If you ship your own rte-config.js, re-copy it from this release
The documented load order puts a standalone rte-config.js before rte.js, and rte.js carries its own copy of the same defaults. That copy used to assign every key, so anything changed in rte-config.jswas silently put back to our default — measured on the published 2.10.0 and 2.11.0 packages, an edited maxHTMLLength, maxUploadFileSize and text_bold all reverted. The embedded defaults now fill gaps instead: a key already on the page wins, and every key the page lacks is still supplied.
With no standalone file at all — every download-zip install — the result is key-for-key the same as before. The one consequence: an old rte-config.js now wins for every key it contains, including a default a later release changed. That is why it should be re-copied.
Colour picker
The “More colours” picker stored recent colours through localStorage without a guard, so it threw SecurityErrorwherever storage is denied — Safari private mode, sandboxed iframes, blocked site data. It now falls back to memory. The hex field accepts #abc, rgb() and pasted values, recent colours work from the keyboard, every field has an accessible name, and the chosen colour is announced to screen readers.
Files that had fallen behind the core
rte-headless.js, rte-config.js and imageeditor.js had stopped being updated in some packages, the NuGet templates were missing seven plugins, and an empty maintainer script was inside every download zip. A new release check now compares every file shipped next to rte.js, not only rte.js itself.