Bump tinymce from 7.9.2 to 8.4.0

[dependabot]

Bumps tinymce from 7.9.2 to 8.4.0.

Changelog

Sourced from tinymce's changelog.

8.4.0 - 2026-03-31

Added

• New view_show option to display a specified view on initialization. #TINY-11967
• New errorHandler option for dropzone dialog components. #TINY-13420
• The noneditable feature can now be disabled with the new allow_noneditable option. #TINY-10121
• Editor option content_id for uniquely identifying the edited document. #TINY-13379
• New table_default_header_rows and table_default_header_cols options to set the default header size for new tables #TINY-13391

Improved

• The file upload feature of link and image dialogs now provide feedback when an unsupported file type is selected. #TINY-13420
• Directionality buttons now only appear active when directionality is set on the selected block. #TINY-13337
• Directionality buttons now always toggle the directionality attribute on selected blocks. #TINY-13337

Changed

• The border-color style with multiple rgb colors would be compressed into border incorrectly #TINY-13393
• Element Path now uses the ARIA-role "group" with an aria-label #TINY-13338

Fixed

• Now link dialog allows uploading empty files. #TINY-13421
• The link dialog now allows uploading empty files. #TINY-13421
• Bundled content CSS is now loaded into preview iframes. #TINY-13190
• Attempting to remove a link after a contentEditable="false" element was not possible. #TINY-13108
• Some formatting was not applied to items in multilevel list. #TINY-13324
• Dialogs did not retain focus when using the block/unblock API. #TINY-12918
• Setting width via Table Properties did not apply when table_style_by_css was false. #TINY-12797

Security

• Updated DOMPurify version to 3.3.2. #TINY-14180

8.3.2 - 2026-01-14

Fixed

• The uc-video element is no longer refreshed on undo/redo. #TINY-12884

8.3.1 - 2025-12-17

Fixed

• Views could not be opened during the init event. #TINY-13463

8.3.0 - 2025-12-10

Added

• New documents_file_types option. #TINY-13278
• New files_upload_handler and link_uploadtab options in the Link plugin. #TINY-13278
• New upload tab to the link dialog when files_upload_handler, documents_file_types, and link_uploadtab are all specified. #TINY-13278
• New options for dropzone dialog components: dropAreaLabel, buttonLabel, allowedFileTypes and allowedFileExtensions. #TINY-13278

Improved

• Accordions can now be opened and closed when the editor is in a read-only state. #TINY-12316

... (truncated)

Commits

• 88fbc51 TINY-12499: Generate changelog for TinyMCE 8.4.0 release (#11009)
• 28dc74c Revert "TINY-9655: Prevent valid iframe, script, style, and meta elements fro...
• 2bf07fc Publish
• 2b50dbb TINY-14180: Update DOMPurify to 3.3.2 (#11034)
• 711246b TINY-14145: Add tinymceai controls to the default menubar and toolbar (#11023)
• 6449634 TINY-14139: Add tinymceai to the list of urls (#11020)
• a0f26be TINY-13190: Load skin UI content CSS as a resource (#11016)
• c2c0dd5 TINY-13338: Update ARIA attributes of Element Path (#10962)
• ff80847 TINY-12797: Set width based on table_style_by_css in table dialog (#10925)
• 44fcf14 TINY-9655: Prevent valid iframe, script, style, and meta elements from being ...
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)