v0.48.0

v0.48.0 is a maintenance release focused on bug fixes across Markdown, tables, lists, links, and selection. It's headlined by a fix for a v0.46.0 regression that broke native text drag-and-drop ([#8842](https://github.com/facebook/lexical/pull/8842)) and a couple of notable security hardening fixes. It also adds a handful of new features, including an `MdastHtmlExtension` with examples for authoring custom Markdown constructs (collapsibles, `kbd`, alerts, footnotes), a customizable Yjs shared-type root name for collaborative editing, and new table row manipulation helpers.

## New APIs & Features

*   [`@lexical/table`](https://lexical.dev/docs/api/modules/lexical_table) — Added `$moveTableRow` for reordering table rows, plus the previously missing `$unmergeCellNode` export ([#8833](https://github.com/facebook/lexical/pull/8833))
*   [`@lexical/yjs`](https://lexical.dev/docs/api/modules/lexical_yjs) / [`@lexical/react`](https://lexical.dev/docs/api/modules/lexical_react) — The Yjs shared-type root name is now customizable, so Lexical can share a Yjs document with other content that uses a different root key ([#8841](https://github.com/facebook/lexical/pull/8841))
*   [`@lexical/extension`](https://lexical.dev/docs/api/modules/lexical_extension) / [`@lexical/mdast`](https://lexical.dev/docs/api/modules/lexical_mdast) — Added `MdastHtmlExtension` and Markdown custom-construct examples (collapsible sections, `kbd`, alerts, footnotes) demonstrating how to extend the Markdown ↔ mdast pipeline. See the [Markdown & mdast serialization guide](https://lexical.dev/docs/serialization/markdown-mdast) ([#8826](https://github.com/facebook/lexical/pull/8826))

## Notable Fixes

**Drag & drop (fix for v0.46.0 regression)**

*   Don't cancel `dragover` for text drags, so native drops work again ([#8842](https://github.com/facebook/lexical/pull/8842))

**Security**

*   `LinkNode.sanitizeUrl()` now fails closed on unparseable URLs, preventing a potential XSS vector ([#8846](https://github.com/facebook/lexical/pull/8846))
*   Fixed a `serialize-javascript` dependency vulnerability ([#8803](https://github.com/facebook/lexical/pull/8803))

**Markdown & code**

*   Roundtrip overlapping inline formats correctly through mdast/Markdown ([#8825](https://github.com/facebook/lexical/pull/8825))
*   Force re-tokenization after an async language load so highlighting appears once the grammar is ready ([#8830](https://github.com/facebook/lexical/pull/8830))

**Tables**

*   Auto-scroll while drag-selecting cells past the visible edge ([#8822](https://github.com/facebook/lexical/pull/8822))
*   Enable table copy in read-only mode ([#8845](https://github.com/facebook/lexical/pull/8845))

**Lists & character limit**

*   Backspace at the start of a list item now outdents or converts to a paragraph ([#8829](https://github.com/facebook/lexical/pull/8829))
*   Merge adjacent `OverflowNode`s in `useCharacterLimit` ([#8831](https://github.com/facebook/lexical/pull/8831))
*   Count block separators when wrapping character-limit overflow ([#8840](https://github.com/facebook/lexical/pull/8840))

**Links & selection**

*   Disable link opening for disabled autolinks ([#8839](https://github.com/facebook/lexical/pull/8839))
*   Skip `scrollIntoViewIfNeeded` when the selection rect is above the editor, fixing a Safari RTL caret jump ([#8848](https://github.com/facebook/lexical/pull/8848))

## What's Changed
* [lexical-mdast][lexical-markdown] Bug Fix: Roundtrip overlapping inline formats by @etrepum in https://github.com/facebook/lexical/pull/8825
* [lexical-table][lexical-playground] Bug Fix: Auto-scroll while drag-selecting cells past the visible edge by @JohnJunior in https://github.com/facebook/lexical/pull/8822
* [lexical-code-shiki] Bug Fix: force re-tokenize after async language load by @ochevallier in https://github.com/facebook/lexical/pull/8830
* [lexical-react] Bug Fix: Merge adjacent OverflowNodes in useCharacterLimit by @mayrang in https://github.com/facebook/lexical/pull/8831
* Open playground links in a new tab by @potatowagon in https://github.com/facebook/lexical/pull/8837
* [lexical-rich-text][lexical-plain-text] Bug Fix: don't cancel dragover for text drags so native drops work again by @etrepum in https://github.com/facebook/lexical/pull/8842
* [lexical-link] Bug Fix: disable link opening for disabled autolink in… by @ochevallier in https://github.com/facebook/lexical/pull/8839
* [lexical-table] Feature: Add $moveTableRow function & Add missing export for $unmergeCellNode by @hamo-o in https://github.com/facebook/lexical/pull/8833
* [lexical-list] Bug Fix: Backspace at start of list item outdents or converts to paragraph by @mayrang in https://github.com/facebook/lexical/pull/8829
* [lexical-yjs][lexical-react] Feature: Customizable Yjs shared-type root name by @mayrang in https://github.com/facebook/lexical/pull/8841
* [lexical] Chore: Fix serialize-javascript package dependency vulnerability by @vijayojha89 in https://github.com/facebook/lexical/pull/8803
* [lexical-react] Bug Fix: Count block separators in character limit overflow wrapping by @mayrang in https://github.com/facebook/lexical/pull/8840
* Fix: fail closed in LinkNode.sanitizeUrl() on unparseable URLs (XSS) by @xiezhenjia-meta in https://github.com/facebook/lexical/pull/8846
* [lexical-extension][lexical-mdast][dev-mdast-editor-example] Feature: Add MdastHtmlExtension and Markdown custom-construct examples (collapsible, kbd, alerts, footnotes) by @etrepum in https://github.com/facebook/lexical/pull/8826
* [lexical-react][lexical-table] Bug Fix: Enable table copy in read-only mode by @mayrang in https://github.com/facebook/lexical/pull/8845
* Skip scrollIntoViewIfNeeded when the selection rect is above the editor (Safari RTL caret jump) by @jeremy in https://github.com/facebook/lexical/pull/8848

## New Contributors
* @JohnJunior made their first contribution in https://github.com/facebook/lexical/pull/8822
* @jeremy made their first contribution in https://github.com/facebook/lexical/pull/8848

**Full Changelog**: https://github.com/facebook/lexical/compare/v0.47.0...v0.48.0