Fixes GHSA-xcpc-8h2w-3j85 / CVE-2026-39244 (high): a crafted ZIP archive
declaring a huge uncompressed size could force an unbounded Buffer.alloc
and OOM the process.
adm-zip 0.6.0 ships built-in TypeScript types, so @types/adm-zip is
dropped from both workspaces' devDependencies to avoid duplicate/
conflicting type declarations.
GitOrigin-RevId: dffc1c38a10f42d09c799ae768f1ffcfc0e09328
Fixes GHSA-xv26-6w52-cph6 (critical): message corruption via abuse of
protocol length headers in the WebSocket frame parser.
GitOrigin-RevId: 678d85f1132e55cfeeef266a65c2deb869fe41ae
* Replace the bibtex entries table with a card layout
Render each reference as a card (citation key, title, author, year and an
error indicator) instead of a table row. Drop @tanstack/react-table, which was
the last consumer of the dependency, and keep @tanstack/react-virtual for
virtualization.
- Add a compact card variant (via a `compact` prop) for the bibtex editor:
tighter spacing, no border-radius, and cards separated by a single collapsing
border rather than a gap.
- Add hover and green selected/selected+hover states.
- Move the select-all checkbox out of the scrolling list into the editor
toolbar so it stays fixed while the list scrolls.
- Lay out title/author/year with nested flex so author and year wrap together.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* In progress dark mode for review
* Slight design changes & updated dark mode
* Small tweaks to dark mode secondary text, and light mode border
* Truncate long authors, also use .summarize() on authors
* Refactor comments: reduce verbose, remove unnecessary
* Fix empty line
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Tom Wells <wellsthomas@hotmail.co.uk>
GitOrigin-RevId: feaa6718484eefb9e9efb44b99f456910697cb17
* [web] Add `features.aiToggling` to Subscriptions
This new flag controls whether the subscription admin
can toggle AI Features for their group.
When the feature is unchecked, group admins only
see a dialog explaining AI Features are enabled/disabled,
but never the controls.
GitOrigin-RevId: 94132f5569102b91113bf15075e66c02aaed277f
The feature should be disabled in Server Pro, since the container is expected not to make any external request.
GitOrigin-RevId: 38b59de61e498c58a5fbacf48d2244481d099187
* [github-sync] Surface "project too large" errors instead of hanging
A GitHub sync of a project whose total editable text exceeds github-sync's
7MB request body limit would hang silently: the modal stayed on "Importing
and merging changes in GitHub" and then closed with no error.
Root cause was a chain of three issues:
1. github-sync's ErrorMiddleware did not recognise the body-parser
PayloadTooLargeError, so it fell through to a generic 500.
2. web's _reportError rethrew any non-4xx error instead of responding, and
several github-sync controller handlers were not wrapped in expressify.
On Express 4 the rethrow became an unhandled rejection and no HTTP
response was ever sent, so the browser request hung until the socket died.
3. the frontend read error.data.error without a null check, which threw a
render-time TypeError when the fetch failed at the network level (as it
did once the hung request was aborted).
Fixes:
- github-sync: add ProjectTooLargeError and map the body-parser 413 to it.
- web: _reportError always responds (500 for unexpected errors) and every
controller handler is expressified as a backstop.
- frontend: null-safe error.data?.error, a friendly message for the
too-large case, and a generic message for server errors.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* [github-sync] Refine project-too-large error copy per content guidance
Apply the content-design system's error-message guidance to the new
github_project_too_large_error string: use a contraction, drop the
redundant "reduce the size of your project" restatement and the formal
"Please", keeping the problem/reason/next-step structure.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* [github-sync] Use plain string matcher in project-too-large CT test
Address review feedback: prefer a plain string matcher with exact:false
over a regex, per the repo's testing guidance.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* [github-sync] Link to the file-limits docs from the too-large error
Add a "Learn about GitHub sync file limits" link below the project-too-large
error, pointing to the GitHub synchronization file-limits documentation, so
users can find out what the limits are and how to stay under them.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* [github-sync] Use rel="noopener noreferrer" on the file-limits docs link
The eslint rule for external docs.overleaf.com links requires
rel="noopener noreferrer" (not just noreferrer) with target="_blank" to
prevent reverse-tabnabbing.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
GitOrigin-RevId: 16f701a85fb4ae049c208e03e328ad80049e8579
* save doc to session storage when offline
* scope offline doc backup key to user id
* clear offline doc backups on logout
* handle anonymous users
* include trackChanges
GitOrigin-RevId: 3fe6a1523cb10cf76a1fcf4ee46790f6673bd84f
* [web] Remove redundant monthlyTimesTwelve from pricing tables
monthlyTimesTwelve was always exactly monthly * 12 in every pricing row,
and the value was only ever used to render the "billed monthly for a year"
strikethrough price in the compile-timeout paywall.
- Drop the stored field from the pricing tables
- Send raw monthly/annual numbers in ol-standardPlanPricing instead of
pre-formatted strings
- Format the prices (and derive the strikethrough as monthly * 12) in the
paywall modal via the frontend currency helper
No user-facing change: the displayed prices are identical.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* Remove `monthlyTimesTwelve` from script
* Remove comments
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
GitOrigin-RevId: b637208540b3b96180b1a3cc4417b09944c5d158
* [web] Widen auth-aux container to fit page headers on one line
Bump .auth-aux-container max-width from 320px to 400px, matching
.login-register-container. Fixes the "Keep your account safe" header
wrapping to two lines on primaryEmailCheck, and keeps the auth pages
(reconfirm, passwordReset, setPassword) consistent with login/register.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* Add x-padding to `.auth-aux-container`
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
GitOrigin-RevId: 3256447bd7f6a1b13fbe09d8d359f037c0e50ac2
* feat: changing chat to use cm6 editor instead to allow for mentions display and autocomplete
* feat: changing review panel comment, edit, and reply to also use cm6 editor to enable mentions
* feat: updating tests, and moving from jsdom to cypress tests as jsdom cant handle cm6
* feat: centralizing mentions component and applying to both chat and review-panel
* feat: centralizing mentions input, and using changesUsers in chat mentions
* fixing dark mode styles of chat
* feat: updating mentions dropdown style and adding custom icon generation for mentions cm6 autocomplete tooltip
* feat: making mentions look like links, and fixing border radius on tooltip
* fix: naming and using correct color util
* feat: fixing hover on highlight
* update scroll bar dance in review panel
when a system had persistent scroll bars, we would run into issues calculating the height of the review panel
Co-authored-by: Kristina <7614497+khjrtbrg@users.noreply.github.com>
---------
Co-authored-by: Kristina <7614497+khjrtbrg@users.noreply.github.com>
GitOrigin-RevId: 96441ad55f9614427506edfecf3d87bae82d1607
Jakob Ackermann