* github-sync: only swallow permanent revocation failures during unlink
404 (token gone) and 422 (token issued under a mismatched client_id,
the confirmed cause of #35108) are treated as safe to proceed past;
any other revocation error now aborts the unlink instead of silently
deleting the local credential row, so a token that might still be
live isn't orphaned by a transient GitHub failure.
* web: surface genuine github-sync unlink failures instead of a 500
When GithubSyncApiHandler.unlink rejects for a reason other than the
permanent 404/422 cases now handled by github-sync, show an error
notification on the settings page instead of crashing the request,
mirroring the existing projectSyncSuccessMessage session-flash pattern.
* github-sync: detect expired credentials in user status check
getStatus now validates a stored token against GitHub (GET /user)
before reporting it as linked. A GithubInvalidCredentialsError (401)
now surfaces as expired: true alongside enabled: true, distinguishing
a dead token from a genuinely working link. Any other validation
failure fails open and reports enabled: true as before.
* web: propagate github-sync expired status through to the client
Thread the new expired field from github-sync's status endpoint
through GithubSyncController.getUserStatus and the settings-page
injectUserSettings middleware, and extend the corresponding
TypeScript types on both the app and frontend side.
* web: show a re-link path on the settings widget when github credentials expire
The widget now checks expired status: it shows an error indicator
with a "connection expired" message and renders the Link action
instead of a dead-end Unlink button, since relinking upserts a fresh
token regardless of the stale row.
* web: keep unlink available for expired github credentials
Some users just want to remove an expired connection rather than
relink it. Keep Unlink as the primary action regardless of expired
status, and surface the relink path as an inline link next to the
expired message instead of replacing the primary action.
* web: correct the github unlink confirmation warning
Unlinking never touches a project's githubSyncProjectStates row,
regardless of whether the credential was healthy or expired -
verified by tracing unlinkAccount/deleteUser and confirming no other
code path deletes project sync state on account unlink. Sync pauses
until relink, but no project loses its GitHub connection, so the
warning text was simply wrong; corrected rather than adding a
separate expired-specific message.
* web: add Storybook story for expired github-sync credentials
Covers the new expired state alongside the existing NoFeature,
Unlinked, Linked and Error stories for the settings widget.
* simplify: collapse duplicated branches and extract session-flash helper
- Merge the near-identical 404/422 checks in _revokeToken into one
status-set check.
- Use optional chaining instead of null-guard ternaries in
GithubSyncMiddleware.
- Extract popSessionValue() in UserPagesController to de-duplicate the
read-then-delete session flash-message pattern, now used 3 times.
* review-self: close test coverage gaps found in self-review
- AuthenticationController: cover 401/403 revocation responses and a
plain network error with no .response, alongside existing 404/422/500.
- GithubSyncController: assert projectSyncErrorMessage stays unset on
the unlink success path.
- UserPagesController: cover projectSyncErrorMessage set-then-cleared
and absent-stays-undefined cases.
- Add GithubSyncMiddleware.test.mjs (previously untested): not-logged-in,
successful status fetch, and callback-error branches.
- Cypress: cover cancelling the unlink confirmation modal while expired.
- Storybook: add ErrorWhileUnlinked story for the disabled-Link +
error-indicator combination.
* review-self: fix audit-log ordering, cache getStatus validation safely
- GithubSyncApiHandler: write the link-github/unlink-github audit log
entry only after the corresponding github-sync API call succeeds,
instead of before (resolves the discrepancy tracked in issue 3354).
- UserController/UserManager: cache getStatus's live token-validation
result for 5 minutes to cut down on redundant GitHub API calls,
with an optimistic-lock write (matched against the encrypted token
that was actually validated) so a relink can never be overwritten by
a stale in-flight validation of the old token.
- github-integration-linking-widget: dedupe the relink href against
the linkPath already passed to IntegrationLinkingWidget.
* web: surface expired github credentials proactively in the sync modal
The modal previously only showed the reauthorize prompt after a real
GitHub API call failed with 401 mid-action. It now also checks the
expired field already returned by the status endpoint and shows the
same prompt immediately on open, before ever rendering the export
form against a token known to be dead. Extracted the existing
reauthorize markup into GithubCredentialsExpired so both call sites
share it.
* github-sync: avoid double-fetching the credential doc in getStatus
getStatus called UserManager.getUser, then getAuthToken which
internally fetched the same document again. Add getAuthTokenFromUser
to decrypt from an already-fetched doc and use it in getStatus,
removing the redundant Mongo query and the now-unreachable
GithubUserNotLinkedError handling (the user doc's existence was
already confirmed by the first fetch).
* github-sync: make expired-token handling reactive, drop proactive getStatus validation
Reverts getStatus in the github-sync service to a pure DB check — no live
GitHub API call, no 5-minute cache, no token_expired/token_validated_at
fields. The expired state is already surfaced reactively: the unmerged-commits
fetch on modal open returns 401 when the token is dead (handled by the existing
case 401 branch), and ExportToGithub handles 401 from the orgs call. The
proactive check added complexity (caching, optimistic-lock writes) without a
meaningful UX gain over the reactive paths.
Removes the expired indicator from the settings widget and the proactive
GithubCredentialsExpired screen from the modal's pre-flight check. The
github_sync_expired locale key is removed as it is no longer referenced.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* github-sync: show reauthorize prompt when push/pull fails with expired credentials
When a merge (push or pull) returns 401, GithubSyncMergeAction now renders
GithubCredentialsExpired with the Reauthorize button instead of the raw
"GithubInvalidCredentialsError" string that was previously falling through
to the default error branch.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* github-sync: wrap all async controller handlers with expressify
Without expressify, an unhandled throw from an async route handler
(e.g. a token decryption failure in the github-sync service producing a
non-4xx error that _reportError re-throws) becomes an unhandled rejection.
Express never sends a response and the modal is left stuck on loading.
expressify catches the error and passes it to next(), so Express's error
handler sends a 500 and the frontend can surface it.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* removing redundant tests
* removing getAuthTokenFromUser function
* removing redundant key
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
GitOrigin-RevId: 0d9a314bf70bea9e6037593f2a6f8b8d1f2c6e71
* filtering out venv directories
* also exclude .venv directories and sync all pattern copies
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
GitOrigin-RevId: 6634d9780da44f90c6777347d52def9a854bd29f
* Throwing 429 errors when ref manager responds with 429
* respecting the APIs retry-after first
* Handle 429 on linked file refresh path
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Show rate-limited message on linked file refresh
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Consolidate backoff helpers into ProviderBackoffStore
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Fix EX 0 crash, null guard, BackoffProvider type, test fixes
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Add unit tests for rate limiting implementation
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* update ZoteroProviderTests for new signedGet return shape
getCollections now returns { collections, backoff, retryAfter } instead
of a bare array. getUsersItemsChanges reads backoff/retryAfter from the
signedGet return tuple, not from response.headers (extraction moved to
the transport layer in OAuth1Transport).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix tpr-webmodule unit test regressions
ZoteroSyncClient: collectionsResponseSchema now requires backoff/retryAfter
as number|null; stub responses were missing these fields causing ZodError.
Assertions updated since getCollections returns CollectionsResult (object)
not a bare array.
ReferencesApiController: vi.doMock for @overleaf/fetch-utils was missing
RequestFailedError; the three 429 propagation tests inline-import it from
the mocked module.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* address PR review comments
- ReferencesApiController: add fallback 500 status and optional-chain
response in all catch blocks where err.response may be absent
- OAuth1Transport: guard Number(header) with Number.isFinite to prevent
NaN propagating as backoff/retryAfter when header value is non-numeric
- ZoteroProvider: same Number.isFinite guard for lastModifiedVersion
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix prettier formatting in ZoteroSyncManager.test.mjs
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* show rate-limited message in groups modal and Write & Cite
use-provider-groups: detect 429/rateLimited response and set error to
'rate_limited' instead of generic 'loading_groups'
file-tree-import-bibliography: add rate_limited key to all three
providers' translation maps so the import modal renders the rate-limited
message when groups loading is blocked
reference-manager-source: add RateLimitedError, throw it on 429 from
search, block further searches and show a toast notification
toasts: add write-and-cite:rate-limited toast and showRateLimitedToast()
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fixup! fix tpr-webmodule unit test regressions
* fixing CI failures
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
GitOrigin-RevId: 158c2b92c557caacef337b89f68c91c47569151f
* [3rd-party-references] replace simple-oauth2 with openid-client
* Refactor OAuth2 handling: replace openid-client with custom OAuth2Client implementation
* Guard unconfigured OAuth2 providers with a controlled error
Providers whose client id/secret env vars are unset now stay registered
but without an OAuth2 client. Using one throws a controlled OError
("OAuth2 provider is not configured") from getOAuth2Client rather than a
TypeError from calling a method on undefined or sending "undefined"
credentials.
* Guard unconfigured OAuth2 providers with a controlled error
* Add clarification comments on OAuth 2.0 client ID and secret encoding requirements
* Add logging for invalid token expiration dates in parseToken function
GitOrigin-RevId: b17884ccba171ff4db8e6a698b3d4dcdca24e8ae
* [agents] allow running all the test-runner skill commands
* [agents] move linting into AGENTS.md
* [agents] double down on permissions and cwd
* [saas-e2e] add support for MOCHA_GREP
* [saas-e2e] fail fast by default outside CI
* [agents] avoid need for Codespace detection
* [agents] work around missing trust prompt in Codespaces
* [saas-e2e] e2e_test_setup: merge split-tests in dev-env
GitOrigin-RevId: f1c1cd2a732e98b2e6125ef86a2b2cda5d3aabb6
GHSA-72gw-mp4g-v24j / CVE-2026-5079 — DoS via deeply nested field names,
patched in 2.2.0. multer is a direct dep of web and clsi (file uploads).
- bump multer to 2.2.0 in services/web and services/clsi
- re-target the Overleaf local patch (attach files with no filename as
'undefined' instead of skipping) from 2.1.1 to 2.2.0, kept as a scoped
root resolution to match the repo's patch convention
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
GitOrigin-RevId: 0d10137b521ebaacee71fc41adba32c4530a4041
* Bump yauzl to ^3.4.0 in history-v1 and web for Node 24.17
yauzl 3.x hangs extracting a large zip entry under Node 24.17 due to
stream backpressure changes. Fixes zip/project uploads, open-in-overleaf
template tests, and the SaaS-E2E "templates" test.
Also fix the open-in-overleaf acceptance test mock to serve the "too large"
fixture with a single res.end (Content-Length) instead of a backpressure-
ignoring res.write loop, which Node 24.17 surfaces as ECONNRESET (404)
instead of the expected 422.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Use plainTextResponse for large-file test fixture
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
GitOrigin-RevId: 55627b7c2c91959f0d1a7f3419467455edb06c9f
* [web] AI Feature controls for managed groups
Adds a Feature Controls section to the group settings with a switch to control whether AI features are enabled or disabled
GitOrigin-RevId: c5d5ed80c0cc3435075bb2c58b43fc08192dd46b
* Merge intermediate component wrappers into OL-prefixed components
* Replace all intermediate wrapper consumers with OL-prefixed components directly
* Fix jsx/js files still importing deleted shim components
* Remove duplicate OLNotification imports left by first pass
* Rename OLTagIcon to TagIcon, remove OL prefix
* Rename OLDropdownMenuItem to DropdownMenuItem, remove OL prefix
* Remove OLNotification, use Notification directly
* Move Notification to the main shared component folder
* Update tag-icon import path out of ol/
* Move TagIcon to the main shared component folder
* Update dropdown-menu-item import path out of ol/
* Move DropdownMenuItem to the main shared component folder
* Fix dropdown-menu-item import path to dropdown/ subfolder
* Remove BS5 alias prefixes from shared components
* Restore notification-list wrapper in Notification component
* Add translation for loading button
* Remove redundant import aliasing
* Resolve conflicts
* Restore notification container `notification-list`
GitOrigin-RevId: 24a5af18599a3e02ac6fd61c09cf5a49ef6e0020
Introduce shared ToolbarLayout component and move editor switch to right in bibtex visual toolbar
GitOrigin-RevId: 5f61bf8144dc68dfb4adce8a03d43c2dd0de3369
* update doc links to point to docs.overleaf.com instead of the old learn wiki
* fix broken link to LaTeX positioning wiki article in figure modal help
* point figure positioning help link to the docs.overleaf.com page
* point figure/table label help links to specific anchors on the captioning-and-referencing-figures doc page
* point figure modal error-help link to the graphicx-loading doc page
* normalize target/rel on docs.overleaf.com links opened in a new tab
* open figure modal and SSO help links in a new tab now that they point off-site
* add eslint rule enforcing rel=noopener noreferrer on docs.overleaf.com links
* extend require-rel-for-docs-links to also check OLButton
* add lint script catching missing rel on docs.overleaf.com links in pug templates
* fix require-rel-for-docs-links autofix crash on valueless rel attribute
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* add regression test for require-rel-for-docs-links valueless-rel autofix
* revert `target=_blank` on figure modal and SSO help links
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
GitOrigin-RevId: b6111341e1080fd7e4b42f6a1a18c27ea0fd7d8c
Adding position:relative prevents the visually hidden elements from getting absolutely positioned outside of the scroll area
GitOrigin-RevId: abe9e0ff91f769be39ed39223ebbbe17420af111
* consistently use cursor: not-allowed for disabled buttons and dropdown items
* fix: exclude anchor .btn.disabled from pointer-events override
* also handle li.dropdown-item and narrow fieldset selector to button.btn
GitOrigin-RevId: d94974370952bbefe74d971d39fa99802a6c3130
* [Security upgrade] bump js-yaml 4.1.1 -> 4.2.0 in root workspace
GHSA-h67p-54hq-rp68, patched in 4.2.0. js-yaml 4.x is pulled at runtime via
the patched referer-parser (web) plus many dev/build consumers.
Bumped the existing scoped resolution referer-parser/js-yaml ^4.1.1 -> ^4.2.0
(security floor on the patched-parent path) and re-resolved all 4.x to 4.2.0
(yarn up -R). The js-yaml 3.x line (3.14.2) is a different major, unaffected.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Bump js-yaml range in referer-parser patch to ^4.2.0 for consistency
The referer-parser/js-yaml resolution override forces js-yaml to 4.2.0,
but the local patch still declared ^4.1.0. Align the patch's declared
range with the resolution. Addresses Jakob's review comment on #34695
(discussion_r3440549168).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Make patched-parent realignment a mandatory Type B step in yarn-security-update skill
The patch-realignment instruction was a soft 'for consistency' parenthetical;
a session reading the rule acted only on 'use a resolution' and dropped the
patch edit, leaving the resolution at ^4.2.0 while the referer-parser patch
still declared ^4.1.0 (PR #34925). Promote it to an explicit mandatory step.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Fully resolve js-yaml to 4.2.0 and stop patching its range in referer-parser
Add a scoped resolution for @istanbuljs/load-nyc-config/js-yaml so the last
sub-4.2.0 instance (3.14.2, GHSA-h67p-54hq-rp68) is forced to 4.2.0 too;
load-nyc-config uses js-yaml.load(), which is 4.x-compatible.
Drop the js-yaml and mocha dependency edits from the referer-parser patch:
editing a patched package's dependencies has no effect on resolution, so the
scoped resolution is the entire fix. Update the yarn-security-update skill to
match (patched parents route to Type B; do not edit the patch).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Combine js-yaml resolutions into a single global override
Replace the two scoped js-yaml resolutions (referer-parser/js-yaml and
@istanbuljs/load-nyc-config/js-yaml) with one global "js-yaml": "^4.2.0". Every
js-yaml consumer should reach the security floor and none needs an older major,
so the global override is equivalent and tidier (reviewer request).
Note the scoped-vs-global tradeoff in the yarn-security-update skill.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
GitOrigin-RevId: 1738cbc04f4cacbfb6880ba6f176a192aa4a03f7
* [web] Minor fixes for AI Disabled state
- Applies opacity to disabled spark icons
- Forces AI controls to be hidden on View state
* Removed redundant check
GitOrigin-RevId: a1389bec3e80a396c77a22294b1d921b4116a75c
* Add png to pdf converter for optimising image loading in pdftex
* refactor
* move fixtures
* refactor and add unit tests
* Remove gamma correction from PNG processing and update related tests
* Add crc32fast dependency and enhance PNG processing tests
* Add fixture test cases for PNG processing
* fix alpha channel to match pdftex
pdftex always uses an 8 bit alpha channel in the output even for 16 bit images
* Refactor PNG processing to use Option for alpha stream and update related logic
* Enhance PDF writing by adding DecodeParms for alpha stream and optimize PNG encoding process
* Add pixel dimensions support in PNG processing and PDF writing
* [copybara] move clsi excludes
* [clsi] move gitignore rules
* [png2pdf] move into dockerfiles folder
* [png2pdf] use atomic writes
* [clsi] integrate png2pdf
* [saas-e2e] add coverage for png2pdf
* [png2pdf] make compatible with seccomp profile in clsi
* [copybara] remove exclude following move of png2pdf
* [copybara] remove spurious excludes
* fix broken detection of malformed chunk headers
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* [project-history] add build script flag for depending on doc-updater types
* [png2pdf] run tests as part of clsi pipeline
* [png2pdf] fix calculation of PDF page size
* [web] put png2pdf behind feature flag and make it opt-in
* [web] fix ClsiManager.promises.sendRequest invocation after merge
* extend is_copy_safe function to follow pdftex
see the conditions in pdftex's writepng.c
https://svn.tug.org:8369/texlive/trunk/Build/source/texk/web2c/pdftexdir/writepng.c?revision=78081&view=markup#l575
the criteria are not an exact match because the png crate does not support all the
png chunk types
https://github.com/image-rs/image-png/issues/116
if the criteria result in a png being converted or skipped the final result should be the same.
in one case the conversion will be done by pdftex (at runtime)
in the other case the conversion will be done by png2pdf -
both conversions should give the same result.
* include tests in png2pdf Dockerfile
* [clsi] explicitly disable png2pdf conversion for project conversion
* [clsi] png2pdf: count converted files
* [png2pdf] bump date in docker image tag
* [web] make draft-setting option wider when png2pdf is available
---------
Co-authored-by: Brian Gough <brian.gough@overleaf.com>
GitOrigin-RevId: d0d952ee009bf93c72bba2ffe763ae0160d396e4
Mathias Jakobsen