Would have a look at the high and medium flagged CC review comments

AI Code Review

🔶 Changes requested — one or more medium-severity items must be addressed

What was reviewed

Skipped (out of scope): dist/, pnpm-lock.yaml, openspec markdown docs

Findings

🔶 Medium — E2E tests failing in CI

File: packages/pluggableWidgets/rich-text-web/e2e/RichText.spec.js
Problem: The prior CI run (30106298121) failed on "Run automated end-to-end tests (0)" with screenshot diffs uploaded as artifact test-screenshot-results-0. The tests must be green before merge.
Fix: Re-run the E2E tests after committing the missing snapshot baselines (see finding below) and verify all screenshot comparisons pass.

🔶 Medium — Missing snapshot baselines for new tests

File: packages/pluggableWidgets/rich-text-web/e2e/RichText.spec.js lines 125, 170
Problem: Two new tests call toHaveScreenshot() with names that have no committed baseline PNG in the snapshots directory:

• classModeEditor.png (referenced on line 125)
• classModeViewCodeDialog.png (referenced on line 170)

Without a committed baseline Playwright will fail on the first run (or silently write a new baseline, making CI non-deterministic on subsequent runs).
Fix: Run the E2E suite with --update-snapshots to generate these two baselines, then commit classModeEditor-chromium-linux.png and classModeViewCodeDialog-chromium-linux.png to the snapshots directory.

🔶 Medium — page.waitForTimeout() (hardcoded sleep) in test

File: packages/pluggableWidgets/rich-text-web/e2e/RichText.spec.js line 212
Problem: await page.waitForTimeout(500) is a hardcoded sleep. Per the E2E test guidelines this is prohibited — it makes tests flaky on slow machines and wastes time on fast ones.
Fix: Replace with a web-first locator assertion that waits for the observable side-effect. For the empty-content test this is likely waiting for the blur/save cycle; assert the editor's content state directly:

// Instead of await page.waitForTimeout(500):
await expect(page.locator(".mx-name-richText1 .tiptap")).toHaveText("");
// or wait for the bound attribute to reflect the empty value if accessible in the DOM

⚠️ Low — PR description not filled in

File: PR body
Note: The PR template sections ("Pull request type" and "Description") are all still commented out. None of the type checkboxes are uncommented and there is no written description. This makes it hard for reviewers and future git archaeology to understand what this PR does. Please uncomment the relevant type(s) and add a summary of the changes.

⚠️ Low — Breaking change not called out prominently in CHANGELOG

File: packages/pluggableWidgets/rich-text-web/CHANGELOG.md
Note: The entry "Empty content now correctly saves as "" ... This is a breaking change for forms that were relying on the incorrect behavior" is placed under ### Fixed with only an inline note. Per Keep a Changelog conventions, breaking changes belong in a dedicated ### Changed or ### Breaking Changes section (or at a minimum get a **Breaking:** prefix) so consumers scanning the changelog don't miss the behavior change. Consider promoting this to its own callout.

Positives

• All new E2E tests use @mendix/run-e2e/fixtures and waitForMendixApp — no raw Playwright imports or manual logout.
• The class-mode assertion test (checks that class mode editor output uses CSS classes instead of inline styles) uses semantic HTML assertions rather than screenshot-only verification — much more robust for logic coverage.
• Snapshot files for updated tests (inlineBasicMode, toolbarBasicMode) are committed alongside the spec changes.
• editorConfig.ts correctly adds helpButton to toolbarGroupKeys to keep the hide-properties logic aligned with the new XML property.
• CHANGELOG entry is detailed, user-facing, and covers the security CVE fix, new features, and the breaking behavior change.