Issue #196: Update TinyMCE to v8.5.1

libraries/tinymce/CHANGELOG.md

@@ -5,6 +5,29 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
+## 8.5.1 - 2026-05-19
+
+### Security
+- Fixed media plugin `data-mce-object` injection leading to stored XSS. #TINY-14357
+- Fixed stored XSS vulnerability through `mce:protected` comments. #TINY-14353
+- Fixed stored XSS vulnerability through `data-mce-` prefixed `src`, `href`, `style` attributes. #TINY-14333
+
+## 8.5.0 - 2026-04-29
+
+### Added
+- New `content_language` option to set the `lang` attribute on the iframe's `html` element or the inline editor's target element. #TINY-11214
+
+### Improved
+- Improved visual styling of inline diff highlights in Suggested Edits and TinyMCE AI plugin. #TINY-13958
+
+### Fixed
+- Script and style elements would incorrectly be removed by DomPurify when considered valid in the schema. #TINY-9655
+- Iframe elements with children would incorrectly be removed by DomPurify. #TINY-9655
+- Certain combinations of divs inside of lists would cause issues turning off lists. #TINY-14070
+- Certain selections would delete the editor body, causing issues. #TINY-14149
+- URIs with non-Latin1 characters were returning an error. #TINY-13938
+- Alert and confirm dialogs were not announced properly by some screen readers. #TINY-13812
+
 ## 8.4.0 - 2026-03-31
 
 ### Added

libraries/tinymce/js/tinymce/tinymce.d.ts

@@ -2101,6 +2101,7 @@ interface BaseEditorOptions {
     content_css_cors?: boolean;
     content_security_policy?: string;
     content_style?: string;
+    content_language?: string;
     content_langs?: ContentLanguage[];
     contextmenu?: string | string[] | false;
     contextmenu_never_use_native?: boolean;

tinymce.module

@@ -434,7 +434,7 @@ function tinymce_library_info() {
   $libraries['tinymce'] = array(
     'title' => 'TinyMCE',
     'website' => 'https://www.tiny.cloud/',
-    'version' => '8.4.0',
+    'version' => '8.5.1',
     'js' => array(
       $path . '/libraries/tinymce/js/tinymce/tinymce.min.js' => array(
         'preprocess' => FALSE,