GHSA-72gw-mp4g-v24j / CVE-2026-5079 — DoS via deeply nested field names,
patched in 2.2.0. multer is a direct dep of web and clsi (file uploads).
- bump multer to 2.2.0 in services/web and services/clsi
- re-target the Overleaf local patch (attach files with no filename as
'undefined' instead of skipping) from 2.1.1 to 2.2.0, kept as a scoped
root resolution to match the repo's patch convention
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
GitOrigin-RevId: 0d10137b521ebaacee71fc41adba32c4530a4041
* Bump yauzl to ^3.4.0 in history-v1 and web for Node 24.17
yauzl 3.x hangs extracting a large zip entry under Node 24.17 due to
stream backpressure changes. Fixes zip/project uploads, open-in-overleaf
template tests, and the SaaS-E2E "templates" test.
Also fix the open-in-overleaf acceptance test mock to serve the "too large"
fixture with a single res.end (Content-Length) instead of a backpressure-
ignoring res.write loop, which Node 24.17 surfaces as ECONNRESET (404)
instead of the expected 422.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Use plainTextResponse for large-file test fixture
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
GitOrigin-RevId: 55627b7c2c91959f0d1a7f3419467455edb06c9f
* [web] AI Feature controls for managed groups
Adds a Feature Controls section to the group settings with a switch to control whether AI features are enabled or disabled
GitOrigin-RevId: c5d5ed80c0cc3435075bb2c58b43fc08192dd46b
* Merge intermediate component wrappers into OL-prefixed components
* Replace all intermediate wrapper consumers with OL-prefixed components directly
* Fix jsx/js files still importing deleted shim components
* Remove duplicate OLNotification imports left by first pass
* Rename OLTagIcon to TagIcon, remove OL prefix
* Rename OLDropdownMenuItem to DropdownMenuItem, remove OL prefix
* Remove OLNotification, use Notification directly
* Move Notification to the main shared component folder
* Update tag-icon import path out of ol/
* Move TagIcon to the main shared component folder
* Update dropdown-menu-item import path out of ol/
* Move DropdownMenuItem to the main shared component folder
* Fix dropdown-menu-item import path to dropdown/ subfolder
* Remove BS5 alias prefixes from shared components
* Restore notification-list wrapper in Notification component
* Add translation for loading button
* Remove redundant import aliasing
* Resolve conflicts
* Restore notification container `notification-list`
GitOrigin-RevId: 24a5af18599a3e02ac6fd61c09cf5a49ef6e0020
Introduce shared ToolbarLayout component and move editor switch to right in bibtex visual toolbar
GitOrigin-RevId: 5f61bf8144dc68dfb4adce8a03d43c2dd0de3369
* update doc links to point to docs.overleaf.com instead of the old learn wiki
* fix broken link to LaTeX positioning wiki article in figure modal help
* point figure positioning help link to the docs.overleaf.com page
* point figure/table label help links to specific anchors on the captioning-and-referencing-figures doc page
* point figure modal error-help link to the graphicx-loading doc page
* normalize target/rel on docs.overleaf.com links opened in a new tab
* open figure modal and SSO help links in a new tab now that they point off-site
* add eslint rule enforcing rel=noopener noreferrer on docs.overleaf.com links
* extend require-rel-for-docs-links to also check OLButton
* add lint script catching missing rel on docs.overleaf.com links in pug templates
* fix require-rel-for-docs-links autofix crash on valueless rel attribute
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* add regression test for require-rel-for-docs-links valueless-rel autofix
* revert `target=_blank` on figure modal and SSO help links
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
GitOrigin-RevId: b6111341e1080fd7e4b42f6a1a18c27ea0fd7d8c
Adding position:relative prevents the visually hidden elements from getting absolutely positioned outside of the scroll area
GitOrigin-RevId: abe9e0ff91f769be39ed39223ebbbe17420af111
* consistently use cursor: not-allowed for disabled buttons and dropdown items
* fix: exclude anchor .btn.disabled from pointer-events override
* also handle li.dropdown-item and narrow fieldset selector to button.btn
GitOrigin-RevId: d94974370952bbefe74d971d39fa99802a6c3130
* [web] Minor fixes for AI Disabled state
- Applies opacity to disabled spark icons
- Forces AI controls to be hidden on View state
* Removed redundant check
GitOrigin-RevId: a1389bec3e80a396c77a22294b1d921b4116a75c
* Add png to pdf converter for optimising image loading in pdftex
* refactor
* move fixtures
* refactor and add unit tests
* Remove gamma correction from PNG processing and update related tests
* Add crc32fast dependency and enhance PNG processing tests
* Add fixture test cases for PNG processing
* fix alpha channel to match pdftex
pdftex always uses an 8 bit alpha channel in the output even for 16 bit images
* Refactor PNG processing to use Option for alpha stream and update related logic
* Enhance PDF writing by adding DecodeParms for alpha stream and optimize PNG encoding process
* Add pixel dimensions support in PNG processing and PDF writing
* [copybara] move clsi excludes
* [clsi] move gitignore rules
* [png2pdf] move into dockerfiles folder
* [png2pdf] use atomic writes
* [clsi] integrate png2pdf
* [saas-e2e] add coverage for png2pdf
* [png2pdf] make compatible with seccomp profile in clsi
* [copybara] remove exclude following move of png2pdf
* [copybara] remove spurious excludes
* fix broken detection of malformed chunk headers
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* [project-history] add build script flag for depending on doc-updater types
* [png2pdf] run tests as part of clsi pipeline
* [png2pdf] fix calculation of PDF page size
* [web] put png2pdf behind feature flag and make it opt-in
* [web] fix ClsiManager.promises.sendRequest invocation after merge
* extend is_copy_safe function to follow pdftex
see the conditions in pdftex's writepng.c
https://svn.tug.org:8369/texlive/trunk/Build/source/texk/web2c/pdftexdir/writepng.c?revision=78081&view=markup#l575
the criteria are not an exact match because the png crate does not support all the
png chunk types
https://github.com/image-rs/image-png/issues/116
if the criteria result in a png being converted or skipped the final result should be the same.
in one case the conversion will be done by pdftex (at runtime)
in the other case the conversion will be done by png2pdf -
both conversions should give the same result.
* include tests in png2pdf Dockerfile
* [clsi] explicitly disable png2pdf conversion for project conversion
* [clsi] png2pdf: count converted files
* [png2pdf] bump date in docker image tag
* [web] make draft-setting option wider when png2pdf is available
---------
Co-authored-by: Brian Gough <brian.gough@overleaf.com>
GitOrigin-RevId: d0d952ee009bf93c72bba2ffe763ae0160d396e4
In the visual markdown editor, Cmd+B (bold) and Cmd+I (italic) now remove
the markdown delimiters when the cursor or selection is already inside a
bold/italic span, instead of always adding another wrapper. Mirrors the
toggle behavior of the visual LaTeX editor.
Issue #34826
GitOrigin-RevId: d9ced8493dfaa28b61f3f0d51479d95f62e0bc4a
* [web] add frontend tests for sharejs transform
* [web] extend tests for sharejs transform to flush eventually
* [web] full coverage for sharejs transform
* [web] add tests for sharejs events
* [web] add tests for sharejs callbacks
* [web] avoid sending empty sharejs op
* [web] add tests for resending after reconnecting
* [web] avoid resending of empty sharejs op after reconnecting
GitOrigin-RevId: 226fe47a7069cb877fd5a60454f86cc5855d9a0e
* [web] use client-side filtering for split tests in admin panel
Filtering on non-indexed fields is not allowed with notablescan.
* [web] add initial value for DEFAULT_FILTERS.active
* [web] unset error before fetching split tests
GitOrigin-RevId: 0813873c5a90d57c4fdbfd0043fcc325f00408aa
* [migrations] only apply non-blocking migrations in CI
* [migrations] use "yarn run migrations" instead of "npm run migrations"
GitOrigin-RevId: d9f96db398adf2febcd82333295fb8d5eab741bb
* [monorepo] fix handling of quoted MOCHA_GREP
* [agents] refine guidance for running tests
- nudge it towards scoped module targets
- nudge it to really run e2e tests when changed
- nudge it towards a11y cypress matchers
- recommend quoting for MOCHA_GREP
* [web] fix forwarding of mocha args from module Makefile
* [monorepo] use BRANCH_NAME_TAG_SAFE for building the ci image name
* [web] also make BRANCH_NAME_TAG_SAFE available in module Makefile
(It's not really needed, but will make copilot happy.)
GitOrigin-RevId: bfda3c8fe2b4f857ef111ac63f94b35a82ad75f8
