* Add reference preview/edit drawer to the library, with mobile bottom-sheet layout
* Fix stylelint comment spacing and update library Cypress spec for the drawer flow
* Fix desktop drawer focus/escape handling and autosave race in the library
Replace the desktop preview panel's hand-rolled Escape listener with the
shared FocusTrap component (already used for the mobile sheet), fixing
missing focus trap/restore and reusing existing infrastructure instead of
duplicating it. Track whether the kebab actions menu is open via a ref so
Escape closes just the menu first, not the whole panel.
Guard the autosave-on-blur form against redundant saves (skip when nothing
changed since the last save) and out-of-order responses (serialize saves
through a queue so a later edit can't be clobbered by a stale response).
Remove dead commented-out JSX for unimplemented tabs/actions.
* Reinstate library reference analytics events for the new preview drawer
* Surface an error notification when deleting a reference from the drawer fails
* Fix stuck kebab-menu state and blocked outside clicks in the reference drawer
* Share error-message extraction and add a test for the delete-failure path
* Fix formatting
* Fix the translation
GitOrigin-RevId: a0082377c6e3f6712fba80c485b9cde4d431c90f
* Initial plan
* fix: always render @[userId] mention tokens regardless of split test
Readers outside the comment-mentions/email-notifications split tests
were seeing raw @[<userId>] tokens in chat messages and review-panel
comments, leaking internal Mongo ObjectIds.
Fix: always parse and render @[userId] tokens using parseMentions() +
MentionBadge regardless of split-test membership. MentionBadge already
safely falls back to "@Unknown" when a userId can't be resolved to a
project member, so no ID is ever emitted.
- message-content.tsx: remove mentionsFeatureEnabled gate; always call
renderMentionedContent() instead of falling back to raw <Linkify>
- review-panel-message.tsx: remove mentionsFeatureEnabled gate; always
pass displayMentions to ExpandableContent
The mentions-input autocomplete (typing new @mentions) remains gated
behind the split test as before — this fix is rendering-only.
Co-authored-by: jdomaga <25135258+jdomaga@users.noreply.github.com>
* feat: always allow for mentions to display
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: jdomaga <25135258+jdomaga@users.noreply.github.com>
Co-authored-by: Jimmy Domagala-Tang <jimmy.domagala-tang@overleaf.com>
GitOrigin-RevId: c7cedbfe6966bb2ebce58a5f4e03b1627198dab7
* Suppress skip-to-content link on pages without a navbar
* Add main content as target area for the skip link on the library page
* Suppress navbar, footer and skip-to-content on account security pages
GitOrigin-RevId: a85fac5667d84c6f60577cd0ea469cd215554cc4
* Rename user-facing Papers reference manager text to ReadCube
* Rename Papers component and files name to Readcube
* Update locales from Papers to ReadCube
* Rename ID name from papers to readcube
* Fix a chinese locale to use ReadCube
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
GitOrigin-RevId: ee89e3f5da5bcf9987c0ee3e558b9ae1dab9372c
* Suppress skip-to-content link on pages without a navbar
* Add main content as target area for the skip link on the library page
GitOrigin-RevId: a47d7bbc283b648e47db93648d8fcae6ae12ea5a
* [web] Add snapshot test for all annualDividedByTwelve values
Captures the 85 stored values into a JSON fixture and asserts the
effective value (stored field, or PlansHelper.roundedTwelfth(annual)
once the field is derived at runtime) matches. Verification harness for
the annualDividedByTwelve refactor.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* [web] Compute annualDividedByTwelve at runtime instead of hardcoding it
* [web] Update annualDividedByTwelve snapshot for the rounding rule
The runtime derivation reproduces 84 of the 85 historical values exactly.
The one difference is PEN assistant, which was historically stored
unrounded (350 / 12 = 29.1667) and now follows the round-up-to-0.05 rule
(29.20). The assistant add-on is unavailable, so this is not user-visible.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Remove `localizedAddOnsPricing` from test
* Add more sanity tests
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
GitOrigin-RevId: e60e8b3e90360817d4be3732243d242dc0cbb69e
* Validate id types in LinkedFiles getSourceProject
Require source_project_id and v1_source_doc_id to be primitives before
querying Mongo, rejecting anything else with BadDataError.
* Validate refreshLinkedFile request params and body
Route refreshLinkedFile through parseReq with a schema requiring
project_id and file_id to be ObjectIds and typing the request body.
* Use well-formed ObjectIds in LinkedFilesController tests
Give the shared test setup valid ObjectId project_id/parent_folder_id
so parseReq passes and the controller logic is actually exercised, and
fail the tests if next is called unexpectedly.
* Use ObjectId file ids in v1 linked-file acceptance fixtures
The refresh route now validates file_id as an ObjectId, so the v1
not-imported fixtures need well-formed ids to reach the refuse-to-refresh
path (409) instead of failing id validation (404).
GitOrigin-RevId: d78b3664e825c6bb25ab2e363e5094b9212db307
* Autogenerate citation key from author/year
* Fix abort handling and error fallback in citation key suggestions
* Apply suggestions from code review
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Always fall back to a generated key on suggestion failure
* Make citation-key suggestion location-aware (project vs library), fix validation timing and duplicate-key edge cases, and consolidate the resolution logic
* Update citation key helper/error copy and hide the autogenerate hint while its error is showing
* Refactor comments: significantly shorten and remove unnecessary
* Fix error logic: if empty show error on save. If invalid entry, show onBlur
* Error refactoring
GitOrigin-RevId: 0cd919c9224731f1d5694204e8cdb03288ade04b
* Add schemas for file restoration and label management in HistoryController
* Add request schemas for proxying to history API and resyncing project history
* prevent transforming version:null into version:0 with coerce
* move jsDoc comments above the handler
* check for undefined resyncProjectStructureOnly
* Add tests for restoreFileFromV2 and revertFile
* Set default value for resyncProjectStructureOnly in resyncProjectHistorySchema
GitOrigin-RevId: 7b8b8a4c3834b8c8a83f93052ab1f59e86c529a6
With the removal of per-doc rooms, there is nothing to race anymore.
The next lower timeout is 0, i.e. useless check.
GitOrigin-RevId: effb6cc0525f5fd785c7dce8df4e279de1f1b13f
Fixes GHSA-xcpc-8h2w-3j85 / CVE-2026-39244 (high): a crafted ZIP archive
declaring a huge uncompressed size could force an unbounded Buffer.alloc
and OOM the process.
adm-zip 0.6.0 ships built-in TypeScript types, so @types/adm-zip is
dropped from both workspaces' devDependencies to avoid duplicate/
conflicting type declarations.
GitOrigin-RevId: dffc1c38a10f42d09c799ae768f1ffcfc0e09328
Fixes GHSA-xv26-6w52-cph6 (critical): message corruption via abuse of
protocol length headers in the WebSocket frame parser.
GitOrigin-RevId: 678d85f1132e55cfeeef266a65c2deb869fe41ae
Kristina