Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade Quill Dependency to 2.0.0-rc.4 #967

Open
wants to merge 3 commits into
base: master
Choose a base branch
from

Conversation

Repugraf
Copy link

@Repugraf Repugraf commented Apr 4, 2024

This PR updates the quill dependency in react-quill from an outdated version (1.3.7) to the latest release candidate, 2.0.0-rc.4. The previous major version of Quill has not been updated for over five years and includes several security vulnerabilities that have been resolved in version 2.0.

Screenshot 2024-04-04 at 15 15 46

Key Changes

  • Version Upgrade:
    The upgrade to Quill 2.0.0-rc.4 addresses critical security concerns, ensuring a safer and more reliable library for our users.
  • Enhanced Security: The new version includes patches for vulnerabilities identified in the earlier releases, significantly improving the overall security posture of applications using react-quill.
  • Future-Proofing:
    By staying current with Quill's latest versions, we ensure compatibility with future updates and maintain the robustness of react-quill.

@adgoncal
Copy link

adgoncal commented Apr 9, 2024

You forgot to update the yarn lock file. Also, Quill 2.0.0-rc.5 is out, so might as well bump it.

Do note that 2 other PRs have been created in the last few years attempting this same upgrade, but neither were merged: #507 and #711.

It's also worth noting that QuillJS v1.3.7 relies on the browser mutation events, which is deprecated and will be removed from Chrome in July 2024. This means react-quill as is today will not work on Chrome without this change after July 23, 2024.
See https://developer.chrome.com/blog/mutation-events-deprecation

The last time we heard from one of the maintainers of react-quill regarding this was in November of 2023: #914 (comment)

@piesuke
Copy link

piesuke commented Apr 19, 2024

It looks like Quill 2.0 has been officially released.
I think this PR will also need to support Quill 2.0. Is it okay if I create a new Pull Request that is compatible with the new Quill 2.0?

@t-ashraf t-ashraf mentioned this pull request Apr 23, 2024
13 tasks
Sources,
} from 'quill';
import Quill, { QuillOptions as QuillOptionsStatic } from 'quill';
import type { EmitterSource as Sources } from 'quill/core/emitter';
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: EmitterSource can be imported directly from quill:

import type { EmitterSource } from 'quill';

The same applies to Range:

import type { Range } from 'quill';

@mparisi76
Copy link

Hello. Any updates on when this will be merged? Would like to address the DomNodeInserted deprecation message..

@dextel2
Copy link

dextel2 commented May 29, 2024

Hey there, when will this get merged ?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

7 participants