time collaboration features do not encounter unnecessary security alerts from their scanning tools. We are committed to maintaining the highest security standards, and this update reflects our ongoing efforts to safeguard user environments proactively.
Released packages
Check out the Versioning policy guide for more information.
Released packages (summary)
Other releases:
v47.7.0Compare Source
Release highlights
CKEditor 5 v47.7.0 is the first maintenance release in the CKEditor 5 Long-term Support (LTS) Edition line. The LTS Edition is a paid add-on to a CKEditor 5 license for teams that want to stay on one major version longer while continuing to receive security updates and selected compatibility fixes.
This release introduces license verification for the LTS Edition. If your license key does not include LTS access, the editor will fail to load. Aside from this license verification, no other changes were introduced in this release.
Which version should you use?
What is CKEditor 5 LTS Edition?
CKEditor 5 LTS Edition is designed for teams that prefer long-term stability over frequent upgrades. It lets you stay on a single major version for up to 3 years, while receiving security updates and compatibility fixes without breaking changes. Unlike the standard release line, which delivers several major releases each year, LTS focuses on stability and predictable maintenance rather than ongoing feature development.
To learn more, visit the LTS documentation.
How to obtain CKEditor 5 LTS Edition?
It is available as a paid add-on to your existing CKEditor 5 license. Contact our sales team for pricing and a tailored plan.
Released packages
Check out the Versioning policy guide for more information.
Released packages (summary)
Other releases:
Configuration
📅 Schedule: (in timezone Europe/Vienna)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.