build(deps-dev): bump action_text-trix from 2.1.15 to 2.1.18

[dependabot]

Bumps action_text-trix from 2.1.15 to 2.1.18.

Release notes

Sourced from action_text-trix's releases.

v2.1.18

Security

• Sanitize javascript: URI in JSON drag-drop deserialization by @​flavorjones in basecamp/trix#1293

Infrastructure/CI

• ci: harden GitHub Actions workflows by @​flavorjones in basecamp/trix#1284

Full Changelog: basecamp/trix@v2.1.17...v2.1.18

v2.1.17

Security

• Address potential XSS vector via data-trix-serialized-attributes sanitizer bypass by @​flavorjones in basecamp/trix#1282

Bug fixes

• Fix bullets merging with prior elements on Firefox when the first node is removed by @​monorkin in basecamp/trix#1280

Infrastructure/CI

• Replace Karma with @web/test-runner by @​flavorjones in basecamp/trix#1272
• ci: get green (2026-01-09 edition) by @​flavorjones in basecamp/trix#1276
• Report web-test-runner test failures by @​flavorjones in basecamp/trix#1275

Chores

• Update README.md by @​Cromian in basecamp/trix#1239

New Contributors

• @​monorkin made their first contribution in basecamp/trix#1280
• @​Cromian made their first contribution in basecamp/trix#1239

Full Changelog: basecamp/trix@v2.1.16...v2.1.17

v2.1.16

Security

• Attachment href attributes are now validated using DOMPurify.isValidAttribute() before rendering as anchor tags. @​flavorjones

Added

• New .editorElements and .editorElement properties have been added to <trix-toolbar> elements for accessing associated <trix-editor> elements. @​seanpdoyle #1127
• <trix-editor> elements can now function without an associated <input type="hidden"> element when using ElementInternals. This is configured by setting willCreateInput = false in the before-trix-initialize event and using the [name] attribute for form submissions. @​seanpdoyle #1128
• Alt text can now be set on attachment preview images via attachment.setAttributes({ alt: "..." }) in trix-attachment-add event handlers. @​seanpdoyle #1198
• Attachment preview URLs can be customized using the new setPreviewURL() and getPreviewURL() methods on ManagedAttachment, accessible from event handlers. @​seanpdoyle #1210
• A new trix-before-render event is dispatched before rendering, with a customizable render property for advanced use cases like morph-style rendering integration. @​seanpdoyle #1252
• When no associated <input> element is present, HTML content within <trix-editor> tags is now safely sanitized and loaded as the initial editor value. @​seanpdoyle #1253

New Contributors

• @​flavorjones made their first contribution in basecamp/trix#1234
• @​MatheusRich made their first contribution in basecamp/trix#1162

Full Changelog: basecamp/trix@v2.1.15...v2.1.16

Commits

• da88699 v2.1.18
• 9c0a993 Fix XSS via javascript: URI in JSON drag-drop deserialization (#1293)
• e62fcc3 ci: harden GitHub Actions workflows (#1284)
• 2e46d51 v2.1.17
• 53197ab Merge pull request #1282 from basecamp/h1-3581911-serialized-attr
• 3229c29 Fix stored XSS via data-trix-serialized-attributes sanitizer bypass (H1 #3581...
• 7069343 Merge pull request #1239 from Cromian/patch-1
• d9dbf0a Merge pull request #1280 from basecamp/fix-bullets-merging-with-prior-element
• bef13e2 Fix bullets merging with prior elements when the first node is removed
• 194a36c Merge pull request #1275 from basecamp/flavorjones/wtr-failure-messages
• Additional commits viewable in compare view