Fixed article saving errors caused by corrupted block data, non-stretchable tables, and emoji usage.
Lists have been migrated to EditorjsList; nested items and checklists are now supported, along with line break preservation.
During update installation, component files are copied.
Stored XSS in tables has been fixed: recursive cell cleaning, header and data escaping upon output.
Redirects to external sites via back_url_settings have been fixed.
A list of allowed block types has been added before connecting editor.blocks component templates.
File uploads require authorization, POST requests, and CSRF tokens. Type, MIME, and size checks have been added; documents are served via a download handler. Image URL imports are restricted to HTTP and HTTPS protocols; internal addresses and redirects are prohibited.
Upload checks consider plugin_attaches_types for documents and plugin_image_types for images, including URL imports.
Form saving has been fixed: submission waits for editor readiness and completion of all block saves. Block IDs and line breaks in legacy lists are preserved; disabling embed does not disrupt editor initialization.
Alignment of long editor menu items has been fixed, and table stretching is restored after reopening.