19397 Commits
Author SHA1 Message Date
yu-i-i 0c8d307575 Make OVERLEAF_OIDC_USER_ID_FIELD support 'email' as a value 2026-09-18 23:09:13 +02:00
yu-i-i f3e5ca9e26 See upstream commit 42ee56e 2026-09-18 23:09:13 +02:00
yu-i-i f793a3965a Fix glitches in symbol palette after switching to Bootstrap 5 2026-09-18 23:09:13 +02:00
yu-i-i 48c4af7545 Whitelist /oidc/login endpoint, fixes #21 2026-09-18 23:09:12 +02:00
yu-i-i 5e4965e784 Add ENV variables to control SAML signature validation 2026-09-18 23:09:12 +02:00
yu-i-i 51e1c3e08b Re-export doLogout (was removed from exports in commit b9fb636). 2026-09-18 23:09:12 +02:00
yu-i-i f3d4a51e79 Refactor authentication code; add OIDC support 2026-09-18 23:02:41 +02:00
yu-i-i 54440bdb58 Allow adding extra flags to LaTeX compiler through environment variable 2026-09-18 20:56:25 +02:00
yu-i-i 6097d93c90 Enable LDAP and SAML authentication support 2026-09-18 20:48:52 +02:00
yu-i-i 3a8ef14900 Enable Symbol Palette 2026-09-18 20:42:16 +02:00
yu-i-i 79c2579d3b Allow selecting a TeX Live image for a project 2026-09-18 20:42:00 +02:00
yu-i-i 236f577974 Enable track changes and comments feature 2026-09-18 20:41:26 +02:00
yu-i-i 65ca4000b9 Redirect non-existing links to Overleaf page 2026-09-18 20:41:15 +02:00
Eric Mc Sween 0ec99c7e3e Merge pull request #37028 from overleaf/em-bibtex-stream-parser
[web] add a streaming bibtex parser

GitOrigin-RevId: 5397ba546a3d5b3436a80eab0467244969b280d0
2026-09-17 12:08:28 +00:00
Eric Mc Sween 0f22a44d1a Merge pull request #37005 from overleaf/em-bibtex-grammar-fixes
[web] match biber in three bibtex parsing edge cases

GitOrigin-RevId: da7e2c0b9f137e7debfe26f09c531a61a135e40e
2026-09-17 12:08:25 +00:00
Eric Mc Sween 7d3d60f2ba Merge pull request #36920 from overleaf/em-shared-frontend-backend
Move shared bibtex model classes to services/web/shared

GitOrigin-RevId: ef768d4f7bcf7b9c4b41844450b0256ecb46fdae
2026-09-17 12:08:21 +00:00
6f784e08c4 Update Organizations card copy on plans page (#36859)
* Update Organizations card text and bullets on plans page

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: thomas- <2176518+thomas-@users.noreply.github.com>
Co-authored-by: Thomas Mees <thomas.mees@overleaf.com>
GitOrigin-RevId: 4eaf5eb547801314c8c8852c1d68fa51532819ac
2026-09-17 12:08:18 +00:00
ThomasandClaude Opus 5 60531d63b7 [web] Add the Back to School group sale banner to the plans page (#36956)
* [web] Add the Back to School group sale banner to the plans page

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
GitOrigin-RevId: 596b23006fce7504fcdfd6341cf93429c08acc8b
2026-09-17 12:08:14 +00:00
Thomas bd8dbe3f11 Merge pull request #32999 from overleaf/tm-objectid-admin-lookup
Extend Project URL Lookup to resolve arbitrary ObjectIds

GitOrigin-RevId: c4006ff8cae38f4141da9cfa153e407e83f0ee7f
2026-09-17 12:08:11 +00:00
Domagoj Kriskovic 48402647b9 [library-sync] List Zotero collections in a sync modal (#36884)
* [library-sync] Zotero collections sync modal

* Update COLLECTIONS_MAX_PAGES to improve request handling and clarify comments

GitOrigin-RevId: f689aa24ca1189b99ad322aa06885f5f969ed81f
2026-09-17 12:08:02 +00:00
Domagoj Kriskovic 79a14571a2 Extract userHasRefProviderFeature and rename refSyncState.synced to syncAvailable
GitOrigin-RevId: 330a7061e88a5179569a7d436f083a8761c472cd
2026-09-17 12:07:59 +00:00
Antoine Clausse 0eac1f1f80 [web] Tear down pro-value-framing (#37016)
* Tear down `pro-value-framing`

* Revert "[web] Add pro-value-framing split test copy (#36628)"

This reverts commit 25b0736af47a3a32f4e1dd108ab0eb14c1bc13e3.

* `make cleanup_unused_locales`

GitOrigin-RevId: 7fdaee52685f8dc415cfa52f28d7fd071740d7e1
2026-09-17 12:07:50 +00:00
Antoine ClausseandClaude Opus 5 943edd29f3 [monorepo] lint .mts/.cts files (#37001)
* [monorepo] lint .mts/.cts files

ESLint's `files` globs listed `{js,jsx,mjs,cjs,ts,tsx}` but never the
module-scoped TypeScript extensions, so every `.mts` file in the repo was
silently skipped with "File ignored because no matching configuration was
supplied" -- 21 files today, all in services/web, and more as backend code
migrates to TypeScript (`.mts` is the extension runtime-loaded backend TS
has to use, since services/web has no `"type": "module"`).

Each extension list now carries the c/m variants of the languages it
already allowed, canonicalised to one of:

    {js,cjs,mjs}                      JS only
    {js,cjs,mjs,jsx}                  JS + JSX
    {js,cjs,mjs,ts,cts,mts}           JS + TS, no JSX
    {ts,cts,mts,tsx}                  TS only
    {js,cjs,mjs,jsx,ts,cts,mts,tsx}   everything

No list gains a language it did not already have, and none gains JSX
where it was previously excluded, so backend globs keep excluding
jsx/tsx and TS-only rule blocks keep excluding JS.

Both the extension declaration and the plugin/parser block in
services/web/eslint.config.mjs are widened together: widening only the
rule blocks makes `@overleaf/*` rules match files the plugin
registration does not, which fails with "could not find plugin
@overleaf".

The root global-ignores shim (`services/**/*.{mjs,cjs,ts,tsx}` and
friends) is deliberately left alone -- it replicates ESLint v8's file
walker so pre-existing debt in never-linted files stays off the build.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Fix eslint errors

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
GitOrigin-RevId: 084d0d054db9db6b5e3dd26de56d14358ab5edf7
2026-09-17 12:07:47 +00:00
Olzhas Askar a234c3cb27 Merge pull request #36952 from overleaf/oa-your-subscriptions
[web] Translate your subscriptions

GitOrigin-RevId: 20b249d8d94a33474d34ee8575c8e41667b6cf0f
2026-09-17 12:07:44 +00:00
Tim Down c3d962c075 Add the SheerID student verification module (#36704)
GitOrigin-RevId: a3673c09e185c8f857d5da3e706fa9a310fba6d4
2026-09-17 12:07:32 +00:00
Jakob Ackermann 37e27bb22e [saas-e2e] reduce disk IO and webpack overhead (#36997)
* [monorepo] reduce writes from chrome in cypress

Chrome puts its shared memory in /dev/shm, and docker's default 64MB is far
too small for it - which is why Cypress passes --disable-dev-shm-usage,
spilling those segments to files on the container's writable layer instead.
Under one spec that is a few hundred MB of write-then-delete churn; under the
CI fan-out it was most of the disk bandwidth on the whole box.

So every service built from dockerfiles/cypress gets shm_size 1gb and every
cypress config drops the flag again: the SaaS e2e service, web's CI and local
component-test services plus its standalone cypress one, and server-ce's e2e
and native cypress services. Both e2e-open variants inherit the setting
through `extends`; the native one is a service of its own, and would be left
running Chrome against 64MB once the flag is gone.

* [monorepo] adopt cypress-pnp-reporter

Materializing the reporter packages copied 267 packages / 3779 files
(59MB) into /tmp on every container start, once per spec. Resolving them
through PnP inside Cypress's Electron process instead drops that to
zero: the entrypoint shell went from 55.6MB of write_bytes to 0.

* [web] serve built assets from a prepared buffer between builds

Serving a chunk cost ~2ms whatever its size, and an editor page pulls ~144
of them, so webpack-dev-server burned 2-3 cores through an e2e run purely
answering requests for output that had not changed since the last build.

It is not bytes: cutting the bundle 2.6x with a cheaper devtool moved CPU
by 8%, and an empty 304 cost nearly as much as the full body. It is the
per-request work - reading the asset out of the in-memory filesystem and
re-hashing the whole body for a strong ETag, on every request.

Three things a build does that this has to respect, each found by tracing
the hooks rather than by reading them:

- `done` fires twice per build, for the compilation and for the manifest,
  both with the same hash. A flag would have been cleared by the second
  while the first was still running, so the gate is a counter.
- An incremental `done` reports only the assets it rewrote - 16, not 630 -
  so asset names accumulate. Resetting them on `invalid` left the
  manifest's two behind and nothing was served from here again.
- webpack-dev-middleware holds requests during a rebuild. This sits in
  front of it, so it steps aside for that window and drops the cache when
  a rebuild starts. Whether a response can be kept is then decided as it
  ends rather than as it began: an epoch bumped on `invalid` names the
  build its bytes were read from, and only a response from the current
  build with no rebuild in flight is stored. A rebuild starting
  mid-response can no longer write the previous build's bytes in behind
  the cache being dropped, which eviction by asset name could not catch
  anyway - an incremental build does not name the assets it left alone.

Measured on the editor entrypoint, 16 concurrent clients:
0.26-0.31s -> 0.045-0.050s of webpack CPU per page load, and 0.0455s
immediately after a rebuild. Same chunk graph, byte-identical output.

GitOrigin-RevId: 08b4ab2d665414069bc01b4763dd64faa9b4e5cb
2026-09-17 12:07:28 +00:00
KristinaandJimmy Domagala-Tang 44910202f3 [web] open comments and changes via url (#36546)
* [web] open a comment from a URL

* [web] add "View comment" button to digest email

* [web] open a tracked change from a URL

* [web] add "View suggestion" button to digest email

* [web] open the review panel from an open=review-panel URL

* [web] drop the digest email CTA and collapse the deep links to t=review

* [web] add an Open project button to the section overflow row and plain-text view links

* [web] validate the comment and change deep-link ids as object ids

* [web] collapse the deep-link resolvers into a single DeepLink component

* fix: scrolling into view when below the fold

* fix: address claude review

* fix: style adjustments

* fix: updating types to accomodate accepted/rejected changes

---------

Co-authored-by: Jimmy Domagala-Tang <jimmy.domagala-tang@overleaf.com>
GitOrigin-RevId: dab535591a93e1c3849a6b2a0dcc3e3934354385
2026-09-17 12:07:22 +00:00
Eric Mc Sween 5dc8c2b0c3 Merge pull request #36949 from overleaf/em-bibtex-crlf-upload-fix
[web] fix bibtex parser dropping fields on CRLF/CR line endings

GitOrigin-RevId: 6174bedeed92a014c2d7210afb6f39387e8608a8
2026-09-17 12:07:19 +00:00
Jakob Ackermann 2317fd6edb [web] remove generic analytics service proxy (#36934)
GitOrigin-RevId: 19b3613b7cc84e73ad556067da1b3cd2f956e1c5
2026-09-17 12:06:50 +00:00
Eric Mc Sween e136bcad05 Merge pull request #36937 from overleaf/em-tpds-app-ts-refs
Point the third-party-datastore deployment at app.ts

GitOrigin-RevId: b0013f02d91a98dbc382c23ea781ec07efdf1eb5
2026-09-17 12:06:33 +00:00
Jakob AckermannandClaude Opus 5 6caa5fc3a3 [monorepo] read empty content from its hash, in a shared blob store base (#36831)
The hash of empty content is a property of the content rather than of anything
stored: every project's empty file has it, whether or not a blob was ever written
under it, and a file may reference it before anything has. Eight blob stores were
each paying a lookup -- a database query, an HTTP request, a read of a cache that
offline mode may be the only thing standing in for -- to be told what the hash
already says, and clsi had already reinvented the answer on its own.

overleaf-editor-core gains BlobStoreBase, which answers getString for that hash
and delegates the rest to the fetchString its subclasses provide. getObject comes
with it: four stores spelled out the same JSON.parse of getString, and a fifth
wrapped it in a log line.

Adopted by history-v1's BlobStore, BackupBlobStore, HashCheckBlobStore and
recover_zip's RecoveryBlobStore, by project-history's BlobStore, by clsi's
BlobStore, and by web's HistoryBlobStore, SimpleBlobStore and FrontendBlobStore.
history-v1 keeps its own answers in getStream, getBlob and getBlobs, which no
other store implements. Writing and copying a blob are untouched, so a project
that wrote empty content still has a blob for it and a read answers the same
either way.

Two paths could not handle a project holding a tracked change or a comment at
all. Loading such a file needs the ranges blob its rangesHash points at, and
hashing one again needs to write it back, so a store missing getObject or
putObject fails outright:

- recover_zip died on `blobStore.getObject is not a function`, making every such
  project unrecoverable. The test covering it asserts a tracked delete is absent
  from the zip, which the script already asked for and never reached.
- GET /projects/:project_id/latest/hashed_content returned 500 from the same
  cause, then would have hit a missing putObject in snapshot.store.
  HashCheckBlobStore becomes a class over the base and gains putObject.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
GitOrigin-RevId: c84f62465beff6cf77ffac26aa772984e1b554cb
2026-09-17 12:06:30 +00:00
Jakob Ackermann 5cbf586b70 [web] log failed create/refresh actions for linked files (#36925)
GitOrigin-RevId: 127ca0fe976d704468842107f6fe6d0200acdb6c
2026-09-17 12:06:21 +00:00
Jakob AckermannandClaude Opus 5 7ae8db6b12 [editor-core] extract shared pieces for history-ot in editor (#36828)
* [editor-core] share the pieces the editor, real-time and history-v1 all need

Project-level history-OT has the browser, real-time and history-v1 all reason
about the same changes, so the rules they reason with move into the shared
library rather than being reimplemented on each side.

- `origin/editor_origin.js` plus `EDITOR_ORIGIN_KIND` and its schema entry: the
  origin an editor client's change carries, holding the editorId that scopes a
  change's timestamp.
- `change_identity.js`: how a submission is recognised when it comes back, so a
  resend of a change that already landed is deduplicated rather than applied
  twice.
- `rebase.js`: transforming a change onto concurrent ones, in the same order on
  both sides, which is what lets the server acknowledge a change with only the
  version it landed at.
- `text_file_defaults.js`: the doc-vs-file extension lists, now read from here
  by web's settings instead of being spelled out again.
- `blob_string_length.js`: the string length of a blob, used by history-v1's
  blob store and by web when it writes an uploaded file into history.
- `file_tree_diff.js`: file-tree operations to a diff, used by
  project-history's FileTreeDiffGenerator.
- `Blob.EMPTY_HASH`, so callers can answer for the empty blob without storing
  it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* [project-history] build the file-tree diff with the shared helper

FileTreeDiffGenerator's hand-rolled walk over add/edit/move/delete operations
becomes a call to `buildFileTreeDiff` from overleaf-editor-core, so the editor
and project-history read a file-tree change the same way. Adds the unit tests
the decaffeinated original never had.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* [web] read the editable-file lists from overleaf-editor-core

web's settings spelled out the text extensions and editable filenames that
decide whether a file becomes a doc, and every other service that has to make
that call carried its own copy. The lists now live in overleaf-editor-core and
web builds settings.textExtensions and settings.editableFilenames from them,
keeping the ADDITIONAL_TEXT_EXTENSIONS override for Server CE/Pro on top.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* [history-v1] read a blob's string length from overleaf-editor-core

Two copies of getStringLengthOfFile lived here, the one in recover_zip.js
carrying a TODO asking for exactly this. Both now import the shared
implementation, which the blob store keeps re-exporting for backupArchiver.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
GitOrigin-RevId: 31948332f416f56848e3b0dfb5142a4c9f93f508
2026-09-17 12:06:17 +00:00
Eric Mc Sween 2024f85941 Merge pull request #36842 from overleaf/em-tpds-typescript
Convert third-party-datastore to TypeScript

GitOrigin-RevId: 028172063d0cfe03c0f105f48ab66020c79ea50e
2026-09-17 12:06:14 +00:00
Domagoj Kriskovic a9ad734cf4 [web] Delete library data when a deleted user expires (#36781)
* Delete library data when an expired deleted user is cleaned up

* Refactor MongoDB session handling

* Remove transaction handling from deleteAllLibraryDataForUser function

* use findUserIdsToKeep rather than filterDanglingUserIds

GitOrigin-RevId: 9e82f6bf943809b55a8b042d9240f99dbc635711
2026-09-17 12:05:57 +00:00
ThomasandClaude Opus 4.8 42b29f0107 Support separate header logo images for light and dark themes (#36362)
Server Pro/CE admins can set a custom header logo via OVERLEAF_HEADER_IMAGE_URL,
but the same image is used for both the light and dark navbar themes. A logo
with good contrast on one background can be hard to see on the other (e.g. a
dark logo on the dark dashboard navbar).

Add two optional env vars, OVERLEAF_HEADER_IMAGE_URL_LIGHT and
OVERLEAF_HEADER_IMAGE_URL_DARK, each falling back to OVERLEAF_HEADER_IMAGE_URL
when unset, so existing configurations are unaffected. The light/dark fallback is
resolved server-side and exposed to the frontend as customLogo (light-effective)
and customLogoDark (dark-effective); the two theme-aware navbars (project
dashboard and library) pick between them using the existing overall-theme hook,
so the logo tracks both the user's theme setting and live OS theme changes.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
GitOrigin-RevId: 587a5679c650717cba6251e6d612146f434e8730
2026-09-17 12:05:54 +00:00
ilkin-overleaf b4b12caf48 Merge pull request #36833 from overleaf/ii-workspaces-collection
[web] Create workspaces collection indexes

GitOrigin-RevId: a84d404e660e6c19eb288712bcf020e1ba4a90d0
2026-09-17 12:05:51 +00:00
Antoine Clausse 09c564fbc4 [web] Cleanup plans-2026-phase-1 - phase 5: unused files in pricing pages (#36688)
* Remove unused Pug files related to Pricing

* `make cleanup_unused_locales`

* Remove unused `descriptionMobile`

* `make cleanup_unused_locales`

* Remove dead CSS

* Remove non-EN dead keys

* Remove "ai-assist" dead CSS

* Remove "ai-assist" listeners

* Remove `plans-new-tabs` and related

* Remove dead SCSS variables

* Remove more dead CSS (mobile)

GitOrigin-RevId: 08c452f66fe5b4d5bca4bb8cf2171254f960bc71
2026-09-17 12:05:47 +00:00
Jessica Lawshe 24802e485b Merge pull request #35956 from overleaf/jel-domain-grace-period-notification
[web] Combine grace period and failed verification notififcations on group domains table

GitOrigin-RevId: 0178421af235ee59a9b8c3a521ac1a8e87c744a6
2026-09-17 12:05:34 +00:00
Jessica Lawshe 69b585caf7 Merge pull request #36752 from overleaf/jel-group-sso-email-check
[web] Stop enforcing requested email for group SSO matches linked account

GitOrigin-RevId: 4988ecf76069d531e3aea892d07a134252c30323
2026-09-17 12:05:30 +00:00
roo hutton e6ceb4fec4 Merge pull request #36864 from overleaf/rh-36644-cancel-spinner-fallback
Fix cancellation flow if downgrade upsell plan is not available

GitOrigin-RevId: c34f7f37057d5e0c08cbdd5f8524a7c5f00ae8b4
2026-09-17 12:05:27 +00:00
Eric Mc Sween b19f7fb6ad Merge pull request #36873 from overleaf/em-remove-duplicate-citation-key-helper
Remove inaccurate citation key helper text

GitOrigin-RevId: 91cff6c47f27980910e059084b14809586f5dae4
2026-09-17 12:05:23 +00:00
David 5e615cd261 Merge pull request #36620 from overleaf/copilot/fix-default-trash-view
Default Trash nav item to the current location

GitOrigin-RevId: 939284aecc4a002394430e9e2850125825d599de
2026-09-17 12:05:20 +00:00
John Lees-Miller df5c9fd8ea Merge pull request #36881 from overleaf/jlm-recurly-stripe-payment-heal-review
Heal migrated payment methods before renewal

GitOrigin-RevId: 72e33e73b3ca0b771ff0124e8a59e12118922573
2026-09-17 12:05:09 +00:00
Jessica Lawshe 5523f0a6e9 Merge pull request #36700 from overleaf/tm-institutions-api-timeout-abort-handling
Handle client-side v1 timeouts gracefully in InstitutionsAPI, bump reconfirmation-lapsed timeout to 60s

GitOrigin-RevId: ecb2b61e257fdd41cadb353da3af98fec0cdf617
2026-09-17 12:04:40 +00:00
Jessica Lawshe 700bc74f22 Merge pull request #35969 from overleaf/jel-domains-table-internal-admin
[web] Group domains table for internal admins

GitOrigin-RevId: 8c16a22502e333d9c604b322ba66703f9c17d100
2026-09-17 12:04:34 +00:00
Jessica Lawshe 09cd43eb17 Merge pull request #36011 from overleaf/jel-domain-capture-sales-email
[web] Weekly domain capture digest email

GitOrigin-RevId: 6682d1d7fcbb179615dbc009d2da8266113a3b4b
2026-09-17 12:04:28 +00:00
Andrew Rumble 52f25234cd Merge pull request #36462 from overleaf/lg-security-mongoose
[Security upgrade] bump mongoose to 8.24.1 in web

GitOrigin-RevId: 89373303435aec06c2e1efde1dd54f1d70c4dfe1
2026-09-17 12:04:17 +00:00
David 90be47c5e1 Merge pull request #36649 from overleaf/dp-cleanup-library-feature-flag
Remove the overleaf-library feature flag

GitOrigin-RevId: ebeabd43c9e44dbc2344b4e8e7e5b9095fcc86e0
2026-09-17 12:04:13 +00:00
Domagoj Kriskovic 6c802c03a6 Fix dark-mode white flash when navigating between dashboard and library (#36785)
* Fix dark-mode white flash when navigating between dashboard and library

* Use userSettings object in layout-base.pug

* Move initial theme styles in a new file

* Sanitize data-initial-theme with a generic getInitialTheme helper

* Add getInitialTheme stub

GitOrigin-RevId: 80812093bbf75dc2a6f6f24710324a31a1930265
2026-09-17 12:04:10 +00:00