It looks like Drupal 8.4 brought an update to CKEditor from 4.6 to 4.7 where essentially CKEditor ended functionality for the paste buttons, seemingly because they were a security issue. Clicking on any of the paste buttons (paste, paste as plain text, paste from Word) gets you a popup that reads some variation of, "Your browser doesn't allow you to paste this way. Press ⌘+V to paste." We're a Mac shop, hence the Command-V message. However the functionality when pasting from Google Docs is very different with ⌘+V, in that all of the text being pasted gets marked up in bold via many, many, maaaaannny STRONG tags. The only option is to delete all of the STRONG tags and then go back and re-bold anything that actually was bold beforehand.
This seems to be a CKEditor issue and in part a Google Docs issue, but from the perspective of my content editors -- who all use Google Docs and paste text from there -- a Drupal upgrade broke the site. In a way it did. They had a WYSIWYG approach that worked for 15 months and then they lost functionality after I updated to 8.4. It's also not the only thing that broke when upgrading from 8.3 to 8.4 so for me this is part of a broader issue where there is a fragility that is concerning for minor upgrades that will happen twice a year. Every minor update seems to mean a lot of backpedaling to regain functionality or work around newly introduced issues. If we do decide to go with the latest versions of other communities software, like CKEditor, should we not be sure they are still working well?
In any event, that is neither here nor there, but I thought I'd share that discussions in CKEditor issues imply that 4.6 still works even though the 4.7 error message implies that the browsers block this... which clearly they are not if 4.6 still works. While backtracking a version of CKEditor was a fine solution for others it does not seem to be recommended for Drupal 8 in the era of Composer. Drupal people on those forums seemed frustrated. Is there a recommended approach for going back to "works better for us" versions of other software like CKEditor bundled in Drupal 8?
And for anyone else with the same issue I thought I'd share that our two temporary workarounds. The first is our backup plan and involves pasting into Word and then pasting from Word into CKEditor. It messes up headings and one or two other things, but keeps most of the more tedious to replace stuff. The preferred approach is we added gd2md-html add-on from Google Docs. There are always security concerns with 3rd-party add-ons but this one seems okay and this risk is mitigated by the fact that the vulnerability is only on documents where you use this tool and documents we use this for are going to be public anyway.
