CKEditor 5 v49.0.0 Adds Shadow DOM and Trusted Types Support

Developers can now integrate CKEditor 5 into Shadow DOM components and applications enforcing Trusted Types security policies with the release of version 49.0.0. The update also introduces changes to the editor's appearance, AI-assisted review and error handling, according to a release overview published on 14 October 2026 by Gökçe Tosun, Product Marketing Manager at CKEditor.

The release has relevance for Drupal, which uses CKEditor 5 for rich-text editing. However, the announcement concerns the upstream editor and does not confirm that version 49.0.0 is available in Drupal core. Its implications for Drupal installations will depend on the versions and integrations they support.

Shadow DOM support allows CKEditor 5 to run inside isolated web components without the custom workarounds previously required. The editor supports selection, focus, scrolling, drag-and-drop interactions and floating interface elements within an open shadow root; closed shadow roots are not supported. Developers must load the editor's styles into that environment, while a new config.ui.overlayContainer option controls where dialogs, tooltips and other floating elements appear. CKEditor says premium features, including collaboration and AI tools, are also compatible with the integration.

The release also adds compatibility with applications enforcing Trusted Types through Content Security Policy. CKEditor 5 now routes HTML insertion through a policy named ckeditor5, allowing the editor to operate under stricter browser security requirements. Some third-party interface components may be disabled when they cannot comply with the policy. CKEditor cautions that Trusted Types support does not sanitise content, and developers remain responsible for validating data loaded into the editor.

Visual changes include a refreshed default theme and a reorganised system of CSS design tokens covering foundation, semantic and component-level properties. Existing core theme overrides retain backward compatibility, although customised CKEditor AI interfaces require updated variable names. The release also changes certain content styles, which may affect the appearance of published material using those styles.

CKEditor AI Review now allows proposed edits to be submitted as Track Changes suggestions rather than applied directly to content. Editors can accept or reject those suggestions, supported by navigation and progress indicators. AI Review, AI Quick Actions and proposed changes in AI Chat also share a more consistent interface.

Error handling has changed with the removal of the @ckeditor/ckeditor5-watchdog package and its automatic restart mechanism. Following an error, the editor remains in place with its content and undo history preserved, although its state may be inconsistent and the host application must decide how to recover. The new onEditorError() function reports errors without restarting the editor. Developers previously using ContextWatchdog must also adjust how shared editor contexts are created.

Version 49.0.0 includes breaking changes across several features, including a move to ES2023 and native CSS nesting in distributed stylesheets. CKEditor has published migration guidance and introduced an AI coding-agent skill intended to assist with upgrades. Developers maintaining CKEditor integrations, including those used alongside Drupal, should review the relevant compatibility requirements before adopting the release.