textAngular still runs on execCommand and still points at the old owner

Every download address still names the fraywing account

The repository sits under the textAngular organisation, and almost every address printed on its page names a different owner. Both CI badges, at the top of the file, point into fraywing. The GitHub route tells you to download from `https://github.com/fraywing/textAngular/releases/latest`. The manifest's repository field is `git://github.com/fraywing/textAngular.git`. Meanwhile the demo is served from the project domain textangular.com, with an editable Plunkr demo linked beside it. Nothing on the page states whether the old path still serves the same archives as the repository you are reading, so a reader following the documented download route is trusting a redirect to land on the code they came to inspect. Two maintainers are named in the manifest, Fraywing and SimeonC, and the same manifest records the homepage as textangular.com rather than a repository address.

The page asks for Angular 1.3 and the manifest asks for 1.2

The stated requirements are AngularJS 1.3 or newer, Rangy 1.3 or newer with both the rangy-core and rangy-selectionsaverestore modules, Font-Awesome 4 or newer for the default toolbar icons, and Bootstrap 3 or newer for the default styles, where the CSS only build is enough. The manifest disagrees with the first of those, listing angular at `^1.2.x`. It also puts angular, rangy, bootstrap and font-awesome into a block called `browserDependencies`, which is not a key the package manager acts on, so the only entry under `dependencies` that installs by itself is rangy at `^1.3.0`. Angular, Bootstrap and Font-Awesome are therefore your problem to install, which lines up with the toolbar complaint further down the page: a toolbar whose buttons render blank is the documented symptom of Font-Awesome being absent. The manifest's own entry point is `./dist/textAngular.umd.js`, so what a bundler resolves is a built UMD file in `dist`, not the sources in `src`.

The rich text layer is the browser's execCommand set

The project's own explanation of how the editor works is one sentence: textAngular uses `execCommand` for the rich text functionality. The page does not dress that up. It calls the command set a fairly experimental browser feature that may not behave the same in all browsers, and links to a third-party compliance page listing how each browser scores against it. The tested list is Chrome, Safari, Opera, Firefox and Internet Explorer 8 and later. That single dependency explains most of what makes this editor feel dated: the formatting verbs come from the document editing API rather than from a component library, so what the toolbar can offer is bounded by what each browser still implements, and the differences between browsers are not something the project papers over. Additional options are not on this page at all; they are deferred to a wiki, which means the option list a new adopter needs lives outside the repository.

One file with two names, and the sanitizer is deliberately loosened

The most consequential installation note is that `textAngular-sanitize.js` and Angular's own `angular-sanitize.js` are the same file, and you must include one or the other but never both. The project recommends its own copy, on the grounds that it loosens parts of the sanitizer that are too strict for how this editor works and adds features the editor needs. Two consequences follow, both documented. The default sanitizer strips iframes, because iframes are treated as a security risk, so inserting a YouTube video produces a placeholder tag instead of an embed; the video is turned back into a real player by the project's own renderers, which you invoke outside the editor with a bind directive:

<div ta-bind ng-model="data.htmlcontent"></div>

And if you keep Angular's stricter sanitizer instead, the page warns that `ng-bind-html` will strip out every style attribute in your content, which is a different kind of loss. The placeholder approach is the interesting part: rather than widen the sanitizer to allow iframes, it keeps the sanitizer closed and moves the decision into a rendering step you control.

Six install routes, and the two CDN examples pin an older version

The page offers Bower, npm, a CommonJS require for webpack or Browserify, CDNJS, jsDelivr, and a release archive. The npm route is the shortest, and the script tags it asks for are the usual four files:

<link rel='stylesheet' href='/node_modules/textangular/dist/textAngular.css'>
<script src='/node_modules/textangular/dist/textAngular-rangy.min.js'></script>
<script src='/node_modules/textangular/dist/textAngular-sanitize.min.js'></script>
<script src='/node_modules/textangular/dist/textAngular.min.js'></script>

For CommonJS the sanitizer has to be required before the editor itself, which the page spells out as an optional step. Both CDN examples, though, name version 1.5.0, and the jsDelivr one goes further and merges the three files into a single request:

<script src='http://cdn.jsdelivr.net/g/[email protected](textAngular-rangy.min.js+textAngular-sanitize.min.js+textAngular.min.js)'></script>

So a reader who copies the CDN snippet gets a build older than the one npm or Bower hands them, with no note that the versions differ. Every CDN address on the page is written with `http://` rather than `https://`, which is another reason to prefer the package manager route.

The test entry point begins by installing from bower

The manifest has exactly one script, and it is not a modern one:

bower install && grunt travis-test --verbose

So running the test suite means installing front end packages through Bower first, which is consistent with a `bower.json` and a `.bowerrc` sitting in the repository root, and it means the pipeline depends on a package manager the project has since stopped being able to assume. The development dependencies describe the same era: Grunt 1.0 with the usual contrib plugins, `grunt-umd` for the UMD bundle, Karma at 1.2, a PhantomJS launcher with `phantomjs` pinned at 2.1.7, jasmine-core at 2.5, coverage through grunt-istanbul, and a coveralls reporter. Two Karma configuration files sit at the root, one for jQuery and one for the lite build. Coverage is pinned hard at `0.0.5`, the kind of version that stops resolving the moment a transitive dependency moves. Nothing in the scripts section builds, publishes, or lints anything beyond that single test command.

The newest release is from 2016 while the branch was pushed in 2023

The version picture has a long tail. The page header reads textAngular v1.5.16, and the manifest agrees at 1.5.16. The three most recent releases are v1.5.14 on 2016-11-30, v1.5.15 on 2016-12-04 and v1.5.16 on 2016-12-05, three patches inside six days. The default branch, meanwhile, was last pushed on 2023-09-20, so roughly seven years of commits sit above the newest tag with no release attached to them. For an adopter that splits the question in two: the documented, installable version is the 2016 one, while anything built from the branch is code no release ever described and no changelog entry covers. The repository counts also sit in that state, with 3942 stars, 1116 forks and 540 open issues against a project whose last tag predates most of the current AngularJS discussion.

The page's own numbering breaks in the requirements and the FAQ

Small things in the document tell you how it is maintained. The requirements list is numbered 1, 2, 3, then 1 again for Bootstrap, then 5, because the list was edited by hand rather than regenerated. The FAQ does the same thing: the toolbar entry and the YouTube entry are both numbered 1, and the entry after them is numbered 2. The upgrade notes for anyone coming from 1.2.2 or earlier are the most useful paragraph on the page, since they name the two breaking changes of that jump: styling moved into `dist/textAngular.css`, and Rangy became a hard requirement in two modules, or the minified combination already sitting in the dist folder. The root of the repository holds the Gruntfile, `changelog.md`, `CONTRIBUTING.md`, a Travis configuration, a `demo` directory with three demo pages, plus `dist`, `src` and `test`, and no license file, even though the manifest declares MIT.

Editorial conclusion

This is a workable choice for an application still on AngularJS that needs a rich text field with two way binding on HTML, and a poor choice for anything new. Before you adopt it, check four things. Whether your Angular version is one the page and the manifest agree on, because the page asks for 1.3 or newer while the manifest's browser dependency block still names 1.2. Whether your build can supply a sanitizer you trust, since the project's recommendation is to load its own loosened copy instead of Angular's, and the difference is exactly the rule that strips iframes. Whether your dependency pipeline still works with a package whose test entry point runs `bower install` before Grunt. And whether the address you clone from is the one you think it is, since the page, the badges and the manifest repository field all point at fraywing while the repository itself is under the textAngular organisation. The manifest declares the MIT license, but no license file is present in the repository root, so check that before redistributing. The branch was last pushed on 2023-09-20 and the newest release is v1.5.16 from 2016-12-05.

Frequently asked questions

Official sources

1. Official README
2. Project repository
3. Release notes